WO2019072039A1 - 一种业务证书管理方法、终端及服务器 - Google Patents

一种业务证书管理方法、终端及服务器 Download PDF

Info

Publication number
WO2019072039A1
WO2019072039A1 PCT/CN2018/102738 CN2018102738W WO2019072039A1 WO 2019072039 A1 WO2019072039 A1 WO 2019072039A1 CN 2018102738 W CN2018102738 W CN 2018102738W WO 2019072039 A1 WO2019072039 A1 WO 2019072039A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
certificate
service certificate
request
identifier
Prior art date
Application number
PCT/CN2018/102738
Other languages
English (en)
French (fr)
Inventor
严雪松
许汝波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201880059099.9A priority Critical patent/CN111066284B/zh
Publication of WO2019072039A1 publication Critical patent/WO2019072039A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a service certificate management method, a terminal, and a server.
  • the Public Key Infrastructure (PKI) system can be self-built by a terminal manufacturer or provided by a third party.
  • the root certificate authority (CA) ie, the vendor CA
  • the second-level CA issues the device certificate according to the batch, and the terminal obtains the certificate.
  • the service certificate can be directly issued by using the private key corresponding to the device certificate.
  • the service certificate is not effectively controlled.
  • the certificate requester needs to submit the certificate issuance request to the third-party CA.
  • the third-party CA manually audits the certificate issuance request, and the business certificate is issued after the audit is passed.
  • the entire business certificate issuance process takes a long time and cannot meet the needs of rapid business response. It can be seen that there is a lack of effective control and poor real-time performance when issuing business certificates.
  • the embodiment of the present application discloses a service certificate management method, a terminal, and a server, which can effectively control the issuance of a service certificate, and can meet the requirement of rapid response of the service.
  • the first aspect of the present application provides a service certificate management method, including: when the first application is started, if it is determined that the first application is pre-configured to apply for a service certificate, the service certificate application request and the service certificate application are sent to the authentication server.
  • the application information carried in the request includes the application identifier of the first application, and the application identifier of the first application is used by the authentication server to verify the service certificate application authority of the first application; and the identity of the first application sent by the authentication server according to the application information is received.
  • the verification result is that, when the authentication result indicates that the first application has the service certificate application authority, the certificate request file is generated in the trusted execution environment, and the target service certificate corresponding to the first application is obtained according to the certificate request file, thereby
  • the authentication can be implemented to effectively control the issuance of the service certificate.
  • the authentication server passes the authentication of the application, the corresponding service certificate can be obtained, and the online response of the service certificate issuance request can be realized, which can meet the rapid response of the service. demand.
  • the specific manner of generating the certificate request file in the trusted execution environment may be: generating a key pair in the trusted execution environment, the key pair including the first public key and the first private key, in the trusted execution environment
  • the certificate request file is generated according to the application information and the first public key, and the first private key is stored in the trusted execution environment, and the private key is stored in the trusted execution environment to ensure the security of the private key and avoid the risk of leakage.
  • the identity verification result includes the digital signature of the application information by the authentication server
  • the specific manner of generating the key pair in the trusted execution environment may be: generating The key pair first acquisition request, the key pair first acquisition request carries a digital signature, the response key checks the digital signature for the first acquisition request, and generates a key pair second acquisition request when the verification pass passes, and responds The key pair generates a key pair in a trusted execution environment.
  • the method for sending a service certificate request to the authentication server may be: generating application information for applying for a service certificate, where the application information includes an application identifier of the first application, and sending a service certificate application request to the authentication server according to the application information,
  • the business certificate application request carries the application information.
  • an index of the first private key and a first target application identifier set of the application that allows the first private key to be used in the trusted execution environment, where the first target application identifier set includes at least one application identifier, where the at least one application identifier is obtained
  • An application identifier includes an application identifier of the first application, establishing a first association relationship between the index of the first private key and the first target application identifier set, and binding the private key to the application authorized to use the private key by establishing an association relationship It can effectively prevent the abuse of private keys and ensure the safe use of private keys.
  • the private key usage request of the second application may be generated, the private key usage request carries the index of the first private key, the application identifier of the second application is obtained in response to the private key usage request, and the second association relationship is obtained according to the first association relationship.
  • the first target application identifier set associated with the index of the first private key when the first target application identifier set includes the application identifier of the second application, allowing the second application to use the first private key in the trusted execution environment, so that only The application of the private key binding is allowed to use the private key, which ensures the security of the private key.
  • the account login page is output through the application interface of the first application, and the account login authentication request is sent to the account server in response to the user input, and the account login authentication request is carried in the account.
  • the user account information input on the account login page receives the account login authentication result of the account server and the user account information.
  • the step of sending a service certificate application request to the authentication server is performed.
  • the application information carried in the service certificate application request further includes an account login authentication identifier, and the account login authentication identifier is used by the authentication server to verify the account login authentication result.
  • the specific manner of generating the certificate request file in the trusted execution environment may be: when the identity verification result indicates that the first application has the service certificate application authority, and the account login authentication is successful, The certificate request file is generated in the trusted execution environment, and the login result of the user account on the account server is verified by the authentication server, so that the service certificate is issued only when the application has the certificate application authority and the user account is successfully logged in. Thereby ensuring the security of issuing business certificates.
  • the specific manner of obtaining the target service certificate corresponding to the first application according to the certificate request file may be: obtaining a certificate request file, sending a service certificate signing request to the authentication server, the service certificate signing request carrying the certificate request file, and receiving the authentication server After the verification of the service certificate issuance request, the sent request certificate is the target service certificate issued by the first application.
  • the specific manner of obtaining the target service certificate corresponding to the first application according to the certificate request file may be: acquiring the second private key corresponding to the device certificate according to the certificate request file, and using the second private key in the trusted execution environment The first application issues a target business certificate.
  • an index of the target service certificate and a second target application identifier set of the application that allows the target service certificate to be used where the second target application identifier set includes at least one application identifier, where the at least one application identifier includes the application of the first application. Identifying, establishing a second association relationship between the index of the target service certificate and the second target application identifier set, and binding the service certificate to the application authorized to use the service certificate by establishing an association relationship, thereby effectively preventing the abuse of the service certificate and ensuring The use of business certificates is safe.
  • the service certificate use request of the third application may be generated, the service certificate use request carries an index of the target service certificate, the service certificate use request is used to obtain the application identifier of the third application, and the target service is obtained according to the second association relationship.
  • the second target application identifier set associated with the index of the certificate when the second target application identifier set includes the application identifier of the third application, allowing the third application to use the target service certificate, so that only the application bound to the service certificate is allowed to be used.
  • This business certificate guarantees the safe use of business certificates.
  • the second aspect of the embodiment of the present application provides another service certificate management method, which includes: receiving a service certificate application request sent by a terminal when the first application that is pre-configured to apply for a service certificate is started, and the service certificate application request is carried.
  • the application information includes an application identifier of the first application, performs identity verification on the first application according to the application information, obtains an authentication result, and sends an identity verification result to the terminal, where the identity verification result is used by the terminal to indicate that the first application has the service in the identity verification result.
  • the certificate request file is generated in the trusted execution environment, and the target service certificate corresponding to the first application is obtained according to the certificate request file.
  • the identity verification of the application can effectively control the issuance of the service certificate.
  • the terminal can obtain the corresponding service certificate, which can realize the online and timely response of the service certificate issuance request, and can meet the requirements of rapid response of the service.
  • the request file issues a target service certificate for the first application, and sends a target service certificate to the terminal.
  • the first application is authenticated according to the application information
  • the specific manner of obtaining the authentication result may be: obtaining an application identifier white list of the application having the service certificate application authority, and the application identifier white list includes at least one application identifier, where
  • the application identifier whitelist includes the application identifier of the first application, determining that the first application has the service certificate application authority, and generating an identity verification result
  • the identity verification result is used to indicate that the first application has the service certificate application permission, and thus only the application identifier is in the application.
  • the application in the whitelist will be allowed to apply for a business certificate, which ensures the security of the issued business certificate.
  • the application information further includes an account login authentication identifier
  • the first application is authenticated according to the application information
  • the specific manner of obtaining the identity verification result may be: obtaining an application identifier white list of the application having the service certificate application authority, and applying the identifier
  • the whitelist includes at least one application identifier, and sends an account login authentication result verification request to the account server.
  • the account login authentication result verification request carries the account login authentication identifier, and the verification result of the account login authentication identifier sent by the account server is received.
  • the application identifier whitelist includes the application identifier of the first application, and the verification result indicates that the identity verification result is generated when the account login authentication identifier is verified, and the identity verification result is used to indicate that the first application has the service certificate application authority, and the account login After the authentication succeeds, the authentication server verifies the login result of the user account on the account server, ensuring that the service certificate is issued only when the application has the certificate application authority and the user account is successfully logged in, thereby ensuring the issuance of the service certificate. Sex.
  • the third aspect of the embodiments of the present application provides a service certificate management apparatus, including:
  • the startup module is used to start the first application.
  • a determining module configured to determine that the first application is pre-configured to apply for a service certificate.
  • a sending module configured to send a service certificate request to the authentication server, where the application information carried by the service certificate request includes an application identifier of the first application, and the application identifier of the first application is used by the authentication server The service certificate application authority of the first application is verified.
  • a receiving module configured to receive an identity verification result sent by the authentication server to the first application according to the application information.
  • a processing module configured to generate a certificate request file in a trusted execution environment, and obtain a corresponding one of the first application according to the certificate request file, when the first verification application has the service certificate application permission The target service certificate, so that the authentication of the application by the authentication server can effectively control the issuance of the service certificate.
  • the authentication server passes the authentication of the application, the corresponding service certificate can be obtained, and the service certificate issuance request can be realized. Timely and timely response, to meet the needs of rapid business response.
  • the processing module generates the certificate request file in the trusted execution environment by generating a key pair in the trusted execution environment, where the key pair includes the first public key and the first private key. Generating a certificate request file according to the application information and the first public key in the trusted execution environment, and storing the first private key in the trusted execution environment.
  • the identity verification result when the identity verification result indicates that the first application has the service certificate application authority, the identity verification result includes a digital signature of the application information by the authentication server.
  • the specific manner of generating the key pair in the trusted execution environment by the processing module is: generating a key pair first obtaining request, where the key pair first obtaining request carries the digital signature, and the response The key pair performs a first acquisition request, and performs verification on the digital signature.
  • a key pair second acquisition request is generated, and the second pair of acquisition requests are responded to in the trusted execution environment.
  • the processing module is further configured to: obtain an index of the first private key, and a first target application identifier set of an application that allows the first private key to be used in the trusted execution environment, where
  • the first target application identifier set includes at least one application identifier
  • the at least one application identifier includes an application identifier of the first application
  • an index between the index of the first private key and the first target application identifier set is established.
  • the first association relationship by establishing an association relationship, binds the private key to an application authorized to use the private key, thereby effectively preventing the abuse of the private key and ensuring the security of the private key.
  • the processing module is further configured to: generate a private key usage request of the second application, where the private key usage request carries an index of the first private key, and obtain the An application identifier of the second application, and acquiring, according to the first association relationship, the first target application identifier set associated with the index of the first private key, where the first target application identifier set includes the second
  • the second application is allowed to use the first private key in the trusted execution environment, so that only the application bound to the private key is allowed to use the private key, and the private key is guaranteed. Safe to use.
  • the device further includes: an output module, where:
  • the output module is configured to output an account login page by using an application interface of the first application.
  • the sending module is further configured to send an account login authentication request to the account server in response to the user input, where the account login authentication request carries user account information input on the account login page.
  • the receiving module is further configured to receive an account login authentication result of the account server for the user account information.
  • the sending module is specifically configured to send a service certificate request request to the authentication server when the account login authentication result indicates that the account login authentication is successful.
  • the application information carried in the service certificate application request further includes an account login authentication identifier, where the account login authentication identifier is used by the authentication server pair.
  • the account login authentication result is verified.
  • the processing module generates, by the processing module, the certificate request file in the trusted execution environment when the identity verification result indicates that the first application has the service certificate application permission:
  • the first application has the service certificate application authority, and when the account login authentication is successful, the certificate request file is generated in the trusted execution environment, and the login result of the user account on the account server is verified by the authentication server, thereby ensuring that only the application has If the certificate is applied for permission and the user account is successfully logged in, the service certificate will be issued, thus ensuring the security of issuing the service certificate.
  • the specific manner of the processing module acquiring the target service certificate corresponding to the first application according to the certificate request file is: acquiring the certificate request file, and sending a service certificate to the authentication server by using the sending module. Issuing a request, the service certificate issuance request carrying the certificate request file, and receiving, by the receiving module, the requesting file sent by the authentication server according to the certificate request after the verification of the service certificate is issued The target service certificate issued by the first application.
  • the specific manner of the processing module acquiring the target service certificate corresponding to the first application according to the certificate request file is: acquiring a second private key corresponding to the device certificate according to the certificate request file, where The second private key is used in the letter execution environment to issue a target service certificate for the first application.
  • the processing module is further configured to: obtain an index of the target service certificate, and a second target application identifier set of an application that allows the target service certificate to be used, where the second target application identifier set includes at least one An application identifier, the at least one application identifier includes an application identifier of the first application, establishing a second association relationship between an index of the target service certificate and the second target application identifier set, and establishing a relationship by using an association relationship
  • the certificate is bound to the application that authorizes the service certificate, which can effectively prevent the abuse of the service certificate and ensure the security of the service certificate.
  • the processing module is further configured to: generate a service certificate use request of the third application, where the service certificate use request carries an index of the target service certificate, and obtain the number according to the service certificate use request An application identifier of the third application, and acquiring, according to the second association relationship, the second target application identifier set associated with the index of the target service certificate, where the second target application identifier set includes the third application
  • the third application is allowed to use the target service certificate, so that only the application bound to the service certificate is allowed to use the service certificate, thereby ensuring the security of the service certificate.
  • a fourth aspect of the embodiments of the present application provides another service certificate management apparatus, including:
  • the receiving module is configured to receive a service certificate application request sent by the terminal when the first application is configured to apply for a service certificate, and the application information carried by the service certificate application request includes an application identifier of the first application.
  • a verification module configured to perform identity verification on the first application according to the application information, to obtain an identity verification result.
  • a sending module configured to send the identity verification result to the terminal.
  • the authentication result is used by the terminal to generate a certificate request file in a trusted execution environment when the identity verification result indicates that the first application has the service certificate application permission, and obtain the file according to the certificate request file.
  • the target service certificate corresponding to the first application can implement effective management and control of the issuance of the service certificate by performing identity verification on the application. After the identity verification is passed, the terminal can obtain the corresponding service certificate, and can implement the service certificate issuance request. Timely and timely response, to meet the needs of rapid business response.
  • the device further includes: an issuance module, where:
  • the receiving module is further configured to receive a service certificate issuance request sent by the terminal after the certificate request file is generated in the trusted execution environment, where the service certificate issuance request carries the certificate request file.
  • the issuance module is configured to issue a target service certificate for the first application according to the certificate request file after the verification of the service certificate issuance request.
  • the sending module is further configured to send the target service certificate to the terminal.
  • the verification module is specifically configured to: obtain an application identifier whitelist of an application that has the service certificate application authority, where the application identifier whitelist includes at least one application identifier, where the application identifier whitelist includes the first
  • the first application is configured to have the service certificate application authority, and the identity verification result is generated, where the identity verification result is used to indicate that the first application has the service certificate application permission, so that only the application identifier is in the application.
  • the application in the whitelist will be allowed to apply for a business certificate, which ensures the security of the issued business certificate.
  • the application information further includes an account login authentication identifier
  • the verification module is specifically configured to: obtain an application identifier white list of an application that has the service certificate application right, and the application identifier white list includes at least one application identifier.
