WO2025001230A1 - Digital certificate management method, apparatus, device and system and readable storage medium - Google Patents

Abstract

The present application relates to the technical field of digital certificates. Particularly disclosed are a digital certificate management method, apparatus, device and system and a nonvolatile readable storage medium, the method comprising: generating a digital certificate issuing request according to a demand of a target service and sending the digital certificate issuing request to a digital certificate device, such that the digital certificate device generates a certificate chain for the target service, the certificate chain at least comprising a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated on the basis of a confidential computing environment. Compared with a single public key infrastructure certificate or a certificate chain constituted only by public key infrastructure certificates in the prior art, the present application increases trusted parties in the certificate chain, thus reducing the security dependence on the certificate authority, improving the security of the certificate chain, and accordingly improving the security of certificate owners and the security of certificate users. The target service is deployed after the certificate chain passes signature verification, thereby improving the security of the target service.

Description

Digital certificate management method, device, equipment, system and readable storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to the Chinese patent application filed with the China Patent Office on June 28, 2023, with application number 202310772031.8, and application name “Digital Certificate Management Method, Device, Equipment, System and Readable Storage Medium”, all contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the field of digital certificate technology, and in particular to a digital certificate management method, device, equipment, system and non-volatile readable storage medium.

Background Art

A digital certificate is a digital identity document used to prove the identity of an entity (usually a person, organization, or website). A digital certificate is created using encryption technology and contains a public key and related identification information, such as the certificate holder's name, email address, organization name, etc. Digital certificates are widely used in e-commerce, Internet banking, email security, network security, and other fields.

Digital certificates are usually issued by an authoritative certificate authority (CA) to the certificate owner. The digital certificate contains the digital signature of the certificate authority for the certificate user to verify the legitimacy of the certificate owner. However, this digital certificate management mechanism is highly dependent on a third party (i.e., the certificate authority). When the certificate authority is under security threat or attacked by a man-in-the-middle attack, it poses a great threat to the security of the certificate user.

How to improve the security of the digital certificate management system, and thereby improve the security of certificate owners and certificate users, is a technical problem that technical personnel in this field need to solve.

Summary of the invention

The purpose of this application is to provide a digital certificate management method, device, equipment, system and non-volatile readable storage medium, which are used to improve the security of the digital certificate management system, thereby improving the security of the certificate owner and the security of the certificate user.

In order to solve the above technical problems, the present application provides a digital certificate management method, including:

Generate a digital certificate issuance request based on the needs of the target business;

Sending a digital certificate issuance request to a digital certificate device so that the digital certificate device generates a certificate chain for a target business;

After the certificate chain is verified to be legitimate, the target business is deployed using the certificate chain;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

In some implementations, at least one level of digital certificates in the certificate chain includes a public key infrastructure certificate and a confidential computing certificate.

In some implementations, the digital certificate device generates a certificate chain for the target service, including:

The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, thereby determining that the first-level digital certificate is legitimate and the first-level digital certificate device has the authority to issue digital certificates;

Starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, and determines that the current-level digital certificate is legal;

After the digital certificates at each level of the certificate chain are generated and all the digital certificates at each level pass the legitimacy verification, the certificate chain is obtained.

In some implementations, the first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, and determines that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates, including:

If the first-level digital certificate is a public key infrastructure certificate, the first-level digital certificate device is a certificate authority device, and the first-level digital certificate device signs the local digital certificate information with the private key in the locally generated asymmetric key to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key in the locally generated asymmetric key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates;

If the first-level digital certificate is a confidential computing certificate, the first-level digital certificate device is a confidential computing device with a confidential computing environment. The first-level digital certificate device signs the local digital certificate information with the private key of the asymmetric key generated in the local confidential computing environment to obtain the first-level digital certificate. After the first-level digital certificate is verified by the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

In some implementations, starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, after the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, determining that the current-level digital certificate is legitimate includes:

If the current-level digital certificate is a public key infrastructure certificate, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, and uses the public key in the asymmetric key generated by the previous-level digital certificate device to verify the signature of the current-level digital certificate. After the current-level digital certificate is passed, it is determined that the current-level digital certificate is legal;

If the current-level digital certificate is a confidential computing certificate, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, receives the private key in the asymmetric key generated by the previous-level digital certificate device, signs the self-signed local digital certificate information to obtain the current-level digital certificate, uses the public key in the asymmetric key generated in the local confidential computing environment to self-sign the current-level digital certificate, and after the current-level digital certificate is verified by the public key in the asymmetric key generated by the previous-level digital certificate device, the current-level digital certificate is determined to be legal.

In some implementations, the first-level digital certificate device signs the local digital certificate information using a private key of an asymmetric key generated in a local confidential computing environment, including:

After verifying the authenticity of the local confidential computing environment, the first-level digital certificate device signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment.

In some implementations, the current-level digital certificate device uses a private key in an asymmetric key generated in a local confidential computing environment to perform a self-signing process on the local digital certificate information of the current-level digital certificate device, including:

After the authenticity of the local confidential computing environment is verified, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device.

In some implementations, if the asymmetric key generated by the previous digital certificate device is an asymmetric key generated in a local confidential computing environment,

The current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device using the private key in the asymmetric key generated by the previous-level digital certificate device, including:

After the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information of the current-level digital certificate device to obtain the current-level digital certificate;

The current-level digital certificate device receives the private key in the asymmetric key generated by the previous-level digital certificate device and signs the local digital certificate information after the self-signature processing to obtain the current-level digital certificate, including:

After triggering and passing the authenticity verification of the local confidential computing environment of the previous level digital certificate device, the current level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous level digital certificate device to sign the local digital certificate information after self-signing to obtain the current level digital certificate.

In some implementations, performing authenticity verification on a local confidential computing environment includes:

The remote attestation data in the local digital certificate information of the device is sent to the device manufacturer to verify the authenticity of the local confidential computing environment.

In some implementations, the remote attestation data includes trustworthiness metric information of the device.

In some implementations, the remote attestation data includes a remote attestation data plaintext and a remote attestation data signature obtained by signing the remote attestation data plaintext using a hardware remote attestation private key of a local confidential computing environment of the device;

The remote proof data plaintext includes a hash value of a public key in an asymmetric key generated in a local confidential computing environment of the device and the trust measurement information of the device.

In some implementations, after the first-level digital certificate is verified by the public key of the asymmetric key generated in the local confidential computing environment, the first-level digital certificate is determined to be legitimate and the first-level digital certificate device has the authority to issue digital certificates, including:

The first-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate. After the first-level digital certificate is signed and verified by the entity public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

In some implementations, the current-level digital certificate device uses a public key in an asymmetric key generated in a local confidential computing environment to perform self-signature verification on the current-level digital certificate, including:

The current-level digital certificate device compares and calculates the hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate, and verifies the signature of the current-level digital certificate through the entity public key.

In some implementations, the digital certificate device generates a certificate chain for the target service, including:

If the current-level digital certificate has a signature of a previous-level digital certificate device, the current-level digital certificate device that has the current-level digital certificate will verify the signature of the previous-level digital certificate device and determine that the current-level digital certificate is legal;

If the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legal after verifying the signatures of the first preset number of the multiple signatures;

The first preset number is smaller than the number of signatures of the previous level digital certificate device in the current level digital certificate.

In some implementations, if the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legitimate after verifying a first preset number of signatures among the multiple signatures, including:

If the signatures of multiple upper-level digital certificate devices possessed by the current-level digital certificate include both public key infrastructure signatures and confidential computing signatures, the current-level digital certificate is determined to be legal after the current-level digital certificate device passes the signature verification of a second preset number of public key infrastructure signatures among the multiple signatures and passes the signature verification of a third preset number of confidential computing signatures among the multiple signatures;

The second preset number is less than the public key infrastructure signature of the previous digital certificate device in the current digital certificate. The third preset number is less than the number of confidential computing signatures of the previous level digital certificate device in the current level digital certificate.

