CN114244542B - Voucher management system and voucher management method - Google Patents
Voucher management system and voucher management method Download PDFInfo
- Publication number
- CN114244542B CN114244542B CN202010934732.3A CN202010934732A CN114244542B CN 114244542 B CN114244542 B CN 114244542B CN 202010934732 A CN202010934732 A CN 202010934732A CN 114244542 B CN114244542 B CN 114244542B
- Authority
- CN
- China
- Prior art keywords
- credential
- certificate
- server
- electronic device
- electronic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000007726 management method Methods 0.000 title claims description 38
- 238000000034 method Methods 0.000 claims description 36
- 238000012795 verification Methods 0.000 claims description 22
- 230000008569 process Effects 0.000 claims description 14
- 230000007246 mechanism Effects 0.000 claims description 5
- 238000005516 engineering process Methods 0.000 description 11
- 238000004891 communication Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 8
- 230000005540 biological transmission Effects 0.000 description 4
- 230000006855 networking Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000008859 change Effects 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 230000002123 temporal effect Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
- H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
技术领域Technical field
本发明是关于一种管理系统，特别是关于一种凭证管理系统及凭证管理方法。The present invention relates to a management system, and in particular to a voucher management system and a voucher management method.
背景技术Background technique
传统上，要识别能够联网的设备是采用序列号码加上密码，以作为设备的身份识别。然而，采用序列号码加上密码的方法可能存在以下风险与问题：设备的序列号码有重复的可能性。在封闭式的网络环境中(例如公司内部的设备)，可以使每个设备对应到唯一的序列号码，然而，在开放式的因特网中，多台设备可能对应到重复的序列号码，设备身份一旦无法确认，就存在机密数据外泄的风险，另外，序列号码是一串有规则的连续编号，黑客只要了解其规则，非常容易变造序列号码，由于此方法容易被黑客破解，特别是当联网设备数量庞大又位于远处，设备管理者难以一一为设备设定不同密码，最常见的做法是每台设备都使用相同的密码，更增加了被黑客取得设备数据的不安全性，再者，采用序列号码加上密码仅提供后台设备主机验证联网设备身份，却无法提供联网设备验证后台设备主机的身份。Traditionally, to identify a device that can connect to the Internet, a serial number plus a password are used to identify the device. However, using the method of serial number plus password may have the following risks and problems: the serial number of the device may be repeated. In a closed network environment (such as equipment within a company), each device can be mapped to a unique serial number. However, in the open Internet, multiple devices may be mapped to duplicate serial numbers. Once the device identity is If it cannot be confirmed, there is a risk of leakage of confidential data. In addition, the serial number is a regular series of consecutive numbers. As long as hackers understand the rules, it is very easy to change the serial number. This method is easy to be cracked by hackers, especially when connected to the Internet. There are a large number of devices and they are located far away. It is difficult for device administrators to set different passwords for each device. The most common method is to use the same password for each device, which increases the insecurity of device data being obtained by hackers. Furthermore, , using the serial number plus password only provides the background device host to verify the identity of the networked device, but cannot provide the networked device to verify the identity of the background device host.
另一方面，联网设备传输数据到后台设备主机时，通信数据无任何加密机制，或是使用固定不变的对称式密钥，黑客相当容易在开放网络拦截数据封包，通过暴力算法破解固定不变的对称式密钥。当联网设备数量庞大又位于远处时，对于失窃的设备或是需要汰除的设备都无法从远程管理。On the other hand, when networked devices transmit data to the backend device host, the communication data does not have any encryption mechanism, or uses a fixed symmetric key. It is very easy for hackers to intercept the data packets on the open network and crack the fixed data through brute force algorithms. symmetric key. When there are a large number of connected devices and they are located far away, it is impossible to remotely manage stolen devices or devices that need to be eliminated.
因此，如何管理联网设备密钥与联网设备凭证生命周期，已成为本领域需解决的问题之一。Therefore, how to manage the life cycle of networking device keys and networking device credentials has become one of the problems that needs to be solved in this field.