  • the application identification whitelist includes an application identifier of the first application, and the verification result indicates that an identity verification result is generated when the account login authentication identifier is verified, and the identity verification result is used to indicate the The first application has the service certificate application authority, and the account login authentication is successful.
  • a fifth aspect of the embodiments of the present application provides a terminal, including: a processor, a transceiver, and a memory, where the processor, the transceiver, and the memory are connected by a bus, and the memory stores executable program code,
  • the transceiver is controlled by the processor for transmitting and receiving messages, and the processor is configured to invoke the executable program code to execute the service certificate management method described in the first aspect.
  • a sixth aspect of the embodiments of the present application provides a server, including: a processor, a network interface, and a memory, where the processor, the network interface, and the memory are connected by a bus, where the memory stores executable program code,
  • the network interface is controlled by the processor for sending and receiving messages, and the processor is configured to invoke the executable program code to execute the service certificate management method described in the second aspect.
  • a seventh aspect of the embodiments of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores instructions, when executed on a computer, causing the computer to perform the service certificate management described in the first aspect above. method.
  • An eighth aspect of the embodiments of the present application provides another computer readable storage medium, wherein the computer readable storage medium stores instructions, when executed on a computer, causing the computer to execute the service certificate described in the second aspect above Management method.
  • a ninth aspect of the embodiments of the present application provides a computer program product comprising instructions for causing a computer to execute the service certificate management method of the first aspect described above when it is run on a computer.
  • a tenth aspect of the embodiments of the present application provides a computer program product comprising instructions, when executed on a computer, causing a computer to execute the service certificate management method described in the second aspect above.
  • the service certificate request is sent to the authentication server, and the application information carried by the service certificate application request includes the first An application identifier of an application, receiving an authentication result of the first application sent by the authentication server according to the application information, and generating, in the trusted execution environment, when the identity verification result indicates that the first application has the service certificate application permission
  • the certificate request file obtains the target service certificate corresponding to the first application according to the certificate request file, so that the authentication of the application by the authentication server can effectively control the issuance of the service certificate, and the authentication of the application by the authentication server is passed. After that, the corresponding service certificate can be obtained, and the online and timely response of the service certificate issuance request can be realized, which can meet the requirement of rapid response of the business.
  • FIG. 1 is a schematic structural diagram of a service certificate management system disclosed in an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a terminal disclosed in an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of a server disclosed in an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a service certificate management method disclosed in an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another service certificate management method disclosed in an embodiment of the present application.
  • FIG. 6a is a schematic diagram of an account login page disclosed in an embodiment of the present application.
  • FIG. 6b is a schematic diagram of an account login failure interface disclosed in the embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a service certificate management apparatus according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of another service certificate management apparatus disclosed in an embodiment of the present application.
  • FIG. 1 is a schematic structural diagram of a service certificate management system according to an embodiment of the present application.
  • the service certificate management system described in this embodiment includes: a terminal, an account server, and an authentication server, where:
  • the terminal may include at least an application layer, a Read-Only Memory (ROM)/Operating System (OS) layer, and a chip layer.
  • the application layer can run various types of applications, for example, a social application, a payment application, a game application, a video application, an office application, a map application, etc., and an application 1 and an application 2 are exemplified in FIG.
  • the ROM/OS layer can run the certificate client.
  • the chip layer provides a Trusted Execution Environment (TEE).
  • TEE is separated from the OS of the terminal. It has its own processing system, including hardware and software resources such as processor core, secure memory, and trusted operating system.
  • a Trust Application is an instance of running in a TEE.
  • the certificate client has the access authority of the TEE, and can communicate with the certificate TA running in the TEE to request the TEE to generate the key pair and the certificate request file through the certificate TA, and can also request the authentication server to authenticate the application and issue the certificate. .
  • the certificate trusted application can request the TEE to generate a key pair and a certificate request file, and write the service certificate to the TEE.
  • the TEE can generate a key pair and a certificate request file, store the service certificate and the corresponding private key, and prohibit the export of the stored private key.
  • the authentication server specifically a Certificate Authority (CA)
  • CA Certificate Authority
  • FIG. 2 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • the terminal can be a terminal device such as a mobile phone, a tablet computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), and the like.
  • UMPC ultra-mobile personal computer
  • PDA personal digital assistant
  • FIG. 2 is a block diagram showing a part of the structure of the mobile phone 2000 related to the embodiments of the present application.
  • the mobile phone 2000 includes: a transceiver 2001, a memory 2002, an input unit 2003, a display unit 2004, a gravity sensor 2005, an audio circuit 2006, a processor 2007, a power supply 2008, and a Subscriber Identity Module (SIM). Kaka slot 2009 and other components.
  • SIM Subscriber Identity Module
  • the transceiver 2001 can be used for receiving and transmitting signals during the transmission and reception of information or during a call.
  • the processor 2007 processes the data; and, in addition, sends the uplink data to the base station.
  • the function of the transceiver 2001 can be implemented by using a transceiver chip or a dedicated chip for transmitting and receiving, and specifically includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), and a dual Tools, etc.
  • the transceiver 2001 can also communicate with the network and other devices via wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (Code). Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), E-mail, Short Messaging Service (SMS), etc.
  • GSM Global System of Mobile communication
  • GPRS General Packet Radio Service
  • Code Division Multiple Access Code Division Multiple Access
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • LTE Long Term Evolution
  • E-mail Short Messaging Service
  • the memory 2002 can be used to store software programs and modules, and the processor 2007 executes various functional applications and data processing of the mobile phone 2000 by running software programs and modules stored in the memory 2002.
  • the memory 2002 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may be stored according to Data created by the use of the mobile phone 2000 (such as audio data, image data, phone book, etc.).
  • memory 2002 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
  • the input unit 2003 can be configured to receive input numeric or character information and to generate key signal inputs related to user settings and function controls of the handset 2000.
  • the input unit 2003 may include a touch panel 20031 and other input devices 20032.
  • the touch panel 20031 also referred to as a touch screen, can collect touch operations on or near the user (such as the operation of the user using a finger, a stylus, or the like on the touch panel 20031 or near the touch panel 20031. ), and drive the corresponding connection device according to a preset program.
  • the touch panel 20031 may include two parts of a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 2007 is provided and can receive commands from the processor 2007 and execute them.
  • the touch panel 20031 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 2003 may also include other input devices 20032.
  • other input devices 20032 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, power switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 2004 can be used to display information input by the user or information provided to the user and various menus of the mobile phone 2000.
  • the display unit 2004 may include a display panel 20041.
  • the display panel 20041 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.
  • the touch panel 20031 may cover the display panel 20041, and when the touch panel 20031 detects a touch operation thereon or nearby, it is transmitted to the processor 2007 to determine the type of the touch event, and then the processor 2007 is based on the type of the touch event.
  • a corresponding visual output is provided on display panel 20041.
  • the touch panel 20031 and the display panel 20041 are two separate components to implement the input and input functions of the mobile phone 2000, in some embodiments, the touch panel 20031 and the display panel 20041 may be integrated to implement The input and output functions of the mobile phone 2000.
  • Gravity Sensor 2005 can detect the acceleration of the mobile phone in all directions (usually three axes). When it is still, it can detect the magnitude and direction of gravity. It can be used to identify the application of the mobile phone (such as horizontal and vertical screen switching). , related games, magnetometer attitude calibration), vibration recognition related functions (such as pedometer, tapping).
  • the handset 2000 can also include other sensors, such as light sensors.
  • the light sensor can include an ambient light sensor and a proximity light sensor.
  • the ambient light sensor can adjust the brightness of the display panel 20041 according to the brightness of the ambient light; the proximity light sensor can detect whether an object approaches or contacts the mobile phone, and can close the display panel 20041 and/or the backlight when the mobile phone 2000 moves to the ear.
  • the mobile phone 2000 can also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, and will not be described herein.
  • the audio circuit 2006, the speaker 20061, and the microphone 20062 can provide an audio interface between the user and the handset 2000.
  • the audio circuit 2006 can transmit the converted audio data of the received audio data to the speaker 20061, and convert it into a sound signal output by the speaker 20061; on the other hand, the microphone 20062 converts the collected sound signal into an electrical signal, by the audio circuit 2006. After receiving, it is converted into audio data, and then the audio data is output to the RF circuit 2001 for transmission to, for example, another mobile phone, or the audio data is output to the memory 2002 for further processing.
  • the processor 2007 is the control center of the mobile phone 2000, which connects various parts of the entire mobile phone using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 2001, and calling data stored in the memory 2002, Perform various functions and processing data of the mobile phone 2000 to perform overall monitoring of the mobile phone.
  • the processor 2007 may include one or more processing units; preferably, the processor 2007 may integrate an application processor and a modem processor, where the application processor mainly processes an operating system, a user interface, an application, and the like.
  • the modem processor primarily handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 2007.
  • the processor 2007 integrates a security chip, and the TEE runs specifically in the security chip.
  • the mobile phone 2000 also includes a power source 2008 (such as a battery) that supplies power to various components.
  • a power source 2008 such as a battery
  • the power source can be logically coupled to the processor 2007 through a power management system to manage functions such as charging, discharging, and power management through the power management system.
  • the mobile phone 2000 can also include a SIM card slot for placing a SIM card, and the user can make or receive a call through the mobile phone.
  • the mobile phone 2000 may further include a Wireless Fidelity (Wi-Fi) module, a Bluetooth module, and the like, and details are not described herein.
  • Wi-Fi Wireless Fidelity
  • Bluetooth Wireless Fidelity
  • the transceiver 2001, the memory 2002, the input unit 2003, the display unit 2004, and the processor 2007 described in the embodiments of the present application may be described in the process of the service certificate management method shown in FIG. 4 and FIG.
  • the implementation manner of the terminal can also be implemented as described in the service certificate management apparatus shown in FIG. 7. For details, refer to the following description.
  • FIG. 3 is a schematic structural diagram of a server according to an embodiment of the present application.
  • the server described in this embodiment corresponds to the authentication server described above, and the server includes: a processor 301, a network interface 302, and a memory 303.
  • the processor 301, the network interface 302, and the memory 303 can be connected by using a bus or other manners.
  • the processor 301 (or Central Processing Unit (CPU)) is a computing core and a control core of the server.
  • the network interface 302 can optionally include a standard wired interface, a wireless interface (such as WI-FI, a mobile communication interface, etc.), and is controlled by the processor 301 for transmitting and receiving data.
  • the memory 303 (Memory) is a memory device of the server for storing programs and data. It can be understood that the memory 303 herein may be a high-speed RAM memory, or may be a non-volatile memory, such as at least one disk memory; optionally, at least one of the processors 301 may be located away from the foregoing processor 301. Storage device.
  • the memory 303 provides a storage space, which stores the operating system and executable program code of the server, and may include, but is not limited to, a Windows system (an operating system), a Linux (an operating system) system, and the like. This is not a limitation.
  • the processor 301, the network interface 302, and the memory 303 described in the embodiments of the present application may implement an implementation manner of the authentication server described in the process of the service certificate management method shown in FIG. 4 and FIG.
  • the implementation described in the service certificate management apparatus shown in FIG. 8 can be executed. For details, refer to the following description.
  • FIG. 4 is a schematic flowchart of a service certificate management method according to an embodiment of the present application.
  • the service certificate management method described in this embodiment includes:
  • the terminal starts the first application.
  • various types of applications can be installed on the terminal, for example, social applications, payment applications, game applications, video applications, office applications, map applications, and the like.
  • the user may input a startup instruction for an application on the terminal by using a click, a touch, a gesture operation, a voice control, or the like, and the terminal starts the first application when receiving the startup instruction for the first application.
  • the terminal determines that the first application is pre-configured to apply for a service certificate.
  • the R&D personnel can configure the service certificate to be applied to the application installed on the terminal according to the service requirement.
  • an application with a higher security level such as a payment application or an application including a payment function
  • An application configured to apply for a business certificate triggers the process of starting to apply for a business certificate at startup.
  • an application list may be configured, where the application list may be an application identifier of an application configured to apply for a service certificate, and the developer may configure the application by adding an application identifier of the application to the application list. Apply for a business certificate and store the application list in the terminal. After the first application is started, the terminal determines whether the application identifier of the first application exists in the application list, and the application identifier is included in the application list, and the terminal determines that the first application is pre-configured as Apply for a business certificate.
  • the developer can update the application list stored by the terminal according to actual needs, for example, adding a new application identifier to the application list, deleting an existing application identifier in the application list, and the like.
  • the terminal sends a service certificate application request to the authentication server.
  • the authentication server receives the service certificate request request.
  • the application information carried in the service certificate application request includes the application identifier of the first application, and the application identifier of the first application is used by the authentication server to verify the service certificate application authority of the first application.
  • the terminal determines a process of triggering the application for the service certificate, and sends a service certificate application request to the authentication server, where the application information carried by the service certificate application request includes the The application identifier of an application.
  • the authentication server performs identity verification on the first application according to the application information, to obtain an identity verification result.
  • the authentication server sends the identity verification result to the terminal.
  • the terminal receives the identity verification result.
  • the authentication server after receiving the service certificate request, performs identity verification on the first application, and the identity verification includes determining whether the service certificate application authority is available.
  • the authentication server may obtain the application identifier of the first application included in the application information, and obtain an application identifier whitelist of the application having the service certificate application right, where the application identifier whitelist includes at least one application identifier, if the application identifier whitelist includes The application identifier of the first application may determine that the first application has the service certificate application authority, generate an identity verification result, and send the identity verification result to the terminal, where the identity verification result is used to indicate that the first application has the service certificate application. Permissions.
  • the application identifier whitelist may be updated according to actual requirements, including adding and/or deleting an application identifier.
  • the terminal generates a certificate request file in a trusted execution environment when the identity verification result indicates that the first application has a service certificate application right.
  • the key pair may be generated in the trusted execution environment, where the key pair includes the first public And the first private key, and then generating a certificate request file according to the application information and the first public key in the trusted execution environment, and storing the first private key in the trusted execution environment.
  • the certificate request file includes the first public key, an application identifier of the first application (ie, the subject of the application certificate), and a certificate usage, and the certificate usage may include issuing a certificate, an identity certificate, a data signature, and the like.
  • the application information carried by the service certificate application request may further include a certificate validity period, where the certificate validity period is used to indicate that a service certificate having a corresponding time limit is issued, and the certificate request file further includes the certificate validity period.
  • the terminal acquires a target service certificate corresponding to the first application according to the certificate request file.
  • the terminal may send a service certificate issuance request to the authentication server, where the service certificate issuance request carries the certificate request file, and when the authentication server receives the service certificate issuance request, the service certificate is verified and verified.
  • the content may include whether the first application has the service certificate application authority, whether the certificate is used for the purpose, and the like. If the first application has the service certificate application authority and the certificate is used legally, the verification of the service certificate issuance request is determined.
  • a service certificate is issued for the first application, and a target service certificate is issued for the first application according to the certificate request file, and the target service certificate is sent to the terminal, and the terminal receives the target service certificate, so that the authentication server completes the issuance of the service certificate.
  • the service certificate may also be sent locally at the terminal, and the method may include: the terminal may obtain the second private key corresponding to the device certificate according to the certificate request file, and use the second private key in the trusted execution environment.
  • a target service certificate is issued for the first application.
  • the device certificate can be issued by the vendor server, and the device certificate and the corresponding second private key are sent to the vendor by the vendor server, and then the device certificate and the second private key are sent to the device vendor by the manufacturer, and then the device The manufacturer allocates the device certificate and the second private key to the terminal at the time of production.
  • the terminal determines whether the first application is configured to apply for a service certificate when the first application is started, and if yes, sends a service certificate application request to the authentication server, where the application information carried by the service certificate application request includes the The application identifier of the first application.
  • the authentication server may use the application identifier whitelist to determine whether the first application has the service certificate application authority. If the application identifier whitelist includes the application identifier of the first application, the first application may be determined to have the service certificate application authority. And indicating that the first application has the identity verification result of the service certificate application authority, and sending the identity verification result to the terminal.
  • the terminal may first generate a key pair in the trusted execution environment when the identity verification result indicates that the first application has the service certificate application right, the key pair includes the first public key and the first private key, and then the Generating a certificate request file according to the application information and the first public key, and storing the first private key in the trusted execution environment, and acquiring the target service corresponding to the first application according to the certificate request file.
  • the certificate can be effectively controlled by the authentication server for the issuance of the business certificate.
  • the manual is not required to participate in the certificate issuance process, and the online certificate is automatically issued, which can meet the needs of rapid response of the business and store the private key in the trusted execution.
  • the private key can be secured in the environment to avoid the risk of disclosure.
  • FIG. 5 is a schematic flowchart diagram of another service certificate management method according to an embodiment of the present application.
  • the service certificate management method described in this embodiment includes:
  • the terminal starts the first application.
  • the terminal determines that the first application is pre-configured to apply for a service certificate.
  • the terminal outputs an account login page by using an application interface of the first application.
  • the first application and the account client of the terminal may be two mutually independent applications. If the first application is pre-configured to apply for a service certificate, the terminal determines a process of triggering the application for the service certificate, and may first log in to the user.
  • the first application can request the account data of the account login page from the account client, and the account client returns the page data to the first application, and the first application generates an account login page according to the page data, and outputs the account login page.
  • the account login page can be as shown in FIG. 6a.
  • the user can input user account information such as a user name (xxx) and a password (******) on the account login page, and the user can click the login to submit the user account information.