In some implementations, generating a digital certificate issuance request based on the needs of the target business includes:

Determine the combination of the public key infrastructure certificate and confidential computing certificate in the certificate chain based on the security requirements of the target business;

Determine the corresponding digital certificate device according to the combination of the public key infrastructure certificate and the confidential computing certificate in the certificate chain;

Generate a digital certificate issuance request for each digital certificate device.

In some implementations, the method further includes:

After receiving an application request for a target service from a requesting device, the certificate chain is verified for legitimacy so that the requesting device determines that the target service is legitimate after determining that the certificate chain is legitimate.

In some implementations, the method is applied to a server that performs a Hypertext Transfer Protocol Secure connection;

The digital certificate management method also includes:

After receiving the access request to the server sent by the client, the certificate chain corresponding to the server's Hypertext Transfer Protocol Security connection service is verified and passed, and the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Security connection service is sent to the client so that the client can verify the last-level digital certificate, so that after the client verifies the last-level digital certificate, it can determine that the Hypertext Transfer Protocol Security connection service is legal and establish a Hypertext Transfer Protocol Security channel with the server.

In some implementations, applied to a file sending device;

The digital certificate management method also includes:

After receiving the legitimacy verification of the target file to be sent by the file receiving device, the digital certificates at all levels of the certificate chain are provided to the file receiving device, so that the file receiving device receives the target file after the legitimacy verification of the digital certificates at all levels of the certificate chain is passed.

To solve the above technical problems, the present application also provides a digital certificate management method, including:

The business device generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device;

The digital certificate device generates a certificate chain for the target business according to the digital certificate issuance request;

After the business equipment verifies the legitimacy of the certificate chain and passes it, it uses the certificate chain to deploy the target business;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

In order to solve the above technical problems, the present application also provides a digital certificate management system, including: a business device and a digital certificate device;

The business device is used to generate a digital certificate issuance request according to the needs of the target business; send the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business; after the certificate chain is verified for legitimacy, the target business is deployed using the certificate chain;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

In order to solve the above technical problems, the present application also provides a digital certificate management device, including:

A request unit, used to generate a digital certificate issuance request according to the needs of the target business;

A sending unit, used to send a digital certificate issuance request to a digital certificate device, so that the digital certificate device generates a certificate chain for a target service;

A deployment unit is used to deploy the target business using the certificate chain after the certificate chain passes the legitimacy verification;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

In order to solve the above technical problems, the present application also provides a digital certificate management device, including:

Memory for storing computer programs;

The processor is used to execute a computer program, and when the computer program is executed by the processor, the steps of any one of the digital certificate management methods described above are implemented.

In order to solve the above technical problems, the present application also provides a non-volatile readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above digital certificate management methods are implemented.

The digital certificate management method provided in the present application generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business, and the certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment; through the certificate chain composed of a hybrid digital certificate consisting of a public key infrastructure certificate and a confidential computing certificate, compared with a single public key infrastructure certificate or a certificate chain consisting only of a public key infrastructure certificate in the related technology, the trusted party in the certificate chain is increased, that is, in addition to the certificate authority, a trusted execution environment for generating confidential computing certificates is introduced as one of the trusted parties, thereby reducing the security dependence on the certificate authority, improving the security of the certificate chain, and further improving the security of the certificate owner and the security of the certificate user. The target business is deployed after the certificate chain is verified and passed, thereby improving the security of the target business.

In the digital certificate management method provided in the present application, at least one level of digital certificate in the certificate chain can include a public key infrastructure certificate and a confidential computing certificate, so as to further improve the security of a single-level digital certificate on the basis that digital certificates at all levels are of a single type of digital certificate, thereby improving the security of the entire certificate chain, and improving the security of certificate owners and certificate users.

The digital certificate management method provided in the present application obtains a more secure digital certificate signature scheme by first self-signing the current level confidential computing certificate through the confidential computing device in the digital certificate device, and then signing it by the digital certificate device of the previous level.

The present application also provides a digital certificate management device, equipment, system and non-volatile readable storage medium, which have the above-mentioned beneficial effects and are not repeated here.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions of the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of the structure of a digital certificate management system provided in an embodiment of the present application;

FIG2 is a flow chart of a digital certificate management method provided in an embodiment of the present application;

FIG3 is a flow chart of a digital certificate device generating a certificate chain for a target service provided by an embodiment of the present application;

FIG4 is a schematic diagram of a first certificate chain scenario provided in an embodiment of the present application;

FIG5 is a schematic diagram of a second certificate chain scenario provided in an embodiment of the present application;

FIG6 is a schematic diagram of a third certificate chain scenario provided in an embodiment of the present application;

FIG7 is a schematic diagram of a fourth certificate chain scenario provided in an embodiment of the present application;

FIG8 is a schematic diagram of a fifth certificate chain scenario provided in an embodiment of the present application;

FIG9 is a schematic diagram of a sixth certificate chain scenario provided in an embodiment of the present application;

FIG10 is a schematic diagram of the structure of a digital certificate management device provided in an embodiment of the present application;

FIG11 is a schematic diagram of the structure of a digital certificate management device provided in an embodiment of the present application.

DETAILED DESCRIPTION

The core of this application is to provide a digital certificate management method, device, equipment, system and non-volatile readable storage medium to improve the security of the digital certificate management system, thereby improving the security of the certificate owner and the security of the certificate user.

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

The first embodiment of the present application is described below.

FIG1 is a schematic diagram of the structure of a digital certificate management system provided in an embodiment of the present application.

To facilitate understanding, the digital certificate management system and related definitions provided by this application are first introduced.

As shown in FIG1 , the digital certificate management system provided in the embodiment of the present application includes: a business device 101 and a digital certificate device 102;

The service device 101 is used to generate a digital certificate issuance request according to the needs of the target service; send the digital certificate issuance request to the digital certificate device 102, so that the digital certificate device 102 generates a certificate chain of the target service; after the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

There are two main types of digital certificates: Public Key Infrastructure (PKI) certificates issued by a Certificate Authority (CA) and confidential computing certificates generated based on a Trusted Execution Environment (TEE).

A complete public key infrastructure basic structure consists of a certificate authority (CA), a digital certificate registration center (RA), an issuance system, a key management platform, and an application programming interface (API). In the embodiment of the present application, a digital certificate issued by a certificate authority is defined as a public key infrastructure certificate.

The trusted execution environment is a secure area built in the central processing unit through software and hardware methods to ensure that the programs and data loaded inside it are protected in terms of confidentiality and integrity. The equipment that builds the trusted execution environment needs to be pre-installed with an integrated commercial central processing unit computing chip. In the related technology, a trusted self-signed certificate can be constructed in the trusted execution environment, and the hardware trusted execution environment can be used as a hardware trusted root to strongly bind the certificate to the hardware environment, eliminating the influence of the public certificate authority. In the embodiment of the present application, a device with a trusted execution environment is defined as a confidential computing device, and a certificate constructed in a trusted execution environment is defined as a confidential computing certificate.

The owner of a digital certificate can be a person, organization, or website and can be deployed in a device.

In the related art, for requests to generate certificates, the digital certificate management system often provides a single type of digital certificate, that is, either providing a single public key infrastructure certificate or a certificate chain consisting of multiple public key infrastructure certificates, or generating a confidential computing certificate based on a trusted execution environment. It is understandable that since the confidential computing certificate generated based on a trusted execution environment binds the credibility of the certificate to the hardware environment, compared with the public key infrastructure issued by a third-party certificate authority, the confidential computing certificate generated based on the trusted execution environment is more reliable than the public key infrastructure issued by a third-party certificate authority. Facility certificates are more secure. However, relying solely on confidential computing certificates still relies on trust in the hardware environment. Therefore, in an embodiment of the present application, a hybrid data certificate solution is provided. For a request to generate a certificate, a certificate chain containing a hybrid digital certificate is generated, that is, the certificate chain contains both a public key infrastructure certificate and a confidential computing certificate. In the certificate chain generated by the digital certificate management system provided in the embodiment of the present application, compared to a single type of digital certificate in the related art, the trust system has been expanded from a single trust system to two trust systems, reducing the reliance on a single trust system, thereby further improving the security of the certificate chain, and the security of the certificate owner and the security of the certificate user have also been further improved.

