TWI746235B - System and method for exchanging new certificate based on current certificate and computer-readable medium - Google Patents

Abstract

The present invention is a system for exchanging new certificate based on current certificate and a method thereof. A certificate exchanging server is established to receive an existing certificate in a certificate-owned device, and this existing certificate is used with the certificate request sent by a device without certificate to obtain a new legal certificate corresponding to the existing certificate from a Certification Authority. The new legal certificate is used for the device without certificate. The present invention solves the problem of limited signing ability of the certificate-owned device by exchanging the certificate. The present invention also provides a computer-readable medium for a method for exchanging new certificate based on current certificate.

Description

System, method and computer readable medium for exchanging new vouchers based on existing vouchers

The present invention relates to the technology of voucher acquisition, in particular to a system, method and computer-readable medium for exchanging new voucher based on existing voucher.

With the advancement of technology and the rapid development of electronic device applications, many network interactions or transactions are also frequently generated. In order to ensure the identification of both parties, digital certificates are a common method for authorization and identity verification for connected devices and network services. Enhance the security of interaction through the use of digital certificates. Generally speaking, a digital certificate can be issued by a certificate management or registration center for the purpose of registering devices and applications (APP), thereby making the use of devices and applications more secure.

With the widespread use of digital certificates, users’ multiple devices, physical components, or applications may require certificates. When each one applies for a certificate separately, especially when interaction or transaction is required immediately, it is necessary to wait for a new certificate to be registered. , It may be time-consuming and troublesome. If the same user’s device, physical component or application can quickly obtain the certificate, it will help reduce the user’s confusion, but the above-mentioned equipment, physical component or application certificate may not be easy Exchange or Sharing may be due to the different algorithms of the two. In addition, some devices have limited signing capabilities, and may only be able to manually enter the value to be signed. When the plaintext to be signed is an invisible code, it cannot be signed. Chapter, or when the string of characters that needs to be signed is too long, it is not easy to manually operate and input, and the above will cause the voucher application to be blocked. For example, the user identification module card (SIM card) of a carrier has a certificate. If other application software in the Android system phone wants to obtain the certificate, the certificate can be retrieved through special software, but this method is suitable for the Apple iOS system For mobile phones, there is no similar special software to use due to security issues, which means that the required credentials cannot be easily obtained.

Therefore, if you can find a technology related to certificate acquisition, especially for devices or components with limited signing capabilities or difficult to sign, by enabling devices or components with signing capabilities to obtain related certificates, then Satisfying the corresponding signature requirements will become the goal of those skilled in the art who are eager to pursue solutions.

In order to solve the above-mentioned problems of the prior art, the present invention proposes a technology based on the existing certificate to exchange for a new certificate. The existing certificate is used to endorse it, and the new certificate is exchanged with the Registration Authority (RA). Download a new certificate and replace it with a new certificate to effectively improve the problem of the limited signature ability of the device itself.

The present invention discloses a system for exchanging a new certificate based on an existing certificate, which includes: a certificate-waiting device, which is used to generate a certificate request file and receive a transaction serial number corresponding to the certificate request file; and a device that stores a certificate is used to transmit The transaction serial number and the existing certificate possessed by the credential device; the renewal server receives the transaction serial number and the existing credential from the credential device to obtain the credential serial number from the existing credential. Send the certificate serial number and the The certificate request file corresponding to the transaction serial number; the registration management center receives the certificate serial number and the certificate request file from the renewal server, and uses the certificate serial number to query the existing certificate to generate a new certificate request; And the certificate management center, which receives the request for applying for a new certificate from the registry to generate a new certificate, and sends the new certificate back to the renewal server through the registry, so that the device to be certified can rely on the transaction Download the new certificate by serial number.

In one embodiment, the renewal server generates the transaction serial number after receiving the certificate request file from the device to be certified, and transmits the transaction serial number to the device to be certified.

In one embodiment, the certificate storage device further includes using the transaction serial number as a signature to generate a signature value, wherein the signature value is transmitted to the renewal server along with the transaction serial number and the existing certificate, For the renewal server to perform signature verification.

In one embodiment, the certificate-to-be-certified device includes generating a private key, so that when the certificate-to-be-certified device obtains the new certificate, the private key is used for signing.