  • the page data of the account login page may be configured in the application data of the first application in advance, and if the first application is pre-configured to apply for a service certificate, the first application may directly be applied from the application of the first application.
  • the data of the account login page is obtained in the data, and an account login page is generated according to the page data.
  • the account client of the terminal sends an account login authentication request to the account server in response to the user input.
  • the account server receives the account login authentication request.
  • the first application after acquiring the user account information submitted by the user, the first application submits the user account information to the account client, and the account client receives the user account information submitted by the first application, and sends an account login authentication request to the account server.
  • the account login authentication request carries the user account information.
  • the first application may also have the function of the account client, and at this time, the account client may be omitted. After obtaining the user account information submitted by the user, the first application directly sends an account login authentication request to the account server, where the account login authentication request carries the user account information.
  • the account server performs login authentication on the user account information, and generates an account login authentication result.
  • the account server sends the account login authentication result to the terminal.
  • the terminal receives the account login authentication result.
  • the account server performs login authentication on the user name and password included in the user account information, checks whether the user name exists, and whether the user name matches the password, and generates an account login authentication result according to the verification result. If the verification succeeds, the account login authentication result includes an account login authentication identifier (for example, a token), and the account login authentication result is sent to the terminal, and the account client of the terminal receives the account login authentication result.
  • an account login authentication identifier for example, a token
  • the certificate client of the terminal sends a service certificate application request to the authentication server.
  • the authentication server receives the service certificate request request.
  • the account client sends the account login authentication result to the first application. If the account login authentication result indicates that the account login authentication fails, the first application may output a prompt message, as shown in FIG. 6b, the account login authentication. If the user fails, you can output the message “Login failed, please log in again!” on the account login page.
  • the first application If the account login authentication result indicates that the account login authentication is successful, the first application generates the application information for applying for the service certificate, and submits the application message to the certificate client, where the application information includes the application identifier and the account of the first application.
  • the authentication certificate is sent, and the certificate client sends a service certificate application request to the authentication server, where the service certificate application request carries the application information.
  • the authentication server performs identity verification on the first application according to the application information, to obtain an identity verification result.
  • the authentication of the first application by the authentication server includes verifying whether the first application has the service certificate application right, and verifying the account login authentication result.
  • the authentication server may obtain the application identifier of the first application included in the application information, and obtain an application identifier whitelist of the application having the service certificate application authority, where the application identifier whitelist includes at least one application identifier, if the application The identifier whitelist includes the application identifier of the first application, and the first application may be determined to have the service certificate application authority.
  • the authentication server may obtain the account login authentication identifier included in the application information, and send an account login authentication result verification request to the account server, where the account login authentication result verification request carries the account login authentication identifier, and the account server logs in the authentication according to the account.
  • the verification verifies that the account login authentication of the first application is successful, and sends a verification result of the account login authentication identifier to the authentication server, and the authentication server determines, according to whether the first application has the service certificate application authority, and the pair The verification result of the account login authentication identifier generates an identity verification result. If the identity verification result indicates that the first application has the service certificate application authority, and the account login authentication is successful, the authentication server digitally signs the application information, and the The digital signature is included in the authentication result.
  • the authentication server sends the identity verification result to the terminal.
  • the terminal receives the identity verification result.
  • the authentication server sends the identity verification result to the terminal, and the certificate client of the terminal receives the identity verification result.
  • the terminal generates a certificate request file in a trusted execution environment when the identity verification result indicates that the first application has a service certificate application right, and the account login authentication is successful.
  • the certificate client when the identity verification result indicates that the first application has the service certificate application authority, and the account login authentication is successful, the certificate client generates a key pair first acquisition request, and the key carries the first acquisition request.
  • the digital signature sends the key pair first acquisition request to the certificate trusted application of the terminal, and the certificate trusted application responds to the key to check the digital signature for the first acquisition request. If the verification pass is passed, the key pair second acquisition request is generated, and the key pair second acquisition request is sent to the trusted execution environment of the terminal, and the trusted execution environment responds to the key pair second acquisition request to generate a key.
  • the key pair includes a first public key and a first private key, and generating a certificate request file according to the application information and the first public key, and storing the first private key in the trusted execution environment; If the verification fails, the message rejecting the service certificate request is returned to the certificate client.
  • the certificate client of the terminal acquires the certificate request file.
  • the certificate request file is sent to the certificate trusted application, and the certificate trusted application sends the certificate request file to the certificate client, so that the certificate client obtains the trusted Execute the certificate request file generated by the environment.
  • the certificate client of the terminal sends a service certificate signing request to the authentication server, where the service certificate signing request carries the certificate request file.
  • the authentication server receives the service certificate issuance request.
  • the certificate client may send a service certificate issuance request to the authentication server, where the service certificate issuance request carries the certificate request file.
  • the certificate request file may include the first public key, an application identifier of the first application (ie, the subject of the application certificate), and a certificate usage.
  • the authentication server After verifying that the service certificate is issued, the authentication server issues a target service certificate for the first application according to the certificate request file.
  • the authentication server when the authentication server receives the service certificate issuance request, the authentication server checks the service certificate issuance request, and the verification content may include whether the first application has the service certificate application authority, whether the certificate is legal, and the like. If the first application has the service certificate application authority and the certificate is valid, the first application is issued with a service certificate, and the first application is issued according to the certificate request file. Business certificate.
  • the authentication server sends the target service certificate to the terminal.
  • the terminal receives the target service certificate.
  • the authentication server sends the issued target service certificate to the terminal, and the certificate client of the terminal receives the target service certificate.
  • the certificate client after receiving the target service certificate, the certificate client sends the target service certificate to the certificate trusted application, and the certificate trusted application can write the target service certificate into the trusted execution environment.
  • the terminal can bind the private key to the application, and the application is authenticated when the application uses the private key. After the authentication is passed, the private key is allowed to be used.
  • the specific implementation manner may be: determining the permission An application set that uses a first private key in a trusted execution environment, where the application set at least includes the first application, the trusted execution environment obtains a first target application identifier set of the application included in the application set, and the first private key Indexing, and establishing a first association relationship between the index of the first private key and the first target application identity set.
  • the second application may generate a private key usage request, and send the private key usage request to the certificate client, and the certificate client may forward the private key usage request to the certificate trusted application to the certificate client.
  • the private key usage request carries an index of the first private key
  • the trusted execution environment obtains the application identifier of the second application in response to the private key usage request, and acquires the first identifier according to the first association relationship.
  • first target application identifier set associated with the index of the private key, and if the first target application identifier set includes the application identifier of the second application, allowing the second application to use the first private key in the trusted execution environment, Therefore, only the authorized application is allowed to use the private key in the trusted execution environment to ensure the security of the private key.
  • the terminal may bind the service certificate to the application, and only allow the authorized application to use the service certificate.
  • the specific implementation manner may be as follows: the target service certificate is written into the trusted execution environment as an example to determine the permission.
  • the application set may include at least the first application, obtain a second target application identifier set of the application included in the application set, and an index of the target service certificate, and establish an index of the target service certificate. A second association relationship with the second target application identity set.
  • the third application may generate a service certificate use request, and send the service certificate use request to the certificate client, and the certificate client may forward the service certificate use request to the certificate through the certificate trusted application.
  • the service certificate use request carries an index of the target service certificate
  • the trusted execution environment obtains the application identifier of the third application in response to the service certificate use request, and acquires the target service certificate according to the second association relationship.
  • the second target application identifier set associated with the index if the second target application identifier set includes the application identifier of the third application, allowing the third application to use the target service certificate, thereby allowing only the authorized application to use the service certificate to ensure the service Certificate security.
  • the first application when the first application that is determined to be activated is pre-configured to apply for a service certificate, the first application outputs an account login page, and the user account information input by the user on the account login page is sent to the account server through the account client.
  • the account server sends an account login authentication result to the terminal for performing login authentication on the user account information. If the account login authentication result indicates that the account login authentication is successful, the certificate client sends a service certificate application request to the authentication server, and the authentication server sends the authentication request to the terminal.
  • the authentication result of the first application when the authentication result indicates that the first application has the service certificate application authority, and the account login authentication is successful, the certificate client requests the trusted execution environment to generate a key pair through the certificate trusted application.
  • the key pair includes a first public key and a first private key
  • the trusted execution environment generates a certificate request file according to the application information and the first public key, and after the certificate client obtains the certificate request file, according to the certificate request Send a service certificate to the authentication server.
  • the authentication server issues a target service certificate for the first application according to the certificate request file, and sends the issued target service certificate to the terminal, so that the authentication server can issue the service certificate. Effective management and control, no manual participation in the certificate issuance process, automatic online signing of service certificates, which can meet the needs of rapid business response.
  • the private key can be stored in the trusted execution environment to ensure the security of the private key and avoid the risk of leakage.
  • FIG. 7 is a schematic structural diagram of a service certificate management apparatus according to an embodiment of the present disclosure.
  • the service certificate management apparatus is configured to execute a corresponding method of a terminal, where the service certificate management apparatus includes:
  • the startup module 701 is configured to start the first application.
  • the determining module 702 is configured to determine that the first application is pre-configured to apply for a service certificate.
  • the sending module 703 is configured to send a service certificate request to the authentication server, where the application information carried by the service certificate request includes an application identifier of the first application, and the application identifier of the first application is used by the authentication server. The service certificate application authority of the first application is verified.
  • the receiving module 704 is configured to receive an identity verification result that is sent by the authentication server to the first application according to the application information.
  • the processing module 705 is configured to: when the identity verification result indicates that the first application has the service certificate application authority, generate a certificate request file in the trusted execution environment, and obtain the first application corresponding according to the certificate request file Target business certificate.
  • the specific manner in which the processing module 705 generates a certificate request file in a trusted execution environment is:
  • a key pair is generated in a trusted execution environment, the key pair including a first public key and a first private key.
  • the identity verification result when the identity verification result indicates that the first application has a service certificate application right, the identity verification result includes a digital signature of the application information by the authentication server.
  • the specific manner in which the processing module 705 generates a key pair in a trusted execution environment is:
  • a key pair is generated in the trusted execution environment in response to the key pair second acquisition request.
  • processing module 705 is further configured to:
  • the first target application identifier set includes at least one application identifier
  • the at least one application identifier includes an application identifier of the first application.
  • processing module 705 is further configured to:
  • the private key usage request carrying an index of the first private key.
  • the first target application identifier set includes the application identifier of the second application, allowing the second application to use the first private key in the trusted execution environment.
  • the apparatus further includes: an output module 706, wherein:
  • the output module 706 is configured to output an account login page by using an application interface of the first application.
  • the sending module 703 is further configured to send an account login authentication request to the account server in response to the user input, where the account login authentication request carries the user account information input on the account login page.
  • the receiving module 704 is further configured to receive an account login authentication result of the account server for the user account information.
  • the sending module 703 is specifically configured to send a service certificate request request to the authentication server when the account login authentication result indicates that the account login authentication is successful.
  • the application information carried in the service certificate application request further includes an account login authentication identifier, and the account login authentication identifier is used in the The authentication server verifies the account login authentication result.
  • the processing module 705 generates a certificate request file in the trusted execution environment when the identity verification result indicates that the first application has the service certificate application permission:
  • the certificate request file is generated in the trusted execution environment.
  • the specific manner in which the processing module 705 obtains the target service certificate corresponding to the first application according to the certificate request file is:
  • the specific manner in which the processing module 705 obtains the target service certificate corresponding to the first application according to the certificate request file is:
  • processing module 705 is further configured to:
  • the second target application identifier set includes at least one application identifier
  • the at least one application identifier includes the first The application identifier of an application.
  • processing module 705 is further configured to:
  • the second target application identifier set includes the application identifier of the third application, allowing the third application to use the target service certificate.
  • the startup module 701 starts the first application, and the determining module 702 determines that the first application is pre-configured to apply for a service certificate, and the sending module 703 determines, when the determining module 702 determines that the first application is pre-configured to apply for a service certificate,
  • the authentication server sends a service certificate request request, and the application information carried in the service certificate application request includes the application identifier of the first application, the receiving module 704 receives the identity verification result of the first application sent by the authentication server according to the application information, and the processing module 705 performs the identity verification.
  • the certificate request file is generated in the trusted execution environment, and the target service certificate corresponding to the first application is obtained according to the certificate request file, and the service certificate can be effectively controlled and controlled. Meet the needs of fast business response.
  • FIG. 8 is a schematic structural diagram of another service certificate management apparatus according to an embodiment of the present disclosure.
  • the service certificate management apparatus is configured to execute a corresponding method of the foregoing authentication server, where the service certificate management apparatus includes:
  • the receiving module 801 is configured to receive a service certificate application request that is sent by the terminal when the first application is configured to apply for a service certificate, and the application information carried by the service certificate application request includes an application identifier of the first application.
  • the verification module 802 is configured to perform identity verification on the first application according to the application information to obtain an identity verification result.
  • the sending module 803 is configured to send the identity verification result to the terminal.
  • the authentication result is used by the terminal to generate a certificate request file in a trusted execution environment when the identity verification result indicates that the first application has the service certificate application permission, and obtain the file according to the certificate request file.
  • the target service certificate corresponding to the first application is used by the terminal to generate a certificate request file in a trusted execution environment when the identity verification result indicates that the first application has the service certificate application permission, and obtain the file according to the certificate request file.
  • the apparatus further includes: an issuance module 804, wherein:
  • the receiving module 801 is further configured to receive a service certificate issuance request sent by the terminal after the certificate request file is generated in the trusted execution environment, where the service certificate issuance request carries the certificate request file.
  • the issuance module 804 is configured to issue a target service certificate for the first application according to the certificate request file after the verification of the service certificate is issued.
  • the sending module 803 is further configured to send the target service certificate to the terminal.
  • the verification module 802 is specifically configured to:
  • an application identifier whitelist of an application having the service certificate application authority where the application identifier whitelist includes at least one application identifier.
  • the application identifier whitelist includes the application identifier of the first application, determining that the first application has a service certificate application right, and generating an identity verification result, where the identity verification result is used to indicate that the first application has Business certificate application authority.
  • the application information further includes an account login authentication identifier
  • the verification module 802 is specifically configured to:
  • an application identifier whitelist of an application having the service certificate application authority where the application identifier whitelist includes at least one application identifier.
  • the application identification whitelist includes an application identifier of the first application, and the verification result indicates that when the account login authentication identifier is verified, an identity verification result is generated, where the identity verification result is used to indicate The first application has the service certificate application authority, and the account login authentication is successful.
  • the receiving module 801 receives the service certificate application request sent by the terminal when the first application that is configured to apply for the service certificate is started, and the application information carried in the service certificate application request includes the application identifier of the first application, and the verification is performed.
  • the module 802 performs identity verification on the first application according to the application information, and obtains an identity verification result.
  • the sending module 803 sends an identity verification result to the terminal, where the identity verification result is used by the terminal, when the identity verification result indicates that the first application has the service certificate application permission.
  • the certificate request file is generated in the trusted execution environment, and the target service certificate corresponding to the first application is obtained according to the certificate request file, which can effectively control the issuance of the service certificate, and can meet the requirement of rapid response of the service.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server or data center by wire (eg coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg infrared, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a Solid State Disk (SSD)) or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种业务证书管理方法、终端及服务器，其中一种业务证书管理方法包括：在第一应用启动时，如果确定该第一应用被预先配置为申请业务证书，则向认证服务器发送业务证书申请请求，该业务证书申请请求携带的申请信息包括该第一应用的应用标识，接收该认证服务器根据该申请信息发送的对该第一应用的身份验证结果，在身份验证结果指示该第一应用具备业务证书申请权限时，可以在可信执行环境中生成证书请求文件，并根据该证书请求文件获取该第一应用对应的目标业务证书。通过实施本申请可以对业务证书的签发进行有效管控，并可以满足业务快速响应的需求。

