Access method, device and cloud platform device

Abstract

The embodiments of the present application relate to an access method, a device and a cloud platform device, wherein the method includes: a first device obtains a ciphertext of an access key and a second random number, wherein the ciphertext of the access key is generated by the access key, the first random number, the second random number and the first key; the first device generates an access key using the ciphertext of the access key, the second random number, the first random number and the first key; the first device uses the access key to access the first cloud platform. The embodiments of the present application can improve the security of accessing the cloud platform and reduce the complexity of communication.

Description

Technical Field

[0001] The present application relates to the field of communications, and more specifically, to an access method, device, and cloud platform device. Background Art

[0002] In the softAP (soft access point) networking mode, the Wi-Fi device can enable a service access point implemented by software. The hardware part of the device may include a standard wireless network card, but it uses a driver to provide the same signal switching, routing and other functions as an AP, and broadcast beacon data. The access device (such as a mobile phone) can start scanning to receive the Beacon data. The access device can connect to the softAP and communicate with the Wi-Fi device through the Wi-Fi protocol, and set the SSID and password of the home Wi-Fi network to the Wi-Fi device. The Wi-Fi device will use the SSID and password of the home Wi-Fi network to establish a connection with the AP of the home Wi-Fi network.

[0003] In the case of cross-manufacturer device access (i.e., the manufacturer of the smart device and the service provider to which the smart device is connected are not the same), when the application terminal has a root certificate, when the application terminal connects to the access cloud platform, it only verifies the access cloud platform, and the access cloud platform does not verify the application terminal, and there may be counterfeit application terminals connected to the access cloud platform. In the case that the application terminal does not have a root certificate, when the application terminal connects to the access cloud platform, there may be counterfeit network configuration devices that intercept the legitimate shared key (PSK, pre-shared key) and configure the counterfeit application terminal to the network, thereby connecting to the mobile phone cloud platform. All of these have caused the application terminal to be unable to securely connect to the access cloud platform. In addition, each time the application terminal connects to the access cloud platform, it needs to use a key (license) to perform two-way authentication through the device cloud platform, which is cumbersome. Summary of the invention

[0004] The embodiments of the present application provide an access method, a device, and a cloud platform device, which can improve the security of device access to the cloud platform and reduce communication complexity.

[0005] The present application embodiment provides an access method, including:

[0006] The first device obtains a ciphertext of the access key and a second random number, wherein the ciphertext of the access key is generated by the access key, the first random number, the second random number and the first key;

[0007] The first device generates an access key using the ciphertext of the access key, the second random number, the first random number, and the first key;

[0008] The first device accesses the first cloud platform using the access key.

[0009] The embodiment of the present application also proposes an access method, including:

[0010] The first cloud platform allocates an access key and a second random number to the first device;

[0011] The first cloud platform sends the second random number and the first random number of the first device to the second cloud platform;

[0012] The first cloud platform receives a second key from the second cloud platform, where the second key is generated by the first random number, the second random number, and the first key;

[0013] The first cloud platform encrypts the access key using the second key to obtain a ciphertext of the access key;

[0014] The first cloud platform sends the ciphertext of the access key and the second random number.

[0015] The embodiment of the present application also proposes an access method, including:

[0016] The second cloud platform receives the first random number and the second random number;

[0017] The second cloud platform generates a second key using the first random number, the second random number and the first key;

[0018] The second cloud platform sends the second key to the first cloud platform.

[0019] The embodiment of the present application also proposes an access method, including:

[0020] The second device receives the ciphertext of the access key of the first device and the second random number, wherein the ciphertext of the access key of the first device is generated by the access key of the first device, the first random number, the second random number and the first key;

[0021] The second device provides the first device with the ciphertext of the access key and the second random number.

[0022] The present application also provides a device, including:

[0023] An acquisition module, used to acquire a ciphertext of an access key and a second random number, wherein the ciphertext of the access key is generated by the access key, the first random number, the second random number and the first key;

[0024] A generating module, configured to generate an access key using the ciphertext of the access key, the second random number, the first random number and the first key;

[0025] The access module is used to access the first cloud platform using an access key.

[0026] The present application also provides a cloud platform device, including:

[0027] An allocation module, configured to allocate an access key and a second random number to the first device;

[0028] A first sending module, used for sending the second random number and the first random number of the first device to the second cloud platform;

[0029] A first receiving module, used to receive a second key from a second cloud platform, where the second key is generated by the first random number, the second random number and the first key;

[0030] An encryption module, used for encrypting the access key with the second key to obtain a ciphertext of the access key;

[0031] The second sending module is used to send the ciphertext of the access key and the second random number.

[0032] The present application also provides a cloud platform device, including:

[0033] A second receiving module, used for receiving a first random number and a second random number;

[0034] A generating module, used to generate a second key using the first random number, the second random number and the first key;

[0035] The third sending module is used to send the second key to the first cloud platform.

[0036] The present application also provides a device, including:

[0037] A third receiving module is used to receive the ciphertext of the access key of the first device and the second random number, wherein the ciphertext of the access key of the first device is generated by the access key of the first device, the first random number, the second random number and the first key;

[0038] A module is provided for providing a ciphertext of an access key and a second random number to the first device.

[0039] The embodiment of the present application improves security by securely transmitting the access key used when the device is connected to the cloud platform; and, since the access key is used, the device no longer needs to interact with the device cloud when reconnecting to the cloud platform, thereby reducing communication complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of an application scenario of an embodiment of the present application.

[0041] Figure 2 It is a schematic flowchart of an access method 200 according to an embodiment of the present application.

[0042] Figure 3 This is an implementation flowchart according to the first embodiment of the present application.

[0043] Figure 4 This is an implementation flow chart according to the second embodiment of the present application.

[0044] Figure 5 This is an implementation flowchart according to the third embodiment of the present application.

[0045] Figure 6 It is a schematic flowchart of an access method 600 according to an embodiment of the present application.

[0046] Figure 7 It is a schematic flowchart of an access method 700 according to an embodiment of the present application.

[0047] Figure 8 It is a schematic flowchart of an access method 800 according to an embodiment of the present application.

[0048] Fig. 9 It is a schematic flow chart of a device 900 according to an embodiment of the present application.

[0049] Fig.10 It is a schematic flow chart of a cloud platform device 1000 according to an embodiment of the present application.

[0050] Fig.11 It is a schematic flow chart of a cloud platform device 1100 according to an embodiment of the present application.

[0051] Fig.12 It is a schematic flow chart of a device 1200 according to an embodiment of the present application.