发明内容Summary of the invention
为了解决上述的问题，本发明内容提供了一种凭证管理系统包含电子设备以及服务器。电子设备用以传送凭证申请请求。服务器用以在接收凭证申请请求后，借由中继凭证装置签发对应电子设备的设备凭证，并将设备凭证及服务器的因特网网址传给电子设备；其中，电子设备存储设备凭证及服务器的因特网网址，以完成签发凭证操作。In order to solve the above problems, the present invention provides a certificate management system including an electronic device and a server. The electronic device is used to transmit the voucher application request. After receiving the certificate application request, the server is used to issue a device certificate corresponding to the electronic device through the relay certificate device, and transmit the device certificate and the Internet address of the server to the electronic device; wherein, the electronic device stores the device certificate and the Internet address of the server. , to complete the operation of issuing the voucher.
本发明又提供一种凭证管理方法，凭证管理方法的步骤包含：借由电子设备传送凭证申请请求；借由服务器接收凭证申请请求后，借由中继凭证装置签发对应电子设备的设备凭证，并将设备凭证及服务器的因特网网址传给电子设备；其中，电子设备存储设备凭证及服务器的因特网网址，以完成签发凭证操作。The present invention also provides a certificate management method. The steps of the certificate management method include: transmitting a certificate application request through an electronic device; after receiving the certificate application request through a server, issuing an equipment certificate corresponding to the electronic equipment through a relay certificate device, and The device certificate and the Internet address of the server are transmitted to the electronic device; wherein the electronic device stores the device certificate and the Internet address of the server to complete the operation of issuing the certificate.
本发明的凭证管理系统及凭证管理方法提供了管理可联网的电子设备密钥与电子设备凭证生命周期的方法，包含电子设备密钥与电子设备凭证产生、电子设备更新、电子设备凭证撤除，以及通过签发凭证，可提供电子设备与电子设备之间以及电子设备与服务器之间辨识身份的功能，确保机密数据传输的安全性。The voucher management system and voucher management method of the present invention provide a method for managing the life cycle of networkable electronic equipment keys and electronic equipment certificates, including the generation of electronic equipment keys and electronic equipment certificates, electronic equipment updates, electronic equipment certificate removal, and By issuing certificates, the identity identification function between electronic devices and between electronic devices and servers can be provided to ensure the security of confidential data transmission.
附图说明Description of drawings
图1依照本发明实施例绘示凭证管理系统的示意图。FIG. 1 is a schematic diagram of a certificate management system according to an embodiment of the present invention.
图2依照本发明实施例绘示凭证管理方法的流程图。FIG. 2 illustrates a flow chart of a certificate management method according to an embodiment of the present invention.
图3依照本发明实施例绘示凭证管理系统的身份验证流程的示意图。FIG. 3 is a schematic diagram illustrating the identity verification process of the certificate management system according to an embodiment of the present invention.
图4依照本发明实施例绘示凭证管理系统的撤除电子设备的示意图。FIG. 4 is a schematic diagram of removing electronic equipment in the certificate management system according to an embodiment of the present invention.
图5依照本发明实施例绘示凭证管理系统的更新凭证的示意图。FIG. 5 is a schematic diagram of updating a certificate in the certificate management system according to an embodiment of the present invention.
具体实施方式Detailed ways
以下说明为完成发明的较佳实现方式，其目的在于描述本发明的基本精神，但并不用以限定本发明。实际的发明内容必须参考之后的权利要求范围。The following description is a preferred implementation of the invention, which is intended to describe the basic spirit of the invention, but is not intended to limit the invention. The actual content of the invention must refer to the scope of the following claims.
必须了解的是，使用于本说明书中的“包含”、“包括”等词，用以表示存在特定的技术特征、数值、方法步骤、作业处理、组件以及/或组件，但并不排除可加上更多的技术特征、数值、方法步骤、作业处理、组件、组件，或以上的任意组合。It must be understood that the words "including" and "including" used in this specification are used to indicate the existence of specific technical features, values, method steps, work processes, components and/or components, but do not exclude the possibility of adding further technical features, values, method steps, job processes, components, components, or any combination of the above.