Description

一种业务证书管理方法、终端及服务器 技术领域
本申请涉及计算机技术领域，尤其涉及一种业务证书管理方法、终端及服务器。
背景技术
目前，公钥基础设施(Public Key Infrastructure，PKI)体系可以由终端厂商自建，也可以由第三方提供。在终端厂商自建PKI体系的方案中，由根认证中心(Certificate Authority，CA)(即厂商CA)为二级CA颁发证书，再由二级CA为终端按照批次颁发设备证书，终端获取到设备证书后可以直接利用设备证书对应的私钥签发业务证书，业务证书的签发缺乏有效管控；在第三方提供PKI体系的方案中，证书请求方需要通过邮件的方式向第三方CA提交证书签发请求，第三方CA对证书签发请求进行人工审核，审核通过后签发业务证书，整个业务证书签发过程耗时较长，无法满足业务快速响应的需求。可见，目前在签发业务证书时存在缺乏有效管控，实时性较差的弊端。
发明内容
本申请实施例公开了一种业务证书管理方法、终端及服务器，可以对业务证书的签发进行有效管控，并可以满足业务快速响应的需求。
本申请实施例第一方面提供了一种业务证书管理方法，包括：启动第一应用时，如果确定第一应用被预先配置为申请业务证书，则向认证服务器发送业务证书申请请求，业务证书申请请求携带的申请信息包括第一应用的应用标识，第一应用的应用标识用于认证服务器对第一应用的业务证书申请权限进行校验；接收认证服务器根据申请信息发送的对第一应用的身份验证结果，在身份验证结果指示第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据证书请求文件获取第一应用对应的目标业务证书，从而通过认证服务器对应用进行身份验证可以实现对业务证书的签发进行有效管控，在认证服务器对应用的身份验证通过后，即可获取相应的业务证书，能够实现业务证书签发请求的在线及时响应，可以满足业务快速响应的需求。
可选的，在可信执行环境中生成证书请求文件的具体方式可以是：在可信执行环境中生成密钥对，密钥对包括第一公钥和第一私钥，在可信执行环境中根据申请信息和第一公钥生成证书请求文件，并将第一私钥存储在可信执行环境中，将私钥存储在可信执行环境中可以保证私钥安全，避免泄露风险。
可选的，在身份验证结果指示第一应用具备业务证书申请权限时，身份验证结果包括认证服务器对申请信息的数字签名，则在可信执行环境中生成密钥对的具体方式可以是：生成密钥对第一获取请求，密钥对第一获取请求携带有数字签名，响应密钥对第一获取请求对数字签名进行验签，在验签通过时生成密钥对第二获取请求，响应密钥对第二获取请求，在可信执行环境中生成密钥对。
可选的，向认证服务器发送业务证书申请请求的具体方式可以是：生成用于申请业务证书的申请信息，申请信息包括第一应用的应用标识，根据申请信息向认证服务器发送业 务证书申请请求，业务证书申请请求携带有申请信息。
可选的，还可以获取第一私钥的索引以及允许在可信执行环境中使用第一私钥的应用的第一目标应用标识集合，第一目标应用标识集合包括至少一个应用标识，该至少一个应用标识包括第一应用的应用标识，建立第一私钥的索引与第一目标应用标识集合之间的第一关联关系，通过建立关联关系将私钥与授权使用该私钥的应用绑定，能够有效防止私钥的滥用，保证了私钥的使用安全。
可选的，还可以生成第二应用的私钥使用请求，私钥使用请求携带有第一私钥的索引，响应私钥使用请求获取第二应用的应用标识，以及根据第一关联关系获取与第一私钥的索引关联的第一目标应用标识集合，在第一目标应用标识集合包括第二应用的应用标识时，允许第二应用在可信执行环境中使用第一私钥，从而只有与私钥绑定的应用才被允许使用该私钥，保证了私钥的使用安全。
可选的，还可以在向认证服务器发送业务证书申请请求之前，通过第一应用的应用界面输出账号登录页面，响应用户的输入，向账号服务器发送账号登录认证请求，账号登录认证请求携带有在账号登录页面输入的用户账号信息，接收账号服务器对用户账号信息的账号登录认证结果，在账号登录认证结果指示账号登录认证成功时，执行向认证服务器发送业务证书申请请求的步骤。
可选的，在账号登录认证结果指示账号登录认证成功时，业务证书申请请求携带的申请信息还包括账号登录认证标识，账号登录认证标识用于认证服务器对账号登录认证结果进行校验，在身份验证结果指示第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件的具体方式可以是：在身份验证结果指示第一应用具备业务证书申请权限，且账号登录认证成功时，在可信执行环境中生成证书请求文件，通过认证服务器对用户账号在账号服务器上的登录结果进行验证，保证了只有在应用具备证书申请权限且用户账号登录成功的情况下才会签发业务证书，从而保证了签发业务证书的安全性。
可选的，根据证书请求文件获取第一应用对应的目标业务证书的具体方式可以是：获取证书请求文件，向认证服务器发送业务证书签发请求，业务证书签发请求携带有证书请求文件，接收认证服务器在对业务证书签发请求校验通过后，发送的根据证书请求文件为第一应用签发的目标业务证书。
可选的，根据证书请求文件获取第一应用对应的目标业务证书的具体方式可以是：根据证书请求文件获取设备证书对应的第二私钥，在可信执行环境中利用该第二私钥为第一应用签发目标业务证书。
可选的，可以获取目标业务证书的索引以及允许使用目标业务证书的应用的第二目标应用标识集合，第二目标应用标识集合包括至少一个应用标识，该至少一个应用标识包括第一应用的应用标识，建立目标业务证书的索引与第二目标应用标识集合之间的第二关联关系，通过建立关联关系将业务证书与授权使用该业务证书的应用绑定，能够有效防止业务证书的滥用，保证了业务证书的使用安全。
可选的，可以生成第三应用的业务证书使用请求，业务证书使用请求携带有目标业务证书的索引，响应业务证书使用请求获取第三应用的应用标识，以及根据第二关联关系获取与目标业务证书的索引关联的第二目标应用标识集合，在第二目标应用标识集合包括第 三应用的应用标识时，允许第三应用使用目标业务证书，从而只有与业务证书绑定的应用才被允许使用该业务证书，保证了业务证书的使用安全。
本申请实施例第二方面提供了另一种业务证书管理方法，包括：可以接收终端在被预先配置为申请业务证书的第一应用启动时，发送的业务证书申请请求，业务证书申请请求携带的申请信息包括第一应用的应用标识，根据申请信息对第一应用进行身份验证，得到身份验证结果，并向终端发送身份验证结果，身份验证结果用于终端在身份验证结果指示第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据证书请求文件获取第一应用对应的目标业务证书，通过对应用进行身份验证可以实现对业务证书的签发进行有效管控，在身份验证通过后，终端即可获取相应的业务证书，能够实现业务证书签发请求的在线及时响应，可以满足业务快速响应的需求。
可选的，还可以接收终端在可信执行环境中生成证书请求文件之后，发送的业务证书签发请求，业务证书签发请求携带有证书请求文件，在对业务证书签发请求校验通过后，根据证书请求文件为第一应用签发目标业务证书，并向终端发送目标业务证书。
可选的，根据申请信息对第一应用进行身份验证，得到身份验证结果的具体方式可以是：获取具备业务证书申请权限的应用的应用标识白名单，应用标识白名单包括至少一个应用标识，在应用标识白名单包括第一应用的应用标识时，确定第一应用具备业务证书申请权限，并生成身份验证结果，身份验证结果用于指示第一应用具备业务证书申请权限，从而只有应用标识在应用标识白名单中的应用才会被允许申请业务证书，保证了签发业务证书的安全性。
可选的，申请信息还包括账号登录认证标识，根据申请信息对第一应用进行身份验证，得到身份验证结果的具体方式可以是：获取具备业务证书申请权限的应用的应用标识白名单，应用标识白名单包括至少一个应用标识，向账号服务器发送账号登录认证结果校验请求，账号登录认证结果校验请求携带有账号登录认证标识，接收账号服务器发送的对账号登录认证标识的校验结果，在应用标识白名单包括第一应用的应用标识，且校验结果指示对账号登录认证标识校验通过时，生成身份验证结果，身份验证结果用于指示第一应用具备业务证书申请权限，且账号登录认证成功，通过认证服务器对用户账号在账号服务器上的登录结果进行验证，保证了只有在应用具备证书申请权限且用户账号登录成功的情况下才会签发业务证书，从而保证了签发业务证书的安全性。
本申请实施例第三方面提供了一种业务证书管理装置，包括：
启动模块，用于启动第一应用。
确定模块，用于确定所述第一应用被预先配置为申请业务证书。
发送模块，用于向认证服务器发送业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识，所述第一应用的应用标识用于所述认证服务器对所述第一应用的业务证书申请权限进行校验。
接收模块，用于接收所述认证服务器根据所述申请信息发送的对所述第一应用的身份验证结果。
处理模块，用于在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目 标业务证书，从而通过认证服务器对应用进行身份验证可以实现对业务证书的签发进行有效管控，在认证服务器对应用的身份验证通过后，即可获取相应的业务证书，能够实现业务证书签发请求的在线及时响应，可以满足业务快速响应的需求。
可选的，所述处理模块在可信执行环境中生成证书请求文件的具体方式为：在可信执行环境中生成密钥对，所述密钥对包括第一公钥和第一私钥，在所述可信执行环境中根据所述申请信息和所述第一公钥生成证书请求文件，并将所述第一私钥存储在所述可信执行环境中。
可选的，在所述身份验证结果指示所述第一应用具备业务证书申请权限时，所述身份验证结果包括所述认证服务器对所述申请信息的数字签名。
可选的，所述处理模块在可信执行环境中生成密钥对的具体方式为：生成密钥对第一获取请求，所述密钥对第一获取请求携带有所述数字签名，响应所述密钥对第一获取请求，对所述数字签名进行验签，在验签通过时，生成密钥对第二获取请求，响应所述密钥对第二获取请求，在可信执行环境中生成密钥对。
可选的，所述处理模块，还用于：获取所述第一私钥的索引以及允许在所述可信执行环境中使用所述第一私钥的应用的第一目标应用标识集合，所述第一目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识，建立所述第一私钥的索引与所述第一目标应用标识集合之间的第一关联关系，通过建立关联关系将私钥与授权使用该私钥的应用绑定，能够有效防止私钥的滥用，保证了私钥的使用安全。
可选的，所述处理模块，还用于：生成第二应用的私钥使用请求，所述私钥使用请求携带有所述第一私钥的索引，响应所述私钥使用请求获取所述第二应用的应用标识，以及根据所述第一关联关系获取与所述第一私钥的索引关联的所述第一目标应用标识集合，在所述第一目标应用标识集合包括所述第二应用的应用标识时，允许所述第二应用在所述可信执行环境中使用所述第一私钥，从而只有与私钥绑定的应用才被允许使用该私钥，保证了私钥的使用安全。
可选的，所述装置还包括：输出模块，其中：
所述输出模块，用于通过所述第一应用的应用界面输出账号登录页面。
所述发送模块，还用于响应用户的输入，向账号服务器发送账号登录认证请求，所述账号登录认证请求携带有在所述账号登录页面输入的用户账号信息。
所述接收模块，还用于接收所述账号服务器对所述用户账号信息的账号登录认证结果。
所述发送模块，具体用于在所述账号登录认证结果指示账号登录认证成功时，向认证服务器发送业务证书申请请求。
可选的，在所述账号登录认证结果指示账号登录认证成功时，所述业务证书申请请求携带的所述申请信息还包括账号登录认证标识，所述账号登录认证标识用于所述认证服务器对所述账号登录认证结果进行校验。
可选的，所述处理模块在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件的具体方式为：在所述身份验证结果指示所述第一应用具备业务证书申请权限，且账号登录认证成功时，在可信执行环境中生成证书请求文件，通过认证服务器对用户账号在账号服务器上的登录结果进行验证，保证了只有在应 用具备证书申请权限且用户账号登录成功的情况下才会签发业务证书，从而保证了签发业务证书的安全性。
可选的，所述处理模块根据所述证书请求文件获取所述第一应用对应的目标业务证书的具体方式为：获取所述证书请求文件，通过所述发送模块向所述认证服务器发送业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件，通过所述接收模块接收所述认证服务器在对所述业务证书签发请求校验通过后，发送的根据所述证书请求文件为所述第一应用签发的目标业务证书。
可选的，所述处理模块根据所述证书请求文件获取所述第一应用对应的目标业务证书的具体方式为：根据所述证书请求文件获取设备证书对应的第二私钥，在所述可信执行环境中利用该第二私钥为所述第一应用签发目标业务证书。
可选的，所述处理模块，还用于：获取所述目标业务证书的索引以及允许使用所述目标业务证书的应用的第二目标应用标识集合，所述第二目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识，建立所述目标业务证书的索引与所述第二目标应用标识集合之间的第二关联关系，通过建立关联关系将业务证书与授权使用该业务证书的应用绑定，能够有效防止业务证书的滥用，保证了业务证书的使用安全。
可选的，所述处理模块，还用于：生成第三应用的业务证书使用请求，所述业务证书使用请求携带有所述目标业务证书的索引，响应所述业务证书使用请求获取所述第三应用的应用标识，以及根据所述第二关联关系获取与所述目标业务证书的索引关联的所述第二目标应用标识集合，在所述第二目标应用标识集合包括所述第三应用的应用标识时，允许所述第三应用使用所述目标业务证书，从而只有与业务证书绑定的应用才被允许使用该业务证书，保证了业务证书的使用安全。
本申请实施例第四方面提供了另一种业务证书管理装置，包括：
接收模块，用于接收终端在被预先配置为申请业务证书的第一应用启动时，发送的业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识。
验证模块，用于根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果。
发送模块，用于向所述终端发送所述身份验证结果。
其中，所述身份验证结果用于所述终端在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书，通过对应用进行身份验证可以实现对业务证书的签发进行有效管控，在身份验证通过后，终端即可获取相应的业务证书，能够实现业务证书签发请求的在线及时响应，可以满足业务快速响应的需求。
可选的，所述装置还包括：签发模块，其中：
所述接收模块，还用于接收所述终端在所述可信执行环境中生成所述证书请求文件之后，发送的业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件。
所述签发模块，用于在对所述业务证书签发请求校验通过后，根据所述证书请求文件为所述第一应用签发目标业务证书。
所述发送模块，还用于向所述终端发送所述目标业务证书。
可选的，所述验证模块，具体用于：获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识，在所述应用标识白名单包括所述第一应用的应用标识时，确定所述第一应用具备业务证书申请权限，并生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限，从而只有应用标识在应用标识白名单中的应用才会被允许申请业务证书，保证了签发业务证书的安全性。
可选的，所述申请信息还包括账号登录认证标识，所述验证模块，具体用于：获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识，向账号服务器发送账号登录认证结果校验请求，所述账号登录认证结果校验请求携带有所述账号登录认证标识，接收所述账号服务器发送的对所述账号登录认证标识的校验结果，在所述应用标识白名单包括所述第一应用的应用标识，且所述校验结果指示对所述账号登录认证标识校验通过时，生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限，且账号登录认证成功，通过对用户账号在账号服务器上的登录结果进行验证，保证了只有在应用具备证书申请权限且用户账号登录成功的情况下才会签发业务证书，从而保证了签发业务证书的安全性。
本申请实施例第五方面提供了一种终端，包括：处理器、收发器和存储器，所述处理器、所述收发器和所述存储器通过总线连接，所述存储器存储有可执行程序代码，所述收发器受所述处理器的控制用于收发消息，所述处理器用于调用所述可执行程序代码，执行上述第一方面所述的业务证书管理方法。
本申请实施例第六方面提供了一种服务器，包括：处理器、网络接口和存储器，所述处理器、所述网络接口和所述存储器通过总线连接，所述存储器存储有可执行程序代码，所述网络接口受所述处理器的控制用于收发消息，所述处理器用于调用所述可执行程序代码，执行上述第二方面所述的业务证书管理方法。
本申请实施例第七方面提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面所述的业务证书管理方法。
本申请实施例第八方面提供了另一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第二方面所述的业务证书管理方法。
本申请实施例第九方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的业务证书管理方法。
本申请实施例第十方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第二方面所述的业务证书管理方法。
通过实施本申请实施例可以在启动第一应用时，如果确定该第一应用被预先配置为申请业务证书，则向认证服务器发送业务证书申请请求，该业务证书申请请求携带的申请信息包括该第一应用的应用标识，接收该认证服务器根据该申请信息发送的对该第一应用的身份验证结果，在身份验证结果指示该第一应用具备业务证书申请权限时，可以在可信执行环境中生成证书请求文件，并根据该证书请求文件获取该第一应用对应的目标业务证书，从而通过认证服务器对应用进行身份验证可以实现对业务证书的签发进行有效管控，在认 证服务器对应用的身份验证通过后，即可获取相应的业务证书，能够实现业务证书签发请求的在线及时响应，可以满足业务快速响应的需求。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍。