It should be noted that in the embodiment of the present application, the digital certificate device 102 and the business device 101 together constitute the digital certificate device 102 corresponding to the digital certificates at each level of the certificate chain, that is, the business device 101 exists as the last level of digital certificate device 102, and the digital certificate devices 102 at each level hold the corresponding digital certificates. The certificate chain includes at least two levels of digital certificates, that is, in addition to the business device 101, at least one digital certificate device 102 is included to cooperate in generating the certificate chain. A first-level digital certificate may include multiple digital certificates. In the embodiment of the present application, "level" represents the link of the certificate chain.

When the business device 101 has a need to deploy the target business, it needs to obtain a digital certificate corresponding to the target business. The combination of different types of digital certificates in the certificate chain can be determined according to the security level of the target business, and then the digital certificate issuance request is sent to the digital certificate devices 102 at each level. The process of the digital certificate device 102 generating a certificate chain starts from the first-level digital certificate device 102, and first generates a root certificate obtained by self-signing. After the first-level certificate device passes the self-signature verification, it issues a second-level digital certificate to the second-level digital certificate device 102. The second-level digital certificate device 102 confirms that the second-level digital certificate is legal after passing the second-level digital certificate. If there is still a third-level digital certificate device 102, continue to execute the step of issuing a third-level digital certificate to the third-level digital certificate device 102. If the second-level digital certificate device 102 is the business device 101, then after the business device 101 receives the second-level digital certificate and passes the signature verification, it uses the legal second-level digital certificate to cooperate in deploying the target business. When the business demander wants to use the target business, the business demander obtains the digital certificates at each level in the certificate chain corresponding to the target business and verifies the signatures step by step. After passing the verification step by step, it is determined that the target business is legal and can be used.

With reference to the above-mentioned digital certificate management system, the digital certificate management method provided in the embodiment of the present application is described below in conjunction with the accompanying drawings.

The second embodiment of the present application is described below.

FIG2 is a flow chart of a digital certificate management method provided in an embodiment of the present application.

As shown in FIG2 , the digital certificate management method provided in the embodiment of the present application includes:

S201: Generate a digital certificate issuance request according to the needs of the target business.

S202: Send a digital certificate issuance request to a digital certificate device so that the digital certificate device generates a certificate chain for the target business; wherein the certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

S203: After the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain.

In specific implementation, the digital certificate management method provided in the embodiment of the present application can be applied to individual user devices or collective user devices, for example, it can be applied to file sending devices or service servers. In the embodiment of the present application, the steps of the digital certificate management method provided in the embodiment of the present application executed by the target device are defined.

When a service server needs to launch a service, it needs to obtain a digital certificate to ensure the legitimacy of the service in order to deploy the target service. When a file sending device needs to send a file, such as user A needs to send a file to user B, the file sent by user A must have a legal digital certificate to ensure the legitimacy of the file. In data encryption and decryption scenarios, digital certificates can also be used as a legitimacy verification tool.

For S201, the target business may include but is not limited to the business launched by the business server mentioned above, the file sending requirements of the file sending device, and the data encryption and decryption business. A digital certificate issuance request is generated according to the needs of the target business. Specifically, when the public infrastructure certificate and the confidential computing certificate are combined, various types of digital certificates can be generated according to different scenarios, requirements, and security levels for users to flexibly choose.

In one implementation, S202: generating a digital certificate issuance request according to the requirements of the target business may include:

Determine the combination of the public key infrastructure certificate and confidential computing certificate in the certificate chain based on the security requirements of the target business;

Determine the corresponding digital certificate device according to the combination of the public key infrastructure certificate and the confidential computing certificate in the certificate chain;

Generate a digital certificate issuance request for each digital certificate device.

Since the security of confidential computing certificates is relatively higher than that of public utility certificates, if the security requirements of the target business are high, more confidential computing certificates can be deployed in the certificate chain. However, since confidential computing certificates have hardware requirements for the device where they are located and the generation cost is high, if the security requirements of the target business are not high, fewer confidential computing certificates can be deployed in the certificate chain. In order to further improve the security of the target business, the first-level digital certificate of the certificate chain can include multiple digital certificates, which can also include digital certificates generated by multiple methods, to improve the security of the single-level digital certificate and further improve the security of the certificate chain.

For S202, as described in the previous embodiment of the present application, the device that generates the target business demand is the last level digital certificate device corresponding to the certificate chain, and the previous level digital certificate devices are all devices that generate and issue digital certificates. The business device sends a digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business. The business device can first send a digital certificate issuance request to the upper level digital certificate device. The digital certificate issuance request carries the information of the digital certificate devices at all levels corresponding to the entire certificate chain and the type of digital certificate that needs to be generated, so that the upper level digital certificate device of the business device passes the digital certificate issuance request upward step by step, and then generates digital certificates step by step downward to form a certificate chain. Alternatively, the business device can also send digital certificate issuance requests to digital certificate devices at all levels according to the corresponding digital certificate devices in the certificate chain. The digital certificate issuance request carries the information of the digital certificate devices at all levels corresponding to the entire certificate chain and the type of digital certificate that needs to be generated, so that the first level digital certificate device of the certificate chain generates digital certificates step by step downward to form a certificate chain.

Based on the hybrid certificate solution provided in the embodiment of the present application, the certificate chain includes at least one public key infrastructure certificate and one confidential computing certificate. For example, the certificate chain includes two levels of digital certificates and each level corresponds to a digital certificate, then one of the two levels of digital certificates is a public key infrastructure certificate and the other is a confidential computing certificate.

For S203, the legitimacy of the digital certificate is verified during the generation of the certificate chain, that is, during the step-by-step generation of the digital certificate. During the generation of the certificate chain, the digital certificate issuer signs the digital certificate information using the private key in the asymmetric key to obtain a digital certificate containing the plain text of the digital certificate information and the corresponding digital signature. The digital certificate issuer issues the digital certificate and the corresponding public key to the digital certificate owner. The digital certificate owner verifies the digital certificate using the public key in the asymmetric key, that is, decrypts the digital signature in the digital certificate using the public key and compares it with the plain text of the digital certificate information. If they are consistent, the digital certificate is determined to be legal, and if they are inconsistent, the digital certificate is determined to be illegal. In the step-by-step generation of the digital certificate, the signature verification is also carried out step by step. Each digital certificate of the next level can only be generated after the legitimacy verification is carried out through the signature verification before entering the generation process of the next level of digital certificate. After the digital certificates at all levels pass the legitimacy verification, a certificate chain that passes the legitimacy verification is obtained, which can be used to deploy the digital certificate of the target business.

The digital certificate information may include, but is not limited to: certificate issuer information, certificate owner information, and user-defined extended information. The digital certificate information of a confidential computing certificate also includes the public key of the certificate owner and even the remote attestation device of the certificate owner.

The management cycle of a digital certificate includes not only the process of generating a digital certificate, but also the process of using a digital certificate. The digital certificate management method provided in the embodiment of the present application may also include: after receiving an application request from a requesting device for a target service, verifying the legitimacy of the certificate chain so that the requesting device determines that the target service is legitimate after determining that the certificate chain is legitimate.

In the embodiment of the present application, the digital certificate user is defined as the requesting device that wants to apply the target service. When the service device provides the target service to the requesting device, or the requesting device requests the service device to use the target service, the requesting device needs to verify the legitimacy of the certificate chain corresponding to the target service. The legitimacy verification process is similar to the legitimacy verification process when the certificate chain is generated. By verifying the signatures step by step, when it is determined that the digital certificates at all levels of the certificate chain are legal, the requesting device completes the handshake with the service device and can use the target service.

The digital certificate management method provided in the embodiment of the present application generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target business, and the certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment; the certificate chain composed of a hybrid digital certificate consisting of a public key infrastructure certificate and a confidential computing certificate increases the trusted party in the certificate chain compared to a single public key infrastructure certificate or a certificate chain consisting only of a public key infrastructure certificate in the related technology, that is, in addition to the certificate authority, a trusted execution environment for generating a confidential computing certificate is introduced as one of the trusted parties, thereby reducing the security dependence on the certificate authority, improving the security of the certificate chain, and further improving the security of the certificate owner and the security of the certificate user. The target business is deployed after the certificate chain is verified and passed, thereby improving the security of the target business.