在权利要求中使用如“第一”、“第二”、“第三”等词用来修饰权利要求中的组件，并非用来表示之间具有优先权顺序，先行关系，或者是一个组件先于另一个组件，或者是执行方法步骤时的时间先后顺序，仅用来区别具有相同名字的组件。In the claims, words such as "first", "second", "third", etc. are used to modify the components in the claims. They are not used to indicate a priority order, a prior relationship, or that one component precedes another, or a temporal order in performing method steps. They are only used to distinguish components with the same name.
请参照图1和图2，图1依照本发明实施例绘示凭证管理系统100的示意图。图2依照本发明实施例绘示凭证管理方法200的流程图。Please refer to Figures 1 and 2. Figure 1 is a schematic diagram of a certificate management system 100 according to an embodiment of the present invention. FIG. 2 illustrates a flow chart of a certificate management method 200 according to an embodiment of the present invention.
如图1所示，凭证管理系统100包含电子设备10及服务器20。电子设备 10为具有连网功能的设备，例如为手机、平板、笔记本电脑等等。电子设备10 与服务器20以无线通信方式(例如应用Wi-Fi、3G、4G、5G、LTE等技术)建立通信链接LK。As shown in FIG. 1 , the certificate management system 100 includes an electronic device 10 and a server 20 . The electronic device 10 is a device with networking functions, such as a mobile phone, a tablet, a laptop, etc. The electronic device 10 and the server 20 establish a communication link LK through wireless communication (for example, applying Wi-Fi, 3G, 4G, 5G, LTE and other technologies).
在实施例中，电子设备10与服务器20之间的通信方式，除了应用无线通信方式，例如应用Wi-Fi、3G、4G、5G、长期演进技术(Long Term Evolution， LTE)等技术，建立通信链接，也可以应用有线通信方式，例如以以太网络 (Ethernet)技术通信。In the embodiment, the communication method between the electronic device 10 and the server 20 uses wireless communication methods, such as Wi-Fi, 3G, 4G, 5G, Long Term Evolution (LTE) and other technologies to establish communication. Links can also use wired communication methods, such as Ethernet technology communication.
在实施例中，服务器20中包含中继凭证装置22。在实施例中，中继凭证装置22可以被实施为例如为微控制单元(microcontroller)、微处理器 (microprocessor)、数字信号处理器(digital signal processor)、特殊应用集成电路 (application specificintegrated circuit，ASIC)或逻辑电路。在实施例中，中继凭证装置22可以由软件、韧体及或硬件实现。由于必须将的根(root)凭证置于数层安全防护之后，因此我们利用中继凭证装置22作为代理(proxy)装置，确保跟证书的密钥绝对无法被存取。由于跟证书本身签署了中继凭证，中间凭证可以被用来签署我们的客户安装与维护的安全套接字层(SecureSockets Layer，SSL)，此为一种标准技术，故此处不赘述之。In an embodiment, the server 20 includes a relay certificate device 22. In an embodiment, the relay certificate device 22 can be implemented as, for example, a microcontroller, a microprocessor, a digital signal processor, an application specific integrated circuit (ASIC), or a logic circuit. In an embodiment, the relay certificate device 22 can be implemented by software, firmware, and/or hardware. Since the root certificate must be placed behind several layers of security protection, we use the relay certificate device 22 as a proxy device to ensure that the key of the certificate is absolutely inaccessible. Since the relay certificate is signed by the certificate itself, the intermediate certificate can be used to sign the Secure Sockets Layer (SSL) installed and maintained by our customers. This is a standard technology and will not be described here.
以下叙述凭证管理方法200的实施方法。The implementation method of the certificate management method 200 is described below.
在步骤210中，电子设备10传送凭证申请请求。In step 210 , the electronic device 10 transmits a credential application request.
在实施例中，电子设备10传送的凭证申请请求中包含电子设备10的出厂序号、出厂时间、出厂日期等信息。In the embodiment, the voucher application request transmitted by the electronic device 10 includes information such as the factory serial number, factory time, and factory date of the electronic device 10 .