图1是本申请实施例公开的一种业务证书管理系统的架构示意图；
图2是本申请实施例公开的一种终端的结构示意图；
图3是本申请实施例公开的一种服务器的结构示意图；
图4是本申请实施例公开的一种业务证书管理方法的流程示意图；
图5是本申请实施例公开的另一种业务证书管理方法的流程示意图；
图6a是本申请实施例公开的一种账号登录页面的示意图；
图6b是本申请实施例公开的一种账号登录失败界面的示意图；
图7是本申请实施例公开的一种业务证书管理装置的结构示意图；
图8是本申请实施例公开的另一种业务证书管理装置的结构示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。
请参阅图1，为本申请实施例提供的一种业务证书管理系统的架构示意图。本实施例中所描述的业务证书管理系统，包括：终端、账号服务器和认证服务器，其中：
终端至少可以包括应用程序层、只读存储器(Read-Only Memory，ROM)/操作系统(Operating System，OS)层、芯片层。应用程序层可以运行各种类型的应用，例如，社交应用、支付应用、游戏应用、视频应用、办公应用、地图应用等，图1中以运行有应用1、应用2为例。ROM/OS层可以运行证书客户端。芯片层提供可信执行环境(Trusted Execution Environment，TEE)，TEE与终端的OS隔开，拥有自己的一套处理系统，包括处理器核、安全存储器、可信操作系统等软硬件资源，TEE用于提供安全操作环境，证书可信应用(Trust Application，TA)是运行在TEE中的一个实例。
证书客户端，具备TEE的访问权限，可以与运行在TEE中的证书TA进行通信，以通过证书TA请求TEE产生密钥对以及证书请求文件，还可以请求认证服务器对应用进行身份验证以及签发证书。
证书可信应用，可以请求TEE生成密钥对以及证书请求文件，将业务证书写入TEE。
TEE，可以生成密钥对以及证书请求文件，存储业务证书以及对应的私钥，并禁止导出存储的私钥。
认证服务器，具体可以是认证中心(Certificate Authority，CA)，可以对应用进行身份验证，校验来自证书客户端的证书签发请求，并在校验通过后签发业务证书。
请参阅图2，为本申请实施例提供的一种终端的结构示意图。该终端可以为手机、平 板电脑、笔记本电脑、超级移动个人计算机(Ultra-mobile Personal Computer，UMPC)、上网本、个人数字助理(Personal Digital Assistant，PDA)等终端设备，本申请实施例以终端为手机为例进行说明，图2示出的是与本申请各实施例相关的手机2000的部分结构的框图。
如图2所示，手机2000包括：收发器2001、存储器2002、输入单元2003、显示单元2004、重力传感器2005、音频电路2006、处理器2007、电源2008以及客户识别模块(Subscriber Identity Module，SIM)卡卡槽2009等部件。本领域技术人员可以理解，图2中示出的手机结构并不构成对手机的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
下面结合图2对手机2000的各个构成部件进行具体的介绍：
收发器2001可用于收发信息或通话过程中，信号的接收和发送，特别地，将基站的下行信息接收后，给处理器2007处理；另外，将上行的数据发送给基站。通常，收发器2001的功能可以考虑通过收发电路或者收发的专用芯片实现，具体可以包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器(Low Noise Amplifier，LNA)、双工器等。此外，收发器2001还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于全球移动通讯系统(Global System of Mobile communication，GSM)、通用分组无线服务(General Packet Radio Service，GPRS)、码分多址(Code Division Multiple Access，CDMA)、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)、长期演进(Long Term Evolution，LTE)、电子邮件、短消息服务(Short Messaging Service，SMS)等。
存储器2002可用于存储软件程序以及模块，处理器2007通过运行存储在存储器2002的软件程序以及模块，从而执行手机2000的各种功能应用以及数据处理。存储器2002可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机2000的使用所创建的数据(比如音频数据、图像数据、电话本等)等。此外，存储器2002可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
输入单元2003可用于接收输入的数字或字符信息，以及产生与手机2000的用户设置以及功能控制有关的键信号输入。具体地，输入单元2003可包括触摸面板20031以及其他输入设备20032。触摸面板20031，也称为触控屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触摸面板20031上或在触摸面板20031附近的操作)，并根据预先设定的程式驱动相应的连接装置。可选的，触摸面板20031可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器2007，并能接收处理器2007发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触摸面板20031。除了触摸面板20031，输入单元2003还可以包括其他输入设备20032。具体地，其他输入设备20032可以包括但不限于物理键盘、功能键(比如音量控制按键、电源开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元2004可用于显示由用户输入的信息或提供给用户的信息以及手机2000的各种菜单。显示单元2004可包括显示面板20041，可选的，可以采用液晶显示器(Liquid Crystal Display，LCD)、有机发光二极管(Organic Light-Emitting Diode，OLED)等形式来配置显示面板20041。进一步的，触摸面板20031可覆盖显示面板20041，当触摸面板20031检测到在其上或附近的触摸操作后，传送给处理器2007以确定触摸事件的类型，随后处理器2007根据触摸事件的类型在显示面板20041上提供相应的视觉输出。虽然在图2中，触摸面板20031与显示面板20041是作为两个独立的部件来实现手机2000的输入和输入功能，但是在某些实施例中，可以将触摸面板20031与显示面板20041集成而实现手机2000的输入和输出功能。
重力传感器(Gravity Sensor)2005，可以检测手机在各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机的放置方式的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等。
手机2000还可以包括其它传感器，比如光传感器。具体地，光传感器可包括环境光传感器及接近光传感器。其中，环境光传感器可根据环境光线的明暗来调节显示面板20041的亮度；接近光传感器可以检测是否有物体靠近或接触手机，可在手机2000移动到耳边时，关闭显示面板20041和/或背光。手机2000还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路2006、扬声器20061、麦克风20062可提供用户与手机2000之间的音频接口。音频电路2006可将接收到的音频数据转换后的电信号，传输到扬声器20061，由扬声器20061转换为声音信号输出；另一方面，麦克风20062将收集的声音信号转换为电信号，由音频电路2006接收后转换为音频数据，再将音频数据输出至RF电路2001以发送给比如另一手机，或者将音频数据输出至存储器2002以便进一步处理。
处理器2007是手机2000的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器2001内的软件程序和/或模块，以及调用存储在存储器2002内的数据，执行手机2000的各种功能和处理数据，从而对手机进行整体监控。可选的，处理器2007可包括一个或多个处理单元；优选的，处理器2007可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器2007中。
其中，处理器2007中集成有安全芯片，TEE具体运行在安全芯片中。
手机2000还包括给各个部件供电的电源2008(比如电池)，优选的，电源可以通过电源管理系统与处理器2007逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
手机2000还可以包括用于放置SIM卡的SIM卡卡槽，用户即可以通过手机拨打或接听电话。
尽管未示出，手机2000还可以包括无线保真(Wireless Fidelity，Wi-Fi)模块、蓝牙模块等，在此不再赘述。
具体实现中，本申请实施例中所描述的收发器2001、存储器2002、输入单元2003、显示单元2004、处理器2007可执行如图4、图5所示的业务证书管理方法的流程中所描述的终 端的实现方式，也可执行如图7所示的业务证书管理装置中所描述的实现方式，具体请参考后面的描述。
请参阅图3，为本申请实施例提供的一种服务器的结构示意图。本实施例中所描述的服务器，对应于前文所述的认证服务器，该服务器包括：处理器301、网络接口302及存储器303。其中，处理器301、网络接口302及存储器303可通过总线或其他方式连接，本申请实施例以通过总线连接为例。
其中，处理器301(或称中央处理器(Central Processing Unit，CPU))是服务器的计算核心以及控制核心。网络接口302可选的可以包括标准的有线接口、无线接口(如WI-FI、移动通信接口等)，受处理器301的控制用于收发数据。存储器303(Memory)是服务器的记忆设备，用于存放程序和数据。可以理解的是，此处的存储器303可以是高速RAM存储器，也可以是非不稳定的存储器(non-volatile memory)，例如至少一个磁盘存储器；可选的还可以是至少一个位于远离前述处理器301的存储装置。存储器303提供存储空间，该存储空间存储了服务器的操作系统和可执行程序代码，可包括但不限于：Windows系统(一种操作系统)、Linux(一种操作系统)系统等等，本发明对此并不作限定。
具体实现中，本申请实施例中所描述的处理器301、网络接口302及存储器303可执行如图4、图5所示的业务证书管理方法的流程中所描述的认证服务器的实现方式，也可执行如图8所示的业务证书管理装置中所描述的实现方式，具体请参考后面的描述。
请参阅图4，为本申请实施例提供的一种业务证书管理方法的流程示意图。本实施例中所描述的业务证书管理方法，包括：
401、终端启动第一应用。
其中，终端上可以安装各种类型的应用，例如，社交应用、支付应用、游戏应用、视频应用、办公应用、地图应用等。
具体实现中，用户可以通过点击、触摸、手势操作、语音控制等方式输入针对终端上的应用的启动指令，终端在接收到针对第一应用的启动指令时，启动第一应用。
402、所述终端确定所述第一应用被预先配置为申请业务证书。
其中，研发人员可以根据业务需求对终端上安装的应用进行是否申请业务证书的配置，例如对于安全等级要求较高的应用(如支付应用或者包含支付功能的应用等)可以配置为申请业务证书，被配置为申请业务证书的应用在启动时会触发开始申请业务证书的流程。
具体实现中，可以配置一个应用列表，该应用列表包括的可以是配置为申请业务证书的应用的应用标识，研发人员可以通过将一个应用的应用标识添加到该应用列表中实现将该应用配置为申请业务证书，并将该应用列表存储在终端中。终端在启动第一应用后，判断该第一应用的应用标识是否存在于该应用列表中，设定该应用列表中包含该第一应用的应用标识，则终端确定该第一应用被预先配置为申请业务证书。
可以理解的是，研发人员可以根据实际需求对终端存储的该应用列表进行更新，例如，向该应用列表中增加新的应用标识，删除该应用列表中已有的应用标识等。
403、所述终端向认证服务器发送业务证书申请请求。
相应地，所述认证服务器接收所述业务证书申请请求。
其中，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识，所述第一应用的应用标识用于认证服务器对所述第一应用的业务证书申请权限进行校验。
具体实现中，如果该第一应用被预先配置为申请业务证书，则终端确定触发开始申请业务证书的流程，并向认证服务器发送业务证书申请请求，该业务证书申请请求携带的申请信息包括该第一应用的应用标识。
404、所述认证服务器根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果。
405、所述认证服务器向所述终端发送所述身份验证结果。
相应地，所述终端接收所述身份验证结果。
具体实现中，认证服务器接收到该业务证书申请请求之后，对该第一应用进行身份验证，身份验证包括确定是否具备业务证书申请权限。认证服务器可以获取申请信息中包括的该第一应用的应用标识，并获取具备业务证书申请权限的应用的应用标识白名单，该应用标识白名单包括至少一个应用标识，如果该应用标识白名单包括该第一应用的应用标识，则可以确定该第一应用具备业务证书申请权限，生成身份验证结果，并向终端发送该身份验证结果，该身份验证结果用于指示该第一应用具备业务证书申请权限。
在一种实施方式中，可以按照实际需求对该应用标识白名单进行更新，包括增加和/或删除应用标识等。
406、所述终端在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件。
具体实现中，终端接收到身份验证结果之后，如果该身份验证结果指示该第一应用具备业务证书申请权限，则可以先在可信执行环境中生成密钥对，该密钥对包括第一公钥和第一私钥，然后在该可信执行环境中根据该申请信息和该第一公钥生成证书请求文件，并将该第一私钥存储在该可信执行环境中。
其中，该证书请求文件包括该第一公钥、该第一应用(即申请证书的主体)的应用标识以及证书用途，证书用途可以包括签发证书、身份证明、数据签名等。
在一种实施方式中，该业务证书申请请求携带的申请信息还可以包括证书有效期，该证书有效期用于指示签发具有相应期限的业务证书，则该证书请求文件还包括该证书有效期。
407、所述终端根据所述证书请求文件获取所述第一应用对应的目标业务证书。
具体实现中，终端可以向认证服务器发送业务证书签发请求，业务证书签发请求携带有该证书请求文件，认证服务器在接收到该业务证书签发请求时，对该业务证书签发请求进行校验，校验内容可以包括该第一应用是否具备业务证书申请权限，证书用途是否合法等，如果该第一应用具备业务证书申请权限，且证书用途合法，则确定对该业务证书签发请求的校验通过，可以为该第一应用签发业务证书，并根据该证书请求文件为该第一应用签发目标业务证书，向终端发送该目标业务证书，终端接收该目标业务证书，从而实现认证服务器完成业务证书的签发。
在一种实施方式中，业务证书也可以在终端本地进行签发，具体包括：终端可以根据 该证书请求文件获取设备证书对应的第二私钥，在该可信执行环境中利用该第二私钥为该第一应用签发目标业务证书。
其中，设备证书可以由厂商服务器签发，并由厂商服务器将设备证书及其对应的第二私钥下发给厂商，再由厂商将设备证书以及该第二私钥下发给设备商，然后设备商在生产时将设备证书以及该第二私钥配置到终端中。
本申请实施例中，终端在启动第一应用时判断该第一应用是否被配置为申请业务证书，如果是，则向认证服务器发送业务证书申请请求，该业务证书申请请求携带的申请信息包括该第一应用的应用标识。认证服务器可以利用应用标识白名单确定该第一应用是否具备业务证书申请权限，如果该应用标识白名单包括该第一应用的应用标识，则可以确定该第一应用具备业务证书申请权限，生成用于指示该第一应用具备业务证书申请权限的身份验证结果，并向终端发送该身份验证结果。终端可以在该身份验证结果指示该第一应用具备业务证书申请权限时，先在可信执行环境中生成密钥对，该密钥对包括第一公钥和第一私钥，然后在该可信执行环境中根据该申请信息和该第一公钥生成证书请求文件，并将该第一私钥存储在该可信执行环境中，进而根据该证书请求文件获取该第一应用对应的目标业务证书，从而可以由认证服务器对业务证书的签发进行有效管控，证书签发过程中不需要人工参与，实现了业务证书的自动化在线签发，可以满足业务快速响应的需求，将私钥存储在可信执行环境中可以保证私钥安全，避免泄露风险。
请参阅图5，为本申请实施例提供的另一种业务证书管理方法的流程示意图。本实施例中所描述的业务证书管理方法，包括：
501、终端启动第一应用。
502、终端确定所述第一应用被预先配置为申请业务证书。
其中，步骤501、502的实现方式请参见上面实施例中步骤401、402的具体描述，此处不再赘述。
503、终端通过所述第一应用的应用界面输出账号登录页面。
具体实现中，终端的第一应用和账号客户端可以是两个相互独立的应用，如果该第一应用被预先配置为申请业务证书，则终端确定触发开始申请业务证书的流程，首先可以登录用户账号，第一应用可以向账号客户端请求账号登录页面的页面数据，账号客户端将该页面数据返回给第一应用，第一应用根据该页面数据生成账号登录页面，并输出该账号登录页面，该账号登录页面可以如图6a所示，用户可以在该账号登录页面输入用户名(xxx)、密码(******)等用户账号信息，用户点击登录即可提交用户账号信息。
在一种实施方式中，账号登录页面的页面数据可以事先配置在第一应用的应用数据中，则如果该第一应用被预先配置为申请业务证书，第一应用可以直接从第一应用的应用数据中获取账号登录页面的页面数据，并根据该页面数据生成账号登录页面。