The present invention provides a system for exchanging a new certificate based on an existing certificate, which includes: a user device, which includes a software module waiting for the certificate and a physical component with the certificate, wherein the software module generates a certificate request file and receives Corresponding to the transaction serial number of the certificate request file, the entity component transmits the transaction serial number and the existing certificate of the entity component; the renewal server receives the transaction serial number and the existing certificate from the entity component to Obtain the certificate serial number from the existing certificate to send the certificate serial number and the certificate request file corresponding to the transaction serial number; the registration management center receives the certificate serial number and the certificate request file from the renewal server to Use the certificate serial number to query the existing certificate to generate a request for applying for a new certificate; and the certificate management center receives the request for applying for a new certificate from the registration management center to generate New certificate, and return the new certificate to the renewal server through the registry management center, so that the software module can download the new certificate according to the transaction serial number.

In one embodiment, after the certificate renewal server receives the certificate request file from the software module, it generates the transaction serial number to send the transaction serial number to the software module.

In one embodiment, the entity component further includes using the transaction serial number as a signature to generate a signature value, and the signature value is sent to the renewal server along with the transaction serial number and the existing certificate for the exchange The certificate server performs signature verification.

In one embodiment, the software module includes generating a private key for the software module to use the private key for signing when obtaining the new certificate.

The present invention provides a method for exchanging a new certificate based on an existing certificate, which includes: ordering the software module to provide a certificate request file to the renewal server, and receive the transaction serial number returned by the renewal server; The physical component of the certificate transmits the transaction serial number and the existing certificate to the renewal server; the renewal server obtains the certificate serial number from the existing certificate to transmit the certificate serial number and the certificate corresponding to the transaction serial number The request file is sent to the registry; order the registry to use the certificate serial number to confirm the legitimacy and validity of the existing certificate, so that when the existing certificate is legal and valid, it generates a request for a new certificate; order the registration management The center uses the existing certificate to apply for a new certificate from the certificate management center; and makes the registration management center send the new certificate to the renewal server for the software module to download.

In the above method, the software module and the physical component are located in the same device or belong to two different devices.

In the above method, the entity component further includes using the transaction serial number as a signature to generate a signature value, wherein the signature value is sent to the renewal server along with the transaction serial number and the existing certificate for the The renewal server performs signature verification.

In the above method, the software module includes generating a private key for the software module to use the private key for signing when obtaining the new certificate.

The present invention further provides a computer-readable medium used in a computing device or a computer, which stores instructions to execute the aforementioned method of exchanging a new certificate based on an existing certificate.

It can be seen from the above that the present invention proposes a system, method and computer-readable medium for exchanging existing certificates for new certificates. Compared with the prior art, the present invention is based on the technology of exchanging existing certificates for new certificates. In addition to being able to perform signing actions for software modules that do not hold a certificate, it can also solve the limitation of limited signing capabilities even if the certificate is stored in the device, allowing devices with better signing capabilities to do the signing. In addition, the new certificate exchanged in the present invention is not completely unrelated to the existing certificate, and the new certificate exchanged is based on the endorsement of the existing certificate, so the new certificate exchanged in the device is related to the existing certificate. , And the signature algorithm of the new certificate obtained in exchange can be changed with application requirements, thus improving the limitation of the algorithm used by the existing certificate, and also allowing the device that obtains the new certificate to extend its signature algorithm.

1, 2: A system based on the exchange of existing vouchers for new vouchers

11: Device to be certificated

12: Device with certificate

13, 23: Renewal server

14, 24: Registration Management Center

15, 25: Certificate Management Center

20: User device

21: Software module

22: physical components

S31-S36: steps

S41-S47: Process

FIG. 1 is a system architecture diagram of an embodiment of the system for exchanging new certificates based on existing certificates of the present invention.

2 is a system architecture diagram of another embodiment of the system for exchanging new certificates based on existing certificates of the present invention.

Fig. 3 is a step diagram of the method of exchanging a new voucher based on an existing voucher according to the present invention.

FIG. 4 is a flowchart of a specific embodiment of the method for exchanging a new voucher based on an existing voucher according to the present invention.

The following describes the technical content of the present invention with specific specific embodiments. Those familiar with the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

FIG. 1 is a system architecture diagram of an embodiment of the system for exchanging new certificates based on existing certificates of the present invention. The purpose of the system 1 for exchanging a new certificate based on an existing certificate of the present invention is to exchange an existing certificate for a new certificate, and use the device with the certificate to endorse the device without the certificate, so that the device without the certificate can obtain the certificate. As shown in the figure, the system 1 for exchanging new certificates based on existing certificates includes a certificate-to-be-certified device 11, a certificate-storing device 12, a certificate renewal server 13, a registration management center 14, and a certificate management center 15. There is no voucher in the device 11, and the voucher stored in the voucher device 12 already has a voucher, but its signing ability is limited.