在步骤220中，服务器20接收凭证申请请求，借由中继凭证装置22签发对应电子设备10的设备凭证，以及将设备凭证及服务器20的因特网网址(Uniform Resource Locator，URL)传给电子设备10。In step 220 , the server 20 receives the certificate application request, issues a device certificate corresponding to the electronic device 10 through the relay certificate device 22 , and transmits the device certificate and the Internet address (Uniform Resource Locator, URL) of the server 20 to the electronic device 10 .
在实施例中，中继凭证装置22位于服务器20中，中继凭证装置22为X.509 凭证装置，中继凭证装置22产生的设备凭证为X.509凭证，X.509凭证为X.509 凭证链技术中的叶(leaf)凭证，X.509凭证以非对称密钥加密。In the embodiment, the relay certificate device 22 is located in the server 20, the relay certificate device 22 is an X.509 certificate device, the device certificate generated by the relay certificate device 22 is an X.509 certificate, and the X.509 certificate is X.509 Leaf certificates in certificate chain technology, X.509 certificates are encrypted with asymmetric keys.
在实施例中，X.509凭证链技术可以是多层式的架构(例如树状结构)，每个层凭证都可以往上推到跟证书，签署到最后一层(没有子凭证)称为叶凭证，X.509凭证链技术的此种特性可以更弹性的使用于多种模型设备上，例如某公司第一类型的模型设备(例如有100台)以一层中继凭证(例如采用100个中继凭证)作签发，第二类型的模型设备(例如有200台)以另一层中继凭证(例如采用 200个另一层中继凭证)作签发。因此，采用X.509凭证链技术可以使凭证的签发更具有弹性。In an embodiment, the X.509 certificate chain technology can be a multi-layered architecture (e.g., a tree structure), and each layer of certificates can be pushed up to the root certificate, and the last layer (without sub-certificates) signed is called a leaf certificate. This feature of the X.509 certificate chain technology can be used more flexibly on a variety of model devices. For example, a company's first type of model devices (e.g., 100 units) are issued with a layer of relay certificates (e.g., 100 relay certificates), and the second type of model devices (e.g., 200 units) are issued with another layer of relay certificates (e.g., 200 another layer of relay certificates). Therefore, the use of the X.509 certificate chain technology can make the issuance of certificates more flexible.
在实施例中，本案采用的设备凭证皆为叶凭证。In the embodiment, the device certificates used in this case are all leaf certificates.
然而，本发明不限于采用X.509凭证链技术，只要是能够产生安全凭证的机制都可以应用。However, the present invention is not limited to the use of X.509 certificate chain technology, and any mechanism that can generate security certificates can be applied.
在步骤230中，电子设备10存储设备凭证及服务器20的因特网网址，以完成签发凭证操作。In step 230, the electronic device 10 stores the device certificate and the Internet address of the server 20 to complete the certificate issuance operation.
借由凭证管理方法200可完成签发电子设备10凭证。The certificate management method 200 can be used to issue the certificate of the electronic device 10 .
在实施例中，电子设备10～电子设备N位于设备生产在线，每一台电子设备都可以借由凭证管理方法200签发各自专属的凭证。In the embodiment, the electronic equipment 10 to electronic equipment N are located on the equipment production line, and each electronic equipment can issue its own exclusive certificate through the certificate management method 200 .
请参阅图3，图3依照本发明实施例绘示凭证管理系统300的身份验证流程的示意图。在实施例中，当电子设备10出厂后或卖出后(代表电子设备10已完成签发凭证操作)，被布署于案场(例如电子设备10电性耦接到太阳能板30) 并启动时，开启电子设备10的身份验证流程。Please refer to FIG. 3 , which is a schematic diagram of the identity verification process of the certificate management system 300 according to an embodiment of the present invention. In the embodiment, when the electronic device 10 leaves the factory or is sold (representing that the electronic device 10 has completed the certificate issuance operation), is deployed at the site (for example, the electronic device 10 is electrically coupled to the solar panel 30 ) and is started. , start the identity verification process of the electronic device 10 .