504、所述终端的账号客户端响应用户的输入，向账号服务器发送账号登录认证请求。
相应地，所述账号服务器接收所述账号登录认证请求。
具体实现中，第一应用获取到用户提交的用户账号信息后，向账号客户端提交该用户账号信息，账号客户端接收第一应用提交的该用户账号信息，向账号服务器发送账号登录 认证请求，该账号登录认证请求携带有该用户账号信息。
在一种实施方式中，第一应用也可以同时具备账号客户端的功能，此时，账号客户端可以省掉。第一应用获取到用户提交的用户账号信息后，直接向账号服务器发送账号登录认证请求，该账号登录认证请求携带有该用户账号信息。
505、所述账号服务器对所述用户账号信息进行登录认证，生成账号登录认证结果。
506、所述账号服务器向所述终端发送所述账号登录认证结果。
相应地，所述终端接收所述账号登录认证结果。
具体实现中，账号服务器对该用户账号信息包括的用户名、密码等进行登录认证，校验是否存在该用户名，以及该用户名与该密码是否匹配，并根据校验结果生成账号登录认证结果，如果校验通过，则账号登录认证结果包括账号登录认证标识(例如令牌(token))，向终端发送该账号登录认证结果，终端的账号客户端接收到该账号登录认证结果。
507、在所述账号登录认证结果指示账号登录认证成功时，所述终端的证书客户端向认证服务器发送业务证书申请请求。
相应地，所述认证服务器接收所述业务证书申请请求。
具体实现中，该账号客户端将该账号登录认证结果发送给第一应用，如果该账号登录认证结果指示账号登录认证失败时，第一应用可以输出提示消息，如图6b所示，账号登录认证失败时，可以在账号登录界面输出“登录失败，请重新登录！”的提示消息。
如果该账号登录认证结果指示账号登录认证成功时，第一应用生成用于申请业务证书的申请信息，并将该申请消息提交给证书客户端，该申请信息包括该第一应用的应用标识和账号登录认证标识，该证书客户端向认证服务器发送业务证书申请请求，该业务证书申请请求携带有该申请信息。
508、所述认证服务器根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果。
其中，认证服务器对第一应用的身份验证包括对第一应用是否具备业务证书申请权限进行校验，以及对账号登录认证结果进行校验。
具体实现中，认证服务器可以获取申请信息中包括的该第一应用的应用标识，并获取具备业务证书申请权限的应用的应用标识白名单，该应用标识白名单包括至少一个应用标识，如果该应用标识白名单包括该第一应用的应用标识，则可以确定该第一应用具备业务证书申请权限。认证服务器可以获取申请信息中包括的该账号登录认证标识，向账号服务器发送账号登录认证结果校验请求，该账号登录认证结果校验请求携带有该账号登录认证标识，账号服务器根据该账号登录认证标识校验该第一应用的账号登录认证是否成功，向认证服务器发送对该账号登录认证标识的校验结果，认证服务器根据对该第一应用是否具备业务证书申请权限的校验结果，以及对该账号登录认证标识的校验结果生成身份验证结果，如果该身份验证结果指示该第一应用具备业务证书申请权限，且账号登录认证成功，则认证服务器对该申请信息进行数字签名，并将该数字签名包括在该身份验证结果中。
509、所述认证服务器向所述终端发送所述身份验证结果。
相应地，所述终端接收所述身份验证结果。
具体实现中，认证服务器向终端发送该身份验证结果，终端的证书客户端接收到该身 份验证结果。
510、所述终端在所述身份验证结果指示所述第一应用具备业务证书申请权限，且账号登录认证成功时，在可信执行环境中生成证书请求文件。
具体实现中，在该身份验证结果指示该第一应用具备业务证书申请权限，且账号登录认证成功时，证书客户端生成密钥对第一获取请求，该密钥对第一获取请求携带有该数字签名，向终端的证书可信应用发送该密钥对第一获取请求，该证书可信应用响应该密钥对第一获取请求对该数字签名进行验签。如果验签通过，则生成密钥对第二获取请求，向终端的可信执行环境发送该密钥对第二获取请求，该可信执行环境响应该密钥对第二获取请求，生成密钥对，该密钥对包括第一公钥和第一私钥，并根据该申请信息和该第一公钥生成证书请求文件，以及将该第一私钥存储在该可信执行环境中；如果验签失败，则向证书客户端返回拒绝业务证书申请的消息。
511、所述终端的证书客户端获取所述证书请求文件。
具体实现中，可信执行环境生成证书请求文件后，将该证书请求文件发送给证书可信应用，证书可信应用再将该证书请求文件发送给证书客户端，从而证书客户端获取到可信执行环境生成的证书请求文件。
512、所述终端的证书客户端向所述认证服务器发送业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件。
相应地，所述认证服务器接收所述业务证书签发请求。
具体实现中，可以由证书客户端向认证服务器发送业务证书签发请求，业务证书签发请求携带有该证书请求文件。该证书请求文件可以包括该第一公钥、该第一应用(即申请证书的主体)的应用标识以及证书用途。
513、所述认证服务器在对所述业务证书签发请求校验通过后，根据所述证书请求文件为所述第一应用签发目标业务证书。
具体实现中，认证服务器在接收到该业务证书签发请求时，对该业务证书签发请求进行校验，校验内容可以包括该第一应用是否具备业务证书申请权限，证书用途是否合法等，如果该第一应用具备业务证书申请权限，且证书用途合法，则确定对该业务证书签发请求的校验通过，可以为该第一应用签发业务证书，并根据该证书请求文件为该第一应用签发目标业务证书。
514、所述认证服务器向所述终端发送所述目标业务证书。
相应地，所述终端接收所述目标业务证书。
具体实现中，认证服务器将签发的目标业务证书发送给终端，终端的证书客户端接收该目标业务证书。
在一种实施方式中，证书客户端接收到该目标业务证书后，向证书可信应用发送该目标业务证书，证书可信应用可以将该目标业务证书写入该可信执行环境中。
在另一种实施方式中，终端可以将私钥与应用进行绑定，在应用使用私钥时先对应用鉴权，鉴权通过后才会允许使用私钥，具体实现方式可以为：确定允许在可信执行环境中使用第一私钥的应用集合，该应用集合至少可以包括该第一应用，可信执行环境获取该应用集合包括的应用的第一目标应用标识集合以及该第一私钥的索引，并建立该第一私钥的 索引与该第一目标应用标识集合之间的第一关联关系。第二应用在请求使用该第一私钥时，可以生成私钥使用请求，并将该私钥使用请求发送给证书客户端，证书客户端可以通过证书可信应用将该私钥使用请求转发给可信执行环境，该私钥使用请求携带有该第一私钥的索引，可信执行环境响应该私钥使用请求获取该第二应用的应用标识，根据该第一关联关系获取与该第一私钥的索引关联的第一目标应用标识集合，如果该第一目标应用标识集合包括该第二应用的应用标识，则允许该第二应用在该可信执行环境中使用该第一私钥，从而只允许授权应用在可信执行环境中使用私钥，保证私钥安全。
在又一种实施方式中，终端可以将业务证书与应用绑定，只允许授权的应用使用业务证书，具体实现方式可以为：以目标业务证书写入该可信执行环境中为例，确定允许使用该目标业务证书的应用集合，该应用集合至少可以包括该第一应用，获取该应用集合包括的应用的第二目标应用标识集合以及该目标业务证书的索引，并建立该目标业务证书的索引与该第二目标应用标识集合之间的第二关联关系。第三应用在请求使用该目标业务证书时，可以生成业务证书使用请求，并将该业务证书使用请求发送给证书客户端，证书客户端可以通过证书可信应用将该业务证书使用请求转发给可信执行环境，该业务证书使用请求携带有该目标业务证书的索引，可信执行环境响应该业务证书使用请求获取该第三应用的应用标识，根据该第二关联关系获取与该目标业务证书的索引关联的第二目标应用标识集合，如果该第二目标应用标识集合包括该第三应用的应用标识，则允许该第三应用使用该目标业务证书，从而只允许授权应用使用业务证书，保证业务证书安全。
本申请实施例中，在确定启动的第一应用被预先配置为申请业务证书时，第一应用输出账号登录页面，将用户在该账号登录页面输入的用户账号信息通过账号客户端发送给账号服务器，账号服务器向终端发送对该用户账号信息进行登录认证的账号登录认证结果，如果该账号登录认证结果指示账号登录认证成功，则证书客户端向认证服务器发送业务证书申请请求，认证服务器向终端发送对该第一应用的身份验证结果，在该身份验证结果指示该第一应用具备业务证书申请权限，且账号登录认证成功时，证书客户端通过证书可信应用请求可信执行环境生成密钥对，该密钥对包括第一公钥和第一私钥，可信执行环境根据该申请信息和该第一公钥生成证书请求文件，证书客户端获取到该证书请求文件后，根据该证书请求文件向认证服务器发送业务证书签发请求，认证服务器在对该业务证书签发请求校验通过后，根据该证书请求文件为第一应用签发目标业务证书，并向终端发送签发的目标业务证书，从而可以由认证服务器对业务证书的签发进行有效管控，证书签发过程中不需要人工参与，实现了业务证书的自动化在线签发，可以满足业务快速响应的需求，将私钥存储在可信执行环境中可以保证私钥安全，避免泄露风险。
请参阅图7，为本申请实施例提供的一种业务证书管理装置的结构示意图，该业务证书管理装置用于执行前文所述的终端的相应方法，该业务证书管理装置包括：
启动模块701，用于启动第一应用。
确定模块702，用于确定所述第一应用被预先配置为申请业务证书。
发送模块703，用于向认证服务器发送业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识，所述第一应用的应用标识用于所述认证服务器 对所述第一应用的业务证书申请权限进行校验。
接收模块704，用于接收所述认证服务器根据所述申请信息发送的对所述第一应用的身份验证结果。
处理模块705，用于在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书。
在一种实施方式中，所述处理模块705在可信执行环境中生成证书请求文件的具体方式为：
在可信执行环境中生成密钥对，所述密钥对包括第一公钥和第一私钥。
在所述可信执行环境中根据所述申请信息和所述第一公钥生成证书请求文件，并将所述第一私钥存储在所述可信执行环境中。
在一种实施方式中，在所述身份验证结果指示所述第一应用具备业务证书申请权限时，所述身份验证结果包括所述认证服务器对所述申请信息的数字签名。
在一种实施方式中，所述处理模块705在可信执行环境中生成密钥对的具体方式为：
生成密钥对第一获取请求，所述密钥对第一获取请求携带有所述数字签名。
响应所述密钥对第一获取请求，对所述数字签名进行验签。
在验签通过时，生成密钥对第二获取请求。
响应所述密钥对第二获取请求，在可信执行环境中生成密钥对。
在一种实施方式中，所述处理模块705，还用于：
获取所述第一私钥的索引以及允许在所述可信执行环境中使用所述第一私钥的应用的第一目标应用标识集合，所述第一目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识。
建立所述第一私钥的索引与所述第一目标应用标识集合之间的第一关联关系。
在一种实施方式中，所述处理模块705，还用于：
生成第二应用的私钥使用请求，所述私钥使用请求携带有所述第一私钥的索引。
响应所述私钥使用请求获取所述第二应用的应用标识，以及根据所述第一关联关系获取与所述第一私钥的索引关联的所述第一目标应用标识集合。
在所述第一目标应用标识集合包括所述第二应用的应用标识时，允许所述第二应用在所述可信执行环境中使用所述第一私钥。
在一种实施方式中，所述装置还包括：输出模块706，其中：
所述输出模块706，用于通过所述第一应用的应用界面输出账号登录页面。
所述发送模块703，还用于响应用户的输入，向账号服务器发送账号登录认证请求，所述账号登录认证请求携带有在所述账号登录页面输入的用户账号信息。
所述接收模块704，还用于接收所述账号服务器对所述用户账号信息的账号登录认证结果。
所述发送模块703，具体用于在所述账号登录认证结果指示账号登录认证成功时，向认证服务器发送业务证书申请请求。
在一种实施方式中，在所述账号登录认证结果指示账号登录认证成功时，所述业务证 书申请请求携带的所述申请信息还包括账号登录认证标识，所述账号登录认证标识用于所述认证服务器对所述账号登录认证结果进行校验。
在一种实施方式中，所述处理模块705在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件的具体方式为：
在所述身份验证结果指示所述第一应用具备业务证书申请权限，且账号登录认证成功时，在可信执行环境中生成证书请求文件。
在一种实施方式中，所述处理模块705根据所述证书请求文件获取所述第一应用对应的目标业务证书的具体方式为：
获取所述证书请求文件。
通过所述发送模块703向所述认证服务器发送业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件。
通过所述接收模块704接收所述认证服务器在对所述业务证书签发请求校验通过后，发送的根据所述证书请求文件为所述第一应用签发的目标业务证书。
在一种实施方式中，所述处理模块705根据所述证书请求文件获取所述第一应用对应的目标业务证书的具体方式为：
根据所述证书请求文件获取设备证书对应的第二私钥。
在所述可信执行环境中利用所述第二私钥为所述第一应用签发目标业务证书。
在一种实施方式中，所述处理模块705，还用于：
获取所述目标业务证书的索引以及允许使用所述目标业务证书的应用的第二目标应用标识集合，所述第二目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识。
建立所述目标业务证书的索引与所述第二目标应用标识集合之间的第二关联关系。
在一种实施方式中，所述处理模块705，还用于：
生成第三应用的业务证书使用请求，所述业务证书使用请求携带有所述目标业务证书的索引。
响应所述业务证书使用请求获取所述第三应用的应用标识，以及根据所述第二关联关系获取与所述目标业务证书的索引关联的所述第二目标应用标识集合。
在所述第二目标应用标识集合包括所述第三应用的应用标识时，允许所述第三应用使用所述目标业务证书。
可以理解的是，本实施例的业务证书管理装置的各功能模块的功能可根据上述方法实施例中终端的方法具体实现，其具体实现过程可以参照上述方法实施例的相关描述，此处不再赘述。
本申请实施例中，启动模块701启动第一应用，确定模块702确定第一应用被预先配置为申请业务证书，发送模块703在确定模块702确定第一应用被预先配置为申请业务证书时，向认证服务器发送业务证书申请请求，业务证书申请请求携带的申请信息包括第一应用的应用标识，接收模块704接收认证服务器根据申请信息发送的对第一应用的身份验证结果，处理模块705在身份验证结果指示第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据证书请求文件获取第一应用对应的目标业务证书，可 以对业务证书的签发进行有效管控，并可以满足业务快速响应的需求。
请参阅图8，为本申请实施例提供的另一种业务证书管理装置的结构示意图，该业务证书管理装置用于执行前文所述的认证服务器的相应方法，该业务证书管理装置包括：
接收模块801，用于接收终端在被预先配置为申请业务证书的第一应用启动时，发送的业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识。
验证模块802，用于根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果。
发送模块803，用于向所述终端发送所述身份验证结果。
其中，所述身份验证结果用于所述终端在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书。
在一种实施方式中，所述装置还包括：签发模块804，其中：
所述接收模块801，还用于接收所述终端在所述可信执行环境中生成所述证书请求文件之后，发送的业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件。
所述签发模块804，用于在对所述业务证书签发请求校验通过后，根据所述证书请求文件为所述第一应用签发目标业务证书。
所述发送模块803，还用于向所述终端发送所述目标业务证书。
在一种实施方式中，所述验证模块802，具体用于：
获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识。
在所述应用标识白名单包括所述第一应用的应用标识时，确定所述第一应用具备业务证书申请权限，并生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限。
在一种实施方式中，所述申请信息还包括账号登录认证标识，所述验证模块802，具体用于：
获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识。
向账号服务器发送账号登录认证结果校验请求，所述账号登录认证结果校验请求携带有所述账号登录认证标识。
接收所述账号服务器发送的对所述账号登录认证标识的校验结果。
在所述应用标识白名单包括所述第一应用的应用标识，且所述校验结果指示对所述账号登录认证标识校验通过时，生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限，且账号登录认证成功。
可以理解的是，本实施例的业务证书管理装置的各功能模块的功能可根据上述方法实施例中认证服务器的方法具体实现，其具体实现过程可以参照上述方法实施例的相关描述，此处不再赘述。
本申请实施例中，接收模块801接收终端在被预先配置为申请业务证书的第一应用启动 时，发送的业务证书申请请求，业务证书申请请求携带的申请信息包括第一应用的应用标识，验证模块802根据申请信息对第一应用进行身份验证，得到身份验证结果，发送模块803向终端发送身份验证结果，该身份验证结果用于终端在身份验证结果指示第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据证书请求文件获取第一应用对应的目标业务证书，可以对业务证书的签发进行有效管控，并可以满足业务快速响应的需求。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
综上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (35)

