WO2018219009A1

WO2018219009A1 - Certificate obtaining method and device

Info

Publication number: WO2018219009A1
Application number: PCT/CN2018/078824
Authority: WO
Inventors: 薛晶
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-05-31
Filing date: 2018-03-13
Publication date: 2018-12-06
Also published as: CN108989039A

Abstract

The present disclosure provides a certificate obtaining method, a certificate obtaining device, a storage medium, and a processor. The certificate obtaining method comprises: authenticating a root certificate or a certificate chain of a server; in the case of an authentication failure, sending a certificate obtaining request to the server, the certificate obtaining request being used for requesting the obtaining of a changed root certificate in the server, and the changed root certificate being used for forming a complete certificate chain; and obtaining the changed root certificate in the server according to response information of the server in response to the certificate obtaining request.

Description

Certificate acquisition method and device

Technical field

The present disclosure relates to the field of communications, and in particular, to a certificate acquisition method and apparatus.

Background technique

Currently, terminal projects mostly involve data interaction with the server of the office. Terminal applications related to this include mobile terminal over-the-air (FOTA) and traffic tracking status data traffic display (DataUsage). These data interactions all involve security issues because the content on the server is not open to the public and has certain confidentiality. At present, the commonly used method for handling security problems is to use Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS).

Some projects because of the security of server certificates, such as the continuous advancement of encryption technology and the in-depth study of professional personnel and hackers in related fields, caused many algorithms to be hacked, resulting in some certificates being tampered with and forged into untrusted certificates. The server needs to update the server certificate.

Terminals (for example, UFI, mobile phones and other wireless Internet products) generally pre-produce related certificates as required. For security reasons, the terminal pre-made certificates will not change unless the version is upgraded. For example, a personal computer (Personal Computer, referred to as PC) By default, the "Turn off automatic root certificate update" function is not enabled. If the PC does not want to automatically update the certificate, you need to manually enable the "Automatically update the root certificate" function. This is a common practice for the terminal. If the server certificate updated by the server is not in the previously negotiated certificate list, the certificate authentication fails because the terminal does not pre-process these new server certificates. As a result, the terminal cannot connect to the server properly, DataUsage and FOTA. If it is not working properly, it will seriously affect the user experience.

After the authentication fails, the terminal can download the certificate from a pre-designated server via the Internet. For example, the PC does not enable the "Automatically close the root certificate" function. However, server and server address security is yet to be confirmed. In addition, some browsers used by the terminal can perform the next step even if the authentication is not passed. Obviously, this is very unsafe.

Therefore, in the related art, after the root certificate in the server is changed, there is a problem that the certificate authentication fails and the terminal cannot connect to the server normally because there is no root certificate changed in the server in the pre-made certificate list in the terminal.

Public content

According to an embodiment of the present disclosure, a method for obtaining a certificate is provided, including the steps of: authenticating a root certificate or a certificate chain of a server; and in case of failing authentication, sending a certificate acquisition request to the server, the certificate obtaining The request is used to request to obtain a changed root certificate in the server, where the root certificate is used to form a complete certificate chain; and according to the response information of the server in response to the certificate obtaining request, the changed information in the server is obtained. Root certificate.

According to another embodiment of the present disclosure, a certificate obtaining method is provided, including the steps of: receiving a certificate obtaining request sent by a terminal, where the certificate obtaining request is used to request to acquire a changed root certificate, where the root certificate is used to form a complete certificate chain; sending, according to the certificate obtaining request, response information for acquiring the changed root certificate to the terminal.

According to still another embodiment of the present disclosure, a certificate obtaining apparatus is provided, including: a detecting module configured to authenticate a root certificate or a certificate chain of a server; and a sending module configured to, in case of authentication failure, to the The server sends a certificate obtaining request, where the obtaining request is used to request to obtain a changed root certificate in the server, where the root certificate is used to form a complete certificate chain; and the obtaining module is configured to respond to the certificate according to the server Obtain the response information of the request, and obtain the changed root certificate in the server.

According to still another embodiment of the present disclosure, a certificate obtaining apparatus is provided, including: a receiving module, configured to receive a certificate obtaining request sent by a terminal, where the certificate obtaining request is used to request to acquire a changed root certificate; and a sending module, And configured to send, to the terminal, response information for acquiring the changed root certificate according to the certificate obtaining request.