在身份验证流程中，电子设备10发送联机请求及设备凭证到服务器(步骤 S1)，服务器20通过公钥基础架设架构(Public Key Infrastructure，PKI)身份验证机制，以中继凭证装置22对设备凭证进行多个验证操作，验证操作包含：确认电子设备10确实拥有设备凭证、确认设备凭证为X.509凭证链技术中的叶凭证、检查设备凭证不在凭证撤除清单里及/或检查设备凭证的有效时间未过期等。In the identity verification process, the electronic device 10 sends a connection request and device certificate to the server (step S1). The server 20 uses the public key infrastructure (Public Key Infrastructure, PKI) identity verification mechanism to use the relay certificate device 22 to verify the device certificate. Perform multiple verification operations. The verification operations include: confirming that the electronic device 10 indeed possesses the device certificate, confirming that the device certificate is a leaf certificate in the X.509 certificate chain technology, checking that the device certificate is not in the certificate revocation list, and/or checking that the device certificate is valid. Time has not expired, etc.
其中，在密码学上，公钥基础架设架构借着数字证书认证机构将用户的个人身份跟公钥链结在一起。每个凭证中心用户的身份必须是唯一的。链结关系通过注册和发布过程建立，取决于担保级别，链结关系可能由凭证中心的各种软件或在人为监督下完成。公钥基础架设架构的确定链结关系的这角色称为注册管理中心。注册管理中心确保公钥和个人身份链结，可以防抵赖。关于公钥基础架设架构为已知技术，故此处不赘述之。Among them, in cryptography, the public key infrastructure links the user's personal identity with the public key through the digital certificate certification authority. The identity of each Credential Center user must be unique. The link relationship is established through the registration and issuance process. Depending on the guarantee level, the link relationship may be completed by various software in the credential center or under human supervision. The role of the public key infrastructure that determines link relationships is called the registry. The registration center ensures that the public key and personal identity are linked to prevent repudiation. The public key infrastructure architecture is a known technology, so it will not be described in detail here.
当设备凭证通过所有的验证操作，服务器20传送验证成功信息至电子设备 10(步骤S2)，并允许电子设备10进行后续操作，例如读取服务器20中的档案。当设备凭证没有通过所有的验证操作，服务器20传送验证失败信息至电子设备 10。When the device certificate passes all verification operations, the server 20 sends verification success information to the electronic device 10 (step S2), and allows the electronic device 10 to perform subsequent operations, such as reading files in the server 20. When the device certificate fails all verification operations, the server 20 sends verification failure information to the electronic device 10 .
请参阅图4，图4依照本发明实施例绘示凭证管理系统400的撤除电子设备的示意图。当电子设备10接收到验证成功信息之后(例如图3中的步骤S2，电子设备10接收来自服务器20的验证成功信息)，且服务器20超过接收时间没有接收到来自电子设备10的任何请求(例如服务器20超过一天都没收到来自电子设备10的请求)，则服务器20判断电子设备10遗失或出现问题(例如被黑客入侵或坏损)，服务器10撤除设备凭证，并将设备凭证写入凭证撤除清单。当服务器10撤除设备凭证后，若电子设备10重新启动，且电子设备10向服务器20发送联机请求(步骤S3)，则服务器20会回传认证失败信息给电子设备 10(步骤S4)。Please refer to FIG. 4. FIG. 4 is a schematic diagram of the removal of electronic equipment in the certificate management system 400 according to an embodiment of the present invention. When the electronic device 10 receives the verification success information (for example, step S2 in FIG. 3, the electronic device 10 receives the verification success information from the server 20), and the server 20 does not receive any request from the electronic device 10 for more than the reception time (for example, step S2 in FIG. 3, the electronic device 10 receives the verification success information from the server 20). If the server 20 does not receive a request from the electronic device 10 for more than one day), the server 20 determines that the electronic device 10 is lost or has a problem (such as being hacked or damaged), the server 10 revokes the device certificate, and writes the device certificate into the certificate removal Checklist. After the server 10 revokes the device certificate, if the electronic device 10 restarts and the electronic device 10 sends a connection request to the server 20 (step S3), the server 20 will return authentication failure information to the electronic device 10 (step S4).