  1. 一种业务证书管理方法，其特征在于，包括：
    启动第一应用；
    确定所述第一应用被预先配置为申请业务证书；
    向认证服务器发送业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识，所述第一应用的应用标识用于所述认证服务器对所述第一应用的业务证书申请权限进行校验；
    接收所述认证服务器根据所述申请信息发送的对所述第一应用的身份验证结果；
    在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书。
  2. 根据权利要求1所述的方法，其特征在于，所述在可信执行环境中生成证书请求文件，包括：
    在可信执行环境中生成密钥对，所述密钥对包括第一公钥和第一私钥；
    在所述可信执行环境中根据所述申请信息和所述第一公钥生成证书请求文件，并将所述第一私钥存储在所述可信执行环境中。
  3. 根据权利要求2所述的方法，其特征在于，在所述身份验证结果指示所述第一应用具备业务证书申请权限时，所述身份验证结果包括所述认证服务器对所述申请信息的数字签名。
  4. 根据权利要求3所述的方法，其特征在于，所述在可信执行环境中生成密钥对，包括：
    生成密钥对第一获取请求，所述密钥对第一获取请求携带有所述数字签名；
    响应所述密钥对第一获取请求，对所述数字签名进行验签；
    在验签通过时，生成密钥对第二获取请求；
    响应所述密钥对第二获取请求，在可信执行环境中生成密钥对。
  5. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    获取所述第一私钥的索引以及允许在所述可信执行环境中使用所述第一私钥的应用的第一目标应用标识集合，所述第一目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识；
    建立所述第一私钥的索引与所述第一目标应用标识集合之间的第一关联关系。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    生成第二应用的私钥使用请求，所述私钥使用请求携带有所述第一私钥的索引；
    响应所述私钥使用请求获取所述第二应用的应用标识，以及根据所述第一关联关系获取与所述第一私钥的索引关联的所述第一目标应用标识集合；
    在所述第一目标应用标识集合包括所述第二应用的应用标识时，允许所述第二应用在所述可信执行环境中使用所述第一私钥。
  7. 根据权利要求1或2所述的方法，其特征在于，所述向认证服务器发送业务证书申请请求之前，所述方法还包括：
    通过所述第一应用的应用界面输出账号登录页面；
    响应用户的输入，向账号服务器发送账号登录认证请求，所述账号登录认证请求携带有在所述账号登录页面输入的用户账号信息；
    接收所述账号服务器对所述用户账号信息的账号登录认证结果；
    在所述账号登录认证结果指示账号登录认证成功时，执行所述向认证服务器发送业务证书申请请求的步骤。
  8. 根据权利要求7所述的方法，其特征在于，在所述账号登录认证结果指示账号登录认证成功时，所述业务证书申请请求携带的所述申请信息还包括账号登录认证标识，所述账号登录认证标识用于所述认证服务器对所述账号登录认证结果进行校验。
  9. 根据权利要求8所述的方法，其特征在于，所述在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，包括：
    在所述身份验证结果指示所述第一应用具备业务证书申请权限，且账号登录认证成功时，在可信执行环境中生成证书请求文件。
  10. 根据权利要求1或2所述的方法，其特征在于，所述根据所述证书请求文件获取所述第一应用对应的目标业务证书，包括：
    获取所述证书请求文件；
    向所述认证服务器发送业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件；
    接收所述认证服务器在对所述业务证书签发请求校验通过后，发送的根据所述证书请求文件为所述第一应用签发的目标业务证书。
  11. 根据权利要求1或2所述的方法，其特征在于，所述根据所述证书请求文件获取所述第一应用对应的目标业务证书，包括：
    根据所述证书请求文件获取设备证书对应的第二私钥；
    在所述可信执行环境中利用所述第二私钥为所述第一应用签发目标业务证书。
  12. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    获取所述目标业务证书的索引以及允许使用所述目标业务证书的应用的第二目标应用标识集合，所述第二目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识；
    建立所述目标业务证书的索引与所述第二目标应用标识集合之间的第二关联关系。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    生成第三应用的业务证书使用请求，所述业务证书使用请求携带有所述目标业务证书的索引；
    响应所述业务证书使用请求获取所述第三应用的应用标识，以及根据所述第二关联关系获取与所述目标业务证书的索引关联的所述第二目标应用标识集合；
    在所述第二目标应用标识集合包括所述第三应用的应用标识时，允许所述第三应用使用所述目标业务证书。
  14. 一种业务证书管理方法，其特征在于，包括：
    接收终端在被预先配置为申请业务证书的第一应用启动时，发送的业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识；
    根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果，并向所述终端发送所述身份验证结果；
    其中，所述身份验证结果用于所述终端在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    接收所述终端在所述可信执行环境中生成所述证书请求文件之后，发送的业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件；
    在对所述业务证书签发请求校验通过后，根据所述证书请求文件为所述第一应用签发目标业务证书，并向所述终端发送所述目标业务证书。
  16. 根据权利要求14或15所述的方法，其特征在于，所述根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果，包括：
    获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识；
    在所述应用标识白名单包括所述第一应用的应用标识时，确定所述第一应用具备业务证书申请权限，并生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限。
  17. 根据权利要求14或15所述的方法，其特征在于，所述申请信息还包括账号登录认证标识，所述根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果，包括：
    获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识；
    向账号服务器发送账号登录认证结果校验请求，所述账号登录认证结果校验请求携带 有所述账号登录认证标识；
    接收所述账号服务器发送的对所述账号登录认证标识的校验结果；
    在所述应用标识白名单包括所述第一应用的应用标识，且所述校验结果指示对所述账号登录认证标识校验通过时，生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限，且账号登录认证成功。
  18. 一种终端，其特征在于，包括：处理器、收发器和存储器，所述处理器、所述收发器和所述存储器通过总线连接，所述存储器存储有可执行程序代码，所述收发器受所述处理器的控制用于收发消息，其中：
    所述处理器，用于启动第一应用；
    所述处理器，还用于确定所述第一应用被预先配置为申请业务证书；
    所述收发器，用于向认证服务器发送业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识，所述第一应用的应用标识用于所述认证服务器对所述第一应用的业务证书申请权限进行校验；
    所述收发器，还用于接收所述认证服务器根据所述申请信息发送的对所述第一应用的身份验证结果；
    所述处理器，还用于在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书。
  19. 根据权利要求18所述的终端，其特征在于，所述处理器在可信执行环境中生成证书请求文件的具体方式为：
    在可信执行环境中生成密钥对，所述密钥对包括第一公钥和第一私钥；
    在所述可信执行环境中根据所述申请信息和所述第一公钥生成证书请求文件，并将所述第一私钥存储在所述可信执行环境中。
  20. 根据权利要求19所述的终端，其特征在于，在所述身份验证结果指示所述第一应用具备业务证书申请权限时，所述身份验证结果包括所述认证服务器对所述申请信息的数字签名。
  21. 根据权利要求20所述的终端，其特征在于，所述处理器在可信执行环境中生成密钥对的具体方式为：
    生成密钥对第一获取请求，所述密钥对第一获取请求携带有所述数字签名；
    响应所述密钥对第一获取请求，对所述数字签名进行验签；
    在验签通过时，生成密钥对第二获取请求；
    响应所述密钥对第二获取请求，在可信执行环境中生成密钥对。
  22. 根据权利要求19所述的终端，其特征在于，
    所述处理器，还用于获取所述第一私钥的索引以及允许在所述可信执行环境中使用所述第一私钥的应用的第一目标应用标识集合，所述第一目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识；
    所述处理器，还用于建立所述第一私钥的索引与所述第一目标应用标识集合之间的第一关联关系。
  23. 根据权利要求22所述的终端，其特征在于，
    所述处理器，还用于生成第二应用的私钥使用请求，所述私钥使用请求携带有所述第一私钥的索引；
    所述处理器，还用于响应所述私钥使用请求获取所述第二应用的应用标识，以及根据所述第一关联关系获取与所述第一私钥的索引关联的所述第一目标应用标识集合；
    所述处理器，还用于在所述第一目标应用标识集合包括所述第二应用的应用标识时，允许所述第二应用在所述可信执行环境中使用所述第一私钥。
  24. 根据权利要求18或19所述的终端，其特征在于，
    所述处理器，还用于通过所述第一应用的应用界面输出账号登录页面；
    所述收发器，还用于响应用户的输入，向账号服务器发送账号登录认证请求，所述账号登录认证请求携带有在所述账号登录页面输入的用户账号信息；
    所述收发器，还用于接收所述账号服务器对所述用户账号信息的账号登录认证结果；
    所述收发器，具体用于在所述账号登录认证结果指示账号登录认证成功时，向认证服务器发送业务证书申请请求。
  25. 根据权利要求24所述的终端，其特征在于，在所述账号登录认证结果指示账号登录认证成功时，所述业务证书申请请求携带的所述申请信息还包括账号登录认证标识，所述账号登录认证标识用于所述认证服务器对所述账号登录认证结果进行校验。
  26. 根据权利要求25所述的终端，其特征在于，所述处理器在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件的具体方式为：
    在所述身份验证结果指示所述第一应用具备业务证书申请权限，且账号登录认证成功时，在可信执行环境中生成证书请求文件。
  27. 根据权利要求18或19所述的终端，其特征在于，所述处理器根据所述证书请求文件获取所述第一应用对应的目标业务证书的具体方式为：
    获取所述证书请求文件；
    通过所述收发器向所述认证服务器发送业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件；
    通过所述收发器接收所述认证服务器在对所述业务证书签发请求校验通过后，发送的 根据所述证书请求文件为所述第一应用签发的目标业务证书。
  28. 根据权利要求18或19所述的终端，其特征在于，所述处理器根据所述证书请求文件获取所述第一应用对应的目标业务证书的具体方式为：
    根据所述证书请求文件获取设备证书对应的第二私钥；
    在所述可信执行环境中利用所述第二私钥为所述第一应用签发目标业务证书。
  29. 根据权利要求18所述的终端，其特征在于，
    所述处理器，还用于获取所述目标业务证书的索引以及允许使用所述目标业务证书的应用的第二目标应用标识集合，所述第二目标应用标识集合包括至少一个应用标识，所述至少一个应用标识包括所述第一应用的应用标识；
    所述处理器，还用于建立所述目标业务证书的索引与所述第二目标应用标识集合之间的第二关联关系。
  30. 根据权利要求29所述的终端，其特征在于，
    所述处理器，还用于生成第三应用的业务证书使用请求，所述业务证书使用请求携带有所述目标业务证书的索引；
    所述处理器，还用于响应所述业务证书使用请求获取所述第三应用的应用标识，以及根据所述第二关联关系获取与所述目标业务证书的索引关联的所述第二目标应用标识集合；
    所述处理器，还用于在所述第二目标应用标识集合包括所述第三应用的应用标识时，允许所述第三应用使用所述目标业务证书。
  31. 一种服务器，其特征在于，包括：处理器、网络接口和存储器，所述处理器、所述网络接口和所述存储器通过总线连接，所述存储器存储有可执行程序代码，所述网络接口受所述处理器的控制用于收发消息，其中：
    所述网络接口，用于接收终端在被预先配置为申请业务证书的第一应用启动时，发送的业务证书申请请求，所述业务证书申请请求携带的申请信息包括所述第一应用的应用标识；
    所述处理器，用于根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果，并向所述终端发送所述身份验证结果；
    其中，所述身份验证结果用于所述终端在所述身份验证结果指示所述第一应用具备业务证书申请权限时，在可信执行环境中生成证书请求文件，并根据所述证书请求文件获取所述第一应用对应的目标业务证书。
  32. 根据权利要求31所述的服务器，其特征在于，
    所述网络接口，还用于接收所述终端在所述可信执行环境中生成所述证书请求文件之后，发送的业务证书签发请求，所述业务证书签发请求携带有所述证书请求文件；
    所述处理器，还用于在对所述业务证书签发请求校验通过后，根据所述证书请求文件为所述第一应用签发目标业务证书；
    所述网络接口，还用于向所述终端发送所述目标业务证书。
  33. 根据权利要求31或32所述的服务器，其特征在于，所述处理器根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果的具体方式为：
    获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识；
    在所述应用标识白名单包括所述第一应用的应用标识时，确定所述第一应用具备业务证书申请权限，并生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限。
  34. 根据权利要求31或32所述的服务器，其特征在于，所述申请信息还包括账号登录认证标识，所述处理器根据所述申请信息对所述第一应用进行身份验证，得到身份验证结果的具体方式为：
    获取具备业务证书申请权限的应用的应用标识白名单，所述应用标识白名单包括至少一个应用标识；
    通过所述网络接口向账号服务器发送账号登录认证结果校验请求，所述账号登录认证结果校验请求携带有所述账号登录认证标识；
    通过所述网络接口接收所述账号服务器发送的对所述账号登录认证标识的校验结果；
    在所述应用标识白名单包括所述第一应用的应用标识，且所述校验结果指示对所述账号登录认证标识校验通过时，生成身份验证结果，所述身份验证结果用于指示所述第一应用具备业务证书申请权限，且账号登录认证成功。
  35. 一种计算机可读存储介质，其特征在于，所述存储介质存储指令，当其在计算机上运行时，使得计算机实现如权利要求1～13中任一项所述的业务证书管理方法或者如权利要求14～17中任一项所述的业务证书管理方法。
PCT/CN2018/102738 2017-10-09 2018-08-28 一种业务证书管理方法、终端及服务器 WO2019072039A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201880059099.9A CN111066284B (zh) 2017-10-09 2018-08-28 一种业务证书管理方法、终端及服务器