The voucher-waiting device 11 is used for generating a voucher request file and receiving a transaction serial number corresponding to the voucher request file. In detail, there is no certificate in the voucher device 11, but its signature ability is better. It can be used to extend the signature algorithm capability. It can use and support different algorithms. The signature can be copied directly, and the signature can be selected. project. Therefore, because the certificate-to-be-certified device 11 does not have a certificate in it, the certificate request file is sent to the renewal server 13 to apply for a new certificate from the certificate management center 15 later. In addition, the certificate-to-be-certified device 11 is also used to download and store the exchanged certificate later. New certificate.

In one embodiment, after the certificate renewal server 13 receives the certificate request file from the certificate waiting device 11, it generates the transaction serial number and sends it back to the certificate waiting device 11. The above means that after the certificate device 11 sends the certificate request file to the renewal server 13, the renewal server 13 will obtain a transaction serial number. This transaction serial number is also a follow-up order to both the certificate-waiting device 11 and the certificate-storing device 12 The main mechanism associated.

The voucher storage device 12 is used to transmit the transaction serial number and the existing voucher possessed by the voucher storage device. In detail, the certificate is stored in the certificate storage device 12, but the support algorithm is fixed and single, and the signing ability is limited. The device may only be able to manually enter the value to be signed. When the plaintext to be signed is an invisible code When the time, it is impossible to sign, or when the string to be signed is too long, it is not easy to manually operate and input. It can be seen from the above that the voucher device 11 cannot use the voucher storage device 12 for signing, and the voucher storage device 12 has limited signing capabilities. Therefore, the voucher storage device 12 is used to communicate with the renewal server 13 and the renewal The server 13 can receive the existing certificate sent by the certificate storage device 12 to perform the process of certificate replacement.

In one embodiment, the certificate storage device 12 further includes using the transaction serial number as a signature to generate a signature value, wherein the signature value is transmitted to the renewal server along with the transaction serial number and the existing certificate 13. For the certificate renewal server 13 to perform signature verification. In other words, the certificate storage device 12 will use the transaction serial number and the private key in the device to generate a signature value, and this signature value will be sent to the renewal server 13 along with the transaction serial number. Only the certificate server 13 can verify the seal to ensure the correctness of the transaction.

The renewal server 13 receives the transaction serial number and the existing certificate from the storage device 12 to obtain the certificate serial number from the existing certificate, and transmits the certificate serial number and the certificate request corresponding to the transaction serial number files. Specifically, the renewal server 13 receives the pending certificate The certificate request file and the verification seal of the device 11 contain the existing signature from the certificate device 12. The renewal server 13 provides the transaction serial number to the certificate-to-be-certified device 11 after receiving the certificate request file, and uses the transaction serial number to make the The certificate device 11 is related to the storage certificate device 12. The renewal server 13 will obtain the certificate serial number from the existing certificate and send it to the registration management center 14 together with the certificate request file corresponding to the transaction serial number. Explain that because the registry 14 has relevant information about the existing certificate, the registry 14 only needs the certificate serial number to find the required existing certificate. Therefore, in order to reduce the amount of transmitted data, the renewal server 13 The entire certificate will not be passed to the registration management center 14, but only the certificate serial number.

In addition, after the renewal server 13 obtains the new certificate, the certificate-to-be-certified device 11 can use the transaction serial number to download it.

The registration management center 14 receives the certificate serial number and the certificate request file from the renewal server 13, uses the certificate serial number to query whether the existing certificate exists, and generates a request for applying for a new certificate when confirming the existence of the existing certificate . Specifically, the registration management center 14 will use the certificate serial number to check whether the existing certificate exists, and after verifying the existence of the existing certificate, it will connect with the certificate management center 15 to apply for a new certificate. Similarly, after applying for a new certificate , The registration management center 14 will send the new certificate to the renewal server 13. It can be seen from the above that the registration management center 14 will use the certificate serial number (Certificate Serial Number) to query whether the existing certificate exists, so as to verify the legitimacy and validity of the existing certificate, and then apply to the certificate management center 15 after confirming that it is correct The new certificate is sent back to the renewal server 13 for the certificate device 11 to download and use.