请参阅图5，图5依照本发明实施例绘示凭证管理系统500的更新凭证的示意图。Please refer to FIG. 5 . FIG. 5 is a schematic diagram of the certificate management system 500 updating the certificate according to an embodiment of the present invention.
在上述的身份验证流程中，服务器20中的中继凭证装置22对设备凭证进行多个验证操作，验证操作包含检查设备凭证的有效时间是否过期。当服务器 20检查设备凭证的有效时间小于日期门限值(例如为90天)，则服务器20传送凭证即将失效信息给电子设备10(步骤S5)，电子设备10收到凭证即将失效信息后，传送凭证更新请求至服务器20(步骤S6)，服务器20传送更新凭证至电子设备10(步骤S7)，以完成凭证的更新。In the above-mentioned identity verification process, the relay certificate device 22 in the server 20 performs multiple verification operations on the device certificate. The verification operations include checking whether the validity time of the device certificate has expired. When the server 20 checks that the validity time of the device certificate is less than the date threshold (for example, 90 days), the server 20 transmits the information that the certificate is about to expire to the electronic device 10 (step S5). After receiving the information that the certificate is about to expire, the electronic device 10 sends The certificate update request is sent to the server 20 (step S6), and the server 20 transmits the update certificate to the electronic device 10 (step S7) to complete the update of the certificate.
本发明的方法，或特定型态或其部份，可以以程序代码的型态存在。程序代码可以包含于实体媒体，如软盘、光盘片、硬盘、或是任何其他机器可读取(如计算机可读取)存储介质，亦或不限于外在形式实物计算机程序产品，其中，当程序代码被机器，如计算机加载且执行时，此机器变成用以参与本发明的装置。程序代码也可以通过一些传送媒体，如电线或电缆、光纤、或是任何传输型态进行传送，其中，当程序代码被机器，如计算机接收、加载且执行时，此机器变成用以参与本发明的装置。当在一般用途处理单元实作时，程序代码结合处理单元提供操作类似于应用特定逻辑电路的独特装置。The method of the present invention, or a specific type or part thereof, may exist in the form of program code. The program code may be contained in physical media, such as floppy disks, optical disks, hard disks, or any other machine-readable (such as computer-readable) storage media, or it may not be limited to physical computer program products in external form. When the program When the code is loaded and executed by a machine, such as a computer, the machine becomes a device for participating in the invention. The program code can also be transmitted through some transmission media, such as wires or cables, optical fibers, or any transmission type. When the program code is received, loaded and executed by a machine, such as a computer, the machine becomes involved in the process. invented device. When implemented in a general purpose processing unit, the program code in conjunction with the processing unit provides a unique device that operates similarly to application specific logic circuits.
本发明的凭证管理系统及凭证管理方法提供了管理可联网的电子设备密钥与电子设备凭证生命周期的方法，包含电子设备密钥与电子设备凭证产生、电子设备更新、电子设备凭证撤除，以及通过签发凭证，可提供电子设备与电子设备之间以及电子设备与服务器之间辨识身份的功能，确保机密数据传输的安全性。The voucher management system and voucher management method of the present invention provide a method for managing the life cycle of networkable electronic equipment keys and electronic equipment certificates, including the generation of electronic equipment keys and electronic equipment certificates, electronic equipment updates, electronic equipment certificate removal, and By issuing certificates, the identity identification function between electronic devices and between electronic devices and servers can be provided to ensure the security of confidential data transmission.
虽然本发明已以实施方式揭露如上，然其并非用以限定本发明，任何本领域技术人员，在不脱离本发明的精神和范围内，当可作各种的更动与润饰，因此本发明的保护范围当权利要求书所界定者为准。Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Any person skilled in the art can make various modifications and modifications without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of protection shall be determined by the claims.
【符号说明】【Symbol Description】
100,300,400,500：凭证管理系统100,300,400,500: Credential management system
10～N：电子设备10～N：Electronic equipment
LK：通信链接LK: communication link
20：服务器20: Server
22：中继凭证装置22: Relay Certificate Device
30：太阳能板30: Solar panels
200：凭证管理方法200: Credential management method
210～230,S1～S7：步骤。210～230,S1～S7: steps.