According to still another embodiment of the present disclosure, there is also provided a storage medium including a stored program that executes any of the above-described certificate acquisition methods while the program is running.

According to still another embodiment of the present disclosure, there is also provided a processor configured to execute a program that executes any of the above-described certificate acquisition methods while the program is running.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the disclosure, and are intended to be a In the drawing:

Figure 1 is a schematic diagram of the location of SSL/TLS in the Internet model;

2 is a schematic diagram of a handshake process of SSL/TLS;

3 is a block diagram showing a hardware configuration of a mobile terminal that executes a certificate acquisition method of an embodiment of the present disclosure;

4 is a flowchart of a certificate acquisition method running on a terminal side according to an embodiment of the present disclosure;

5 is a schematic diagram of a wireless terminal configuring a digital certificate in accordance with an embodiment of the present disclosure;

6 is a schematic diagram of a process of a User Equipment (UE) requesting a Public Data Network (PDN) connection;

7 is a preferred flow diagram of a certificate acquisition method in accordance with an embodiment of the present disclosure;

8 is a flowchart of a certificate acquisition method running on a server side, according to an embodiment of the present disclosure;

9 is a diagram showing an example of interaction of network side digital certificate synchronization, in accordance with an embodiment of the present disclosure;

FIG. 10 is a structural block diagram of a certificate obtaining apparatus according to an embodiment of the present disclosure; FIG.

FIG. 11 is a structural block diagram of another certificate obtaining apparatus according to an embodiment of the present disclosure.

detailed description

The present disclosure will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present disclosure and the features in the embodiments may be combined with each other without conflict.

It should be noted that the terms "first", "second" and the like in the related description of the present disclosure and the claims and the drawings are used to distinguish similar objects, and are not used to describe a specific order or order. order.

For the sake of easy understanding, the following is a brief description of the relevant concepts in the certification process.

The Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are based on the Transmission Control Protocol/Internet Protocol (TCP/IP). The client server application provides security measures such as client and server authentication, data integrity, and information confidentiality. It is a protocol designed to ensure the security of both parties' information. It relies on a reliable TCP transport layer. Transfer and receive data.

Figure 1 is a schematic diagram of the location of SSL/TLS in the Internet model. As shown in Figure 1, the SSL/TLS protocol is characterized by an application layer protocol independent of the upper layer (such as Hypertext Transfer Protocol HTTP, File Transfer Protocol FTP, Remote Terminal Protocol TELNET). Etc.), these applications are protected by data encryption. These application layer protocols can transparently use the SSL/TLS protocol. The SSL/TLS protocol can negotiate a symmetric encryption algorithm and session key, and at the same time authenticate the validity of the server before communicating. All application layer data is encrypted and transmitted.

The SSL/TLS protocol consists of two important independent processes, the SSL handshake process (including authentication) and the SSL record process (including data stream encryption). In a risky network environment, it is important to use strong encryption to protect the packet so that it can reach its intended destination. SSL/TLS works fine and is secure. Throughout the process, the identity authentication process is relatively weak. The focus of this disclosure is on the identity authentication problem encountered in the project. Here, a brief introduction to the identity authentication process is given.

"Certificate" is also called "digital certificate" or "public key certificate", which is used to prove that something is indeed something. In layman's terms, a certificate is like a seal. Through the official seal, it can be proved that the letter of introduction is indeed issued by the corresponding company. In theory, everyone can find a certificate tool and make a certificate of their own. But whether this official seal is credible remains to be confirmed. The contents of the certificate include the information of the electronic visa authority, the public key user information, the public key, the signature of the authority and the validity period. Currently, the format and certification methods of certificates generally follow the X.509 international standard.

Currently, server certificates are generally in the form of a certificate chain, that is, trust relationships between certificates can be nested. For example, C trusts A1, A1 trusts A2, A2 trusts A3..., this is called the certificate's trust chain. As long as the first certificate (also called the root certificate) on the chain of trust, the subsequent certificates can be trusted. Correspondingly, if the certificate chain does not have a trusted certificate, the authentication will fail. The trust process of the entire certificate chain is mainly to find a public key capable of decoding the certificate chain from the trusted root certificate, thereby performing a series of verification work.