[0052] Fig.13 It is a schematic structural diagram of a device 1300 according to an embodiment of the present application.

[0053] Fig.14 is a schematic structural diagram of a chip 1400 according to an embodiment of the present application. DETAILED DESCRIPTION

[0054] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0055] It should be noted that the terms "first", "second", etc. in the description and claims of the embodiments of the present application and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. The objects described by the "first" and "second" described at the same time may be the same or different.

[0056] The technical solution of the embodiment of the present application can be applied to, for example, Figure 1In the communication system shown in FIG. 1 , the communication system may include a device cloud platform 110, an access cloud platform 120, a control terminal device 130, and an application terminal device 140. The cloud platform may be referred to as a cloud service, a cloud server, a cloud platform, a cloud service platform, a cloud, and the like.

[0057] Taking the smart home system as an example, the smart home cloud service platform can unify and flexibly call various smart home information resources through the network to realize the processing method of large-scale computing of smart home information. The cloud service platform can use technologies such as distributed computing and virtual resource management to centralize scattered ICT (Information Communications Technology) resources (including computing and storage, application operation platform, software, etc.) through the network to form a shared smart home resource pool, and provide services to users in a dynamic, on-demand and measurable manner. The smart home cloud service platform can connect with various electrical appliances, home facilities and sensing devices in the home space based on the public communication network and the home local area network to provide various home application services.

[0058] In a smart home system, a control terminal comprehensively manages or controls various home application terminals locally or remotely, mainly to convert the user's operation or control behavior into actual command signals, and coordinate the intelligent application service resources of the cloud service platform, and send them to the application terminal for it to perform specific operations. For example, a control terminal can be installed with an application (Application, APP) for controlling network configuration, and the APP of the control terminal can control the network configuration of the application terminal through interactive instructions. A control terminal can be called a Wi-Fi access device in a Wi-Fi network.

[0059] In a smart home system, application terminals can be connected to a home network, can execute interactive commands of control terminals, and are electronic and information products that meet people's needs for intelligent applications in their living environments. Application terminals include but are not limited to various smart home appliances such as refrigerators, washing machines, air conditioners, televisions, projectors, etc. Application terminals can be called Wi-Fi devices in a Wi-Fi network.

[0060] It should be understood that the terms "system" and "network" are often used interchangeably in this article. The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0061] It should be understood that the "indication" mentioned in the embodiments of the present application can be a direct indication, an indirect indication, or an indication of an association relationship. For example, A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association relationship between A and B.

[0062] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between two items, or an association relationship between the two items, or a relationship between indication and being indicated, configuration and being configured, and the like.

[0063] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0064] This application embodiment proposes an access method. Figure 2 is a schematic flow chart of an access method 200 according to an embodiment of the present application, which method can optionally be applied to Figure 1 The system shown in the figure is not limited thereto. The method includes at least part of the following contents.

[0065] S210: The first device obtains a ciphertext of an access key and a second random number, wherein the ciphertext of the access key is generated by the access key, the first random number, the second random number, and the first key;

[0066] S220: The first device generates an access key using the ciphertext of the access key, the second random number, the first random number, and the first key;

[0067] S230: The first device accesses the first cloud platform using the access key.

[0068] The first device may be Figure 1 The application terminal device 140 in the system shown is not limited to various smart home appliances such as refrigerators, washing machines, air conditioners, televisions, projectors, etc.

[0069] The first cloud platform can be Figure 1 The access cloud platform 120 in the system is shown.

[0070] Optionally, the access key and the second random number (denoted by R2 in the embodiment of the present application) are allocated to the first device by the first cloud platform;

[0071] The first random number is generated by the first device;

[0072] The first key is pre-stored in the second cloud platform and the first device.

[0073] Optionally, the second cloud platform is Figure 1 The device cloud platform 110 in the system shown may be a cloud platform of a device manufacturer of the first device.

[0074] Optionally, the process of generating the ciphertext of the access key includes:

[0075] (1) combining the first random number and the second random number;

[0076] (2) using the first key to encrypt the combined data to obtain a second key;

[0077] (3) The access key is encrypted using the second key to obtain a ciphertext of the access key. The encryption process may use a symmetric encryption algorithm, such as the AES256-CMAC algorithm.

[0078] In the above steps, the above steps (1) and (2) can be performed by the second cloud platform. After the second cloud platform generates the second key, it sends the second key to the first cloud platform; the above step (3) can be performed by the first cloud platform. The first cloud platform encrypts the access key using the received second key. In this way, the access key can only be obtained by the first cloud platform and the first device, which can ensure the security of the access key. In addition, the first key allocated by the device manufacturer to the first device can only be obtained by the second cloud platform and the first device, which can ensure the security of the first key.

[0079] In addition, as can be seen from the above step S230, the first device no longer needs to perform two-way authentication with the second cloud platform when subsequently accessing the first cloud platform, thereby reducing the complexity of communication.

[0080] In the embodiment of the present application, the first random number, the second random number, the access key, the first key, and the second key are represented by R1, R2, K1, K, and K2, respectively.

[0081] Optionally, the above step S220 includes:

[0082] The first device combines the first random number with the second random number;

[0083] The first device encrypts the combined data using the first key to obtain a second key;

[0084] The first device uses the second key to decrypt the ciphertext of the access key to obtain the access key.

[0085] The first random number is randomly generated by the first device, and the second random number is generated by the first cloud platform and obtained by the first device.

[0086] It can be seen that the first device calculates the second key in the same way as the second cloud platform; then the second key is used to decrypt the ciphertext encrypted by the first cloud platform. Since the access key is encrypted using a symmetric encryption algorithm, the same password is used to decrypt the ciphertext of the access key to obtain the access key.

[0087] The manner in which the first device or the second cloud platform combines the first random number and the second random number may include: combining the first random number and the second random number using a predefined algorithm.

[0088] Optionally, the predefined algorithm includes at least one of the following:

[0089] Data splicing;

[0090] Multiplication operation;

[0091] The first random number is used as a key to encrypt the second random number; for example, the AES encryption algorithm is used for encryption;

[0092] The second random number is used as a key to encrypt the first random number; for example, the AES encryption algorithm is used for encryption.

[0093] The first device or the second cloud platform may encrypt the combined data by using a key generation algorithm, for example, using encryption algorithms such as AES256-CMAC, HKDF, and PBKDF.

[0094] Optionally, the above step S230 may include: the first device uses the above access key to establish a connection with the first cloud platform in a PSK manner.

[0095] Optionally, the connection includes at least one of the following:

[0096] Transport Layer Security (TLS) connections;

[0097] Datagram Transport Layer Security (DTLS) connections;

[0098] Application layer encrypted connection.

[0099] In the above step S210, in addition to obtaining the ciphertext of the access key and the second random number, the first device can also obtain the identifier assigned to the first device by the first cloud platform; the identifier is used to uniquely identify the first device on the first cloud platform, and the first cloud platform can use the identifier index to assign the access key to it.

[0100] Accordingly, in the above step S230, the first device uses the access key and the identifier to access the first cloud platform. The first cloud platform finds the access key previously allocated to the first device according to the identifier, and uses the access key to complete access authentication of the first device.

[0101] In the above process, the way in which the first device obtains the ciphertext of the access key, the second random number, and the identifier assigned to the first device by the first cloud platform may include:

[0102] The first device receives the ciphertext of the access key, the second random number, and the identifier assigned to the first device by the first cloud platform from the second device; or,

[0103] The first device scans and parses the QR code generated by the second device to obtain the ciphertext of the access key, the second random number, and the identifier assigned to the first device by the first cloud platform; or,

[0104] The first device receives the ciphertext of the access key, the second random number, and the identifier assigned to the first device by the first cloud platform from the first cloud platform.

[0105] After the first device is connected to the home network, if it is in an unconfigured state or does not have an access key for accessing the first cloud platform, it can authenticate with the first cloud platform, that is, execute Figure 2 The access process shown; if it is in a configured state and has an access key for accessing the first cloud platform, you can authenticate with the first cloud platform, that is, use the access key to access the first cloud platform.

[0106] The present application is described in detail below with reference to specific application scenarios and embodiments.

[0107] Embodiment 1:

[0108] This embodiment is mainly based on the optimization of two-way authentication before soft AP network configuration. In the embodiment, the first device is specifically an application terminal device (referred to as device), the second device is specifically a control terminal device (such as a mobile phone), the first cloud platform is specifically an access cloud (such as a mobile phone cloud platform), and the second cloud platform is specifically a device cloud.

[0109] The device manufacturer allocates a unique key K to each device (identified by device ID1), presets the key K to the corresponding application terminal, and stores the key K and the corresponding device ID1 in the cloud platform of the device manufacturer.

[0110] Figure 3 This is a flowchart of the implementation of the first embodiment of the present application. Figure 3 As shown, the first embodiment includes the following steps:

[0111] Step 1: When the network configuration device (such as a mobile phone) discovers the application terminal device, it parses the device's SSID and / or BSSID and / or manufacturer-defined IE to obtain the device manufacturer information, the ID1 (such as MAC) preset by the device cloud for the device, and the random number R1 generated by the device.

[0112] Step 2: The mobile phone establishes a secure connection with the mobile cloud, and the mobile phone sends the aforementioned device manufacturer information, ID1 and R1 to the mobile cloud (the purpose of this request is to obtain device authentication information and cloud authentication information from the mobile cloud, corresponding to the subsequent step 9).

[0113] Step 3. Mobile Cloud finds the corresponding device cloud based on the device manufacturer information.

[0114] Step 4. The mobile cloud generates a unique identifier ID2, a random access key K1 and a random number R2 assigned to the device by the mobile cloud according to the device ID1 (the mobile cloud needs to save the K1 and the corresponding device ID2).

[0115] Step 5. The mobile cloud establishes a secure connection with the device cloud, and the device cloud obtains the device authentication information from the mobile cloud. During this process, the mobile cloud platform sends the aforementioned R1, the aforementioned R2, and the aforementioned ID1 to the device cloud platform.

[0116] Step 6: The device cloud platform obtains the device key K according to the device ID1. K is used to encrypt R1 to generate the device authentication information Hc1. The device cloud platform generates a random number R3, and uses K to encrypt R1 and R3 to generate the cloud authentication information Hc2. In addition, the device cloud also uses K to encrypt R1 and R2 to generate the key K2.

[0117] Optionally, K2 is generated by:

[0118] Combine R1 and R2 using a predefined algorithm M1 to generate R4 (e.g., data concatenation, or multiplication, or AES encryption of R2 using R1 as a key, or AES encryption of R1 using R2 as a key, etc.);

[0119] Use a predefined key generation algorithm S1 (such as AES256-CMAC, HKDF, PBKDF, etc.) to encrypt R4 with K to obtain K2.

[0120] Step 7: The device cloud platform returns the device authentication information Hc1, random number R3, cloud authentication information Hc2 and key K2 to the mobile cloud platform.

[0121] Step 8: The mobile cloud platform uses a predefined symmetric encryption algorithm S2 (such as AES256-CMAC) to encrypt K1 with K2 to obtain the ciphertext C1.

[0122] Step 9: The mobile phone cloud platform returns the device authentication information Hc1, random number R3, cloud authentication information Hc2, identification ID2, random number R2 and ciphertext C1 to the mobile phone.

[0123] Step 10. Establish a softAP connection between the mobile phone and the device.

[0124] Step 11, the mobile phone sends the random number R3, cloud authentication information Hc2, identification ID2, random number R2 and ciphertext C1 to the device.

[0125] Step 12: The device uses K to encrypt R1 and R3 to generate cloud authentication information Hc2'. If Hc2' = Hc2, the cloud authentication is successful; otherwise, a failure message is returned and the current process ends.

[0126] Step 13: The device uses K to encrypt R1, generates device authentication information Hc1', and returns the device authentication information Hc1' to the mobile phone. The mobile phone authenticates the device. If Hc1' = Hc1, the authentication of the device is successful; otherwise, it returns a failure message and ends the current process. If both parties are authenticated, the network configuration is completed and the softAP connection is disconnected.

[0127] Step 14. The device uses the predefined algorithm M1 for R1 and R2 to generate R4' (equivalent to R4). The predefined key generation algorithm S1 is used to encrypt R4' with K to obtain K2' (equivalent to K2). Then, K2 is used to decrypt C1 using the predefined symmetric encryption algorithm S2 to obtain K1' (equivalent to K1), and the device saves K1'. In this way, the intermediate node (such as a mobile phone) does not have K, so it cannot obtain K2, nor can it decrypt to obtain K1. The device cloud platform cannot obtain K1 either. Therefore, K1 is only obtained by the mobile phone cloud platform and the device, which can ensure security.

[0128] Afterwards, when the device reconnects to the mobile cloud platform, it can use the access key K1' (equivalent to K1) to authenticate with the mobile cloud platform without interacting with the device cloud, thereby reducing the complexity of communication. Specifically, the following steps are included:

[0129] Step 15: The device uses K1' as the key to establish a TLS / DTLS connection or an application layer encrypted connection with the mobile cloud platform through the PSK method. During authentication, the device can send the ID2 assigned by the mobile cloud platform to the mobile platform, and the mobile cloud platform can use ID2 to index K1.

[0130] Optionally, each time the device connects to the mobile cloud platform, it can use K1 as the key to directly perform one-way or two-way challenge authentication with the mobile cloud platform. For example: the device sends the random value A1 and the verification value X1 generated by K1 to the mobile cloud, and the mobile cloud uses K1 and the random value A1 to generate the verification value X2, and compares X2 with X1. If the results are consistent, the mobile cloud sends A2 and the verification value X3 generated by K1 to the mobile cloud, and the device uses K1 and the random value A2 to generate the verification value X4, and compares X4 with X3. If the results are consistent, the authentication between the access cloud and the device is successful.

[0131] Embodiment 2:

[0132] This embodiment is mainly based on the optimization of the authentication device identity after the softAP is configured. In the prior art, when the SoftAP is configured, the configuration device (such as a mobile phone) sends home network information to the application terminal (device to be connected to the network), and after the device is connected to the home network and establishes a secure connection with the access cloud (for example, using the TLS / DTLS method), the device cloud uses a key (license) to authenticate the device, and the device uses a key (license) to authenticate the device cloud. This authentication process has many steps. This embodiment can reduce the communication complexity of the authentication process.

[0133] In an embodiment, the first device is specifically an application terminal device (referred to as device for short), the second device is specifically a control terminal device (such as a mobile phone), the first cloud platform is specifically an access cloud (such as a mobile phone cloud platform), and the second cloud platform is specifically a device cloud.

[0134] Figure 4 This is a flowchart of the implementation of the second embodiment of the present application. Figure 4 As shown, the second embodiment includes the following steps:

[0135] Step 1: After the device is connected to the home network, if it is in an unconfigured state or there is no K1′ for accessing the mobile cloud, it will authenticate with the device cloud; if it is in a configured state and there is K1′ for accessing the mobile cloud, it will authenticate with the mobile cloud.

[0136] Among them, authentication with the device cloud includes: after the device establishes a secure connection with the access cloud (for example, using TLS / DTLS method), the device issuing cloud authenticates the device using a key (license), and the device authenticates the mobile phone cloud using a key (license). In this process, the mobile phone cloud uses the same method as in Example 1 to send K1' to the device. Specifically, authentication with the device cloud includes steps 2 to 13:

[0137] Step 2: Establish a secure connection between the device and the mobile cloud.

[0138] Step 3: The device generates a random number R1, encrypts R1 with K, and generates device authentication information Hc1. The device reports the device manufacturer information, the ID1 (such as MAC) preset by the device cloud for the device, the random number R1 generated by the device, and the aforementioned Hc1 to the mobile phone to apply for authentication.

[0139] Step 4. Mobile Cloud finds the corresponding device cloud based on the device manufacturer information.

[0140] Step 5. The mobile cloud generates a unique identifier ID2, a random access key K1 and a random number R2 assigned to the device by the mobile cloud according to the device ID1 (the mobile cloud needs to save the K1 and the corresponding device ID2).

[0141] Step 6. The mobile cloud establishes a secure connection with the device cloud, and the device cloud obtains the device authentication information from the mobile cloud. During this process, the mobile cloud platform sends the aforementioned R1, the aforementioned R2, and the aforementioned ID1 to the device cloud platform.

[0142] Step 7: The device cloud platform obtains the device key K according to the device ID1. K is used to encrypt R1 to generate the device authentication information Hc1'. If Hc1' = Hc1, the device authentication is successful; otherwise, the authentication fails and the current process ends.

[0143] Step 8: The device cloud platform generates a random number R3, encrypts R1 and R3 using K, and generates cloud authentication information Hc2. In addition, the device cloud also encrypts R1 and R2 using K to generate a key K2.

[0144] Optionally, K2 is generated by:

[0145] Combine R1 and R2 using a predefined algorithm M1 to generate R4 (for example, data concatenation, or multiplication, or AES encryption of R2 using R1 as a key, or AES encryption of R1 using R2 as a key, etc.);

[0146] Use a predefined key generation algorithm S1 (such as AES256-CMAC, HKDF, PBKDF, etc.) to encrypt R4 with K to obtain K2.

[0147] Step 9: The device cloud platform returns the cloud authentication information Hc2, random number R3 and key K2 to the mobile cloud platform.

[0148] Step 10: The mobile cloud platform uses a predefined symmetric encryption algorithm S2 (eg, AES256-CMAC) to encrypt K1 with K2 to obtain a ciphertext C1.

[0149] Step 11, the mobile cloud platform returns the random number R3, cloud authentication information Hc2, identification ID2, random number R2 and ciphertext C1 to the device.

[0150] Step 12: The device uses K to encrypt R1 and R3 to generate cloud authentication information Hc2'. If Hc2' = Hc2, the cloud authentication is successful; otherwise, a failure message is returned, the connection with the cloud is disconnected, and the current process ends.

[0151] Step 13, the device uses the predefined algorithm M1 to generate R4' (equivalent to R4) for R1 and R2. The predefined key generation algorithm S1 is used to encrypt R4' with K to obtain K2' (equivalent to K2). Then K2 is used to decrypt C1 using the predefined symmetric encryption algorithm S2 to obtain K1' (equivalent to K1), and the device saves K1'. In this way, the device cloud platform cannot obtain K1, so K1 is only obtained by the mobile phone cloud platform and the device, which can ensure security.

[0152] The process of authenticating with the access cloud includes: the device uses K1' as the key to establish a TLS / DTLS connection or an application layer encrypted connection with the access cloud through the PSK method. During authentication, the device can send the ID2 assigned by the mobile cloud platform to the mobile platform, and the mobile cloud platform can use ID2 to index K1.

[0153] Optionally, each time the device connects to the mobile cloud platform, it can use K1 as the key to directly perform one-way or two-way challenge authentication with the mobile cloud platform. For example: the device sends the random value A1 and the verification value X1 generated by K1 to the mobile cloud, and the mobile cloud uses K1 and the random value A1 to generate the verification value X2, and compares X2 with X1. If the results are consistent, the mobile cloud sends A2 and the verification value X3 generated by K1 to the mobile cloud, and the device uses K1 and the random value A2 to generate the verification value X4, and compares X4 with X3. If the results are consistent, the authentication between the access cloud and the device is successful.

[0154] Embodiment three:

[0155] This embodiment is mainly based on the optimization of the process of authenticating the device identity before the soft AP scans the code for network configuration. In the prior art, when configuring the network for smart devices with camera functions (such as cameras, AR glasses, etc.), the device identity authentication is performed before the SSID and password of the home Wi-Fi network are issued. If the device has a root certificate, after the device is connected to the network, a TLS / DTLS connection is established with the mobile cloud platform, and the legitimacy of the mobile cloud platform is verified through the root certificate. Since the access cloud does not verify the device, there may be counterfeit terminals connected to the access cloud. If the device does not have a root certificate, after the device is connected to the network, a TLS / DTLS connection or an application layer encrypted connection is established with the mobile cloud platform through the PSK (generated by the mobile cloud and sent to the mobile phone, carried in the home network configuration information). Alternatively, after the device is connected to the home network and establishes a secure connection with the mobile cloud (for example, using the TLS / DTLS method), the device cloud authenticates the device using a key (license), and the device authenticates the device cloud using a key (license). There may be counterfeit network configuration devices that intercept the legitimate PSK and configure the counterfeit application terminal into the network to access the mobile cloud. This embodiment can improve the security of device connection to the cloud platform.

[0156] In an embodiment, the first device is specifically an application terminal device (referred to as device for short), the second device is specifically a control terminal device (such as a mobile phone), the first cloud platform is specifically an access cloud (such as a mobile phone cloud platform), and the second cloud platform is specifically a device cloud.

[0157] The device manufacturer allocates a unique key K to each device (identified by device ID1), presets the key K to the corresponding application terminal, and stores the key K and the corresponding device ID1 in the cloud platform of the device manufacturer.

[0158] Figure 5 This is a flowchart of the implementation of the third embodiment of the present application. Figure 5 As shown, the third embodiment includes the following steps:

[0159] Step 1: Scan the device QR code with your mobile phone, parse the QR code, and obtain the device manufacturer information, the ID1 (such as MAC) preset by the device cloud for the device, and the preset random number R1.

[0160] Step 2: The mobile phone establishes a secure connection with the mobile cloud. The mobile phone sends the aforementioned device manufacturer information, ID1 and R1 to the mobile cloud (the purpose of this request is to obtain the configuration information encryption password from the mobile cloud, corresponding to the subsequent step 7).

[0161] Step 3. Mobile Cloud finds the corresponding device cloud based on the device manufacturer information.

[0162] Step 4. The mobile cloud generates a unique identifier ID2, a random access key K1 and a random number R2 assigned to the device by the mobile cloud according to the device ID1 (the mobile cloud needs to save the K1 and the corresponding device ID2).

[0163] Step 5. The mobile cloud establishes a secure connection with the device cloud. The device cloud obtains the configuration information encryption password from the mobile cloud. During this process, the mobile cloud platform sends the aforementioned R1, the aforementioned R2, and the aforementioned ID1 to the device cloud platform.

[0164] Step 6: The device cloud platform obtains the device key K according to the device ID1. K is used to encrypt R1 to generate the configuration information encryption password Hc1. In addition, the device cloud also uses K to encrypt R1 and R2 to generate the key K2.

[0165] Optionally, K2 is generated by:

[0166] Combine R1 and R2 using a predefined algorithm M1 to generate R4 (for example, data concatenation, or multiplication, or AES encryption of R2 using R1 as a key, or AES encryption of R1 using R2 as a key, etc.);

[0167] Use a predefined key generation algorithm S1 (such as AES256-CMAC, HKDF, PBKDF, etc.) to encrypt R4 with K to obtain K2.

[0168] Step 7: The device cloud platform returns the configuration information encryption password Hc1 and key K2 to the mobile cloud platform.

[0169] Step 8: The mobile cloud platform uses a predefined symmetric encryption algorithm S2 (such as AES256-CMAC) to encrypt K1 with K2 to obtain the ciphertext C1.

[0170] Step 9: The mobile cloud platform returns the configuration information encrypted password Hc1, identification ID2, random number R2 and ciphertext C1 to the mobile phone.

[0171] Step 10: The mobile phone uses Hc1 to encrypt the home network configuration information D (SSID, password, etc.), ID2 and R2, and then combines them with C1 to obtain D1. Use D1 to generate a QR code.

[0172] Step 11. The device scans the mobile phone QR code, obtains D1, and parses it to obtain C1. Use the key K to encrypt the preset random number R1 to obtain Hc1. If Hc1 is correct, D1 can be decrypted to obtain D, ID2 and R2; if Hc1 is wrong, the decryption fails and the current process ends.

[0173] Step 12. The device uses the predefined algorithm M1 for R1 and R2 to generate R4' (equivalent to R4). The predefined key generation algorithm S1 is used to encrypt R4' with K to obtain K2' (equivalent to K2). Then K2 is used to decrypt C1 using the predefined symmetric encryption algorithm S2 to obtain K1' (equivalent to K1), and the device saves K1'. In this way, the intermediate node (such as a mobile phone) does not have K, so it cannot obtain K2, nor can it decrypt to obtain K1. The device cloud platform cannot obtain K1 either. Therefore, K1 is only obtained by the mobile phone cloud platform and the device, which can ensure security.

[0174] Afterwards, when the device reconnects to the mobile cloud platform, it can use the key K1' (equivalent to K1) to authenticate with the mobile cloud platform without interacting with the device cloud, thereby reducing the complexity of communication. Specifically, the following steps are included:

[0175] Step 13: The device uses K1' as the key to establish a TLS / DTLS connection or an application layer encrypted connection with the mobile cloud platform through the PSK method. During authentication, the device can send the ID2 assigned by the mobile cloud platform to the mobile platform, and the mobile cloud platform can use ID2 to index K1.

[0176] Optionally, each time the device connects to the mobile cloud platform, it can use K1 as the key to directly perform one-way or two-way challenge authentication with the mobile cloud platform. For example: the device sends the random value A1 and the verification value X1 generated by K1 to the mobile cloud, and the mobile cloud uses K1 and the random value A1 to generate the verification value X2, and compares X2 with X1. If the results are consistent, the mobile cloud sends A2 and the verification value X3 generated by K1 to the mobile cloud, and the device uses K1 and the random value A2 to generate the verification value X4, and compares X4 with X3. If the results are consistent, the authentication between the access cloud and the device is successful.

[0177] From the above implementation, it can be seen that the embodiment of the present application realizes the secure transmission of the access key for the device to access the mobile cloud, and improves the security of the device's access to the mobile cloud, when authentication is performed before the network information is sent. For the case where authentication is performed after the network information is sent, the access key for the device to access the mobile cloud is transmitted during the first authentication, so that the device no longer needs to interact with the device cloud when it subsequently connects to the mobile cloud, reducing the complexity of communication.

[0178] The embodiment of the present application also proposes an access method. Figure 6 is a schematic flow chart of an access method 600 according to an embodiment of the present application, which method can optionally be applied to Figure 1 The system shown in the figure is not limited thereto. The method includes at least part of the following contents. Including:

[0179] S610: The first cloud platform allocates an access key and a second random number to the first device;

[0180] S620: The first cloud platform sends the second random number and the first random number of the first device to the second cloud platform;

[0181] S630: The first cloud platform receives a second key from the second cloud platform, where the second key is generated by the first random number, the second random number, and the first key;

[0182] S640: The first cloud platform encrypts the access key using the second key to obtain a ciphertext of the access key;

[0183] S650: The first cloud platform sends the ciphertext of the access key and the second random number.

[0184] The first cloud platform can be Figure 1 The access cloud platform 120 in the system is shown.

[0185] Optionally, the first random number is generated by a first device;

[0186] The first key is pre-stored in the second cloud platform and the first device.

[0187] Optionally, the second key is generated by:

[0188] combining the first random number and the second random number;

[0189] The combined data is encrypted using the first key to obtain a second key.

[0190] Optionally, the first cloud platform uses a symmetric encryption algorithm to encrypt the access key.

[0191] Optionally, it also includes:

[0192] The first cloud platform assigns an identifier to the first device;

[0193] The first cloud platform sends an identification.

[0194] Optionally, the first cloud platform sends the ciphertext of the access key, the second random number, and the identifier, including:

[0195] The first cloud platform sends the ciphertext of the access key, the second random number and the identifier to the first device;

[0196] Alternatively, the first cloud platform sends a ciphertext of the access key, a second random number, and an identifier to the second device.

[0197] The embodiment of the present application also proposes an access method. Figure 7 is a schematic flow chart of an access method 700 according to an embodiment of the present application, which method can optionally be applied to Figure 1The system shown in the figure is not limited thereto. The method includes at least part of the following contents. Including:

[0198] S710: The second cloud platform receives the first random number and the second random number;

[0199] S720: The second cloud platform generates a second key using the first random number, the second random number, and the first key;

[0200] S730: The second cloud platform sends the second key to the first cloud platform.

[0201] The second cloud platform can be Figure 1 The device cloud platform 110 in the system is shown.

[0202] Optionally, the second random number is allocated to the first device by the first cloud platform;

[0203] The first random number is generated by the first device;

[0204] The first key is pre-stored in the second cloud platform and the first device.

[0205] Optionally, the second cloud platform generates a second key using the first random number, the second random number and the first key, including:

[0206] The second cloud platform combines the first random number with the second random number;

[0207] The second cloud platform encrypts the combined data using the first key to obtain a second key.

[0208] Optionally, the combining of the first random number and the second random number includes:

[0209] The first random number and the second random number are combined using a predefined algorithm.

[0210] Optionally, the predefined algorithm includes at least one of the following:

[0211] Data splicing;

[0212] Multiplication operation;

[0213] Using the first random number as a key, encrypting the second random number;

[0214] The second random number is used as a key to encrypt the first random number.

[0215] Optionally, the combined data is encrypted using a key generation algorithm.

[0216] The embodiment of the present application also proposes an access method. Figure 8is a schematic flow chart of an access method 800 according to an embodiment of the present application, which method can optionally be applied to Figure 1 The system shown in the figure is not limited thereto. The method includes at least part of the following contents. Including:

[0217] S810: The second device receives the ciphertext of the access key of the first device and the second random number, wherein the ciphertext of the access key of the first device is generated by the access key of the first device, the first random number, the second random number and the first key;

[0218] S820: The second device provides the first device with the ciphertext of the access key and the second random number.

[0219] The second device may be Figure 1 The control terminal device 130 in the system is shown.

[0220] Optionally, the above method further includes:

[0221] The second device receives an identifier assigned by the first cloud platform to the first device;

[0222] The second device provides an identification to the first device.

[0223] Optionally, the second device providing the first device with a ciphertext of the access key, the second random number, and the identifier includes:

[0224] The second device sends the ciphertext of the access key, the second random number and the identifier to the first device; or,

[0225] The second device generates a QR code using the ciphertext of the access key, the second random number and the identifier.

[0226] The present application also provides a device, Fig. 9 is a schematic diagram of a device 900 according to an embodiment of the present application, which can be optionally applied to Figure 1 The system shown is, but not limited to, the device comprising:

[0227] An acquisition module 910 is configured to acquire a ciphertext of an access key and a second random number, wherein the ciphertext of the access key is generated by the access key, the first random number, the second random number and the first key;

[0228] A generating module 920, configured to generate an access key using the ciphertext of the access key, the second random number, the first random number and the first key;

[0229] The access module 930 is used to prepare to access the first cloud platform using the access key.

[0230] Optionally, the access key and the second random number are allocated to the first device by the first cloud platform;

[0231] The first random number is generated by the first device;

[0232] The first key is pre-stored in the second cloud platform and the first device.

[0233] Optionally, the ciphertext of the access key is generated in the following manner:

[0234] combining the first random number and the second random number;

[0235] Encrypting the combined data using the first key to obtain a second key;

[0236] The access key is encrypted using the second key to obtain a ciphertext of the access key.

[0237] Optionally, the generation module 920 is used to: combine the first random number and the second random number; encrypt the combined data using the first key to obtain the second key; and decrypt the ciphertext of the access key using the second key to obtain the access key.

[0238] Optionally, the generating module 920 is used to combine the first random number and the second random number using a predefined algorithm.

[0239] Optionally, the predefined algorithm includes at least one of the following:

[0240] Data splicing;

[0241] Multiplication operation;

[0242] Using the first random number as a key, encrypting the second random number;

[0243] The second random number is used as a key to encrypt the first random number.

[0244] Optionally, the access key is encrypted using a symmetric encryption algorithm;

[0245] The generation module 920 uses a symmetric encryption algorithm and decrypts the ciphertext of the access key.

[0246] Optionally, the combined data is encrypted using a key generation algorithm.

[0247] Optionally, the access module 930 is used to establish a connection with the first cloud platform using an access key in a PSK manner.

[0248] Optionally, the connection includes at least one of the following:

[0249] TLS connection;

[0250] DTLS connections;

[0251] Application layer encrypted connection.

[0252] Optionally, the acquisition module 910 is further used to acquire an identifier assigned by the first cloud platform to the first device;

[0253] The access module 930 is used to access the first cloud platform using an access key and an identifier.

[0254] Optionally, the acquisition module 910 is used to:

[0255] Receive, from the second device, the ciphertext of the access key, the second random number, and the identifier assigned by the first cloud platform to the first device; or,

[0256] Scan and parse the QR code generated by the second device to obtain the ciphertext of the access key, the second random number, and the identifier assigned by the first cloud platform to the first device.

[0257] Optionally, the acquisition module 910 is used to:

[0258] Receive the ciphertext of the access key, the second random number, and the identifier assigned by the first cloud platform to the first device from the first cloud platform.

[0259] Optionally, when the first device is in an unconfigured state or has no access key, the acquisition module 910 acquires the ciphertext of the access key and the second random number.

[0260] Optionally, when the first device is in a configured state and has an access key, the access module 930 uses the access key to access the first cloud platform.

[0261] Optionally, the first cloud platform is an access cloud platform.

[0262] Optionally, the second cloud platform is a cloud platform of a device manufacturer of the first device.

[0263] It should be understood that the above and other operations and / or functions of the modules in the device according to the embodiments of the present application are respectively to implement Figure 2 The corresponding process of the device in method 200 is not repeated here for the sake of brevity.

[0264] The present application also provides a cloud platform device, Fig.10 is a schematic diagram of a cloud platform device 1000 according to an embodiment of the present application, which can be optionally applied to Figure 1 The system shown is, but not limited to, the device comprising:

[0265] An allocating module 1010, configured to allocate an access key and a second random number to the first device;

[0266] A first sending module 1020, configured to send the second random number and the first random number of the first device to the second cloud platform;

[0267] The first receiving module 1030 is used to receive a second key from the second cloud platform, where the second key is generated by the first random number, the second random number and the first key;

[0268] An encryption module 1040 is used to encrypt the access key with the second key to obtain a ciphertext of the access key;

[0269] The second sending module 1050 is used to send the ciphertext of the access key and the second random number.

[0270] Optionally, the first random number is generated by the first device;

[0271] The first key is pre-stored in the second cloud platform and the first device.

[0272] Optionally, the second key is generated by:

[0273] combining the first random number and the second random number;

[0274] The combined data is encrypted using the first key to obtain a second key.

[0275] Optionally, the encryption module 1040 uses a symmetric encryption algorithm to encrypt the access key.

[0276] Optionally, the allocation module 1010 is further configured to allocate an identifier to the first device;

[0277] The second sending module 1050 is further used to send an identification.

[0278] Optionally, the second sending module 1050 is used to:

[0279] Sending a ciphertext of the access key, a second random number, and an identifier to the first device;

[0280] Alternatively, a ciphertext of the access key, a second random number, and an identifier are sent to the second device.

[0281] It should be understood that the above and other operations and / or functions of the modules in the cloud platform according to the embodiments of the present application are respectively to implement Figure 6 The corresponding process of the cloud platform in method 600 is not repeated here for the sake of brevity.

[0282] The present application also provides a cloud platform device, Fig.11 is a schematic diagram of a cloud platform device 1100 according to an embodiment of the present application, which can be optionally applied to Figure 1 The system shown is, but not limited to, the device comprising:

[0283] The second receiving module 1110 is used to receive a first random number and a second random number;

[0284] A generating module 1120, configured to generate a second key using the first random number, the second random number and the first key;

[0285] The third sending module 1130 is used to send the second key to the first cloud platform.

[0286] Optionally, the second random number is allocated to the first device by the first cloud platform;

[0287] The first random number is generated by the first device;

[0288] The first key is pre-stored in the second cloud platform and the first device.

[0289] Optionally, the generation module 1120 is used to: combine the first random number and the second random number; and encrypt the combined data using the first key to obtain the second key.

[0290] Optionally, the generating module 1120 is used to combine the first random number and the second random number using a predefined algorithm.

[0291] Optionally, the predefined algorithm includes at least one of the following:

[0292] Data splicing;

[0293] Multiplication operation;

[0294] Using the first random number as a key, encrypting the second random number;

[0295] The second random number is used as a key to encrypt the first random number.

[0296] Optionally, the generation module 1120 uses a key generation algorithm to encrypt the combined data.

[0297] It should be understood that the above and other operations and / or functions of the modules in the cloud platform according to the embodiments of the present application are respectively to implement Figure 7 The corresponding process of the cloud platform in method 700 is not repeated here for the sake of brevity.

[0298] The present application also provides a device, Fig.12 is a schematic diagram of a device 1200 according to an embodiment of the present application, which can be optionally applied to Figure 1 The system shown is, but not limited to, the device comprising:

[0299] The third receiving module 1210 is used to receive the ciphertext of the access key of the first device and the second random number, wherein the ciphertext of the access key of the first device is generated by the access key of the first device, the first random number, the second random number and the first key;

[0300] A providing module 1220 is configured to provide the first device with a ciphertext of the access key and a second random number.

[0301] Optionally, the third receiving module 1210 is further used to receive an identifier assigned by the first cloud platform to the first device;

[0302] The providing module 1220 is further configured to provide an identifier to the first device.

[0303] Optionally, the providing module 1220 is used to: send a ciphertext of the access key, a second random number, and an identifier to the first device; or,

[0304] A QR code is generated using the ciphertext of the access key, the second random number and the identifier.

[0305] It should be understood that the above and other operations and / or functions of the modules in the device according to the embodiments of the present application are respectively to implement Figure 8 The corresponding process of the device in method 800 is not repeated here for the sake of brevity.

[0306] Fig.13 It is a schematic structural diagram of a device 1300 according to an embodiment of the present application. Fig.13 The device 1300 shown includes a processor 1310, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0307] Alternatively, if Fig.13 As shown, the device 1300 may further include a memory 1320. The processor 1310 may call and run a computer program from the memory 1320 to implement the method in the embodiment of the present application.

[0308] The memory 1320 may be a separate device independent of the processor 1310 , or may be integrated into the processor 1310 .

[0309] Alternatively, if Fig.13 As shown, the device 1300 may further include a transceiver 1330 , and the processor 1310 may control the transceiver 1330 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices.

[0310] The transceiver 1330 may include a transmitter and a receiver. The transceiver 1330 may further include an antenna, and the number of antennas may be one or more.

[0311] Optionally, the device 1300 may be a terminal device of an embodiment of the present application, and the device 1300 may implement the corresponding processes implemented by the terminal device in each method of the embodiment of the present application, which will not be described again for the sake of brevity.