Claims (12)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010934732.3A CN114244542B (en) | 2020-09-08 | 2020-09-08 | Voucher management system and voucher management method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010934732.3A CN114244542B (en) | 2020-09-08 | 2020-09-08 | Voucher management system and voucher management method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114244542A CN114244542A (en) | 2022-03-25 |
| CN114244542B true CN114244542B (en) | 2024-03-29 |
Family
ID=80742454
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010934732.3A Active CN114244542B (en) | 2020-09-08 | 2020-09-08 | Voucher management system and voucher management method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114244542B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101371550A (en) * | 2005-11-30 | 2009-02-18 | 意大利电信股份公司 | Method and system for automatically and securely provisioning a user of a mobile communication terminal with service access credentials for an online service |
| GB201714064D0 (en) * | 2017-09-01 | 2017-10-18 | Trustonic Ltd | Post-manufacture generation of device certificate and private key for public key infrastructure |
| KR101859339B1 (en) * | 2017-11-24 | 2018-06-27 | (주)소만사 | Appratus and method for network relay of moving target defense environment |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8621203B2 (en) * | 2009-06-22 | 2013-12-31 | Nokia Corporation | Method and apparatus for authenticating a mobile device |
-
2020
- 2020-09-08 CN CN202010934732.3A patent/CN114244542B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101371550A (en) * | 2005-11-30 | 2009-02-18 | 意大利电信股份公司 | Method and system for automatically and securely provisioning a user of a mobile communication terminal with service access credentials for an online service |
| GB201714064D0 (en) * | 2017-09-01 | 2017-10-18 | Trustonic Ltd | Post-manufacture generation of device certificate and private key for public key infrastructure |
| KR101859339B1 (en) * | 2017-11-24 | 2018-06-27 | (주)소만사 | Appratus and method for network relay of moving target defense environment |
Non-Patent Citations (1)
| Title |
|---|
| 天威诚信――广西CA合作模式报告书;电子政务(第23期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114244542A (en) | 2022-03-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109845188B (en) | Secure Handling of Proof of Authorization Requests | |
| US10142113B2 (en) | Identifying and maintaining secure communications | |
| US7849314B2 (en) | Method and system for secure authentication in a wireless network | |
| US8327142B2 (en) | System and method for facilitating secure online transactions | |
| US20200014694A1 (en) | Certificate system for verifying authorized and unauthorized secure sessions | |
| US10432595B2 (en) | Secure session creation system utililizing multiple keys | |
| US20090307486A1 (en) | System and method for secured network access utilizing a client .net software component | |
| US20160315777A1 (en) | Certificate updating | |
| CN114731279A (en) | Method and apparatus for automatic digital certificate verification | |
| US20090271630A1 (en) | Authentication system, authentication method and terminal device | |
| CN105471885A (en) | Remote server based on VPN connection and login method thereof | |
| CN114157428A (en) | Block chain-based digital certificate management method and system | |
| CN118740387A (en) | Certificate-based data authentication | |
| JP5186648B2 (en) | System and method for facilitating secure online transactions | |
| CN117397199A (en) | Secure root of trust registration and identity management for embedded devices | |
| KR102288445B1 (en) | On-boarding method, apparatus and program of authentication module for organization | |
| CN114244542B (en) | Voucher management system and voucher management method | |
| TWI804754B (en) | Certificate management system and certificate management method | |
| TWI735332B (en) | Certificate transfer system and certificate transfer method | |
| CN114244541B (en) | Certificate transfer system and certificate transfer method | |
| JP6254964B2 (en) | Authentication system, spare key management apparatus, spare key management method, and spare key management program | |
| TW202116038A (en) | Identification method and systerm of electronic device | |
| TWI759090B (en) | Platform login method | |
| KR20240099019A (en) | Tls-based authentication method without the intervention of a certification authority | |
| HK40070079A (en) | Methods and devices for automated digital certificate verification |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |