TWI730549B - System for checking key pair generating algorithm during certificate applying process and method thereof - Google Patents

Abstract

A system for checking a key pair generating algorithm during certificate applying process and a method thereof are provided. By using an algorithm to generate key pairs by a client, generating a certificate signing request(CSR) including public key of the key pairs and a message of the algorithm by the client, transmitting the CSR from the client to a Certificate Authority(CA) via Registration Authority, and generating a certificate by the CA after the CA determines the message included in the CSR matches a requirement set up by the CA, the system and the method can check key pairs generating algorithm when CA issues certificate, and achieve the effect of increasing security and encryption and decryption efficiency.

Description

System and method for confirming key pair generation algorithm in certificate application process

A certificate application system and method, in particular, refers to a system and method for confirming the key pair generation algorithm in the certificate application process.

Public Key Infrastructure (PKI), also known as public key infrastructure, public key infrastructure, public key infrastructure, public key infrastructure, or public cryptographic infrastructure, is a group of hardware, An infrastructure composed of software, participants, management policies, and procedures is designed to create, manage, distribute, use, store, and restore digital certificates. From the perspective of cryptography, the public key infrastructure uses a digital certificate authority (CA) to link the personal identity of the user with the public key. At the same time, for each digital certificate certification authority, the user's identity must be unique.

The user can use a predetermined algorithm to generate a key pair consisting of a public key (public key for short) and a private key (private key for short), then use the public key to generate a certificate signing request, and authenticate to the digital certificate through the certificate signing request The organization applies for a digital certificate so that users can use the digital certificate to prove their identity on the Internet through the public key infrastructure.

However, with the advancement of technology, there may be faster and more efficient encryption and decryption algorithms, or some encryption and decryption algorithms may have loopholes, which means that the encryption and decryption speed/efficiency is not good or there are loopholes. Algorithms need to be eliminated. However, the digital certificate certification authority of the public key infrastructure does not reject the effective mechanism of the algorithm used by the user to generate the key pair. When the digital certificate authority receives the user’s certificate signing request, it will only pass the digital certificate signing request. Upon verification by the certificate certification authority, the digital certificate certification authority will issue a digital certificate to the user.

In summary, it can be seen that there has been a long-standing problem in the prior art that the digital certificate certification authority does not check the algorithm of the key pair generated by the user in the process of issuing digital certificates. Therefore, it is necessary to propose improved technical means to solve the problem. This question.

In view of the problem in the prior art that the digital certificate certification authority does not verify the algorithm for generating the key pair by the user, the present invention discloses a system and method for confirming the algorithm for generating the key pair during the certificate application process, in which:

The system for confirming the key pair generation algorithm in the certificate application process disclosed in the present invention at least includes: a client for generating a key pair including a client public key and a client private key by using the algorithm, and Generate a certificate signing request containing the client's public key and algorithm information; the certificate registration host is used to receive the certificate signing request, and to generate the certificate application data containing the certificate signing request, and sign the certificate application data to generate the host Signature data; the certificate authentication server is used to receive certificate application data and host signature data, and verify the certificate application data according to the host signature data, and to check the certificate application data when the certificate application data is verified, and When the certificate application data passes the check, the algorithm information in the certificate signing request is used to determine whether the algorithm used by the client meets the calculation requirements, and when the algorithm meets the calculation requirements, a digital certificate is generated and the digital certificate is sent through the certificate registration host To the client, make the client store the digital certificate.

The method for confirming the key pair generation algorithm in the certificate application process disclosed in the present invention includes at least the steps: the client uses the algorithm to generate a key pair including the client public key and the client private key; the client generation includes The certificate signing request includes a certificate signing request containing the client's public key and algorithm information, and sends the certificate signing request to the certificate registration host; the certificate registration host generates the certificate application data containing the certificate signing request, and signs the certificate application data to generate the host After signing the signature data, send the certificate application data and host signature data to the certificate authentication server; the certificate authentication server successfully verifies the certificate application data according to the host signature data, then checks the certificate application data; the certificate authentication server passes the certificate application data After checking, according to the algorithm information in the certificate signing request, when it is determined that the algorithm used by the client meets the calculation requirements, a digital certificate is generated, and the digital certificate is sent to the client through the certificate registration host; the client stores the digital certificate.