The third embodiment of the present application is described below.

In the above embodiment, in order to further improve the security of the certificate chain, in addition to including at least one public key infrastructure certificate and one confidential computing certificate in the certificate chain, the security of the certificate chain can also be improved by including multiple digital certificates in the primary digital certificate. The primary digital certificate can also be a hybrid digital certificate solution.

On the basis of the above embodiments, in the digital certificate management method provided in the embodiments of the present application, at least one level of digital certificate in the certificate chain can be set to include a public key infrastructure certificate and a confidential computing certificate.

In the digital certificate management method provided in the present application, at least one level of digital certificate in the certificate chain can include a public key infrastructure certificate and a confidential computing certificate, so as to further improve the security of a single-level digital certificate on the basis that digital certificates at all levels are of a single type of digital certificate, thereby improving the security of the entire certificate chain, and improving the security of certificate owners and certificate users.

The fourth embodiment of the present application is described below.

FIG3 is a flow chart of a digital certificate device generating a certificate chain for a target business provided by an embodiment of the present application.

Based on the above embodiments, the embodiments of the present application further illustrate the process of generating a certificate chain.

In the digital certificate management method provided in the embodiment of the present application, in S202, the digital certificate device generates a certificate chain for the target service, including:

S301: The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates a first-level digital certificate by self-signing and verifies the first-level digital certificate, thereby determining that the first-level digital certificate is legal and that the first-level digital certificate device has the authority to issue digital certificates.

S302: Starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, and determines that the current-level digital certificate is legal.

S303: After the digital certificates at all levels of the certificate chain are generated and all the digital certificates at all levels pass the legitimacy verification, the certificate chain is obtained.

In the specific implementation, for S301, the owner of the first-level digital certificate corresponding to the certificate chain is the first-level digital certificate device. The first-level digital certificate device generates the first-level digital certificate by self-signing, which is the root certificate of the certificate chain. The first-level digital certificate device verifies the signature of the first-level digital certificate by itself, and after passing the verification, it is determined that the first-level digital certificate is legal, and the first-level digital certificate device has the authority to issue digital certificates.

S301: The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the first-level digital certificate, and determines that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates, which may include:

If the first-level digital certificate is a public key infrastructure certificate, the first-level digital certificate device is a certificate authority device, and the first-level digital certificate device signs the local digital certificate information with the private key in the locally generated asymmetric key to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key in the locally generated asymmetric key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates;

If the first-level digital certificate is a confidential computing certificate, the first-level digital certificate device is a confidential computing device with a confidential computing environment. The first-level digital certificate device signs the local digital certificate information with the private key of the asymmetric key generated in the local confidential computing environment to obtain the first-level digital certificate. After the first-level digital certificate is verified by the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

The public key infrastructure certificate in the first-level digital certificate is generated and issued by a certificate authority. When used as a first-level digital certificate, the first-level digital certificate device should be a certificate authority device, so as to generate a first-level public key infrastructure certificate by itself. During the generation process, the first-level digital certificate device generates a pair of asymmetric keys locally, and uses the private key therein to sign the plaintext of the local digital certificate information, thereby obtaining a first-level digital certificate containing the plaintext of the local digital certificate information and the digital signature of the local digital certificate information. The first-level digital certificate device then verifies the signature of the first-level digital certificate using the public key in the above-mentioned asymmetric key. If it passes, it is determined that the first-level digital certificate is legal, and at this time the first-level digital certificate device can issue a digital certificate to the second-level digital certificate device.

The confidential computing certificate in the first-level digital certificate should be generated based on the local precision computing environment, so the first-level digital certificate device should be a confidential computing device with a confidential computing environment. During the generation process, the first-level confidential computing device generates a pair of asymmetric keys in the local precision computing environment, and uses the private key therein to sign the plaintext of the local digital certificate information, thereby obtaining a first-level digital certificate containing the plaintext of the local digital certificate information and the digital signature of the local digital certificate information. The first-level precision computing device then verifies the signature of the first-level digital certificate using the public key in the above asymmetric key. If it passes, it is determined that the first-level digital certificate is legal, and at this time the first-level digital certificate device can issue a digital certificate to the second-level digital certificate device.

In order to ensure that the confidential computing certificate in the first-level digital certificate is generated in a confidential computing environment, the authenticity of the local confidential computing environment needs to be verified. Then the first-level digital certificate device signs the local digital certificate information by using the private key of the asymmetric key generated in the local confidential computing environment, which may include: after the first-level digital certificate device verifies the authenticity of the local confidential computing environment, it signs the local digital certificate information by using the private key of the asymmetric key generated in the local confidential computing environment. It should be noted that the step of the first-level digital certificate device verifying the authenticity of the local confidential computing environment and the step of the first-level digital certificate device signing the local digital certificate information by using the private key of the asymmetric key generated in the local confidential computing environment may have no sequential relationship, and the step of the first-level digital certificate device verifying the authenticity of the local confidential computing environment and the step of the first-level digital certificate device signing the local digital certificate information by using the public key of the locally generated asymmetric key The steps of verifying the signature of the certificate may also have no order relationship, that is, after the first-level digital certificate device verifies the authenticity of the local confidential computing environment and verifies the signature of the first-level digital certificate through the public key in the locally generated asymmetric key, it can be determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates. For S302, in the embodiment of the present application, starting from the second-level digital certificate of the certificate chain, the generation of digital certificates at all levels requires the help of the previous-level digital certificate device. The current-level digital certificate device provides the local digital certificate information to the previous-level digital certificate device, and the previous-level digital certificate device signs the local digital certificate information of the current-level digital certificate device using the public key in the locally generated asymmetric key to obtain the current-level digital certificate, and provides the current-level digital certificate and the corresponding public key to the current-level digital certificate device. After the current-level digital certificate device verifies the signature of the current-level digital certificate using the public key, it is determined that the current-level digital certificate is legal.

S302: From the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, after the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, determining that the current-level digital certificate is legal may include:

If the current-level digital certificate is a public key infrastructure certificate, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, and uses the public key in the asymmetric key generated by the previous-level digital certificate device to verify the signature of the current-level digital certificate. After the current-level digital certificate is passed, it is determined that the current-level digital certificate is legal;

If the current-level digital certificate is a confidential computing certificate, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, receives the private key in the asymmetric key generated by the previous-level digital certificate device, signs the self-signed local digital certificate information to obtain the current-level digital certificate, uses the public key in the asymmetric key generated in the local confidential computing environment to self-sign the current-level digital certificate, and after the current-level digital certificate is verified by the public key in the asymmetric key generated by the previous-level digital certificate device, the current-level digital certificate is determined to be legal.

The public key infrastructure certificate in the non-first-level digital certificate is completely signed and issued by the previous-level digital certificate device. During the generation process, the current-level digital certificate device provides the local digital certificate information to the previous-level digital certificate device, and the previous-level digital certificate device uses the private key in the locally generated asymmetric key to sign the local digital certificate information of the current-level digital certificate device, and obtains the current-level digital certificate containing the local digital certificate information plaintext of the current-level digital certificate device and the digital signature of the local digital certificate information of the current-level digital certificate device. The previous-level digital certificate device sends the current-level digital certificate and the corresponding public key to the current-level digital certificate device. The current-level digital certificate device verifies the signature of the current-level digital certificate through the public key, and determines that the current-level digital certificate is legal after passing. If the current-level digital certificate device is a business device, the certificate chain is generated; if the current-level digital certificate device is not a business device, the current-level digital certificate device continues to issue digital certificates to the next-level digital certificate device.