The following is a brief discussion of the handshake process of SSL/TLS. Figure 2 is a schematic diagram of the handshake process of SSL/TLS. As shown in Figure 2 (especially the comment box), after the handshake process of SSL/TLS starts, identity authentication is performed. Identity authentication is divided into: 1) client-side authentication only; 2) server-side identity authentication; 3) server and client authentication.

For client authentication, that is, when the terminal receives the certificate chain of the server, it performs certificate verification. When the certificate is an untrusted certificate, the subsequent interaction process stops. Conversely, when the certificate is trusted, subsequent related services can be performed.

The certificate acquisition method provided by the embodiment of the present disclosure may be performed in a mobile terminal, a computer terminal, or the like. Taking a mobile terminal as an example, FIG. 3 is a hardware block diagram of a mobile terminal that executes a certificate obtaining method of an embodiment of the present disclosure. As shown in FIG. 3, the mobile terminal 30 may include one or more (only one shown) processor 302 (the processor 302 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA). A memory 304 for storing data, and a transmission device 306 for communication functions. It will be understood by those skilled in the art that the structure shown in FIG. 3 is merely illustrative, and does not limit the structure of the mobile terminal. For example, mobile terminal 30 may also include more or fewer components than shown in FIG. 3, or may have a different configuration than that shown in FIG.

The memory 304 can be used to store software programs and modules of application software, such as program instructions/modules corresponding to the certificate acquisition method in the embodiment of the present disclosure, and the processor 302 executes each by executing a software program and a module stored in the memory 304. A functional application and data processing, that is, the above-mentioned certificate acquisition method is implemented. Memory 304 can include high speed random access memory and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 304 can further include memory remotely located relative to processor 302, which can be connected to mobile terminal 30 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Transmission device 306 is for receiving or transmitting data via a network. Specific examples of the above-described network may include a wireless network provided by a communication provider of the mobile terminal 30. In one example, transmission device 306 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 306 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.

In this embodiment, a method for obtaining a certificate running on the mobile terminal is provided. FIG. 4 is a flowchart of a method for obtaining a certificate according to an embodiment of the present disclosure. As shown in FIG. 4, the method for obtaining a certificate includes the following steps. Step S402: authenticating the root certificate or the certificate chain of the server; in step S404, if the authentication fails, sending a certificate obtaining request to the server, where the certificate obtaining request is used to request to obtain the changed root certificate in the server, the root certificate And used to form a complete certificate chain; in step S406, the changed root certificate in the server is obtained according to the response information of the server in response to the certificate obtaining request.

Through the above steps, after the root certificate or certificate chain authentication of the server fails, the terminal can obtain the changed root certificate in the server in time to update the locally saved certificate, thereby solving the pre-made certificate list saved locally by the terminal. The problem that the authentication fails and the terminal cannot connect to the server properly is not included in the root certificate of the server, and the normal interaction between the terminal and the server is achieved.

In some embodiments, authenticating the root certificate or certificate chain of the server comprises: initiating a handshake request to the server; receiving a certificate returned by the server according to the handshake request; and detecting whether there is a certificate matching the certificate returned by the server according to the handshake request. The manner of authenticating the root certificate or the certificate chain of the server.

In some embodiments, transmitting the certificate acquisition request to the server comprises transmitting the certificate acquisition request to the server by the first predetermined signaling.

For example, the terminal can locally prepare two sets of different access point feature (APN profile) parameters, one for the normal dial-up process and the other for obtaining certificate-related parameters. FIG. 5 is a schematic diagram of a wireless terminal configuring a digital certificate according to an embodiment of the present disclosure. As shown in FIG. 5, the configuration process includes the following steps 1 and 2.

Step 1: The terminal configures two sets of APN profile parameters A and B.

The APN profile A does not carry the certificate acquisition request field information, that is, the APN profile used by the general project, and the APN profile is used for normal dialing.

The APN profile B carries the certificate obtaining request field information, and is used to request to obtain related information of the certificate. The specific content of APN profile B can be as follows:

2015 May 22 04:05:23.927[31]0xB0ED LTE NAS EMM Plain OTA Outgoing Message--Attach request Msg

......

Num_recs2=8(0x8)

Sm_container[0]

Container_id=13(0xd)(DNS Server IPv4 Address Requestt)

Container_len=0(0x0)

Sm_container[1]

Container_id=3(0x3)(DNS Server IPv6 Address Request)

Container_len=0(0x0)

Sm_container[2]

Container_id=65280(0xff00)(unknown)

Container_len=3(0x3)

Container_contents[0]=19(0x13)

Container_contents[1]=1(0x1)

Container_contents[2]=132(0x84)

......