The system and method disclosed in the present invention are as described above. The difference between the present invention and the prior art is that the present invention generates a key pair by using an algorithm on the client side, and the certificate registration host will include the algorithm information of the algorithm for generating the key pair. After the certificate signing request of is sent to the certificate authentication server, the certificate authentication server can determine whether the algorithm information in the certificate signing request meets the calculation requirements, and only generate a digital certificate when the algorithm of the key pair generated by the client meets the calculation requirements , In order to solve the problems of the prior art, and can achieve the technical effect of increasing security and encryption and decryption performance.

In the following, the features and implementation of the present invention will be described in detail with the drawings and embodiments. The content is sufficient to enable any person familiar with the relevant art to easily and fully understand the technical means used by the present invention to solve the technical problems and implement them accordingly. The achievable effect of the present invention.

The present invention allows the certificate authentication server to determine whether the algorithm used by the client to generate the key pair conforms to the algorithm accepted by the certificate authentication server after receiving the certificate signing request (Certificate Signing Request, CSR) sent by the client When the algorithm used by the client to generate the key pair meets the calculation requirements, a digital certificate (certificate) that is returned to the client is generated. Among them, the certificate authentication server is one or more servers in a digital certificate authority (CA).

In the following, the system architecture diagram of the algorithm for verifying the key pair generation during the certificate application process mentioned in the "Figure 1" of the present invention is used to illustrate the system operation of the present invention. As shown in "Figure 1", the system of the present invention includes a client 110, a certificate registration host 120, and a certificate authentication server 130. Among them, the certificate registration host 120 and the certificate authentication server 130 are usually digital devices; the client 110 can be digital devices such as mobile phones, tablets, computers, or specific software running on the digital devices, but the present invention does not This is limited.

The computing device mentioned in the present invention includes, but is not limited to, one or more processors, one or more memory modules, and components such as buses connecting different components (including memory modules and processors). Through the included multiple components, the computing device can load and execute the operating system, make the operating system run on the computing device, and can also execute software or programs. In addition, the computing device also includes a housing, and the above-mentioned components are arranged in the housing.

The bus of the computing device mentioned in the present invention may include one or more types, for example, including data bus, address bus, control bus, extended function bus ( expansion bus), and/or local bus (local bus). The bus of computing equipment includes, but is not limited to, parallel industry standard architecture (ISA) bus, peripheral component interconnect (PCI) bus, Video Electronics Standards Association (VESA) local bus, and serial universal serial bus (USB), PCI-E bus, etc.

The processor of the computing device provided by the present invention is coupled with the bus. The processor contains a register group or register space. The register group or register space can be completely set on the processing chip, or all or part of it can be set outside the processing chip and connected via a dedicated electrical connection. And/or coupled to the processor via the bus. The processor may be a processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processors, the processors included in the computing device are all the same or similar, and they are coupled and communicated through a bus. The processor can interpret a series of multiple instructions to perform specific operations or operations, such as mathematical operations, logical operations, data comparison, copy/move data, etc., to run the operating system or execute various programs, modules, and/or element.

The processor of the computing device can be coupled to the chipset or electrically connected to the chipset through a bus. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and peripheral input/output (I/O) controllers, that is to say, the memory controller and peripheral input/output controllers can be included in In an integrated circuit, two or more integrated circuits can also be used. Chipsets usually provide I/O and memory management functions, as well as multiple general-purpose and/or special-purpose registers, timers, etc., among which the aforementioned general-purpose and/or special-purpose registers and timers can be coupled or One or more processors electrically connected to the chipset are accessed or used.

The processor of the computing device can also access the data in the memory module and the mass storage area installed on the computing device through the memory controller. The above-mentioned memory modules include any type of volatile memory (volatile memory) and/or non-volatile memory (NVRAM), such as static random access memory (SRAM), dynamic random access Memory (DRAM), flash memory (Flash), read-only memory (ROM), etc. The above-mentioned large-capacity storage area can include any type of storage device or storage medium, such as hard disk drives, optical discs, flash drives (flash memory), memory cards, and solid state disks (Solid State Disk, SSD), or any other storage device, etc. In other words, the memory controller can access data in static random access memory, dynamic random access memory, flash memory, hard disk drives, and solid state drives.