The confidential computing certificates in non-first-level digital certificates are self-signed by the current-level digital certificate device and signed using the private key of the previous-level digital certificate device. During the generation process, the current-level digital certificate device generates a pair of asymmetric keys in the local confidential computing environment, and uses the private key therein to sign the plaintext of the local digital certificate information, thereby obtaining local digital certificate information containing the plaintext of the local digital certificate information and the digital signature of the local digital certificate information. The current-level digital certificate device then signs the self-signed local digital certificate information using the private key in the asymmetric key generated by the previous-level digital certificate device, thereby obtaining the current-level digital certificate containing the self-signature and the previous-level signature. When verifying the signature, the current-level digital certificate device uses the corresponding public key in the local confidential computing environment to sign the self-signed signature in the current-level digital certificate. Verify the signature and use the public key provided by the previous digital certificate device to verify the previous signature in the current digital certificate.

It can be seen that the embodiment of the present application provides a new confidential computing certificate solution, that is, the confidential computing certificate contains both a self-signature and an upper-level signature, which is more secure than the confidential computing certificate in the related technology.

In order to ensure that the confidential computing certificate in the current-level digital certificate is generated in a confidential computing environment, the authenticity of the local confidential computing environment needs to be verified. Then the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, which can include: after the current-level digital certificate device verifies the authenticity of the local confidential computing environment, it uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device. By verifying the authenticity of the local confidential computing environment before self-signing, and then using the private key in the asymmetric key generated in the local confidential computing environment to self-sign after the authenticity verification, the security of generating confidential computing certificates is further improved. It should be noted that the step in which the current-level digital certificate device verifies the authenticity of the local confidential computing environment and the step in which the current-level digital certificate device signs the local digital certificate information by using the private key of the asymmetric key generated in the local confidential computing environment may have no sequential relationship, and the step in which the current-level digital certificate device verifies the authenticity of the local confidential computing environment and the step in which the current-level digital certificate device verifies the signature of the current-level digital certificate by using the public key in the locally generated asymmetric key may also have no sequential relationship, that is, the current-level digital certificate can be determined to be legal after the current-level digital certificate device verifies the authenticity of the local confidential computing environment and verifies the signature of the current-level digital certificate by using the public key in the locally generated asymmetric key.

Regardless of the type of the current-level digital certificate, it needs to be signed by the previous-level digital certificate device. If the asymmetric key provided by the previous-level digital certificate device for signing and verifying the signature is generated in a confidential computing environment, the authenticity of the local confidential computing environment should also be verified for the previous-level digital certificate device on the previous-level digital signature device.

If the asymmetric key generated by the previous-level digital certificate device is an asymmetric key generated in a local confidential computing environment, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, which may include: after the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate obtained by obtaining the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information of the current-level digital certificate device.

If the asymmetric key generated by the previous-level digital certificate device is an asymmetric key generated in the local confidential computing environment, the current-level digital certificate device receives the private key in the asymmetric key generated by the previous-level digital certificate device to sign the self-signed local digital certificate information to obtain the current-level digital certificate, which may include: after the current-level digital certificate device triggers and passes the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, obtaining the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the self-signed local digital certificate information to obtain the current-level digital certificate.

That is to say, if the previous-level digital certificate device uses the private key in the asymmetric key generated in the confidential computing environment to sign the digital certificate for the current-level digital certificate device, the authenticity of the confidential computing environment of the previous-level digital certificate device must be verified first, and then the current-level digital certificate issued by the previous-level digital certificate device is received.

In some implementations, after the first-level digital certificate is verified by the public key of the asymmetric key generated in the local confidential computing environment, determining that the first-level digital certificate is legitimate and the first-level digital certificate device has the authority to issue the digital certificate may include: the first-level digital certificate device compares the calculated confidential computing certificate with the subject The hash value of the public key is consistent with the hash value of the public key in the remote attestation data in the confidential computing certificate, and after the signature of the first-level digital certificate is verified by the main body public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates. The remote attestation data is the data in the confidential computing certificate used to verify the authenticity of the local confidential computing environment of the device. When the first-level digital certificate device generates the first-level digital certificate, by placing the hash value of the public key in the asymmetric key generated based on the confidential computing environment in the remote attestation data, the legality verification of the public key hash value can be completed when the authenticity of the local confidential computing environment of the first-level digital certificate device is remotely attested. When the first-level digital certificate device verifies the signature of the local confidential computing certificate, after the local confidential computing environment is remotely attested, the hash value of the main body public key in the confidential computing certificate calculated is compared with the hash value of the public key in the remote attestation data in the confidential computing certificate. After the signature of the first-level digital certificate is verified by the main body public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates.

Similarly, the current-level digital certificate device uses the public key in the asymmetric key generated in the local confidential computing environment to perform self-signature verification on the current-level digital certificate, which may include: the current-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate to be consistent, and verifies the current-level digital certificate through the entity public key. When the current-level digital certificate device generates the current-level digital certificate, by placing the hash value of the public key in the asymmetric key generated based on the confidential computing environment in the remote attestation data, the legitimacy of the public key hash value can be verified when the authenticity of the local confidential computing environment of the current-level digital certificate device is remotely proven, and when the current-level digital certificate device verifies the local confidential computing certificate, after the local confidential computing environment is remotely proven to be authentic, the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate are compared to be consistent, and after the current-level digital certificate is verified through the entity public key, it is determined that the current-level digital certificate is legal and the current-level digital certificate device has the authority to issue digital certificates.

For the verification of the self-signature in the confidential computing certificate, if the existence of the local confidential computing environment is proved by remote attestation data, and the entity public key carried in the confidential computing certificate is consistent with the public key hash value in the remote attestation data, it can be determined that the confidential computing certificate was generated in the local confidential computing environment, and then the entity public key can be used to verify the self-signature in the confidential computing certificate.

The same applies to signing and verifying the asymmetric key generated in the confidential computing environment provided by the previous-level confidential computing device. After the current-level digital certificate device triggers the previous-level digital certificate device to verify the authenticity of the local confidential computing environment, the previous-level digital certificate device completes the above steps and passes the authenticity verification of the local confidential computing environment and the consistency verification of the entity public key. It can then sign or verify the current-level digital certificate performed by the previous-level confidential computing device, thereby further improving the security of the digital certificate.

The digital certificate management method provided in the embodiment of the present application obtains a more secure digital certificate signature scheme by having the confidential computing device in the digital certificate device first self-sign the current level confidential computing certificate, and then having the previous level digital certificate device sign it.

The fifth embodiment of the present application is described below.

Based on the above embodiments, the embodiments of the present application further illustrate a method for verifying the authenticity of a local confidential computing environment of a confidential computing device.

In the digital certificate management method provided in the embodiment of the present application, authenticity verification of the local confidential computing environment may include: sending remote certification data in the local digital certificate information of the device to the device manufacturer to verify the authenticity of the local confidential computing environment.

The remote attestation data includes the trust measurement information of the device, such as the hardware trust measurement information of the device. The device manufacturer uses the trust measurement information in the remote attestation data to determine that the device has a confidential computing environment and feedbacks the authenticity of the local confidential computing environment to the device.

To further improve the reliability of authenticity verification, the remote attestation data may include the remote attestation data plaintext and the remote attestation data signature obtained by signing the remote attestation data plaintext using the hardware remote attestation private key of the local confidential computing environment of the device; wherein the remote attestation data plaintext includes the hash value of the public key in the asymmetric key generated in the local confidential computing environment of the device and the trust measurement information of the device. After the device manufacturer verifies the remote attestation data using the remote attestation public key of the local confidential computing environment of the device, it can be determined that the device has passed the authenticity verification, and feedback to the device that the local confidential computing environment is authentic.

The sixth embodiment of the present application is described below.

In the above embodiment, it is introduced that the first-level digital certificate of the certificate chain may include one digital certificate or multiple digital certificates. The situation of including multiple digital certificates can further improve the security of the certificate chain. A digital certificate device with multiple digital certificates can add multiple signatures when issuing a certificate for a digital certificate device at the next level, that is, the signature corresponds to the digital certificate device that issued the certificate one by one. If the current-level digital certificate has multiple signatures of the previous-level digital certificate device, when verifying the signature, it can be set that the current-level digital certificate must be confirmed to be legal only by verifying all signatures, or it can be set to confirm the legality of the current-level digital certificate by verifying some signatures.

In the digital certificate management method provided in the embodiment of the present application, the digital certificate device generates a certificate chain for the target service in S202, which may include:

If the current-level digital certificate has a signature of a previous-level digital certificate device, the current-level digital certificate device that has the current-level digital certificate will verify the signature of the previous-level digital certificate device and determine that the current-level digital certificate is legal;

If the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legal after verifying the signatures of the first preset number of the multiple signatures;

The first preset number is smaller than the number of signatures of the previous level digital certificate device in the current level digital certificate.

In specific implementations, the embodiment of the present application adopts a threshold signature verification method for the situation where the current-level digital certificate has signatures of multiple previous-level digital certificate devices. That is, the current-level digital certificate can be determined to be legal after only some of the signatures of the previous-level digital certificate devices are verified.

Considering the situation that the first-level digital certificate provided by the above embodiment of the present application includes a public key infrastructure certificate and a confidential computing certificate, if the previous-level digital certificate device has both a public key infrastructure certificate and a confidential computing certificate, the previous-level digital certificate device can perform a public key infrastructure signature and a confidential computing signature on the current-level digital certificate, and at this time, the type can be distinguished and set a threshold. If the current-level digital certificate has signatures of multiple previous-level digital certificate devices, the current-level digital certificate device determines that the current-level digital certificate is legal after the first preset number of signatures in the multiple signatures are verified, including:

If the signatures of multiple upper-level digital certificate devices possessed by the current-level digital certificate include both public key infrastructure signatures and confidential computing signatures, the current-level digital certificate is determined to be legal after the current-level digital certificate device passes the signature verification of a second preset number of public key infrastructure signatures among the multiple signatures and passes the signature verification of a third preset number of confidential computing signatures among the multiple signatures;

Among them, the second preset number is less than the number of public key infrastructure signatures of the previous level digital certificate device in the current level digital certificate, and the third preset number is less than the number of confidential computing signatures of the previous level digital certificate device in the current level digital certificate.

It should be noted that if the previous-level digital certificate device has multiple previous-level digital certificates, multiple pairs of corresponding asymmetric keys can be generated for signing and verifying the current-level digital certificate, but not all private keys need to be used for signing the current-level digital certificate.

The seventh embodiment of the present application is described below.

Figure 4 is a schematic diagram of the first certificate chain scenario provided in an embodiment of the present application; Figure 5 is a schematic diagram of the second certificate chain scenario provided in an embodiment of the present application; Figure 6 is a schematic diagram of the third certificate chain scenario provided in an embodiment of the present application; Figure 7 is a schematic diagram of the fourth certificate chain scenario provided in an embodiment of the present application; Figure 8 is a schematic diagram of the fifth certificate chain scenario provided in an embodiment of the present application; Figure 9 is a schematic diagram of the sixth certificate chain scenario provided in an embodiment of the present application.

Based on the above embodiments, the embodiments of the present application use two adjacent levels of digital certificates in a certificate chain to illustrate the scenarios, which may specifically include six scenarios.

As shown in Figure 4, in the first scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate and the current-level digital certificate can both be public key infrastructure certificates. If the previous-level digital certificate is the first-level digital certificate of the certificate chain, the previous-level digital certificate is a self-signed public key infrastructure certificate, and the current-level digital certificate is signed by the private key provided by the previous-level digital certificate device 401, and verified by the public key provided by the previous-level digital certificate device 401. If the previous-level digital certificate is not the first-level digital certificate of the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

As shown in FIG5 , in the second scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a public key infrastructure certificate, and the current-level digital certificate is a confidential computing certificate. If the previous-level digital certificate is the first-level digital certificate of the certificate chain, the previous-level digital certificate is a self-signed public key infrastructure certificate, and the current-level confidential computing certificate is generated in a local confidential computing environment, and is self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous-level digital certificate device 401 using the private key generated locally, to ensure the credibility of the current-level digital certificate and improve the efficiency of using the current-level digital certificate. If the previous-level digital certificate is not the first-level digital certificate of the certificate chain, it will be issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, the next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

As shown in FIG6 , in the third scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate and the current-level digital certificate are both confidential computing certificates. If the previous-level digital certificate is the first-level digital certificate of the certificate chain, the previous-level digital certificate is a self-signed confidential computing certificate, which is specifically generated by the confidential computing environment of the previous-level digital certificate device 401. The current-level confidential computing certificate is generated in a local confidential computing environment, self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous-level digital certificate device 401 using the private key generated locally. If the previous-level digital certificate is not the first-level digital certificate of the certificate chain, it is then issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

As shown in FIG7 , in the fourth scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a confidential computing certificate, and the current-level digital certificate is a public key infrastructure certificate. If the previous-level digital certificate is the first-level digital certificate in the certificate chain, the previous-level digital certificate is a self-signed confidential computing certificate, which is specifically generated by the confidential computing environment of the previous-level digital certificate device 401. The current-level confidential computing certificate is generated in the local confidential computing environment, self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous-level digital certificate. Device 401 signs with a locally generated private key. If the previous digital certificate is not the first digital certificate of the certificate chain, it will be issued by the next digital certificate device according to the certificate type. When the current digital certificate is not a business certificate, the next digital certificate can be derived to extend the certificate chain. The next digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

As shown in FIG8 , in the fifth scenario, corresponding to the previous digital certificate device 401 and the current digital certificate device 402, the previous digital certificate is a hybrid certificate, that is, the previous digital certificate device 401 has both a public key infrastructure certificate and a confidential computing certificate, and the current digital certificate is a confidential computing certificate. If the previous digital certificate is the first-level digital certificate of the certificate chain, the previous digital certificate includes a self-signed public key infrastructure certificate and a self-signed confidential computing certificate. The current confidential computing certificate is generated in a local confidential computing environment, self-signed by the private key in the asymmetric key generated by the local confidential computing environment, and then signed by the previous digital certificate device 401 using the private key generated locally. If the previous digital certificate is not the first-level digital certificate of the certificate chain, it is issued by the next-level digital certificate device according to the certificate type. When the current digital certificate is not a business certificate, the next digital certificate can be derived to extend the certificate chain. The next digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

As shown in FIG9 , in the sixth scenario, corresponding to the previous-level digital certificate device 401 and the current-level digital certificate device 402, the previous-level digital certificate is a hybrid certificate, that is, the previous-level digital certificate device 401 has both a public key infrastructure certificate and a confidential computing certificate, and the current-level digital certificate is a public key infrastructure certificate. If the previous-level digital certificate is the first-level digital certificate of the certificate chain, the previous-level digital certificate includes a self-signed public key infrastructure certificate and a self-signed confidential computing certificate. The current-level digital certificate is signed by the private key provided by the previous-level digital certificate device 401 and verified by the public key provided by the first-level digital certificate device. If the previous-level digital certificate is not the first-level digital certificate of the certificate chain, it is issued by the next-level digital certificate device according to the certificate type. If the current-level digital certificate is not a business certificate, a next-level digital certificate can be derived to extend the certificate chain. The next-level digital certificate can be a public key infrastructure certificate or a confidential computing certificate.

The eighth embodiment of the present application is described below.

Based on the above embodiments, the embodiments of the present application illustrate an application scenario of a digital certificate management method.

In the digital certificate management method provided in the embodiment of the present application, the business server includes a server for performing a Hypertext Transfer Protocol Security connection.

The digital certificate management method provided in the embodiment of the present application may also include: after receiving an access request to a server sent by a client, after verifying the certificate chain corresponding to the server's Hypertext Transfer Protocol Secure (HTTPS) protocol connection service, the last-level digital certificate of the certificate chain corresponding to the HTTPS protocol connection service is sent to the client so that the client can verify the last-level digital certificate, so that after verifying the last-level digital certificate, the client can determine that the HTTPS protocol connection service is legal and establish a HTTPS protocol secure channel with the server.

It should be noted that every time the client reopens the website of the business server, it needs to re-execute the signature verification process of the certificate chain.

The ninth embodiment of the present application is described below.