2015 May 22 04:05:24.382[36]0xB0EC LTE NAS EMM Plain OTA Incoming Message--Attach accept Msg

......

Sm_container[0]

Container_id=3(0x3)(DNS Server IPv6 Address)

Container_len=16(0x10)

Address=0x200148880010ff000132000d00000000(2001:4888:10:ff00:132:d:0:0)

Sm_container[1]

Container_id=3(0x3)(DNS Server IPv6 Address)

Container_len=16(0x10)

Address=0x200148880011ff000137000d00000000(2001:4888:11:ff00:137:d:0:0)

......

Address=0x200148880005fe0000e00104000000a4(2001:4888:5:fe00:e0:104:0:a4)

Sm_container[5]

Container_id=65280(0xff00)(unknown)

Container_len=4(0x4)

Container_contents[0]=19(0x13)

Container_contents[1]=1(0x1)

Container_contents[2]=132(0x84)

Container_contents[3]=0(0x0)

......

Referring to the above attached content, when the terminal needs to obtain a protocol configuration option (PCO) digital certificate, the request information needs to be sent to the network, and the network is required to reply to the related content. The content of the specific reply needs to be negotiated with the network side in advance.

The digital certificate acquisition request field includes but is not limited to: 1) a network-approved PCO signaling message representing a request field of a digital certificate type that can determine the request, that is, a container_id in the signaling; 2) if the network side still needs to provide the terminal Additional information about the certificate request, which can be placed in the container_contents field.

Here, what the terminal has to do is code configuration, and ensure that the terminal sends the certificate acquisition request field, that is, the sm_container field, when the "Attach request Msg" request is issued.

Step 2: Pre-configure the two APN profile parameters A and B that have been configured in the terminal, so that the terminal can make different choices in different situations.

It should be noted that, when the terminal is successfully connected to the network and a request to connect to the server occurs, the terminal detects that the local root certificate cannot be found and the certificate chain verification caused by the server update certificate is not passed. The APN profile that carries the request field information by carrying the certificate re-initiates the attach procedure of requesting the relevant parameters of the certificate. After receiving the relevant request, the core network gives a corresponding response. The terminal parses the received response message, and obtains the trusted root certificate through parsing and subsequent operations.

In some embodiments, according to the response information of the server in response to the certificate obtaining request, acquiring the changed root certificate in the server includes: receiving, by the second server, response information of the certificate obtaining request by using the second predetermined signaling, where the response information carries The parameters of the changed root certificate; parsing the response information acquisition parameters, and obtaining the changed root certificate according to the parameters. Through the above steps, the related content of the trusted certificate (root certificate) is transmitted by signaling instead of IP, so that the certificate related information is not intercepted and falsified during the transmission process, and the root certificate received by the terminal is ensured. reliability.

In some embodiments, the first predetermined signaling includes Protocol Configuration Options (PCO) signaling, and the second predetermined signaling includes Protocol Configuration Option (PCO) signaling. The PCO is used to provide additional selection information for the destination network (the destination network to which the terminal is connected). When the terminal is connected to the Internet, the Internet distributes the PCO signaling in addition to the IP address of the terminal. The signaling includes the default gateway IP address, the Domain Name System (DNS) service address, etc. PCO signaling contains a lot of additional information. The transmission and reception of PCO signaling takes place in an attach procedure. 6 is a schematic diagram of a process for a UE to request a Public Data Network (PDN) connection, which is intercepted in the protocol 3GPP23.401 “Figure 5.10.2-1: UE requested PDN connectivity”. Meanwhile, 3GPP 23.401 also has the following description: The terminal initializes a procedure for requesting a PDN connection by the UE by transmitting PDN connection request information (access point APN, PDN, PCO, header compression configuration), and the PCO is used to transmit parameters between the terminal and the network. It can be seen from the above that the PCO is generally used to transmit parameters between the terminal and the network. For example, PCO signaling is often used to transmit IP addresses and APN types, but does not use PCO signaling to transmit information about the server certificate. PCO signaling is applied to the transmission of server certificates in embodiments of the present disclosure.

