Data transmission methods, devices, computer equipment and communication systems

Abstract

This application discloses a data transmission method, apparatus, computer device, and communication system, relating to the field of communications. The method includes: generating an authentication key based on security credentials distributed by an authentication center; authenticating devices with an authentication code generated from the authentication key; and transmitting encrypted data processed by an encryption key. Thus, authentication is based on the generated authentication key, eliminating the need for devices to transmit the authentication key itself, preventing its acquisition, improving authentication key security, and reducing network attacks. The authentication center does not need to manage authentication keys and security credentials, decentralizing the authentication mechanism and reducing the complexity of key management. Furthermore, the authentication key has a small data size, meeting the storage requirements of resource-constrained IoT devices, thereby achieving secure authentication for resource-constrained IoT devices, reducing network attacks on the IoT, and improving IoT network security.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication, and in particular to a data transmission method and device, computer equipment and a communication system. BACKGROUND

[0002] With the development of the Internet of Things, the number and types of Internet of Things devices have also increased. Since the resources (such as storage resources and computing resources) of the Internet of Things devices are limited, the traditional authentication mechanism cannot be used to authenticate the Internet of Things devices, which provides a physical environment for network attacks on the Internet of Things, and the Internet of Things is vulnerable to network attacks, resulting in frequent communication security incidents of the Internet of Things. SUMMARY

[0003] The present application provides a data transmission method and device, computer equipment and a communication system, thereby achieving secure authentication of resource-constrained Internet of Things devices, reducing network attacks on the Internet of Things, and improving the network security of the Internet of Things.

[0004] In a first aspect, a data transmission method is provided, comprising: generating an authentication key based on a security credential distributed by an authentication center, and transmitting encrypted data processed according to an encryption key after mutual authentication between devices according to an authentication code generated by the authentication key.

[0005] Compared with symmetric key encryption, the authentication center needs to store a shared key, and the shared key needs to be transmitted between devices, which is difficult to manage and easy to be obtained to cause network attacks. Compared with asymmetric key encryption, the network bandwidth occupied by the certificate and the public key is large and the storage resources are more. The scheme provided by the present application is based on the generated authentication key authentication, and the authentication key does not need to be transmitted between devices, which reduces the occupied bandwidth, avoids the authentication key from being obtained, improves the security of the authentication key, and reduces network attacks. The authentication center does not need to manage the authentication key and the security credential, which decentralizes the authentication mechanism and reduces the complexity of key management. In addition, the data amount of the authentication key is small, which meets the storage requirements of the resource-constrained Internet of Things devices, thereby achieving secure authentication of resource-constrained Internet of Things devices, reducing network attacks on the Internet of Things, and improving the network security of the Internet of Things.

[0006] In a possible implementation manner, the method further comprises: generating an encryption key according to the security credential. Thus, the security of the encryption key is improved.

[0007] In another possible implementation, the authentication key is generated according to the security credential, including: generating the authentication key according to the security credential based on an elliptic curve algorithm. Since the elliptic curve algorithm has the advantages of high security, fast processing speed, small storage space occupation, and small required bandwidth occupation, the authentication key is generated based on the elliptic curve algorithm, the calculation amount is small, the data amount of the authentication key is small, the lightweight security authentication of the Internet of Things device in the Internet of Things is implemented, and the resource performance requirement of the Internet of Things device is met.

[0008] In another possible implementation, the authentication key is generated according to the security credential, including: generating the public key of the second device according to the public key of the authentication center and the security credential; and generating the authentication key according to the public key of the second device and the private key of the first device.

[0009] In this way, the public key of the opposite party is generated based on the elliptic curve algorithm and the hash function, and the authentication key is generated based on the public key of the opposite party, that is, the same authentication key is generated based on different parameters according to the asymmetric encryption algorithm, the public key and the authentication key do not need to be transmitted between devices, the public key and the authentication key are prevented from being obtained by an illegal device (such as an attack device), and the security of the public key and the authentication key is improved.

[0010] In another possible implementation, the method further includes: generating an authentication code based on the authentication key, the identifier of the first device, and the random number. Since the random number is used as the parameter for generating the authentication code, the security of the authentication code is improved.

[0011] In another possible implementation, the security credential includes at least one of the identifier of the authentication center, the security parameter, the hash function, and the elliptic curve identifier.

[0012] In another possible implementation, the method further includes: generating the public key and the private key of the first device according to the security credential when the security credential is verified to be legal.

[0013] In another possible implementation, the security credential is verified to be legal, including: verifying the security credential to be legal according to the public key of the authentication center, the identifier of the first device, and the identifier of the authentication center.

[0014] Therefore, the security of the key is further ensured by verifying the security credential, and the public key and the private key of the device generated by using an illegal security credential are avoided.

[0015] In another possible implementation, the method further includes: updating the public key and the private key of the authentication center; or updating the public key and the private key of the first device.

[0016] In this way, based on the key update mechanism, the key is updated before the end of the life cycle of the key, or the key is known or possibly leaked, and the security of the public key, the private key, the security credential, the authentication key, and the encryption key of the device in the Internet of Things is improved.

[0017] In another possible implementation, the method further includes receiving a revocation request, and performing a revocation operation according to the revocation request. The revocation request includes a revocation list and a public key of the authentication device, and the revocation list includes the identity of the first device.

[0018] In a second aspect, a data transmission method is provided. The method includes receiving an authentication code sent by a first device, and determining that the first device is authenticated successfully when a check code generated based on a second authentication key is the same as the authentication code. The method further includes receiving encrypted data sent by the first device, wherein the authentication code is calculated based on a first authentication key generated based on a first security credential. The encrypted data is encrypted by a first encryption key, and the first encryption key is calculated based on the first security credential.

[0019] In this way, the authentication code sent by the first device is checked based on the authentication key generated by the second device, and the authentication keys do not need to be transmitted between devices, so that the authentication keys are prevented from being obtained by an illegal device, and the security of the authentication keys is improved. The two-way authentication between the first device and the second device is completed based on the authentication key, the amount of data of the ciphertext is small, and the occupied bandwidth is reduced. Thus, the secure authentication of the resource-constrained Internet of Things device is implemented, the Internet of Things is prevented from being attacked by a network, and the network security of the Internet of Things is improved.

[0020] In a possible implementation, the method further includes obtaining a second security credential from an authentication center, and generating a second authentication key based on the second security credential.

[0021] In this way, the authentication between devices is also performed based on the generated authentication key, the authentication keys do not need to be transmitted between devices, the occupied bandwidth is reduced, the authentication keys are prevented from being obtained, the security of the authentication keys is improved, and network attacks are reduced. The authentication center does not need to manage the authentication keys and the security credentials, the authentication mechanism is decentralized, the complexity of key management is reduced, and in addition, the amount of data of the authentication key is small, the storage requirement of the resource-constrained Internet of Things device is met, the secure authentication of the resource-constrained Internet of Things device is implemented, the Internet of Things is prevented from being attacked by a network, and the network security of the Internet of Things is improved.

[0022] In another possible implementation, the method further includes generating a second authentication key based on an elliptic curve algorithm and based on a second security credential.

[0023] In another possible implementation, the second authentication key is generated based on the second security credential, including generating a public key of the first device based on a public key of the authentication center and the second security credential, and generating the second authentication key based on the public key of the first device and a private key of the second device.

[0024] In another possible implementation, the second authentication key is used to generate the check code, including: the second authentication key is used to calculate the identity of the first device and the random number to generate the check code.

[0025] In a third aspect, a data transmission method is provided. The method includes: generating a first security credential based on a random number, an identity of a first device, an identity of an authentication center, and a private key of the authentication center; and feeding back the first security credential to the first device, which is used by the first device to generate a public key, a private key, and an authentication key of the first device for authentication with a second device.

[0026] In this way, the authentication center distributes the first security credential to the first device, so that the first device generates the public key, the private key, and the authentication key of the first device based on the security credential, improving the security of the keys. The authentication center manages its own public key and private key, without managing the public key, the private key, and the security credential of the device, decentralizing the authentication mechanism of the Internet of Things and reducing the complexity of key management.

[0027] In another possible implementation, the first security credential is generated based on the random number, the identity of the first device, the identity of the authentication center, and the private key of the authentication center, including: when the first device is verified to be legitimate, the first security credential is generated based on the random number, the identity of the first device, the identity of the authentication center, and the private key of the authentication center.

[0028] In this way, the authentication center distributes the first security credential to the first device after the first device is verified to be legitimate, so that the authentication center verifies the first device in the registration stage, ensuring the security of the distribution of the security credential and avoiding the distribution of the security credential to an illegitimate device.

[0029] In another possible implementation, the first security credential is generated based on the random number, the identity of the first device, the identity of the authentication center, and the private key of the authentication center, including: when the first device is verified to be legitimate, the first security credential is generated based on the random number, the identity of the first device, the identity of the authentication center, and the private key of the authentication center based on an elliptic curve algorithm.

[0030] In a fourth aspect, a data transmission apparatus is provided. The data transmission apparatus includes various modules for performing the data transmission method of the first aspect or any possible design in the first aspect; or performing the data transmission method of the second aspect or any possible design in the second aspect. For example, the data transmission apparatus includes a communication module, an authentication module, and an encryption module.

[0031] In a fifth aspect, a data transmission apparatus is provided. The data transmission apparatus includes various modules for performing the data transmission method of the third aspect or any possible design in the third aspect. For example, the data transmission apparatus includes a communication module and a registration module.

[0032] In a sixth aspect, a computer device is provided, which includes at least one processor and a memory, the memory being configured to store a set of computer instructions; when the processor executes the set of computer instructions as the first device in the first aspect or any possible implementation manner of the first aspect, the operation steps of the data transmission method in the first aspect or any possible implementation manner of the first aspect are performed; when the processor executes the set of computer instructions as the second device in the second aspect or any possible implementation manner of the second aspect, the operation steps of the data transmission method in the second aspect or any possible implementation manner of the second aspect are performed; when the processor executes the set of computer instructions as the authentication center in the third aspect or any possible implementation manner of the third aspect, the operation steps of the data transmission method in the third aspect or any possible implementation manner of the third aspect are performed.

[0033] In a seventh aspect, a communication system is provided, which includes an authentication center, a first device and a second device. The first device is configured to perform the operation steps of the data transmission method in the first aspect or any possible implementation manner of the first aspect. The second device is configured to perform the operation steps of the data transmission method in the second aspect or any possible implementation manner of the second aspect. The authentication center is configured to perform the operation steps of the data transmission method in the third aspect or any possible implementation manner of the third aspect.

[0034] In an eighth aspect, a chip is provided, which includes: a processor and a power supply circuit; wherein the power supply circuit is configured to supply power for the processor; the processor is configured to perform the operation steps of the method in the first aspect or any possible implementation manner of the first aspect; the processor is configured to perform the operation steps of the method in the second aspect or any possible implementation manner of the second aspect; the processor is configured to perform the operation steps of the method in the third aspect or any possible implementation manner of the third aspect.

[0035] In a ninth aspect, a computer readable storage medium is provided, which includes: computer software instructions; when the computer software instructions run in a computer device, the computer device is caused to perform the operation steps of the method in the first aspect or any possible implementation manner of the first aspect; or, the operation steps of the method in the second aspect or any possible implementation manner of the second aspect are performed; or, the operation steps of the method in the third aspect or any possible implementation manner of the third aspect are performed.

[0036] In a tenth aspect, a computer program product is provided, which, when running on a computer, causes the computer to perform the operation steps of the method according to the first aspect or any possible implementation manner of the first aspect; or, the operation steps of the method according to the second aspect or any possible implementation manner of the second aspect; or, the operation steps of the method according to the third aspect or any possible implementation manner of the third aspect.

[0037] The technical effects brought by any one of the fourth aspect to the tenth aspect or the technical effects brought by different design manners of the first aspect to the third aspect can be referred to, and will not be repeated here.

[0038] On the basis of the implementation manners of the above aspects, the application can be further combined to provide more implementation manners. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 An architecture schematic diagram of an Internet of Things provided by the application is provided.

[0040] Figure 2 Another architecture schematic diagram of an Internet of Things provided by the application is provided.

[0041] Figure 3 A security authentication schematic diagram of an Internet of Things provided by the application is provided.

[0042] Figure 4 A flow schematic diagram of data transmission in a registration stage provided by the application is provided.

[0043] Figure 5 Another flow schematic diagram of data transmission in a registration stage provided by the application is provided.

[0044] Figure 6 Another flow schematic diagram of data transmission in a registration stage provided by the application is provided.

[0045] Figure 7 A flow schematic diagram of data transmission in an authentication stage provided by the application is provided.

[0046] Figure 8 Another flow schematic diagram of data transmission in an authentication stage provided by the application is provided.

[0047] Figure 9 A flow schematic diagram of key update in a management stage provided by the application is provided.

[0048] Figure 10 A flow schematic diagram of key revocation in a management stage provided by the application is provided.

[0049] Figure 11A structural schematic diagram of a data transmission device provided in the present application is shown in FIG. 1.

[0050] Figure 12 A structural schematic diagram of another data transmission device provided in the present application is shown in FIG. 2.

[0051] Figure 13 A structural schematic diagram of a computer device provided in the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0052] For the convenience of understanding, the main terms involved in the present application are first explained.

[0053] The Internet of Things (IoT) is an important part of new generation information technology, which means the Internet of Things. First, the core and foundation of the Internet of Things is still the Internet, which is an extension and expansion of the Internet; second, the user end of the Internet of Things is extended and expanded to any information exchange and communication between things. Therefore, the Internet of Things is a network that connects any object with the Internet through radio frequency identification, infrared sensor, global positioning system, laser scanner and other information sensing devices according to the agreed protocol, exchanges and communicates information, so as to realize intelligent identification, positioning, tracking, monitoring and management of objects.

[0054] Secret key encryption is an encryption service provided to ensure the network security of an open network environment, that is, an encryption method for encryption and decryption operation of plaintext by using asymmetric key or symmetric key at the sending end and the receiving end.

[0055] For example, symmetric key encryption (Symmetric-key algorithm), also known as private key encryption or shared key encryption, refers to the encryption and decryption of terminal devices using the same key, which is a common secret of terminal devices. Compared with asymmetric key encryption, one of the main shortcomings of symmetric key encryption is that both parties need to obtain the same key.

[0056] For another example, asymmetric key encryption (Asymmetric cryptography), also known as public key encryption (Public-key cryptography), includes a public key and a private key. The public key is used to encrypt plaintext to obtain ciphertext. The private key is used to decrypt ciphertext to obtain plaintext. Since two different keys are required for encryption and decryption, it is called asymmetric encryption. The public key can be public and can be published to the outside world; the private key cannot be public. Based on the characteristics of public key encryption, the function of digital signature is also provided, so that electronic files can have the effect of handwritten signature on paper documents.

[0057] In order to reduce network attacks suffered by the Internet of Things and improve the network security of the Internet of Things, the application provides a data transmission method, that is, generating an authentication key based on the security credential distributed by the authentication center, and transmitting the encrypted data obtained by processing according to the encryption key after mutual authentication between devices according to the authentication code generated by the authentication key.

[0058] Compared with symmetric key encryption, the authentication center needs to store the shared key, the shared key needs to be transmitted between devices, the shared key is difficult to manage and easy to be obtained to cause network attacks; compared with asymmetric key encryption, the network bandwidth occupied by the certificate and the public key is larger and the storage resources are more. The scheme provided by the application avoids the transmission of the authentication key between the Internet of Things devices based on the authentication of the authentication key generated by the Internet of Things devices, avoids the acquisition of the authentication key, improves the security of the authentication key, and reduces network attacks; the authentication center does not need to manage the authentication key and the security credential, so that the authentication mechanism is decentralized, the complexity of key management is reduced; in addition, the data amount of the authentication key is small, which meets the storage requirements of the resource-constrained Internet of Things devices, so that the secure authentication of the resource-constrained Internet of Things devices is realized, the network attacks suffered by the Internet of Things are reduced, and the network security of the Internet of Things is improved.

[0059] Among them, the Internet of Things device described in the application can be called a lightweight device or a resource-constrained device, including the device of the Internet of Things device level defined in IETF-RFC7228. For example, the storage capacity of the random access memory (RAM) in the Internet of Things device is less than or equal to 10K, and the storage capacity of the read-only memory (ROM) is less than or equal to 100K.

[0060] The data transmission method provided by the application can be applied to any scale network, without limiting the network scale and network type. For example, campus network, Internet of Things, local area network, Internet, etc. For the convenience of description, the Internet of Things is taken as an example for description.

[0061] Figure 1 An architecture diagram of the Internet of Things is provided in the application. Here, the Internet of Things in the cloud computing deployment scenario is described. As shown in Figure 1 The end is used for collecting data, and the end can be used as a sensing layer in the architecture of the Internet of Things. The end includes an Internet of Things device 110, which includes but is not limited to: a switch, a temperature control, a smoke sensor, a lamp, a tag, a camera, a gate, a perimeter, an access control, etc. terminal device.

[0062] The edge is used to provide edge computing, software-defined Internet of Things, and data transmission functions. For example, the edge includes infrastructure and edge devices. The pipe is used to converge data and traffic, and provide a transmission channel for converged data. For example, the edge and the pipe include network devices 120. The network devices 120 include, but are not limited to, switches, gateways. The edge and the pipe can serve as a network layer in the architecture of the Internet of Things, as a bridge between the end and the cloud, and transmit data obtained by the perception layer to a designated destination.

[0063] The cloud can be a cloud data center including a plurality of servers 130, and is used to provide device management, terminal management, container management, application management, secure access, and the like. The explanations of the respective functions can refer to the existing related descriptions. The cloud can serve as a platform layer and an application layer in the architecture of the Internet of Things. The platform layer is used to communicate with devices in the Internet of Things and run management. The application layer is used to provide intelligent services based on business fields, such as medical systems, access security, asset management, environmental monitoring, and personnel monitoring.

[0064] In the present application, the connection mode and the link protocol of the devices in the Internet of Things are not limited. The devices in the Internet of Things can be connected in a wireless manner or a wired manner to facilitate data transmission between devices. The device link protocol includes WiFi, Ethernet protocol, Bluetooth, RS485, RS232, and various link protocols.

[0065] In the present application, the cloud data center can serve as a key distribution center (KDC) for distributing security credentials to devices in the Internet of Things. The edge and the pipe can serve as a key distribution agent (KDA) for verifying, distributing, and transmitting security credentials. The end serves as a key distribution edge (KDE) for generating an authentication key based on the security credentials, and transmitting encrypted data obtained by processing according to the encryption key after mutual authentication between the Internet of Things devices based on the authentication code generated by the authentication key.

[0066] For example, the Internet of Things device 110 can deploy an operating system and a software development kit (SDK) for secure authentication based on the scheme provided in the present application to facilitate secure communication between Internet of Things devices.

[0067] In some other embodiments, a small park deploys the secure authentication scheme provided in the present application in a server-client (C / S) architecture. Figure 2Another architecture diagram of the Internet of Things provided by the present application is provided. Among them, the Internet of Things 200 includes a server 210 and a client 220. The server 210 and the client 220 are based on the park network data transmission. The server 210 integrates the functions of the key distribution center and the key authentication agent. The server 210 provides functions such as security authentication, configuration issuance, data reporting, version updating, registration query, etc. The client 220 serves as a key authentication edge and provides the function of the key authentication edge. For example, the switch in the park serves as an authenticated client, and the controller serves as a server. Based on the scheme provided by the present application, bidirectional authentication is completed to facilitate secure communication.

[0068] Next, the implementation of the security authentication based on the Internet of Things provided by the present application is described in detail in combination with the drawings.

[0069] Figure 3 A security authentication diagram of the Internet of Things provided by the present application is provided. The security authentication of the Internet of Things includes a registration phase, an authentication phase, and a management phase.

[0070] Registration phase: register to apply for a security credential. For example, the authentication center checks the device to be accessed to the Internet of Things based on the white list, and the device obtains a security credential from the authentication center after passing the authentication center check (step 310).

[0071] Authentication phase: both parties of the communication negotiate authentication and data communication encryption and decryption. For example, the device generates an authentication key according to the security credential, and the device is mutually authenticated after generating an authentication code according to the authentication key (step 320), and transmits encrypted data processed according to the encryption key (step 330).

[0072] Management phase: key life cycle management. For example, the authentication center updates the public key and the private key of the authentication center. The device updates the public key and the private key of the device (step 340).

[0073] The present application provides a certificate-free lightweight authentication scheme for the Internet of Things, which is suitable for resource-constrained Internet of Things devices in the Internet of Things, i.e., the Internet of Things devices include limited computing resources and storage resources, which realizes the security authentication of the Internet of Things devices, reduces the network attack events of the Internet of Things, and improves the network security of the Internet of Things. Overcome the problems of key management, distribution, and maintenance difficulty, excessive rights of the authentication center, large resource occupation, and low performance of the Internet of Things using traditional authentication methods.

[0074] The registration phase, the authentication phase, and the management phase are described in detail below in combination with the drawings.

[0075] Figure 4 A flowchart of data transmission in the registration phase provided by the present application is provided. Here, the first device accessing the authentication center is taken as an example for description. The first device can be Figure 1The device described in the specification as a key authentication agent or a key authentication edge. The authentication center can be Figure 1 The device described in the specification as a key distribution center. As shown in the specification Figure 4 The method comprises the following steps.

[0076] Step 410, the first device sends a registration request to the authentication center.

[0077] The registration request comprises the identity of the first device. The identity of the first device is used to indicate the first device. For example, the identity of the first device comprises an electronic serial number (ESN), a manufacturer, a model, etc.

[0078] Step 420, the authentication center sends a response message to the first device.

[0079] The authentication center stores a white list, which comprises the identities of a plurality of devices. After receiving the registration request, the authentication center queries the white list. If the white list comprises the identity of the first device, it is determined that the first device is legal, and a response message, such as an acknowledgement (ACK), is fed back to the first device. If the white list does not comprise the identity of the first device, it is determined that the first device is illegal, and a response message, such as a non-acknowledgement (NACK), is fed back to the first device.

[0080] When the first device is legal, the response message comprises the public key of the authentication center, a hash function, and an elliptic curve identity, so that the first device generates a public key and a private key. The public key and the private key of the authentication center can be pre-configured. The elliptic curve identity is used to indicate an elliptic curve, i.e., the shape of the elliptic curve.

[0081] Step 430, the first device sends a first ciphertext to the authentication center.

[0082] After receiving the response message, the first device calculates the first ciphertext according to the identity of the first device and a random number based on the public key of the authentication center. This is so that the authentication center can verify the first device and feed back a security credential.

[0083] Optionally, the first device calculates the first ciphertext according to the identity of the first device, the random number, and a fixed string based on the public key of the authentication center. In this way, the possibility of deciphering the first ciphertext is further reduced, and the security of the first ciphertext is improved.

[0084] In some embodiments, the first device and the authentication center send the first ciphertext to the authentication center after one encryption and decryption calculation based on the public key of the authentication center and the identity of the first device. In this way, the security of the authentication center performing the registration process is improved.

[0085] For example, asFigure 5 As shown, the first device obtains the public key of the authentication center from the authentication center. The real value is calculated according to the identification of the first device, the encryption parameter and the temporary key (step 431). For example, the real value satisfies the following formula (1).

[0086] AuthenValue_i = AES-CMAC (n_i.ID_i‖R_i‖"MAC") Formula (1)

[0087] R_i = HKDF (K, ID_i‖nonce)

[0088] n_i = HKDF (K, R_i)

[0089] Wherein, AuthenValue_i represents the real value, AES-CMAC and HKDF represent the encryption algorithm, K represents the first random number, ID_i represents the identification of the device, nonce and MAC represent the fixed string, R_i represents the first encryption parameter obtained according to the first random number, and n_i represents the temporary key.

[0090] The first device calculates the third ciphertext according to the identification of the first device and the real value of the public key of the authentication center. For example, the third ciphertext is calculated as follows: ENC (PK1, ID_i‖AuthenValue).

[0091] The first device sends the third ciphertext to the authentication center (step 432), and the authentication center decrypts the third ciphertext according to the private key of the authentication center (step 433). The third ciphertext is decrypted as follows: AuthenValue_i = Dec (SK1), SK1 represents the private key of the authentication center.

[0092] If the decryption is successful, it means that the first device is legal, and the identification and the real value of the first device are obtained, and the identification and the real value of the first device are saved, so as to verify the first device according to the identification and the real value of the first device. The authentication center feeds back the confirmation to the first device (step 434).

[0093] The first device calculates the first ciphertext according to the identification of the first device, the encryption parameter and the temporary key of the authentication center, and sends the first ciphertext to the authentication center (step 435). For example, the first ciphertext is calculated as follows: ENC (PK1, ID_i‖R_i‖n_i‖A_i), wherein, PK1 represents the public key of the authentication center, and A_i represents the second encryption parameter obtained according to the second random number. A_i = a_i*G, a_i represents the second random number, and G represents the base point of the elliptic curve.

[0094] Step 440, the authentication center verifies the first device successfully, and generates the first security credential.

[0095] The authentication center decrypts the first ciphertext using its private key to obtain the identifier, encryption parameters, and temporary key of the first device. The decryption calculation method for the first ciphertext is as follows: ID_i‖R_i‖n_i‖A_i=Dec(SK1).

[0096] The authentication center uses the temporary key obtained from decrypting the first ciphertext to calculate the true value based on the identifier of the first device, encryption parameters, and a fixed string. The authentication center and the first device can be pre-configured with the same fixed string.

[0097] If the real value generated by the certification center is the same as the real value of the first device stored by the certification center, it means that the first device is legitimate, and the security parameters of the first device are generated (step 440).

[0098] For example, if AuthenValue_i* == AuthenValue_i, AuthenValue_i* = AES-CMAC(n_i.ID_i‖R_i‖"MAC"), where AuthenValue_i* represents the actual value generated by the authentication center.

[0099] In some embodiments, the authentication authority generates a first security credential based on a random number, the identifier of the first device, the identifier of the authentication authority, and the private key of the authentication authority. For example, the authentication authority generates a first security parameter based on a hash function. The first security parameter satisfies the following formula (2).

[0100] S_i = b_i + Hash(ID_i‖ID_center‖B_i)·SK2 Formula (2)

[0101] B_i=b_i·G+A_i

[0102] Where b_i represents the third random number, and ID_center represents the identifier of the authentication center. B_i and S_i represent the security parameters of the first device.

[0103] The first security credential includes at least one of the following: the identifier of the certification authority, the security parameters of the first device, a hash function, and an elliptic curve identifier.

[0104] Step 450: The authentication center sends a second ciphertext to the first device, the second ciphertext including the first security credential.

[0105] The authentication center calculates the second ciphertext based on the temporary key pair, the identifier of the first device, the identifier of the authentication center, the encryption parameters, and the security parameters of the first device. For example, the second ciphertext is calculated as follows: AES-GCM(n_i, lD_i‖ID_center‖A_i‖B_i‖S_i).

[0106] Step 460: The first device generates its public and private keys based on the first security credential.

[0107] The first device decrypts the second ciphertext using the temporary key, obtaining the identifier of the first device, the identifier of the authentication center, the encryption parameters, and the security parameters of the first device. The decryption calculation method for the second ciphertext is as follows: ID_i‖ID_center‖A_i‖B_i‖S_i=Dec(n).

[0108] In some embodiments, the first device verifies the validity of the first security credential based on the public key of the authentication center, the identifier of the first device, and the identifier of the authentication center, and generates the public key and private key of the first device based on the first security credential. For example, the first device verifies the first security credential based on a hash function and an elliptic curve algorithm and generates the public key and private key of the first device, and saves the public key and private key of the first device. The public key and private key of the first device satisfy formula (3).

[0109] if S_i·G+Ai==T_i+B_i

[0110] T_i=Hash(ID_i‖D_center‖B_i)·PK2

[0111] pk_i=B_i+T_i sk_i = a_i+ s_i Formula (3)

[0112] Where pk_i represents the public key of the first device, and sk_i represents the private key of the first device.

[0113] In this way, after the certification authority successfully verifies the first device to be connected to the Internet of Things, it issues the first security credential to the first device. Thus, during the registration phase, the certification authority verifies the first device, ensuring the security of the security credential distribution and preventing the distribution of security credentials to unauthorized devices. Furthermore, the first device generates its public and private keys based on the elliptic curve algorithm, effectively reducing the consumption of the first device's computing and storage resources, and avoiding the transmission of the first device's public and private keys, thereby reducing the risk of them being obtained and improving their security.

[0114] It should be noted that any device to be accessed to the Internet of Things can perform the registration process according to the description of the above embodiment, obtain the security credential from the authentication center, and generate the public key and the private key according to the security credential. Each device in the Internet of Things saves its own public key and private key, and the public key and the private key of each device are different. The authentication center manages its own public key and private key, and does not need to manage the public key, the private key and the security credential of the device, so that the authentication mechanism is decentralized, the complexity of key management is reduced, and the security of the public key and the private key of the device is improved. The authentication center can configure a pair of public key and private key, or two pairs of public key and private key. When the first device generates the first ciphertext and generates the public key and the private key of the first device, a public key of a different authentication center is used to improve the security of the registration process.

[0115] Optionally, as shown in Figure 6 , the device to be accessed to the Internet of Things can also be pre-configured with the public key and the private key of the authentication center. After the authentication center successfully verifies the device, the response message fed back to the device can not include the public key and the private key of the authentication center, but include the hash function and the elliptic curve identifier.

[0116] After the first device successfully registers with the authentication center, it can bidirectionally authenticate and communicate with other devices in the Internet of Things.

[0117] Figure 7 A flowchart of data transmission in an authentication phase is provided for the present application. Here, the authentication and transmission of data between the first device and the second device are taken as examples for illustration. The first device and the second device can be any device in the network, such as the device as a key authentication agent or key authentication edge described in Figure 1 . As shown in Figure 7 , the method comprises the following steps.

[0118] Step 710, the first device sends a first authentication request to the second device.

[0119] The first authentication request includes parameters related to the first device, such as the identity of the first device, the first security parameter and the first encryption parameter.

[0120] Optionally, the first authentication request can be taken as the payload content of the User Datagram Protocol (UDP) message.

[0121] Step 720, the second device sends a second authentication request to the first device.

[0122] The second authentication request includes parameters related to the second device, such as the identity of the second device, the second security parameter and the second encryption parameter.

[0123] Step 730, the first device generates a first authentication key according to the first security credential.

[0124] The first device generates a first authentication key according to the first security credential based on an elliptic curve algorithm. The elliptic curve algorithm (ECC) is a public key encryption system, and its mathematical basis is to use rational points on an elliptic curve to construct the computational difficulty of the elliptic discrete logarithm on the Abel additive group. Because of high security, fast processing speed, small storage space occupation, and small bandwidth occupation, etc., the elliptic curve algorithm is used to generate an authentication key, to realize lightweight security authentication of the Internet of Things device in the Internet of Things, and to meet the resource performance requirements of the Internet of Things device.

[0125] In some embodiments, the first device generates a public key of the second device according to the public key of the authentication center and the first security credential; and generates the first authentication key according to the public key of the second device and a private key of the first device. Optionally, the first device generates the first authentication key by taking the identity of the first device and the random number obtained from the first device as input parameters. For example, as shown in Figure 8 The public key of the second device satisfies formula (4), and the first authentication key satisfies formula (5).

[0126] pk_2 = B2 + Hash (ID2‖ID_center, B2) * PK2 Formula (4)

[0127] K_Auth = Hash (MK; W‖“workKey”) Formula (5)

[0128] MK = (x + Hash (w) * sk_1) * (Y + Hash (w) * pk_2)

[0129] w = B1‖B2‖ID1‖ID2‖X‖Y

[0130] wherein pk_2 represents the public key of the second device, B2 represents the second security parameter, ID2 represents the identity of the second device, PK2 represents the public key of the authentication center, sk_1 represents the private key of the first device, B1 represents the first security parameter, ID1 represents the identity of the first device, X and Y represent encryption parameters, X = x * G, Y = y * G, x represents the fourth random number, and y represents the fifth random number.

[0131] Optionally, the first device generates a first encryption key according to formula (5), K_Enc = Hash (MK; W‖“workKey”).

[0132] Step 740, the second device generates a second authentication key according to the second security credential.

[0133] The second device uses the elliptic curve algorithm to generate a second authentication key based on the second security credential. The details regarding the second device obtaining the second security credential from the certification authority and generating its public and private keys based on it can be found in the explanation of the registration process described above, and will not be repeated here.

[0134] The second device generates the first device's public key based on the authentication center's public key and the second security credential; it then generates a second authentication key based on the first device's public key and the second device's private key. Optionally, when generating the second authentication key, the second device uses its own identifier and a random number obtained from the second device as input parameters. For example, such as... Figure 8 As shown, the public key of the first device satisfies formula (6), and the second authentication key satisfies formula (7).

[0135] pk_1 = B1 + Hash(ID1‖ID_center, B1) * PK2 Formula (6)

[0136] K_Auth = Hash(MK; W‖"workKey") Formula (7)

[0137] MK=(y+Hash(w)"sk_2)·(Y+Hash(W)·pk_1)

[0138] w=B1‖B2‖ID1‖ID2‖X‖Y

[0139] Where pk_1 represents the public key of the first device and sk_2 represents the private key of the second device.

[0140] Optionally, the second device generates a second encryption key according to formula (5), K_Enc = Hash(MK; W‖“workKey”).

[0141] Step 750: The first device sends a first authentication code generated based on the first authentication key to the second device.

[0142] The first device generates a first authentication code based on the first authentication key, the device's identifier, and a random number. Using the random number as an input parameter for generating the authentication code improves its security. Since an attacking device may not be able to obtain the random number, the authentication code generated by the attacking device may be unrecognizable, meaning it is invalid data. The first authentication code satisfies the following formula (8).

[0143] Code1 = C-MAC(K_Auth,B1‖ID1‖X‖Y) Formula (8)

[0144] Here, Code1 represents the first authentication code, C-MAC represents the encryption algorithm, and K_Auth represents the first authentication key.

[0145] Step 760, the second device checks that the first authentication code is successful, and sends the second authentication code generated based on the second authentication key to the first device.

[0146] The second device can generate the first authentication code based on the second authentication key using the method of the first device, and check whether the first authentication code is legal. For example, the second device determines whether the first authentication code and the first check code are the same. When the first authentication code and the first check code are the same, it is determined that the first device is authenticated successfully, indicating that the first authentication code is legal. When the first authentication code and the first check code are different, it is determined that the first device is authenticated unsuccessfully, indicating that the first authentication code is illegal. For example, if the first device is an attack device, the first authentication key generated by the first device may be incorrect, resulting in authentication failure. The second authentication code satisfies the following formula (9).

[0147] Code1* = C-MAC(K_Auth, B1‖ID1‖X‖Y) Formula (9)

[0148] Wherein, Code1* represents the first check code, K_Auth represents the second authentication key. If Code1 = Code1*, it indicates that the first device is authenticated successfully.

[0149] After the second device authenticates the first device successfully, the second authentication code is generated based on the second authentication key and the identity and random number of the first device. The second authentication code satisfies the following formula (10).

[0150] Code2 = C-MAC(K_Auth, B2‖ID2‖X‖Y) Formula (10)

[0151] Wherein, Code2 represents the second authentication code, C-MAC represents the encryption algorithm, and K_Auth represents the second authentication key.

[0152] Step 770, the first device checks that the second authentication code is successful, and sends the first encryption data generated based on the first encryption key to the second device.

[0153] The first device can generate the second authentication code based on the first authentication key using the method of the second device, and check whether the second authentication code is legal. For example, the second device determines whether the second authentication code and the second check code are the same. When the second authentication code and the second check code are the same, it is determined that the second device is authenticated successfully, indicating that the second authentication code is legal. When the second authentication code and the second check code are different, it is determined that the first device is authenticated unsuccessfully, indicating that the second authentication code is illegal. For example, if the second device is an attack device, the second authentication key generated by the first device may be incorrect, resulting in authentication failure. The second check code satisfies the following formula (11).

[0154] Code2* = C-MAC(K_Auth, B2‖ID2‖X‖Y) Equation (11)

[0155] Code2* represents the second check code, and K_Auth represents the first authentication key. If Code2 = Code2*, it indicates that the second device is successfully authenticated.

[0156] The calculation method of the first encrypted data is as follows: AES-GCM(K_Enc, data1), and K_Enc represents the first encryption key.

[0157] Step 780, the second device sends the second encrypted data generated based on the second encryption key to the first device.

[0158] The calculation method of the second encrypted data is as follows: AES-GCM(K_Enc, data2), and K_Enc represents the second encryption key.

[0159] In this way, the first device and the second device generate the public key of the other party based on the elliptic curve algorithm and the hash function, generate the authentication key based on the public key of the other party, that is, generate the same authentication key according to different parameters according to the asymmetric encryption algorithm, and do not need to transmit the public key and the authentication key between the devices, thereby avoiding that an illegal device obtains the public key and the authentication key, and improving the security of the public key and the authentication key. The first device and the second device complete mutual authentication based on the authentication key, the data amount of the ciphertext is small, and the occupied bandwidth is reduced. Thus, the security authentication of the resource-constrained Internet of Things device is realized, the Internet of Things is less likely to suffer network attacks, and the network security of the Internet of Things is improved.

[0160] Optionally, when the device in the Internet of Things is restarted or the like for the first time, it is not necessary to register with the authentication center again, and mutual authentication with the device that needs to communicate is performed, thereby improving the performance of mutual authentication between devices.

[0161] In addition, the scheme provided in the present application does not need to add devices in the Internet of Things, does not need to modify hardware and increase memory capacity, and reduces deployment costs. The terminal software SDK mode can be used for configuration, and the deployment is simple and easy.

[0162] After the device in the Internet of Things is successfully registered with the authentication center, the authentication center can manage the key life cycle in the system. Key update is one of the important contents of key management, which refers to the process of replacing an old key with a new key.

[0163] Figure 9 A flowchart for managing the key update in the stage is provided in the present application. Here, the first device updates the key as an example. The authentication center can act as a key distribution center. The first device can act as a key authentication agent or a key authentication edge. As shown in the figure, Figure 9 The method comprises the following steps.

[0164] Step 910, the authentication center sends an update request to the first device.

[0165] The authentication center can send the update request to the first device according to the operation instruction of the system administrator. Alternatively, the authentication center can also periodically send the update request to the first device. The update request is used to indicate the update of the security credential.

[0166] For example, the authentication center can periodically update the public key and the private key of the authentication center. The authentication center sends the updated security credential to the first device. The update period can be 5 years, and the update can be performed 1 month in advance. The first device generates an updated public key and an updated private key according to the updated security credential, thereby realizing the update of the public key and the private key of the first device.

[0167] The authentication center can record the version number of the security credential to support the update of the credential. Before the version number is rewound, the device automatically reappears negotiation.

[0168] Step 920, the first device updates the public key and the private key of the first device.

[0169] The first device can update the public key and the private key of the first device according to the update request of the authentication center. Alternatively, the first device can periodically update the public key and the private key of the first device. The update period can be 1 year, and the update can be performed 1 week in advance.

[0170] Step 930, the first device sends a registration request to the authentication center.

[0171] After the first device updates the public key and the private key of the first device, the first device re-registers with the authentication center. For specific explanations of the registration process, please refer to the explanations of the above-mentioned embodiments, which will not be repeated here.

[0172] In this way, based on the key update mechanism, the key is updated before the end of the life of the key, or the key is known or suspected to be leaked, thereby improving the security of the public key, the private key, the security credential, the authentication key and the encryption key of the device in the Internet of Things.

[0173] Figure 10 A process diagram for managing the revocation of the key in the stage is provided for the present application. Here, the first device updates the key as an example. The authentication center can act as a key distribution center. The first device can act as a key authentication agent, and the second device can act as a key authentication edge. As Figure 10As shown, the method includes the following steps. The authentication center sends a revocation request to the first device. The revocation request includes the identifier of the first device, the public key of the authentication center, and a revocation list (step 1010). Optionally, the authentication center sends a revocation request to the first device according to the system administrator's operation instructions. The first device saves the revocation list and the public key of the authentication center (step 1020). When the first device executes the authentication process, it checks whether the identifier of the second device is in the revocation list. If the identifier of the second device is in the revocation list, the second device authentication fails; if the identifier of the second device is not in the revocation list, the second device authentication succeeds (step 1030). When the first device executes the registration process, it sends a registration request to the authentication center. The authentication center checks whether the identifier of the first device is in the revocation list. If the identifier of the first device is in the revocation list, the first device registration fails; if the identifier of the first device is not in the revocation list, the first device registration succeeds (step 1040). The registration process, credential application process, and session establishment process all require checking whether the device has been revoked to avoid using revoked security credentials for authentication.

[0174] Optionally, the protocol on which message forwarding in the registration, authentication, and management processes described in this application is based may be a Certificateless Public Key Cryptography over The Constrained Application Protocol (CLPKC over CoAP) or an alternative interactive protocol.

[0175] It is understood that, in order to achieve the functions in the above embodiments, the device includes hardware structures and / or software modules corresponding to each function. Those skilled in the art should readily recognize that, based on the units and method steps of the various examples described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0176] The above text combines Figures 1 to 10 The data transmission method provided in this application is described in detail below, in conjunction with... Figure 11 This application describes a data transmission apparatus provided in accordance with the present application.

[0177] Figure 11 This is a schematic diagram of a possible data transmission device provided in this application. These data transmission devices can be used to implement the functions of devices in the Internet of Things (IoT) in the above method embodiments, and therefore can also achieve the beneficial effects of the above method embodiments. In this embodiment, the data transmission device can be as follows: Figure 4 orFigure 7 The device shown can also be a module (such as a chip) applied to a server.

[0178] As shown in the figure, the data transmission device 1100 includes a communication module 1110, an authentication module 1120, an encryption module 1130, and a storage module 1140. The data transmission device 1100 is used to implement the functions of the first device or the second device in the method embodiments shown in the above Figure 11 or Figure 4 . Figure 7 The data transmission device 1100 is used to implement the functions of the first device in the method embodiments shown in the above

[0179] or Figure 4 . Figure 7 The communication module 1110 is used to obtain the first security credential from the authentication center. For example, the communication module 1110 is used to perform steps 410, 430, and 460 in the above

[0180] . Figure 4 The authentication module 1120 is used to generate a first authentication key according to the first security credential, and generate a first authentication code based on the first authentication key. For example, the authentication module 1120 is used to perform steps 710, 730, and 750 in the above

[0181] . Figure 7 The encryption module 1130 is used to process the data to be transmitted according to a first encryption key based on the first authentication code after the authentication of the second device. For example, the encryption module 1130 is used to perform step 770 in the above

[0182] . Figure 7 The data transmission device 1100 is used to implement the functions of the second device in the method embodiments shown in the above

[0183] or Figure 4 . Figure 7 The communication module 1110 is used to receive the first authentication code sent by the first device and the second security credential sent by the authentication center. For example, the communication module 1110 is used to perform steps 410, 430, and 460 in the above

[0184] . Figure 4 The authentication module 1120 is used to generate a second authentication key according to the second security credential, generate a first check code based on the second authentication key, and determine that the authentication of the first device is successful when the first check code and the first authentication code are the same. For example, the authentication module 1120 is used to perform steps 740 and 760 in the above

[0185] . Figure 7

[0186] ​The encryption module 1130 is configured to, after the authentication of the first device based on the second authentication code, process the data to be transmitted according to the second encryption key to obtain second encrypted data. For example, the encryption module 1130 is configured to perform Figure 7 in step 780.

[0187] Optionally, the authentication module 1120 is specifically configured to generate the first authentication key according to the first security credential based on an elliptic curve algorithm, and generate the second authentication key according to the second security credential.

[0188] The storage module 1140 is configured to store the encryption key, the public key, the private key, and the authentication key, so as to facilitate the bidirectional authentication between the device in the Internet of Things and the authentication center based on the authentication key.

[0189] Figure 12 A possible data transmission apparatus provided in the present application is shown in a structural schematic diagram. The data transmission apparatus can be used to implement the function of the authentication center in the Internet of Things in the above-mentioned method embodiments, and thus can also achieve the beneficial effects possessed by the above-mentioned method embodiments. In the present embodiment, the data transmission apparatus can be a device as shown in Figure 4 , and can also be a module (such as a chip) applied to a server.

[0190] As shown in Figure 12 , the data transmission apparatus 1200 includes a communication module 1210, a registration module 1220, and a storage module 1230. The data transmission apparatus 1200 is configured to implement the function of the authentication center in the method embodiments shown in the above-mentioned Figure 4 .

[0191] The communication module 1210 is configured to receive a registration request and feed back the public key and the security credential of the authentication center. For example, the communication module 1210 is configured to perform Figure 4 steps 420 and 450.

[0192] The registration module 1220 is configured to generate the first security credential according to the random number, the identifier of the first device, the identifier of the authentication center, and the private key of the authentication center. For example, the registration module 1220 is configured to perform Figure 4 step 460.

[0193] Optionally, the registration module 1220 is specifically configured to generate the first security credential according to the random number, the identifier of the first device, the identifier of the authentication center, and the private key of the authentication center when it is verified that the first device is legal.

[0194] The storage module 1230 is configured to store the public key and the private key of the authentication center.

[0195] It should be understood that the data transmission apparatus 1100 and the data transmission apparatus 1200 of the embodiments of the present application can be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), which can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can also be implemented by software Figure 4 or Figure 7 The heat dissipation control method shown, and each module thereof can also be a software module, and the data transmission apparatus 1100 and the data transmission apparatus 1200 and each module thereof can also be a software module.

[0196] The data transmission apparatus 1100 and the data transmission apparatus 1200 according to the embodiments of the present application can correspond to performing the methods described in the embodiments of the present application, and the above and other operations and / or functions of each unit in the data transmission apparatus 1100 and the data transmission apparatus 1200 are respectively to realize Figure 4 or Figure 7 the corresponding flow of each method in the above embodiments. For brevity, they will not be described here.

[0197] Figure 13 A structural schematic diagram of a computer device 1300 is provided in the present application. As shown in Figure 13 The computer device 1300 includes a processor 1310, a bus 1320, a memory 1330, a communication interface 1340, and a memory unit 1350 (which can also be referred to as a main memory unit). The processor 1310, the memory 1330, the memory unit 1350, and the communication interface 1340 are connected through the bus 1320.

[0198] It should be understood that in the present embodiment, the processor 1310 can be a CPU, and the processor 1310 can also be other general-purpose processors, digital signal processors (DSPs), ASICs, FPGAs, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0199] The processor can also be a graphics processing unit (GPU), a neural network processing unit (NPU), a microprocessor, an ASIC, or one or more integrated circuits for controlling program execution of the solutions of the present application.

[0200] The communication interface 1340 is configured to enable the computer device 1300 to communicate with external devices or apparatuses. In the present embodiment, the computer device 1300 is configured to implement the functions of the device in the Internet of Things as shown in the above embodiments, and the communication interface 1340 is configured to obtain security credentials to facilitate the processor 1310 to perform mutual authentication with the device in the Internet of Things based on the authentication key. Figure 4 Or Figure 7 When the communication interface 1340 is used to implement the functions of the device in the Internet of Things as shown in the above embodiments, the communication interface 1340 is configured to obtain security credentials to facilitate the processor 1310 to perform mutual authentication with the device in the Internet of Things based on the authentication key.

[0201] The bus 1320 can include a path for transmitting information between the above-mentioned components (such as the processor 1310, the memory unit 1350, and the storage 1330). The bus 1320 can include not only a data bus, but also a power supply bus, a control bus, and a status signal bus, etc. However, for the purpose of clarity, all kinds of buses are marked as the bus 1320 in the figure. The bus 1320 can be a Peripheral Component Interconnect Express (PCIe) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus 1320 can be divided into an address bus, a data bus, a control bus, etc.

[0202] As an example, the computer device 1300 can include multiple processors. The processor can be a multi-CPU processor. The processor here can refer to one or more devices, circuits, and / or computing units for processing data (such as computer program instructions).

[0203] It is worth noting that, Figure 13 In the above embodiments, only the computer device 1300 is taken as an example including 1 processor 1310 and 1 storage 1330, and here the processor 1310 and the storage 1330 are respectively used to indicate a type of device or apparatus, and in specific embodiments, the number of each type of device or apparatus can be determined according to business needs.

[0204] The memory unit 1350 can be a volatile memory pool or a non-volatile memory pool, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DR RAM). The memory unit 1350 is used to store information such as security credentials, public keys, private keys, authentication keys, and encryption keys.

[0205] The memory 1330 can correspond to the storage medium used to store information such as elliptic curve algorithms and hash algorithms in the above method embodiments, for example, a disk such as a mechanical hard disk or a solid state disk.

[0206] The above computer device 1300 can be a general-purpose device or a special-purpose device. For example, the computer device 1300 can be an edge device (for example, a box carrying a chip with processing capability) and the like. Alternatively, the computer device 1300 can also be a server or other device with computing capability.

[0207] It should be understood that the computer device 1300 according to the present embodiment can correspond to the data transmission apparatus 1100 or the data transmission apparatus 1200 in the present embodiment, and can correspond to the corresponding subject performing the method according to any one of Figure 4 or Figure 7 and the above and other operations and / or functions of each module in the data transmission apparatus 1100 or the data transmission apparatus 1200 are respectively implemented to achieve the method according to any one of Figure 4 or Figure 7The corresponding flow of each method in the above embodiments is not described here again for brevity.

[0208] The chip provided in the embodiment of the present application comprises: a processor and a power supply circuit; the power supply circuit is configured to supply power for the processor; and the processor is configured to perform the operation steps of the data processing method in the above method embodiments.

[0209] The method steps in the embodiment can be implemented in the form of hardware, or in the form of software instructions executed by a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), a register, a hard disk, a mobile hard disk, a CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a computing device. Of course, the processor and the storage medium can also exist as discrete components in the computing device.

[0210] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer programs or instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are performed. The computer can be a general purpose computer, a special purpose computer, a computer network, a network device, a user equipment or other programmable apparatus. The computer programs or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer programs or instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired or wireless manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center and the like integrated with one or more available media. The available media can be a magnetic medium, for example, a floppy disk, a hard disk, a magnetic tape; or an optical medium, for example, a digital video disc (digital video disc, DVD); or a semiconductor medium, for example, a solid state disk (solid state drive, SSD). The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed in the present application, and these modifications or replacements should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data transmission method, characterized by, The method comprises: a first device sends an identity of the first device to an authentication center, the identity of the first device being used for the authentication center to verify the first device; in a case where the first device is successfully verified by the authentication center, a security credential is obtained from the authentication center, the security credential comprising at least one of an identity of the authentication center, a security parameter, a hash function and an elliptic curve identity; a public key of a second device is generated according to the security credential, and an authentication key is generated according to the public key of the second device; after the authentication code generated based on the authentication key is authenticated by the second device, data to be transmitted is processed according to an encryption key, to obtain encrypted data; the encrypted data is sent.

2. The method of claim 1, wherein, The method further comprises: the encryption key is generated according to the security credential.

3. The method according to claim 1 or 2, characterized in that, The generation of the public key of the second device and the authentication key according to the public key of the second device based on the security credential comprises: the public key of the second device is generated according to the security credential based on an elliptic curve algorithm, and the authentication key is generated according to the public key of the second device.

4. The method according to any one of claims 1 to 3, characterized in that, The generation of the public key of the second device and the authentication key according to the public key of the second device based on the security credential comprises: the public key of the second device is generated according to the public key of the authentication center and the security credential; the authentication key is generated according to the public key of the second device and the private key of the first device.

5. The method according to any one of claims 1-4, characterized in that, The method further comprises: the authentication code is generated by calculating the identity of the first device and a random number based on the authentication key.

6. The method according to any one of claims 1-5, characterized in that, The method further comprises: when the security credential is verified to be legal, the public key and the private key of the first device are generated according to the security credential.

7. The method of claim 6, wherein, The verification of the security credential to be legal comprises: the security credential is verified to be legal according to the public key of the authentication center, the identity of the first device and the identity of the authentication center.

8. The method according to any one of claims 1-7, characterized in that, The method further comprises: the public key and the private key of the authentication center are updated; or / and, the public key and the private key of the first device are updated.

9. The method according to any one of claims 1-8, characterized in that, The authentication center is a key distribution center, and the first device is used as a key authentication agent or a key authentication edge.

10. A data transmission method, characterized by, The method comprises: an authentication code sent by a first device is received, the authentication code being calculated based on a first authentication key generated based on a first security credential, the first authentication key being generated based on a public key of a second device generated based on the first security credential, the first security credential comprising at least one of an identity of an authentication center, a security parameter, a hash function and an elliptic curve identity; a verification code is generated based on a second authentication key, the second authentication key being generated based on a public key of the first device generated based on a second security credential; when the verification code and the authentication code are the same, it is determined that the first device is successfully authenticated; encrypted data sent by the first device is received, the encrypted data being encrypted by an encryption key, the encryption key being calculated based on the first security credential.

11. The method of claim 10, wherein, The method further comprises: the second security credential is obtained from the authentication center; the second authentication key is generated according to the second security credential.

12. The method of claim 11, wherein, The generation of the second authentication key according to the second security credential comprises: generate the public key of the first device according to the public key of the authentication center and the second security credential; generate the second authentication key according to the public key of the first device and the private key of the second device.

13. The method according to any one of claims 10-12, characterized in that, The generating the verification code based on the second authentication key comprises: calculating the verification code based on the second authentication key and the identity and random number of the first device.

14. The method according to any one of claims 10-13, characterized in that, The authentication center is a key distribution center, and the first device is used as a key authentication agent or a key authentication edge.

15. A data transmission method, characterized by, Comprise: receiving the identity of the first device; generating a security credential according to a random number, the identity of the first device, the identity of the authentication center and the private key of the authentication center if the authentication center successfully verifies the first device according to the identity of the first device, wherein the security credential comprises at least one of the identity of the authentication center, a security parameter, a hash function and an elliptic curve identity; feeding back the security credential, wherein the security credential is used for the first device to generate an authentication key for authentication with a second device, and the authentication key is generated based on the second device's public key generated based on the security credential.

16. The method of claim 15, wherein, The generating a security credential according to a random number, the identity of the first device, the identity of the authentication center and the private key of the authentication center comprises: generating the security credential according to the random number, the identity of the first device, the identity of the authentication center and the private key of the authentication center when the first device is verified to be legal.

17. The method according to claim 15 or 16, characterized in that The authentication center is a key distribution center, and the first device is used as a key authentication agent or a key authentication edge.

18. A data transmission apparatus, characterized by comprising: The device comprises: a communication module configured to send the identity of the first device to an authentication center, wherein the identity of the first device is used for the authentication center to verify the first device; the communication module is further configured to obtain a security credential from the authentication center if the authentication center successfully verifies the first device, wherein the security credential comprises at least one of the identity of the authentication center, a security parameter, a hash function and an elliptic curve identity; an authentication module configured to generate a public key of a second device according to the security credential, generate an authentication key according to the public key of the second device, and generate an authentication code based on the authentication key; an encryption module configured to process data to be transmitted according to an encryption key after the second device is authenticated based on the authentication code, to obtain encrypted data; the communication module is further configured to send the encrypted data to the second device.

19. The apparatus of claim 18, wherein, The authentication module is further configured to: generate the encryption key according to the security credential.

20. The apparatus of claim 18 or 19, wherein, When the authentication module generates a public key of a second device according to the security credential and generates an authentication key according to the public key of the second device, it is specifically configured to: generate the public key of the second device according to the security credential based on an elliptic curve algorithm, and generate the authentication key according to the public key of the second device.

21. The apparatus of any one of claims 18-20, wherein, When the authentication module generates a public key of a second device according to the security credential and generates an authentication key according to the public key of the second device, it is specifically configured to: generate the public key of the second device according to the public key of the authentication center and the security credential; generate the authentication key according to the public key of the second device and the private key of the first device.

22. The apparatus of any one of claims 18-21, wherein, The authentication module is configured to generate an authentication code based on the authentication key, and specifically configured to: generate the authentication code based on the authentication key and the identity of the first device and a random number.

23. The apparatus of any one of claims 18-22, wherein, The authentication center is a key distribution center, and the first device is used as a key authentication agent or a key authentication edge.

24. The apparatus of any one of claims 18-23, wherein, The authentication module is further configured to: generate a public key and a private key of the first device according to the security credential when the security credential is verified to be legal.

25. The apparatus of claim 24, wherein, The authentication module is configured to verify the security credential to be legal, and specifically configured to: verify the security credential to be legal according to a public key of the authentication center, the identity of the first device, and the identity of the authentication center.

26. The apparatus of any one of claims 18-25, wherein, The authentication module is further configured to: update the public key and the private key of the authentication center; or / and, update the public key and the private key of the first device.

27. A data transmission device, characterized by The device comprises: a communication module configured to receive an authentication code sent by a first device, the authentication code being calculated based on a first authentication key generated based on a first security credential, the first authentication key being generated based on a public key of a second device generated based on the first security credential, the first security credential comprising at least one of an identity of an authentication center, a security parameter, a hash function, and an elliptic curve identity; an authentication module configured to generate a verification code based on a second authentication key, the second authentication key being generated based on a public key of the first device generated based on a second security credential; The authentication module is further configured to determine that the first device is authenticated successfully when the verification code and the authentication code are the same. The communication module is further configured to receive encrypted data sent by the first device, the encrypted data being encrypted by an encryption key, the encryption key being calculated based on the first security credential.

28. The device of claim 27, wherein: the communication module is further configured to obtain a second security credential from the authentication center; the authentication module is further configured to generate the second authentication key according to the second security credential.

29. The apparatus of claim 28, wherein, The authentication module is configured to generate the second authentication key according to the second security credential, and specifically configured to: generate the public key of the first device according to a public key of the authentication center and the second security credential; generate the second authentication key according to the public key of the first device and a private key of the second device.

30. The apparatus of any one of claims 27-29, wherein, The authentication module is configured to generate the verification code based on the second authentication key, and specifically configured to: generate the verification code based on the second authentication key and the identity of the first device and a random number.

31. The apparatus of any one of claims 27-30, wherein, The authentication center is a key distribution center, and the first device is used as a key authentication agent or a key authentication edge.

32. A data transmission device, characterized by The device comprises: a communication module configured to receive an identity of a first device; a registration module configured to generate a security credential according to a random number, the identity of the first device, an identity of the authentication center, and a private key of the authentication center when the authentication center verifies the first device to be successful according to the identity of the first device, the security credential comprising at least one of the identity of the authentication center, a security parameter, a hash function, and an elliptic curve identity. The communication module is further configured to feed back the security credential, wherein the security credential is used for the first device to generate an authentication key for authentication with a second device, and the authentication key is generated based on a public key of the second device generated based on the security credential.

33. The apparatus of claim 32, wherein, When generating the security credential based on the random number, the identity of the first device, the identity of the authentication center and the private key of the authentication center, the registration module is specifically configured to: When verifying that the first device is legitimate, the security credential is generated based on the random number, the identity of the first device, the identity of the authentication center and the private key of the authentication center.

34. The apparatus of claim 32 or 33, wherein, The authentication center is a key distribution center, and the first device is used as a key authentication agent or a key authentication edge.

35. A computer device, comprising: The computer device comprises a memory and a processor, the memory is used to store a set of computer instructions; when the processor executes the set of computer instructions, the operation steps of the method in any one of claims 1-9 are executed, or the operation steps of the method in any one of claims 10-14 are executed, or the operation steps of the method in any one of claims 15-17 are executed.

36. A communication system, characterized by The communication system comprises an authentication center, a first device and a second device, the first device is used to execute the operation steps of the method in any one of claims 1-9, the second device is used to execute the operation steps of the method in any one of claims 10-14, and the authentication center is used to execute the operation steps of the method in any one of claims 15-17.

Images