Based on the above embodiments, the embodiment of the present application describes an application scenario of another digital certificate management method.

The digital certificate management method provided in the embodiment of the present application can also be applied to a file sending device.

The digital certificate management method provided in the embodiment of the present application may also include: after receiving the legitimacy verification of the target file to be sent by the file receiving device, providing the digital certificates at all levels of the certificate chain to the file receiving device, so that the file receiving device receives the target file after performing legitimacy verification on the digital certificates at all levels of the certificate chain.

Each time a file receiving device receives a file sent by a file sending device, it needs to verify the signature of the certificate chain corresponding to the file, and confirm that the file is legal after passing the verification.

The tenth embodiment of the present application is described below.

Based on the above embodiments, the present application also provides a digital certificate management method, including:

The business device generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device;

The digital certificate device generates a certificate chain for the target business according to the digital certificate issuance request;

After the business equipment verifies the legitimacy of the certificate chain and passes it, it uses the certificate chain to deploy the target business;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

The embodiments of the present application correspond to the embodiments of the methods in the above part, so the specific implementation methods of the embodiments of the present application can be found in the description of the embodiments of the methods in the above part, which will not be repeated here.

The above describes in detail various embodiments corresponding to the digital certificate management method. On this basis, the present application also discloses a digital certificate management apparatus, device and non-volatile readable storage medium corresponding to the above method.

The eleventh embodiment of the present application is described below.

FIG10 is a schematic diagram of the structure of a digital certificate management device provided in an embodiment of the present application.

As shown in FIG10 , the digital certificate management device provided in the embodiment of the present application includes:

The request unit 1001 is used to generate a digital certificate issuance request according to the requirements of the target business;

The sending unit 1002 is used to send the digital certificate issuance request to the digital certificate device so that the digital certificate device generates a certificate chain for the target service;

The deployment unit 1003 is used to deploy the target service using the certificate chain after the certificate chain passes the validity verification;

The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment.

In some implementations, the digital certificate management device provided in the embodiments of the present application may also include:

The first verification unit is used to verify the legitimacy of the certificate chain after receiving an application request for a target service from a requesting device, so that the requesting device can determine that the target service is legitimate after determining that the certificate chain is legitimate.

In some implementations, the digital certificate management device provided in the embodiment of the present application is applied to a business server, specifically a server for performing a Hypertext Transfer Protocol Security connection; then the digital certificate management device provided in the embodiment of the present application may also include:

The second verification unit is used to, after receiving an access request to the server sent by the client, verify the certificate chain corresponding to the server's Hypertext Transfer Protocol Security connection service, and then send the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Security connection service to the client so that the client can verify the last-level digital certificate, so that after the client verifies the last-level digital certificate, it can determine that the Hypertext Transfer Protocol Security connection service is legal and establish a Hypertext Transfer Protocol Security channel with the server.

In some implementations, the digital certificate management device provided in the embodiment of the present application is applied to a file sending device; then the digital certificate management device provided in the embodiment of the present application may also include:

The third verification unit is used to provide the digital certificates of each level of the certificate chain to the file receiving device after receiving the legitimacy verification of the target file to be sent by the file receiving device, so that the file receiving device receives the target file after passing the legitimacy verification of the digital certificates of each level of the certificate chain.

Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, which will not be repeated here.

The twelfth embodiment of the present application is described below.

FIG11 is a schematic diagram of the structure of a digital certificate management device provided in an embodiment of the present application.

As shown in FIG11 , the digital certificate management device provided in the embodiment of the present application includes:

A memory 1110, used for storing a computer program 1111;

The processor 1120 is used to execute the computer program 1111. When the computer program 1111 is executed by the processor 1120, the steps of the digital certificate management method in any of the above embodiments are implemented.

Among them, the processor 1120 may include one or more processing cores, such as a 3-core processor, an 8-core processor, etc. The processor 1120 may be implemented in at least one hardware form of a digital signal processing DSP (Digital Signal Processing), a field-programmable gate array FPGA (Field-Programmable Gate Array), and a programmable logic array PLA (Programmable Logic Array). The processor 1120 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 1120 may be integrated with a graphics processor GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1120 may also include an artificial intelligence AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

The memory 1110 may include one or more non-volatile readable storage media, which may be non-transitory. The memory 1110 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 1110 is at least used to store the following computer program 1111, wherein the computer program 1111, after being loaded and executed by the processor 1120, can implement the relevant steps in the digital certificate management method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 1110 may also include an operating system 1112 and data 1113, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 1112 may be Windows. Data 1113 may include, but is not limited to, the data involved in the above method.

In some embodiments, the digital certificate management device may further include a display screen 1130 , a power supply 1140 , a communication interface 1150 , an input/output interface 1160 , a sensor 1170 , and a communication bus 1180 .

Those skilled in the art will appreciate that the structure shown in FIG. 11 does not constitute a limitation on the digital certificate management device, and may include more or fewer components than those shown in the figure.

The digital certificate management device provided in the embodiment of the present application includes a memory and a processor. When the processor executes the program stored in the memory, it can implement the above digital certificate management method, and the effect is the same as above.

The thirteenth embodiment of the present application is described below.

It should be noted that the above-described embodiments of the apparatus and equipment are merely schematic. For example, the division of modules is merely a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or modules, which may be electrical, mechanical or other forms. The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place. Or it can be distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a non-volatile readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the various embodiments of the present application.

To this end, an embodiment of the present application further provides a non-volatile readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the digital certificate management method are implemented.

The non-volatile readable storage medium may include: a U disk, a mobile hard disk, a read-only memory ROM (Read-Only Memory), a random access memory RAM (Random Access Memory), a magnetic disk or an optical disk, and other media that can store program codes.

The computer program contained in the non-volatile readable storage medium provided in this embodiment can implement the steps of the above digital certificate management method when executed by the processor, and the effect is the same as above.

The above is a detailed introduction to a digital certificate management method, device, equipment, system and non-volatile readable storage medium provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referenced to each other. For the devices, equipment and non-volatile readable storage medium disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims (24)