The certificate management center 15 receives the request for applying for a new certificate from the registration management center 14 to generate a new certificate, and sends the new certificate back to the renewal server 13 through the registration management center 14 for the certificate-to-be-certified device 11 Download the new certificate according to the transaction serial number. In other words, After the voucher management center 15 receives the new voucher request issued by the registration management center 14, it will generate a new voucher and give it to the registration management center 14.

In another embodiment, the certificate-waiting device 11 further includes generating a private key for the certificate-waiting device 11 to use the private key for signing when the new certificate is obtained. As described above, when the certificate request file is generated by the certificate waiting device 11, a private key is also generated. This private key can be used for certificate applications such as signing after the certificate waiting device 11 obtains a new certificate.

In addition, the private key also ensures that the new certificate will not be stolen. Specifically, after the new certificate is generated, if the transaction serial number is known or guessed by other devices and the new certificate is obtained, the other device does not have the private key. The signature application is performed in conjunction with the new certificate.

Under the above-mentioned structure, the device to be certified 11 can be an application of a mobile device (such as a mobile phone), which has no certificate but has the ability to sign, and the device with a certificate 12 can be a built-in device of another mobile device (such as a mobile phone). The SIM card has a certificate but has limited signature capabilities. Since the SIM card and the application program cannot communicate directly, and the SIM card is the signature of the RSA encryption algorithm, the application program may be Elliptic Curves Cryptography (Elliptic Curves Cryptography, ECC) signature, the two cannot be shared. In order to facilitate the user to apply the certificate, the present invention uses the existing certificate of the SIM card to apply for a new certificate for use by the application, so that the application can use the new certificate to sign For other applications, since the new certificate is related to the existing certificate, the internal information of the two certificates is mostly the same.

It can be seen from the above that the system 1 for exchanging a new certificate based on an existing certificate of the present invention can use the existing certificate in the certificate storage device 12 as an endorsement to exchange for a related new certificate, and the new certificate will be provided to the company. A certificate but a device with a signature, in order to improve the storage of the certificate device 12 with limited signature capabilities, there is an alternative way to perform the signature.

2 is a system architecture diagram of another embodiment of the system for exchanging new certificates based on existing certificates of the present invention. As shown in the figure, the renewal server 23, the registration management center 24, and the certificate management center 25 in the system 2 for exchanging new certificates based on existing certificates are the same as the renewal server 13, the registration management center 14, and the system shown in FIG. The certificate management center 15 is the same. In this embodiment, those without certificates and those with existing certificates are located in a single device, that is, the user device 20, which can be an electronic device.

The user device 20 includes a software module 21 waiting for a certificate and a physical component 22 with a certificate. The software module 21 generates a certificate request file and receives a transaction serial number corresponding to the certificate request file, and the physical component 22 is Send the transaction serial number and the existing certificate of the physical component. Specifically, after the software module 21 sends the certificate request file to the renewal server 13, the renewal server 13 will return a transaction serial number to the software Module 21.

The renewal server 23 is used to receive the transaction serial number and the existing certificate from the entity component 22 to obtain the certificate serial number from the existing certificate, and transmit the certificate serial number and the certificate request file corresponding to the transaction serial number To the registration management center 24.

The registration management center 24 receives the certificate serial number and the certificate request file from the renewal server 23, and uses the certificate serial number to query whether the existing certificate exists, so as to generate a new certificate request request when confirming that the existing certificate exists And send it to the credential management center 25.

The certificate management center 25 receives the request for applying for a new certificate from the registry 24 to generate a new certificate, and sends the new certificate back to the renewal server 23 through the registry 24 for the software module 21 to follow Download the new certificate with the transaction serial number.

The biggest difference between this embodiment and FIG. 1 is that the new certificate and the unit with the existing certificate are all in the same device, and the rest of the certificate renewal server 23, the registration management center 24, and the certificate The operation of the management center 25 is the same as that described in FIG. 1. For example, the software module 21 is an APP in a mobile phone. There is no certificate in it, but it has better signing ability, can copy and select items to be signed, and has the ability to extend the signing algorithm. , Can use and support different algorithms according to application requirements, and the entity component 22 with existing certificates is the global subscriber identity module (UMTS Subscriber Identity Module, USIM) in the mobile device, which has limited signing ability and supports fixed algorithm, Single, and the operation is not convenient, you can only manually enter the value to be signed. If the plaintext to be signed is an invisible code, it cannot be signed, or when the string to be signed is too long, it is not easy Manual operation and input.