The processor of the computing device can also connect and communicate with peripheral output devices, peripheral input devices, communication interfaces, and GPS receivers and other peripheral devices or interfaces through the peripheral I/O bus through the peripheral I/O controller. The peripheral input device can be any type of input device, such as a keyboard, mouse, trackball, touchpad, joystick, etc. The peripheral output device can be any type of output device, such as a display, a printer, etc., a peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface can include a wireless communication interface and/or a wired communication interface. The wireless communication interface can include a mobile communication network that supports Wi-Fi, Zigbee and other wireless local area networks, Bluetooth, infrared, near field communication (NFC), 3G/4G/5G, etc. The wired communication interface can be an Ethernet device, Asynchronous Transfer Mode (ATM) device, DSL modem, cable modem, etc. The processor can periodically poll various peripheral devices and interfaces, so that the computing device can input and output data through various peripheral devices and interfaces, and can also communicate with another computing device having the above-described components.

The client 110 can be connected to the certificate registration host 120 via a wired or wireless network, and can send data or signals to the certificate registration host 120, and can also receive data or signals sent by the certificate registration host 120.

The client 110 is responsible for using a predetermined algorithm (encryption and decryption algorithm) to generate a key pair including a public key and a private key. Generally speaking, the client 110 can call a pre-installed trusted security component to generate a key pair using a predefined algorithm.

In the present invention, the public key and private key generated by the client 110 are also referred to as the client public key and the client private key. The algorithm proposed in the present invention may be an algorithm conforming to Elliptic Curve Cryptography (ECC), etc., but the present invention is not limited to this.

The client 110 is also responsible for generating a certificate signing request containing the client's public key, and can transmit the generated certificate signing request to the certificate registration host 120. The certificate signing request generated by the client 110 includes the algorithm information of the algorithm used to generate the key pair. Among them, the algorithm information includes the algorithm name and so on.

The client 110 is also responsible for receiving the digital certificate sent by the certificate registration server 120 and storing the received digital certificate. In more detail, the client 110 can import the applied digital certificate into a corresponding carrier for storage according to the purpose of applying for the digital certificate. Among them, the purpose of the client 110 to apply for a digital certificate includes but is not limited to identification or encryption and decryption, etc.; the carrier of the client 110 to import the digital certificate includes, but is not limited to, chip cards, electronic files (such as PFX files), and browser programs. Local storage, etc.

The credential registration host 120 is a digital device that has passed the audit of a digital credential certification authority (that is, obtained a digital credential issued by a digital credential certification authority) and can be used as a digital device of a certification registration authority (RA). The certificate registration host 120 can connect to the client 110 and/or the certificate authentication server 130 through a wired or wireless network, and can receive data or signals sent by the client 110 and/or the certificate authentication server 130, and can also send data Or a signal to the client 110 and/or the certificate authentication server 130.

The certificate registration host 120 is responsible for generating certificate application data, and uses the host private key to sign the generated certificate application data to generate corresponding host signature data. The certificate application data generated by the certificate registration host 120 includes the certificate signing request received from the client 110.

The certificate registration host 120 is also responsible for receiving the digital certificate sent by the certificate authentication server 130 and forwarding the received digital certificate to the client 110. Generally speaking, the certificate registration host 120 can also save the received digital certificate, that is, save the digital certificate of the client 110 applied by itself.

The certificate authentication server 130 can be connected to the certificate registration host 120 via a wired or wireless network, and can receive data or signals sent by the certificate registration host 120, and can also send data or signals to the certificate registration host 120.

The certificate authentication server 130 is responsible for receiving the certificate application data and host signature data sent by the certificate registration host 120, and can verify the received certificate application data based on the received host signature data.

The certificate authentication server 130 is also responsible for further checking the received certificate application data when the certificate application data received from the certificate registration host 120 is verified. For example, the certificate authentication server 130 may read the certificate signing request in the certificate application data, and verify the certificate signing request according to the client signature data in the certificate signing request. However, the method and process for the certificate authentication server 130 to check the certificate application data are not limited to the above.

The certificate authentication server 130 is also responsible for determining whether the algorithm used by the client 110 to generate the key pair conforms to the certificate authentication server 130 based on the algorithm information contained in the certificate signing request in the certificate application data when the certificate application data passes the inspection. Scheduled calculation requirements. For example, the calculation request may be the algorithm name of the algorithm recognized by the certificate authentication server 130. The certificate authentication server 130 may determine whether the calculation request includes the algorithm name contained in the algorithm message. If so, it means the client 110 The algorithm for generating the key pair meets the calculation requirements; on the contrary, if the algorithm name contained in the algorithm message does not exist in the calculation request recorded by the certificate authentication server 130, it means that the algorithm for generating the key pair by the client 110 does not exist. Meet the calculation requirements. However, the method by which the certificate authentication server 130 determines whether the algorithm for generating the key pair of the client 110 meets the calculation requirements is not limited to the above. For example, the calculation request may also be a time threshold. The certificate authentication server 130 may use one or A variety of predetermined algorithm sets are calculated. If the key pair is cracked within the time threshold, the certificate authentication server 130 can determine that the algorithm for generating the key pair does not meet the calculation requirements.

The certificate authentication server 130 is also responsible for generating a digital certificate when the algorithm included in the certificate signing request in the certificate application data meets the predetermined calculation requirements of the certificate authentication server 130. In more detail, the certificate authentication server 130 can use the server private key to sign the client public key in the certificate signing request to generate the corresponding server signature data, and generate the client public key and the server signature. The digital certificate of the data. Generally speaking, the digital certificate of the client 110 generated by the certificate authentication server 130 is an end-entity (EE) certificate, but the present invention is not limited to this.

The certificate authentication server 130 is also responsible for transmitting the generated digital certificate to the certificate registration host 120, so as to transmit the generated digital certificate to the client 110 through the certificate registration host 120.

Next, an embodiment is used to explain the operating system and method of the present invention, and please refer to "Figure 2A" the flow chart of the method for verifying the key pair generation algorithm in the certificate application process of the present invention. In this embodiment, it is assumed that the client 110 is a computer, but the invention is not limited to this.

First, the client 110 uses an algorithm to generate a key pair including the client public key and the client private key, and then generates a key pair including the client public key in the generated key pair and the algorithm used to generate the key pair And send the generated certificate signing request to the certificate registration host 120 (step 210), so as to apply for a digital certificate from the certificate authentication server 130 through the certificate registration host 120.

After the certificate registration host 120 receives the certificate signing request sent by the client 110, the certificate registration host 120 can generate certificate application data containing the received certificate signing request, and can sign the generated certificate application data, so as to After signing, the host signature data will be generated. After that, the certificate registration host 120 may send the generated certificate application data and host signature data to the certificate authentication server 130 (step 220).

After the certificate authentication server 130 receives the certificate application data and host signature data sent by the certificate registration host 120, it can use the received host signature data to verify the received certificate application data, and can determine the certificate according to the verification result Whether the application materials pass the verification with the host signature data (step 230).

If the certificate authentication server 130 determines that the certificate application data has not been verified, the certificate authentication server 130 may reject the certificate application of the client 110, and may send the rejection application message to the client 110 through the certificate registration host 120, so that the client 110 A message indicating that the certificate application is rejected is displayed; if the certificate authentication server 130 determines that the certificate application data has passed the verification, the certificate authentication server 130 may further check the certificate application data, and may determine whether the certificate application data has passed the check (step 250). In this embodiment, the certificate authentication server 130 can verify the certificate signing request based on the client signature data in the certificate signing request. If the certificate signing request fails the verification, the certificate authentication server 130 can determine that the certificate application data has not passed the check If the certificate signing request passes the verification, the certificate authentication server 130 can determine that the certificate application data passes the inspection.

If the certificate authentication server 130 determines that the certificate application data has not passed the check, the certificate authentication server 130 can reject the certificate application of the client 110, and can send the reject application message to the client 110 through the certificate registration host 120, so that the client 110 displays A message that the certificate application is rejected; if the certificate authentication server 130 determines that the certificate application data passes the check, the certificate authentication server 130 can further determine whether the algorithm indicated by the algorithm message in the certificate signing request conforms to the preset calculation Request (step 260). In this embodiment, it is assumed that the certificate authentication server 130 can determine whether the algorithm used by the client 110 to generate the key pair conforms to the algorithm based on whether the algorithm name contained in the algorithm message exists in the algorithm name recorded in the calculation request. Claim.

If the certificate authentication server 130 determines that the algorithm used by the client 110 does not meet the calculation requirements, that is, the algorithm name included in the calculation request preset by the certificate authentication server 130 does not exist in the algorithm information in the certificate signing request. If it contains the algorithm name, the certificate authentication server 130 can reject the certificate application of the client 110, and can send the reject application message to the client 110 through the certificate registration host 120, so that the client 110 displays a message that the certificate application is rejected; if The certificate authentication server 130 determines that the algorithm used by the client 110 meets the calculation requirements, that is, the algorithm name contained in the algorithm message in the certificate signing request is recorded in the calculation request preset by the certificate authentication server 130, then The certificate authentication server 130 may generate a digital certificate, and may transmit the digital certificate to the client 110 through the certificate registration host 120 (step 270). In this embodiment, assuming the process shown in "Figure 2B", the certificate authentication server 130 can use the server private key to sign the client public key in the certificate signing request to generate a corresponding server signature Data (step 271), and a digital certificate containing the client public key and server signature data can be generated (step 273). After that, the certificate authentication server 130 can send the generated digital certificate back to the certificate registration host 120 (step 275), so that the voucher registration host 120 forwards the received digital voucher back to the client 110 (step 277).

Continuing back to "Figure 2A", after the client 110 receives the digital certificate sent by the certificate authentication server 130 through the certificate registration host 120, the client 110 can store the received digital certificate (step 280). In this embodiment, the client 110 can import the received digital certificate into a chip card, a specific file, or a specific software according to the purpose of applying for the digital certificate.

In this way, through the present invention, the certificate authentication server 130 can check the algorithm used by the client 110 to generate the key pair during the process of the client 110 applying for a certificate.

In summary, it can be seen that the difference between the present invention and the prior art is that the client uses an algorithm to generate a key pair, and sends a certificate signing request including an algorithm message of the algorithm for generating the key pair through the certificate registration host. After reaching the certificate authentication server, the certificate authentication server can determine whether the algorithm information in the certificate signing request meets the calculation requirements, and only generates the digital certificate when the algorithm of the key pair generated by the client meets the calculation requirements. As a result, a technical method can solve the problem that the digital certificate certification authority in the prior art does not check the algorithm of the key pair generated by the user during the process of issuing the digital certificate, thereby achieving the technical effect of increasing security and encryption and decryption performance.

Furthermore, the method of the present invention for confirming the key pair generation algorithm in the certificate application process can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or in different ways. The components are distributed in a number of interconnected computer systems in a decentralized manner.

Although the embodiments of the present invention are disclosed as above, the content described is not intended to directly limit the scope of patent protection of the present invention. Any person with ordinary knowledge in the technical field to which the present invention belongs, without departing from the spirit and scope of the present invention, makes slight modifications to the form and details of the implementation of the present invention, all belong to the patent protection of the present invention. range. The scope of patent protection of the present invention shall still be determined by the scope of the attached patent application.

110: client

120: Credential registration host

130: certificate authentication server

Step 210: The client uses an algorithm to generate a key pair, generates a certificate signing request including the client's public key and algorithm information, and sends the certificate signing request to the certificate registration host

Step 220: The certificate registration host generates certificate application data including the certificate signing request, generates host signature data for the certificate application data, and transmits the certificate application data and host signature data to the certificate authentication server

Step 230: The certificate authentication server determines whether the certificate application data passes the verification with the host signature data

Step 250: The certificate authentication server determines whether the certificate application data passes the check

Step 260: The certificate authentication server determines whether the algorithm meets the calculation requirements

Step 270: The certificate authentication server generates a digital certificate and sends the digital certificate to the client through the certificate registration host

Step 271: The certificate authentication server uses the server private key to sign the client public key in the certificate signing request to generate server signature data

Step 273: The certificate authentication server generates a digital certificate containing the client public key and server signature data

Step 275: The certificate authentication server sends the digital certificate to the certificate registration host

Step 277: The certificate registration host sends the digital certificate to the client

Step 280: The client stores the digital certificate

Figure 1 is a system architecture diagram of the algorithm for verifying key pair generation during the certificate application process according to the present invention. Figure 2A is a flow chart of the method for confirming the key pair generation algorithm in the certificate application process according to the present invention. Figure 2B is a flow chart of the method for the certificate authentication server to generate a digital certificate and send it back to the client according to the present invention.