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
CN201710931749.1 2017-10-09
CN201710931749 2017-10-09
CN201711147672.5 2017-11-17
CN201711147672 2017-11-17
CN201810342901.7 2018-04-17
CN201810342901 2018-04-17

Publications (1)

Publication Number Publication Date
WO2019072039A1 true WO2019072039A1 (zh) 2019-04-18

Family

ID=66101282

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/102738 WO2019072039A1 (zh) 2017-10-09 2018-08-28 一种业务证书管理方法、终端及服务器

Country Status (2)

Country Link
CN (1) CN111066284B (zh)
WO (1) WO2019072039A1 (zh)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111726782B (zh) * 2020-05-22 2023-12-29 浙江吉利汽车研究院有限公司 一种安全认证方法及系统
CN111901303A (zh) * 2020-06-28 2020-11-06 北京可信华泰信息技术有限公司 设备认证方法和装置、存储介质及电子装置
CN112202719B (zh) * 2020-09-04 2022-09-13 广州江南科友科技股份有限公司 基于数字证书的签名方法、系统、装置及存储介质
CN112202567B (zh) * 2020-09-30 2024-03-15 北京百度网讯科技有限公司 一种证书发送方法、证书发送方法、云端以及终端设备
CN114362951B (zh) * 2020-10-13 2024-05-17 花瓣云科技有限公司 用于更新证书的方法和装置
CN114915418A (zh) * 2021-02-10 2022-08-16 华为技术有限公司 业务证书管理方法、装置、系统及电子设备
CN113114699B (zh) * 2021-04-26 2023-04-28 中国第一汽车股份有限公司 一种车辆终端身份证书申请方法
CN113204752A (zh) * 2021-06-01 2021-08-03 京东科技控股股份有限公司 基于区块链的身份验证方法及客户端、服务器
CN115460083B (zh) * 2021-06-09 2024-04-19 贵州白山云科技股份有限公司 安全加速服务部署方法、装置、介质及设备
CN114168928B (zh) * 2022-02-14 2022-05-06 阿里云计算有限公司 获取身份认证信息的方法、装置、存储介质及系统
CN114666112B (zh) * 2022-03-14 2023-08-15 亿咖通(湖北)技术有限公司 通信认证方法、装置、电子设备和存储介质
CN115001841A (zh) * 2022-06-23 2022-09-02 北京瑞莱智慧科技有限公司 一种身份认证方法、装置及存储介质
WO2024076384A1 (en) * 2022-10-04 2024-04-11 Altiostar Networks India Private Limited Certificate management microservice
CN117852565B (zh) * 2024-02-28 2024-05-28 花瓣支付(深圳)有限公司 Nfc卡片生成方法、系统、装置、电子设备及服务器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104125226A (zh) * 2014-07-28 2014-10-29 北京握奇智能科技有限公司 一种锁定和解锁应用的方法、装置及系统
WO2016105784A1 (en) * 2014-12-22 2016-06-30 Mcafee, Inc. Trust establishment between a trusted execution environment and peripheral devices
CN106454528A (zh) * 2015-08-07 2017-02-22 阿里巴巴集团控股有限公司 基于可信执行环境的业务处理方法和客户端
CN106789067A (zh) * 2016-12-13 2017-05-31 北京握奇智能科技有限公司 一种基于TEE和可穿戴设备的手机网银Key方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088360B (zh) * 2009-12-08 2013-12-25 长春吉大正元信息技术股份有限公司 分布式授权管理系统及其实现方法
WO2014036021A1 (en) * 2012-08-28 2014-03-06 Visa International Service Association Secure device service enrollment
CN103888252A (zh) * 2012-12-19 2014-06-25 深圳市华营数字商业有限公司 一种基于uid、pid、appid控制应用访问权限方法
US9294468B1 (en) * 2013-06-10 2016-03-22 Google Inc. Application-level certificates for identity and authorization
WO2015024253A1 (zh) * 2013-08-23 2015-02-26 华为终端有限公司 管理权限方法、装置及终端
US9652631B2 (en) * 2014-05-05 2017-05-16 Microsoft Technology Licensing, Llc Secure transport of encrypted virtual machines with continuous owner access

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104125226A (zh) * 2014-07-28 2014-10-29 北京握奇智能科技有限公司 一种锁定和解锁应用的方法、装置及系统
WO2016105784A1 (en) * 2014-12-22 2016-06-30 Mcafee, Inc. Trust establishment between a trusted execution environment and peripheral devices
CN106454528A (zh) * 2015-08-07 2017-02-22 阿里巴巴集团控股有限公司 基于可信执行环境的业务处理方法和客户端
CN106789067A (zh) * 2016-12-13 2017-05-31 北京握奇智能科技有限公司 一种基于TEE和可穿戴设备的手机网银Key方法及系统

Also Published As

Publication number Publication date
CN111066284B (zh) 2021-06-29
CN111066284A (zh) 2020-04-24

Similar Documents

Publication Publication Date Title
CN111066284B (zh) 一种业务证书管理方法、终端及服务器
CN107222485B (zh) 一种授权方法以及相关设备
US11233649B2 (en) Application program authorization method, terminal, and server
CN109600223B (zh) 验证方法、激活方法、装置、设备及存储介质
EP3281141B1 (en) Cloud-based cross-device digital pen pairing
CN103634109B (zh) 操作权限验证方法和装置
WO2017186100A1 (zh) 身份认证方法、系统及设备
CN108632253B (zh) 基于移动终端的客户数据安全访问方法及装置
WO2017118412A1 (zh) 一种更新密钥的方法、装置和系统
US9635018B2 (en) User identity verification method and system, password protection apparatus and storage medium
WO2017041599A1 (zh) 业务处理方法及电子设备
WO2017118437A1 (zh) 进行业务处理的方法、装置和系统
TW201836322A (zh) 憑證管理方法及系統
WO2017211205A1 (zh) 一种白名单更新方法和装置
KR20170096117A (ko) 멀티-테넌트 컴퓨팅 시스템의 보안 및 허가 아키텍처
WO2018000370A1 (zh) 一种移动终端的认证方法及移动终端
WO2018129726A1 (zh) 一种授权凭据迁移的方法、终端设备及业务服务器
WO2015035936A1 (zh) 身份验证方法、身份验证装置和身份验证系统
WO2019010863A1 (zh) 控制可信应用访问的方法和终端
CN108234124B (zh) 身份验证方法、装置与系统
US11017066B2 (en) Method for associating application program with biometric feature, apparatus, and mobile terminal
WO2017206833A1 (zh) 支付方法、支付设备和支付服务器
CN111176794A (zh) 一种容器管理方法、装置及可读存储介质
WO2018108062A1 (zh) 身份验证方法、装置及存储介质
CN110474864B (zh) 一种注册、登录移动应用程序的方法及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18866584

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18866584

Country of ref document: EP

Kind code of ref document: A1