Since the global user identification card in the user's mobile phone device has a certificate, in order to quickly make the APP application in the mobile phone also have a certificate, and even be used to perform a certificate application for the global user identification card, the existing certificate of the global user identification card is used to generate The new certificate, because the two certificates are related, most of the information in the certificate is the same.

In one embodiment, the entity component 22 further includes using the transaction serial number as a signature to generate a signature value, wherein the signature value is transmitted to the renewal server 23 along with the transaction serial number and the existing certificate. For the renewal server to perform signature verification. It can be seen from the above that the entity component 22 uses the transaction serial number and the private key in the device to generate the signature, and the signature value will be sent to the renewal server 23 along with the transaction serial number for execution by the renewal server 23 Verify the seal to ensure the correctness of the transaction.

In one embodiment, the software module 21 further includes generating a private key for the software module 21 to use the private key for signing when obtaining the new certificate. In other words, when the software module 21 generates a certificate request file, it will also generate a private key, so that after obtaining a new certificate, it can be used with certificate applications such as signing, and it can also prevent others from obtaining a new certificate illegally. , Also cannot be used.

The key point of the present invention is to establish a certificate renewal server 23 to receive the existing certificate, and use this existing certificate with the certificate request file (Certificate Signing Request, CSR) issued by the software module 21 to send it to the Certificate Management Center (Certification Authority). , CA) Obtain a new legal certificate that corresponds to the existing certificate and provide it to the software module 21. This can improve the problem of the limited signing ability of the physical component 22 with the existing certificate, thereby effectively solving The device is limited and difficult to operate, that is, the technology of the present invention is based on the existing certificate in the physical component 22 as an endorsement, and goes to the certificate management center 15 to exchange for a new certificate, which is stored in the non-certified software module 21 for use. The effect of certificate replacement.

Fig. 3 is a step diagram of the method of exchanging a new voucher based on an existing voucher according to the present invention.

In step S31, the software module is made to provide the certificate request file to the renewal server, and receive the transaction serial number returned by the renewal server. In this step, the software module provides the certificate request file to the renewal server, and the renewal server will reply with a transaction serial number.

In step S32, the entity component with the existing certificate transmits the transaction serial number and the existing certificate to the renewal server. This step is to describe the process that the device or component with the existing certificate will send the transaction serial number and the existing certificate to the renewal server for the renewal server to perform the renewal process. The present invention uses the transaction serial number to make There is a correlation between two devices or components.

In one embodiment, the entity component further includes using the transaction serial number as a signature to generate a signature value, wherein the signature value is sent to the renewal server along with the transaction serial number and the existing certificate for use The renewal server performs signature verification. That is to say, the equipment or component with the existing certificate will use the transaction serial number as a signature, and the transaction serial number, signature value, and existing certificate will be transferred to the renewal server.

In step S33, the renewal server is made to obtain the certificate serial number from the existing certificate, and transmit the certificate serial number and the certificate request file corresponding to the transaction serial number to the registration management center. As mentioned earlier, the renewal server will verify the signature value. After the verification, the renewal server will retrieve the certificate serial number of the existing certificate to reduce the size of subsequent transmission data, and then the certificate serial number and Use the certificate request file corresponding to the transaction serial number that associates the two devices to the registration management center.

In step S34, the registry is asked to use the certificate serial number to confirm the legitimacy and validity of the existing certificate, so that when the existing certificate is legal and valid, a request for applying for a new certificate is generated. This step is to explain that the registration management center uses the certificate serial number to determine whether the certificate exists.

In step S35, the registration management center is asked to use the existing certificate to apply for a new certificate from the certificate management center. Following the previous step, in this step, after the verification is successful, the registration management center applies for a new certificate from the credential management center.

In step S36, the registration management center is made to return the new certificate to the renewal server for the software module to download. This step means that the registration management center will transfer the new certificate applied for to the renewal server, so that the software device can use the transaction serial number to download the new certificate to the device.

Figure 4 is a flow chart of a specific embodiment of the method of exchanging new vouchers based on existing vouchers of the present invention. Please refer to Figure 2 together, where both the new vouchers and the existing vouchers are required An example of the same device is used for illustration.