A digital certificate management method, characterized by comprising: Generate a digital certificate issuance request based on the needs of the target business; Sending the digital certificate issuance request to a digital certificate device so that the digital certificate device generates a certificate chain for the target service; After the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment. The digital certificate management method according to claim 1 is characterized in that at least one level of digital certificate in the certificate chain includes a public key infrastructure certificate and a confidential computing certificate. The digital certificate management method according to claim 1, wherein the digital certificate device generates a certificate chain for the target service, comprising: The first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, and determines that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates; Starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, and determines that the current-level digital certificate is legal; After the digital certificates at each level of the certificate chain are generated and all the digital certificates at each level pass the legitimacy verification, the certificate chain is obtained. The digital certificate management method according to claim 3 is characterized in that, after the first-level digital certificate device for holding the first-level digital certificate of the certificate chain generates the first-level digital certificate by self-signing and verifies the signature of the first-level digital certificate, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates, including: If the first-level digital certificate is a public key infrastructure certificate, the first-level digital certificate device is a certificate authority device, and the first-level digital certificate device signs the local digital certificate information with the private key in the locally generated asymmetric key to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key in the locally generated asymmetric key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates; If the first-level digital certificate is a confidential computing certificate, then the first-level digital certificate device is a confidential computing device with a confidential computing environment, and the first-level digital certificate device signs the local digital certificate information with the private key of the asymmetric key generated in the local confidential computing environment to obtain the first-level digital certificate; after the first-level digital certificate device verifies the signature of the first-level digital certificate with the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates. The digital certificate management method according to claim 3 is characterized in that, starting from the second-level digital certificate device for holding the second-level digital certificate of the certificate chain, after the current-level digital certificate device receives the current-level digital certificate issued by the previous-level digital certificate device and verifies the signature of the current-level digital certificate, it is determined that the current-level digital certificate is legal, including: If the current-level digital certificate is a public key infrastructure certificate, the current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, and after the current-level digital certificate is verified by the public key in the asymmetric key generated by the previous-level digital certificate device, determines that the current-level digital certificate is legal; If the current-level digital certificate is a confidential computing certificate, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to self-sign the local digital certificate information of the current-level digital certificate device, receives the private key in the asymmetric key generated by the previous-level digital certificate device, signs the self-signed local digital certificate information to obtain the current-level digital certificate, uses the public key in the asymmetric key generated in the local confidential computing environment to self-sign the current-level digital certificate, and after the public key in the asymmetric key generated by the previous-level digital certificate device is used to verify the signature of the current-level digital certificate, it is determined that the current-level digital certificate is legal. The digital certificate management method according to claim 4 is characterized in that the first-level digital certificate device signs the local digital certificate information by using the private key of the asymmetric key generated in the local confidential computing environment, comprising: After verifying the authenticity of the local confidential computing environment, the first-level digital certificate device signs the local digital certificate information using the private key of the asymmetric key generated in the local confidential computing environment. The digital certificate management method according to claim 5 is characterized in that the current-level digital certificate device uses a private key in an asymmetric key generated in a local confidential computing environment to perform self-signature processing on the local digital certificate information of the current-level digital certificate device, comprising: After verifying the authenticity of the local confidential computing environment, the current-level digital certificate device uses the private key in the asymmetric key generated in the local confidential computing environment to perform self-signature processing on the local digital certificate information of the current-level digital certificate device. The digital certificate management method according to claim 5 is characterized in that if the asymmetric key generated by the upper-level digital certificate device is an asymmetric key generated in a local confidential computing environment, The current-level digital certificate device receives the current-level digital certificate obtained by signing the local digital certificate information of the current-level digital certificate device with the private key in the asymmetric key generated by the previous-level digital certificate device, including: After triggering and passing the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information of the current-level digital certificate device to obtain the current-level digital certificate; The current-level digital certificate device receives the private key in the asymmetric key generated by the previous-level digital certificate device and performs a signing process on the local digital certificate information after the self-signature process to obtain the current-level digital certificate, including: After triggering and passing the authenticity verification of the local confidential computing environment of the previous-level digital certificate device, the current-level digital certificate device obtains the private key in the asymmetric key generated in the local confidential computing environment of the previous-level digital certificate device to sign the local digital certificate information after self-signature processing to obtain the current-level digital certificate. The digital certificate management method according to any one of claims 6 to 8, characterized in that the authenticity verification of the local confidential computing environment comprises: The remote attestation data in the local digital certificate information of the device is sent to the device manufacturer to verify the authenticity of the local confidential computing environment. The digital certificate management method according to claim 9 is characterized in that the remote certification data includes trust measurement information of the device. The digital certificate management method according to claim 9, characterized in that the remote attestation data includes a plain text of the remote attestation data and a remote attestation data signature obtained by signing the plain text of the remote attestation data using a hardware remote attestation private key of a local confidential computing environment of the device; The remote attestation data plain text includes a hash value of a public key in an asymmetric key generated in a local confidential computing environment of the device and trust measurement information of the device. The digital certificate management method according to claim 4 is characterized in that after the first-level digital certificate is verified by the public key of the asymmetric key generated in the local confidential computing environment, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates, including: The first-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote attestation data in the confidential computing certificate and finds that they are consistent. After the first-level digital certificate is signed and verified by the entity public key, it is determined that the first-level digital certificate is legal and the first-level digital certificate device has the authority to issue digital certificates. The digital certificate management method according to claim 5 is characterized in that the current-level digital certificate device uses the public key in the asymmetric key generated in the local confidential computing environment to perform self-signature verification on the current-level digital certificate, comprising: The current-level digital certificate device compares the calculated hash value of the entity public key in the confidential computing certificate and the public key hash value in the remote certification data in the confidential computing certificate and verifies the signature of the current-level digital certificate through the entity public key. The digital certificate management method according to claim 1, wherein the digital certificate device generates a certificate chain for the target service, comprising: If the current-level digital certificate has a signature of a previous-level digital certificate device, the current-level digital certificate device that has the current-level digital certificate verifies the signature of the previous-level digital certificate device and determines that the current-level digital certificate is legal; If the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legal after verifying a first preset number of signatures among the multiple signatures; The first preset number is smaller than the number of signatures of the previous-level digital certificate device in the current-level digital certificate. The digital certificate management method according to claim 14 is characterized in that if the current-level digital certificate has multiple signatures of the previous-level digital certificate device, the current-level digital certificate device determines that the current-level digital certificate is legitimate after verifying a first preset number of signatures among the multiple signatures, including: If the signatures of the multiple previous-level digital certificate devices in the current-level digital certificate include both public key infrastructure signatures and confidential computing signatures, after the current-level digital certificate device passes the signature verification of the second preset number of public key infrastructure signatures in the multiple signatures and passes the signature verification of the third preset number of confidential computing signatures in the multiple signatures, Determining that the current-level digital certificate is legitimate; Among them, the second preset number is smaller than the number of public key infrastructure signatures of the previous level digital certificate device in the current level digital certificate, and the third preset number is smaller than the number of confidential computing signatures of the previous level digital certificate device in the current level digital certificate. The digital certificate management method according to claim 1 is characterized in that generating a digital certificate issuance request according to the needs of the target business includes: Determining a combination method of a public key infrastructure certificate and a confidential computing certificate in the certificate chain according to the security requirements of the target business; Determine the corresponding digital certificate device according to the combination of the public key infrastructure certificate and the confidential computing certificate in the certificate chain; Generate a digital certificate issuance request for each of the digital certificate devices. The digital certificate management method according to claim 1, further comprising: After receiving the application request of the target service from the requesting device, the certificate chain is verified for legitimacy so that the requesting device determines that the target service is legitimate after determining that the certificate chain is legitimate. The digital certificate management method according to claim 1 is characterized in that it is applied to a server that performs a Hypertext Transfer Protocol Security connection; The digital certificate management method also includes: After receiving an access request to the server sent by the client, after verifying the certificate chain corresponding to the server's Hypertext Transfer Protocol Security connection service, the last-level digital certificate of the certificate chain corresponding to the Hypertext Transfer Protocol Security connection service is sent to the client so that the client can verify the last-level digital certificate, so that after verifying the last-level digital certificate, the client can determine that the Hypertext Transfer Protocol Security connection service is legal and establish a Hypertext Transfer Protocol Security secure channel with the server. The digital certificate management method according to claim 1 is characterized in that it is applied to a file sending device; The digital certificate management method also includes: After receiving the legitimacy verification of the target file to be sent by the file receiving device, the digital certificates at all levels of the certificate chain are provided to the file receiving device, so that the file receiving device receives the target file after the legitimacy verification of the digital certificates at all levels of the certificate chain is passed. A digital certificate management method, characterized by comprising: The business device generates a digital certificate issuance request according to the needs of the target business, and sends the digital certificate issuance request to the digital certificate device; The digital certificate device generates a certificate chain of the target service according to the digital certificate issuance request; After the business device verifies the legitimacy of the certificate chain, the target business is deployed using the certificate chain; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment. A digital certificate management system, characterized in that it comprises: a business device and a digital certificate device; The service device is used to generate a digital certificate issuance request according to the needs of the target service; the digital certificate issuance request is sent to the digital certificate device so that the digital certificate device generates a certificate chain for the target service; After the certificate chain is verified to be legitimate, the target service is deployed using the certificate chain; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment. A digital certificate management device, comprising: A request unit, used to generate a digital certificate issuance request according to the needs of the target business; A sending unit, configured to send the digital certificate issuance request to a digital certificate device, so that the digital certificate device generates a certificate chain for the target service; A deployment unit, configured to deploy the target service using the certificate chain after the certificate chain passes the legitimacy verification; The certificate chain includes at least a public key infrastructure certificate issued by a certificate authority and a confidential computing certificate generated based on a confidential computing environment. A digital certificate management device, comprising: Memory for storing computer programs; A processor is used to execute the computer program, and when the computer program is executed by the processor, the steps of the digital certificate management method as described in any one of claims 1 to 20 are implemented. A non-volatile readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the digital certificate management method as described in any one of claims 1 to 20 are implemented.