In order to facilitate the understanding of the above embodiments, the following is a detailed description. FIG. 7 is a preferred flowchart of a certificate obtaining method according to an embodiment of the present disclosure. As shown in FIG. 7, the certificate obtaining method includes the following steps S702 to S722, where The steps performed on the terminal side are mainly described.

Step S702: The terminal initiates an attach request to the network side by using an APN profile parameter (ie, APN profile A) that does not carry the certificate acquisition request field. The main reason for using this APN profile is that although the local server does not update the certificate regularly, if the server does not update the certificate, it is not necessary to obtain the certificate.

In step S704, the attach response is completed, and the terminal is successfully connected. Here, the success of networking is a prerequisite for normal communication between the terminal and the central server.

Step S706, the terminal initiates an SSL/TLS handshake request to the server according to the project requirement.

Step S708, after receiving the handshake request of the terminal, the network side sends a corresponding response to the terminal, and the terminal receives the certificate chain of the local server.

In step S710, the terminal checks the server certificate chain. If the verification is successful, the process goes to step S712. If the verification fails, the process proceeds to step S714.

In step S712, the server performs subsequent normal handshake and communication.

In step S714, the terminal determines the cause of the verification failure locally, and selects whether the certificate needs to be updated according to the failure reason. There are many reasons for certificate failure, such as certificate signature failure, root certificate not found, certificate expiration, and so on. The specific rules that need to be updated will be clearly defined by the product design requirements. If it is necessary to update the certificate, go to step S716, otherwise go to step S722.

Step S716, the terminal actively initiates a detach request, and then re-initiates the attach request using the APN profile B carrying the certificate acquisition request field.

Step S718, the network side responds to the received request message, and the terminal successfully receives the response message.

Here, the network side response message to the terminal includes, but is not limited to: 1) the network side directly sends the root certificate itself to the terminal through the PCO signaling; 2) the network side sends the key to obtain the root certificate to the terminal through the PCO signaling. Data, such as certificate acquisition password, certificate acquisition server address, etc.

Step S720: The terminal locally parses the received message, and successfully obtains a root certificate of the reliable server certificate chain through parsing and subsequent operations. This ensures the normal use of related functions.

Here, the terminal performs corresponding operations according to the parsed information, for example: 1) If the terminal receives the certificate itself delivered by the network side through the PCO signaling, the terminal saves the parsed root certificate locally for subsequent use. 2) If the terminal parses the server address and password for obtaining the root certificate through PCO signaling, the terminal performs subsequent operations to complete the certificate acquisition.

In step S722, the exception processing flow is entered.

In the above embodiment, when the terminal confirms that the certificate chain verification fails due to a certificate change or the like, the terminal sends a trusted certificate acquisition request message to the network side through protocol configuration option (PCO) signaling. The requesting network side sends the trusted root certificate or the content related to the root certificate of the certificate chain deployed by the central office server to the terminal through the corresponding signaling message. Then, the terminal performs corresponding parsing processing on the received information to obtain a trusted root certificate. The method for transmitting key information of a certificate by signaling of the present disclosure greatly improves the reliability of certificate transmission and ensures normal use of related functions.

In this embodiment, a certificate acquisition method running on the server side is further provided. FIG. 8 is a flowchart of a certificate acquisition method running on the server side according to an embodiment of the present disclosure. As shown in FIG. The obtaining method includes the following steps: Step S802: Receive a certificate obtaining request sent by the terminal, where the certificate obtaining request is used to request to acquire the changed root certificate, and the root certificate is used to form a complete certificate chain; and in step S804, the method is sent to the terminal according to the certificate obtaining request. Used to obtain response information for the changed root certificate.

In some embodiments, the request for obtaining a certificate sent by the receiving terminal comprises: receiving a certificate obtaining request sent by the terminal by using the first predetermined signaling.

In some embodiments, the sending the response information for acquiring the changed root certificate to the terminal according to the certificate obtaining request includes: determining response information for acquiring the changed root certificate according to the certificate obtaining request, where the response information carries the information for obtaining The parameter of the changed root certificate; sending the response information to the terminal by using the second predetermined signaling.

In some embodiments, the first predetermined signaling includes a protocol configuration option (PCO) signaling and the second predetermined signaling includes protocol configuration option (PCO) signaling.

In some embodiments, the certificate obtaining method further includes: after transmitting the response information for acquiring the changed root certificate to the terminal according to the certificate obtaining request, notifying the core network to perform the certificate update, for example, sending the notification information to the core network. The notification information carries valid information of the certificate. It should be noted that the core network synchronizes the trusted certificates used by the local server in time, and the synchronization mode is not limited.

It should be noted that since the local server and the core network are in charge of different functions, the synchronization between the two is involved, but since both of them belong to the internal office, the synchronization work is relatively easy. 9 is a diagram showing an example of interaction of network side digital certificate synchronization according to an embodiment of the present disclosure. As shown in FIG. 9, the network side digital certificate synchronization includes the following two schemes: scheme 1, when a certificate used by an authority server changes The core network is notified in time to update the certificate; in the second scheme, the central server and the core network are periodically synchronized according to certain rules.

In the present disclosure, when the certificate of the terminal does not match the certificate between the terminal and the server, the terminal is configured to use the protocol configuration option (PCO) to send the trusted certificate to the network. The request is to request the network side to deliver the certificate or certificate related content used by the server to the terminal through the corresponding response message, and then the terminal parses and responds to the received response message, thereby effectively ensuring the certificate between the terminal and the server. Secure and reliable synchronization, ultimately, ensures normal communication between the terminal and the central server.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the foregoing embodiment can be implemented by using software and a necessary general hardware platform, and of course, can also be implemented only by hardware, but in many cases, the former It is a better implementation. Based on such understanding, portions of the technical solution of the present disclosure that contribute substantially or to the related art may be embodied in the form of a computer software product that can be stored in a storage medium (eg, ROM/RAM, disk, The optical disc, etc., includes a number of instructions for causing a terminal device (such as a cell phone, computer, server, or network device, etc.) to perform the methods described in various embodiments of the present disclosure.

The embodiment of the present disclosure further provides a certificate obtaining apparatus, which is used to implement the certificate obtaining method of the embodiments and the embodiments of the present disclosure, and the above description has been omitted herein. As used hereinafter, the term "module" is a combination of software and/or hardware that can perform a predetermined function. Although the certificate acquisition device described below is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and conceivable.

FIG. 10 is a structural block diagram of a certificate obtaining apparatus (for a terminal side) according to an embodiment of the present disclosure. As shown in FIG. 10, the certificate obtaining apparatus includes: a detecting module 102 for a root certificate or certificate to a server The chain is authenticated; the sending module 104 is connected to the detecting module 102, and is configured to send a certificate obtaining request to the server in the case that the authentication fails, and the certificate obtaining request is used to request to obtain the changed root certificate in the server, where the root certificate is The obtaining module 106 is connected to the sending module 104, and configured to obtain the changed root certificate in the server according to the response information of the server in response to the certificate obtaining request.

In some embodiments, the sending module 104 is configured to send a certificate acquisition request to the server by using the first predetermined signaling.

In some embodiments, the obtaining module 106 is configured to receive, by the server, the response information of the request for obtaining the certificate by using the second predetermined signaling, where the response information carries a parameter for acquiring the changed root certificate, and the obtaining module 106 is further configured to parse the response. The information gets the parameters, and then the changed root certificate is obtained according to the parameters.

FIG. 11 is a structural block diagram of another certificate obtaining apparatus (for a server side) according to an embodiment of the present disclosure. As shown in FIG. 11, the certificate obtaining apparatus includes: a receiving module 112, configured to receive a certificate obtained by a terminal. The request, the certificate obtaining request is used to request to obtain the changed root certificate, and the root certificate is used to form a complete certificate chain; the sending module 114 is connected to the receiving module 112, and configured to send the terminal to the terminal according to the certificate obtaining request. Response information of the changed root certificate.

It should be noted that each of the foregoing modules may be implemented by software or hardware. In the case that each module is implemented by hardware, each of the foregoing modules may be located in the same processor, or any combination of the foregoing modules may be used in any combination. The forms are respectively located in different processors, but the implementation is not limited to this.

Embodiments of the present disclosure also provide a storage medium including a stored program that executes the steps in the certificate acquisition method of the embodiment of the present disclosure described above when the stored program runs.

In some embodiments, the above storage medium may be configured to store program code (for the terminal side) for performing the following steps: S1, authenticating the root certificate or certificate chain of the server; S2, in case of authentication failure Sending a certificate acquisition request to the server, the certificate obtaining request is used to request to obtain the changed root certificate in the server, and the root certificate is used to form a complete certificate chain; and S3, according to the response information obtained by the server in response to the certificate obtaining request, is obtained after the server changes Root certificate.

In some embodiments, the authenticating the root certificate or the certificate chain of the server in step S1 comprises: initiating a handshake request to the server; receiving a certificate returned by the server according to the handshake request; and detecting whether the certificate returned by the server according to the handshake request is detected locally. The way to match the certificate, the server's root certificate or certificate chain is authenticated.

In some embodiments, the sending the certificate acquisition request to the server in step S2 comprises: sending a certificate acquisition request to the server by using the first predetermined signaling.

In some embodiments, the root certificate according to the response information acquired by the server in response to the certificate obtaining request in step S3 includes: the receiving server responds to the certificate obtaining request response information by using the second predetermined signaling, and the response information is carried in the response information. There are parameters for obtaining the changed root certificate; parsing the response information acquisition parameters, and obtaining the changed root certificate according to the parameters.

In some embodiments, the first predetermined signaling includes Protocol Configuration Option (PCO) signaling.

In some embodiments, the second predetermined signaling includes Protocol Configuration Option (PCO) signaling.

In some embodiments, the above storage medium may be configured to store program code (for server side) for performing the following steps: S1', receiving a certificate acquisition request sent by the terminal, and requesting the certificate acquisition request for obtaining the changed The root certificate is used to form a complete certificate chain; S2' sends a response message for obtaining the changed root certificate to the terminal according to the certificate obtaining request.

In some embodiments, the obtaining request sent by the receiving terminal in step S1' includes: receiving a certificate obtaining request sent by the terminal by using the first predetermined signaling.

In some embodiments, the sending, by the certificate obtaining request, the response information for acquiring the changed root certificate according to the certificate obtaining request in the step S2 is: determining, according to the certificate obtaining request, response information for acquiring the changed root certificate, the response information. The parameter carries the parameter for obtaining the changed root certificate, and sends the response information to the terminal by using the second predetermined signaling.

In some embodiments, the storage medium is further configured to store program code for performing the following steps: after transmitting the response information for acquiring the changed root certificate to the terminal according to the certificate acquisition request, notifying the core network to perform the certificate update .

In some embodiments, the foregoing storage medium may include, but is not limited to, a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk. Or a variety of media such as optical discs that can store program code.

Embodiments of the present disclosure also provide a processor configured to execute a program that, when executed, performs the steps in the certificate acquisition method of the embodiments of the present disclosure described above.

In some embodiments, the processor runs a program for performing the following steps (for the terminal side): S1, authenticating the server's root certificate or certificate chain; S2, sending the certificate to the server if the authentication fails The request, the certificate obtaining request is used to obtain the changed root certificate in the server, and the root certificate is used to form a complete certificate chain; S3, the changed root certificate in the server is obtained according to the response information of the server in response to the certificate obtaining request.

In some embodiments, the authenticating the root certificate or the certificate chain of the server in step S1 comprises: initiating a handshake request to the server; receiving a certificate returned by the server according to the handshake request; and detecting whether the certificate returned by the server according to the handshake request is detected locally. A matching certificate to authenticate the server's root certificate or certificate chain to detect if the server's root certificate has changed.

In some embodiments, the program run by the processor is configured to perform the following steps (for the server side): S1', receiving a certificate acquisition request sent by the terminal, and the certificate obtaining request is used to request to acquire the changed root certificate, the root The certificate is used to form a complete certificate chain; S2' sends a response message for obtaining the changed root certificate to the terminal according to the certificate obtaining request.

In some embodiments, the certificate obtaining request sent by the receiving terminal in step S1' includes: receiving a certificate obtaining request sent by the terminal by using the first predetermined signaling.

For specific examples of the steps, reference may be made to the examples described above, and details are not described herein again.

Obviously, those skilled in the art should understand that the above modules or steps of the present disclosure may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices. In some embodiments, various modules or steps of the present disclosure may be implemented by program code executable by a computing device such that the program code may be stored in a storage device and executed by the computing device, and in certain The steps of the present disclosure may be performed in an order different from that shown or described in the present disclosure, or the various modules or steps of the present disclosure may be separately fabricated into individual integrated circuit modules, or the various modules of the present disclosure may be Or a plurality of modules or steps in each step are fabricated into a single integrated circuit module. As such, implementations of the present disclosure are not limited to any particular combination of hardware and software.

The above description is only exemplary embodiments of the present disclosure, and is not intended to limit the present disclosure, and various modifications and changes can be made to the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present disclosure are intended to be included within the scope of the present disclosure.

Claims

A method for obtaining a certificate, comprising the steps of:

Authenticate the server's root certificate or certificate chain;

If the authentication fails, the certificate obtaining request is sent to the server, where the certificate obtaining request is used to request to acquire the changed root certificate in the server, where the root certificate is used to form a complete certificate chain;

And obtaining, according to the response information of the server, the changed root certificate in the server.
The method of claim 1 wherein the step of authenticating the root certificate or certificate chain of the server comprises:

Initiating a handshake request to the server;

Receiving a certificate returned by the server according to the handshake request;

The root certificate or the certificate chain of the server is authenticated by detecting whether there is a local certificate matching the certificate returned by the server according to the handshake request.
The method of claim 1, wherein the step of transmitting the certificate acquisition request to the server comprises:

The certificate acquisition request is sent to the server by first predetermined signaling.
The method according to claim 1, wherein the step of acquiring the changed root certificate in the server according to the response information of the server in response to the certificate obtaining request comprises:

Receiving, by the server, the response information of the certificate obtaining request by using the second predetermined signaling, where the response information carries a parameter for acquiring the changed root certificate;

Parsing the response information to obtain the parameter, and acquiring the changed root certificate according to the parameter.
The method of claim 3 wherein said first predetermined signaling comprises protocol configuration option signaling.
The method of claim 4 wherein said second predetermined signaling comprises protocol configuration option signaling.
A method for obtaining a certificate, comprising the steps of:

Receiving a certificate obtaining request sent by the terminal, where the certificate obtaining request is used to request to acquire a changed root certificate, where the root certificate is used to form a complete certificate chain;

Sending, according to the certificate obtaining request, response information for acquiring the changed root certificate to the terminal.
The method of claim 7, wherein the step of receiving the certificate acquisition request sent by the terminal comprises:

Receiving a certificate acquisition request sent by the terminal by using the first predetermined signaling.
The method according to claim 7, wherein the step of transmitting response information for acquiring the changed root certificate to the terminal according to the certificate obtaining request comprises:

And determining, according to the certificate obtaining request, response information for acquiring the changed root certificate, where the response information carries a parameter for acquiring the changed root certificate;

The response information is sent to the terminal by second predetermined signaling.
The method of claim 7 further comprising the step of:

After transmitting the response information for acquiring the changed root certificate to the terminal according to the certificate obtaining request, the core network is notified to perform the certificate update.
A certificate obtaining device includes:

The detection module is configured to authenticate the root certificate or the certificate chain of the server;

a sending module, configured to send a certificate obtaining request to the server if the authentication fails, where the certificate obtaining request is used to request to acquire a changed root certificate in the server, where the root certificate is used to form a complete Certificate chain

The obtaining module is configured to acquire the changed root certificate in the server according to the response information of the server in response to the certificate obtaining request.
The apparatus of claim 11, wherein the transmitting module is further configured to send the certificate acquisition request to the server by first predetermined signaling.
The apparatus of claim 11, wherein the obtaining module is further configured to:

Receiving, by the server, the response information of the certificate obtaining request by using the second predetermined signaling, where the response information carries a parameter for acquiring the changed root certificate;

Parsing the response information to obtain the parameter, and acquiring the changed root certificate according to the parameter.
A certificate obtaining device includes:

a receiving module, configured to receive a certificate obtaining request sent by the terminal, where the certificate obtaining request is used to request to acquire a changed root certificate, where the root certificate is used to form a complete certificate chain;

And a sending module, configured to send, according to the certificate obtaining request, response information for acquiring the changed root certificate to the terminal.
A storage medium comprising a stored program, the program running to perform the method according to any one of claims 1 to 6.
A processor configured to execute a program, the program running to perform the method of any one of claims 1 to 6.
A storage medium comprising a stored program, the program running to perform the method of any one of claims 7 to 10.
A processor configured to execute a program, the program running to perform the method of any one of claims 7 to 10.