In process S41, the certificate request file is presented. This process generates a key for the software module, and provides a certificate request file, which is ultimately used when applying for a new certificate by the registration management center. The key can be used with the obtained new certificate for certificate applications such as signing. In specific implementation, use software modules (e.g. For example, the APP application) performs the action of placing an order. Before placing an order, the APP application will generate a certificate request file and a private key. When placing the order, the certificate request file will be sent to the renewal server, from the renewal server Obtain a transaction serial number.

In process S42, provide existing credentials. In this process, the existing certificate is stored in the physical component, and the existing certificate is provided to the renewal server. In specific implementation, use the transaction serial number obtained in process S41 to let the entity component (such as USIM) sign the transaction serial number, and transmit the transaction serial number, signature value, and the existing certificate in the USIM to the renewal server, here , Through the transaction serial number to make the APP application and USIM related.

In process S43, the certificate serial number is taken out. This process is for the renewal server to retrieve the certificate serial number of the existing certificate. In specific implementation, the renewal server will verify whether the signature is correct, and then retrieve the serial number of the certificate to reduce the amount of subsequent transmission of data.

In the process S44, the certificate serial number and the certificate request file are transmitted to the registration management center. In this process, the renewal server sends the certificate serial number and the certificate request file provided by the software module to the registration management center. During the specific implementation, the renewal server takes out the certificate request file obtained when placing the order from the database by allowing the APP application and USIM to establish the associated transaction serial number, and sends it to the registration management together with the certificate serial number obtained in process S43 center.

In process S45, it is determined whether there is a certificate. In this process, the registration management center will use the certificate serial number to check the legality and validity of the certificate. During the specific implementation, the registration management center will use the obtained certificate serial number to check whether this certificate exists.

In process S46, apply for a new certificate from the certificate management center. In this process, the registration management center uses the existing certificate information to apply for a new certificate from the certificate management center. During the specific implementation, the registration management center uses the existing certificate found by the certificate serial number to do endorsement and send it to the certificate management The management center applies for a new voucher, and the applied new voucher and the existing voucher are related to each other.

In process S47, the new certificate is returned for the device to download. This process is for the registration management center to return the new certificate to the renewal server so that the software module can download the new certificate. During the specific implementation, the certificate management center sends the new certificate applied for to the renewal server and stores it in the database. After that, the APP application can use the transaction serial number to obtain the new certificate from the renewal server in the application software. You can use the new certificate and the previously generated private key for signing.

From the above, it can be solved that when the certificated device has limited signing ability, the association between the device and the software module can be established based on the transaction serial number, and then a new certificate can be exchanged for the software module to solve the problem of device signing Restricted, allowing devices with better signing capabilities to sign. In addition, because the new voucher exchanged by the present invention is exchanged for endorsement based on the existing voucher, it is related to each other, rather than a completely new and unrelated new voucher.

In addition, the present invention also provides a computer-readable medium based on an existing certificate in exchange for a new certificate, which is applied to a computing device or computer with a processor (for example, CPU, GPU, etc.) and/or memory, and stores There are instructions, and the computing device or computer can be used to execute the computer-readable medium through the processor and/or memory, so as to execute the above content when the computer-readable medium is executed.

In summary, the present invention proposes a system, method and computer-readable medium for exchanging new certificates based on existing certificates. The present invention is based on a certificate renewal server established between a certificated device and a certificate management center (CA). Take out the certificate serial number in the certificate and use it with the certificate request file made before the device to apply for a new certificate from the certificate management center. A smaller amount of data can be transferred to the registration management center, and the existing certificate can also be compared. In addition, the present invention is based on the technology of exchanging existing vouchers for new vouchers, and the exchanged new vouchers have a one-to-one correlation with the existing vouchers. It can effectively solve the limitation of the existing certificate devices that are not easy to sign and the limitation of the signature algorithm, so that devices that do not hold the certificate can apply for a legal certificate, thereby improving the limitation of the signature.

The above-mentioned embodiments are only illustrative descriptions, and are not used to limit the present invention. Anyone who is familiar with this technique can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the rights of the present invention is defined by the scope of the patent application attached to the present invention. As long as it does not affect the effect and implementation purpose of the present invention, it should be covered in the technical content of this disclosure.