Step 210: The client uses an algorithm to generate a key pair, generates a certificate signing request including the client's public key and algorithm information, and sends the certificate signing request to the certificate registration host

Step 220: The certificate registration host generates certificate application data including the certificate signing request, generates host signature data for the certificate application data, and transmits the certificate application data and host signature data to the certificate authentication server

Step 230: The certificate authentication server determines whether the certificate application data passes the verification with the host signature data

Step 250: The certificate authentication server determines whether the certificate application data passes the check

Step 260: The certificate authentication server determines whether the algorithm meets the calculation requirements

Step 270: The certificate authentication server generates a digital certificate and sends the digital certificate to the client through the certificate registration host

Step 280: The client stores the digital certificate

Claims (10)

A method for confirming the key pair generation algorithm in the certificate application process. The method includes at least the following steps: a client uses an algorithm to generate a key pair, the key pair includes a client public key and a client Private key; the client generates a certificate signing request, and sends the certificate signing request to a certificate registration host, the certificate signing request includes the client public key and one of the algorithm information; the certificate registration host generates and includes The certificate application data is one of the certificate signing requests, and after the certificate application data is signed to generate a host signature data, the certificate application data and the host signature data are sent to a certificate authentication server; the certificate authentication server After successfully verifying the certificate application data based on the host signature data, it checks the certificate application data; after the certificate application data passes the check, the certificate authentication server generates a certificate when it determines that the algorithm meets the calculation requirements based on the algorithm information. A digital certificate, and send the digital certificate to the client through the certificate registration host; and the client stores the digital certificate. For example, the method for confirming the key pair generation algorithm during the certificate application process described in item 1 of the scope of patent application, wherein the step of judging whether the algorithm meets the calculation requirements based on the algorithm information is to determine whether the calculation requirements include the calculation The name of the law or determine whether the key pair is cracked within the time threshold indicated by the calculation request. As described in item 1 of the scope of patent application, the method for confirming the key pair generation algorithm in the certificate application process, wherein the step of generating the key pair by the client using the algorithm is that the client calls the security control component using an ellipse The curve algorithm generates the key pair. For example, the method for verifying the key pair generation algorithm in the certificate application process as described in item 1 of the scope of patent application, wherein the step of the certificate authentication server checking the certificate application data further includes the certificate authentication server signing the request according to the certificate One of the steps in which the client signature data verifies the certificate signing request. For example, the method for confirming the key pair generation algorithm in the certificate application process described in the first item of the scope of patent application, wherein the step of storing the digital certificate by the client is that the client remits the digital certificate according to the purpose of the digital certificate Store in the corresponding vehicle. A system for confirming a key pair generation algorithm during a certificate application process. The system at least includes: a client for generating a key pair using an algorithm, the key pair including a client public key and a client Client private key, and used to generate a certificate signing request, the certificate signing request includes the client public key and an algorithm message of the algorithm; a certificate registration host, used to receive the certificate signing request, and used to generate Contains one of the certificate application data of the certificate signing request, and signs the certificate application data to generate a host signature data; and a certificate authentication server for receiving the certificate application data and the host signature data, and based The host signature data verifies the certificate application data, and is used to check the certificate application data when the certificate application data passes the verification, and when the certificate application data passes the check, determine whether the algorithm conforms to the algorithm information A calculation requirement, and the algorithm meets the calculation When requested, a digital certificate is generated, and the digital certificate is sent to the client through the certificate registration host, so that the client stores the digital certificate. For example, the system for verifying the key pair generation algorithm during the certificate application process described in item 6 of the scope of patent application, wherein the certificate authentication server determines whether the calculation request includes the name of the algorithm or determines whether the key pair It is cracked within the time threshold indicated by the calculation requirement to determine whether the algorithm meets the calculation requirement. As described in item 6 of the scope of patent application, the system for confirming the key pair generation algorithm during the certificate application process, wherein the client is a call security control component that uses the elliptic curve algorithm to generate the key pair. For example, the system for verifying the key pair generation algorithm during the certificate application process described in item 6 of the scope of patent application, wherein the certificate authentication server is further used to verify the certificate according to one of the client signature data in the certificate signing request Sign the request. For example, the system for verifying the key pair generation algorithm during the certificate application process described in item 6 of the scope of patent application, wherein the client imports the digital certificate into the corresponding vehicle for storage according to the purpose of the digital certificate.

Images