1: A system based on an existing certificate to exchange for a new certificate

11: Device to be certificated

12: Device with certificate

13: Renewal server

14: Registration Management Center

15: Certificate Management Center

Claims (13)

A system based on the exchange of existing vouchers for new vouchers, including: The certificate-waiting device is used to generate the certificate request file and receive the transaction serial number corresponding to the certificate request file; The voucher storage device is used to transmit the transaction serial number and the existing voucher possessed by the voucher storage device; The renewal server receives the transaction serial number and the existing certificate from the storage device to obtain the certificate serial number from the existing certificate, and transmits the certificate serial number and the certificate request file corresponding to the transaction serial number ； The registration management center receives the certificate serial number and the certificate request file from the renewal server, and uses the certificate serial number to query the existing certificate to generate a request for applying for a new certificate; and The certificate management center receives the request for applying for a new certificate from the registry to generate a new certificate, and sends the new certificate back to the renewal server through the registry, so that the device to be certified can use the transaction serial number Download the new certificate. The system for exchanging a new certificate based on an existing certificate as described in claim 1, wherein the renewal server generates the transaction serial number after receiving the certificate request file from the device to be certificated, and transmits the transaction serial number to the Device to be certificated. For example, the system for exchanging new vouchers based on existing vouchers as described in claim 1, wherein the device for storing vouchers further includes using the transaction serial number as a signature to generate a signature value, and the signature value follows the transaction serial number and The existing certificate is sent to the renewal server for the renewal server to perform signature verification. The system for exchanging a new certificate based on an existing certificate as described in claim 1, wherein the device to be certificated includes generating a private key for the device to be certificated to obtain the new certificate and use the private key to sign . A system based on the exchange of existing vouchers for new vouchers, including: The user device includes a software module waiting for a certificate and a physical component with a certificate. The software module generates a certificate request file and receives a transaction serial number corresponding to the certificate request file, and the physical component transmits the transaction serial number and Existing certificates possessed by the entity component; The renewal server receives the transaction serial number and the existing certificate from the entity component to obtain the certificate serial number from the existing certificate, and transmits the certificate serial number and the certificate request file corresponding to the transaction serial number; The registration management center receives the certificate serial number and the certificate request file from the renewal server, and uses the certificate serial number to query the existing certificate to generate a request for applying for a new certificate; and The certificate management center receives the request for applying for a new certificate from the registry to generate a new certificate, and sends the new certificate back to the renewal server through the registry for the software module to use the transaction serial number Download the new certificate. The system for exchanging a new certificate based on an existing certificate as described in request item 5, wherein the certificate renewal server generates the transaction serial number after receiving the certificate request file from the software module to send the transaction serial number to the Software modules. For example, the system for exchanging new vouchers based on existing vouchers as described in claim 5, wherein the entity component includes using the transaction serial number as a signature to generate a signature value, and the signature value follows the transaction serial number and the existing certificate. A certificate is sent to the renewal server for signature verification by the renewal server. The system for exchanging a new certificate based on an existing certificate as described in claim 5, wherein the software module includes generating a private key for the software module to use the private key to sign when the new certificate is obtained . A method of exchanging existing certificates for new certificates includes: Make the software module provide the certificate request file to the renewal server, and receive the transaction serial number returned by the renewal server; Make the entity component with the existing certificate send the transaction serial number and the existing certificate to the renewal server; Order the renewal server to obtain the certificate serial number from the existing certificate to send the certificate serial number and the certificate request file corresponding to the transaction serial number to the registry; Order the registry to use the serial number of the certificate to confirm the legitimacy and validity of the existing certificate, so that when the existing certificate is legal and valid, it generates a request for a new certificate; Make the registration management center use the existing certificate to apply for a new certificate from the certificate management center; and Order the registry to send the new certificate to the renewal server for the software module to download. The method for exchanging a new certificate based on an existing certificate as described in claim 9, wherein the software module and the physical component are located in the same device or belong to two different devices. As described in claim 9, the method for exchanging a new certificate based on an existing certificate, wherein the entity component includes using the transaction serial number as a signature to generate a signature value, and the signature value The transaction serial number and the existing certificate are sent to the renewal server for the renewal server to perform signature verification. The method for exchanging a new certificate based on an existing certificate as described in claim 9, wherein the software module includes generating a private key for the software module to use the private key for signing when obtaining the new certificate . A computer-readable medium used in a computing device or computer, and storing instructions to execute the method of exchanging a new certificate based on an existing certificate as described in any one of request items 9 to 12.

Images