[0312] Optionally, the device 1300 may be a cloud platform device of an embodiment of the present application, and the device 1300 may implement the corresponding processes implemented by the cloud platform device in each method of the embodiment of the present application, which will not be described again for the sake of brevity.

[0313] Fig.14 is a schematic structural diagram of a chip 1400 according to an embodiment of the present application. Fig.14 The chip 1400 shown includes a processor 1410, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0314] Alternatively, if Fig.14 As shown, the chip 1400 may further include a memory 1420. The processor 1410 may call and run a computer program from the memory 1420 to implement the method in the embodiment of the present application.

[0315] The memory 1420 may be a separate device independent of the processor 1410 , or may be integrated into the processor 1410 .

[0316] Optionally, the chip 1400 may further include an input interface 1430. The processor 1410 may control the input interface 1430 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0317] Optionally, the chip 1400 may further include an output interface 1440. The processor 1410 may control the output interface 1440 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0318] Optionally, the chip can be applied to the terminal device in the embodiments of the present application, and the chip can implement the corresponding processes implemented by the terminal device in the various methods of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0319] Optionally, the chip can be applied to the network device in the embodiments of the present application, and the chip can implement the corresponding processes implemented by the network device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0320] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0321] The processor mentioned above may be a general-purpose processor, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC) or other programmable logic devices, transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor mentioned above may be a microprocessor or any conventional processor, etc.

[0322] The memory mentioned above may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM) or a flash memory. The volatile memory may be a random access memory (RAM).

[0323] It should be understood that the above-mentioned memory is exemplary but not restrictive. For example, the memory in the embodiments of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0324] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instruction is loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instruction can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0325] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0326] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0327] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An access method, applied to a first device in a communication system, wherein the communication system further comprises a first cloud platform, a second cloud platform, and a second device, wherein the first cloud platform is an access cloud platform, and the second cloud platform is a cloud platform of a manufacturer of the first device; the method comprises: The first device obtains a ciphertext of an access key and a second random number, wherein the ciphertext of the access key is generated by the access key, the first random number, the second random number and the first key, the access key and the second random number are allocated to the first device by the first cloud platform, the first random number is generated by the first device, and the first key is pre-stored in the second cloud platform and the first device, and the generation method of the ciphertext of the access key includes: the second cloud platform combines the first random number and the second random number; the second cloud platform uses the first key to encrypt the combined data to obtain the second key, and the second cloud platform sends the second key to the first cloud platform; the first cloud platform uses the second key to encrypt the access key to obtain the ciphertext of the access key; The first device generates the access key using the ciphertext of the access key, the second random number, the first random number and the first key, wherein the generating of the access key comprises: the first device combines the first random number and the second random number; the first device encrypts the combined data using the first key to obtain the second key; the first device decrypts the ciphertext of the access key using the second key to obtain the access key; The first device accesses the first cloud platform using the access key.

2. The method according to claim 1, wherein: The combining the first random number and the second random number comprises: The first random number and the second random number are combined using a predefined algorithm.

3. The method according to claim 2, wherein: The predefined algorithm includes at least one of the following: Data splicing; Multiplication operation; Using the first random number as a key, encrypting the second random number; The first random number is encrypted using the second random number as a key.

4. The method according to claim 1, wherein: Encrypting the access key using a symmetric encryption algorithm; The symmetric encryption algorithm is used to decrypt the ciphertext of the access key.

5. The method according to claim 3, wherein: The combined data is encrypted using a key generation algorithm.

6. The method according to claim 1, wherein: The first device uses the access key to access the first cloud platform, including: The first device uses the access key to establish a connection with the first cloud platform in a shared key PSK manner.

7. The method according to claim 6, wherein: The connection includes at least one of the following: Transport Layer Security TLS connections; Datagram Transport Layer Security DTLS connection; Application layer encrypted connection.

8. The method according to claim 1, further comprising: The first device obtains an identifier assigned to the first device by the first cloud platform; The first device uses the access key to access the first cloud platform, including: the first device uses the access key and the identifier to access the first cloud platform.

9. The method according to claim 1, wherein: The first device obtains the ciphertext of the access key, the second random number, and the identifier assigned to the first device by the first cloud platform, including: The first device receives, from the second device, the ciphertext of the access key, the second random number, and an identifier assigned to the first device by the first cloud platform; or, The first device scans and parses the QR code generated by the second device to obtain the ciphertext of the access key, the second random number, and an identifier assigned by the first cloud platform to the first device.

10. The method according to claim 1, wherein: The first device obtains the ciphertext of the access key, the second random number, and the identifier assigned to the first device by the first cloud platform, including: The first device receives the ciphertext of the access key, the second random number, and an identifier assigned to the first device by the first cloud platform from the first cloud platform.

11. The method according to claim 10, wherein: When the first device is in an unconfigured state or does not have the access key, the step of the first device acquiring the ciphertext of the access key and the second random number is performed.

12. The method according to claim 10, wherein: When the first device is in a configured state and has the access key, the first cloud platform is accessed using the access key.

13. An access method, applied to a first cloud platform in a communication system, wherein the communication system further comprises a second cloud platform, a first device, and a second device, wherein the first cloud platform is an access cloud platform, and the second cloud platform is a cloud platform of a manufacturer of the first device; the method comprises: The first cloud platform allocates an access key and a second random number to the first device; The first cloud platform sends the second random number and the first random number of the first device to the second cloud platform, where the first random number is generated by the first device; The first cloud platform receives a second key from the second cloud platform, the second key is generated by the first random number, the second random number and the first key, the first key is pre-stored in the second cloud platform and the first device, and the second key is generated in a manner including: the second cloud platform combines the first random number and the second random number; the second cloud platform encrypts the combined data using the first key to obtain the second key, and the second cloud platform sends the second key to the first cloud platform; The first cloud platform encrypts the access key using the second key to obtain a ciphertext of the access key; The first cloud platform sends the ciphertext of the access key and the second random number.

14. The method according to claim 13, wherein: The first cloud platform encrypts the access key using a symmetric encryption algorithm.

15. The method according to claim 13, further comprising: The first cloud platform assigns an identifier to the first device; The first cloud platform sends the identifier.

16. The method according to claim 13, wherein: The first cloud platform sends the ciphertext of the access key, the second random number, and the identifier, including: The first cloud platform sends the ciphertext of the access key, the second random number and the identifier to the first device; Alternatively, the first cloud platform sends the ciphertext of the access key, the second random number and the identifier to the second device.

17. An access method, applied to a second cloud platform in a communication system, wherein the communication system further comprises a first cloud platform, a first device, and a second device, wherein the first cloud platform is an access cloud platform, and the second cloud platform is a cloud platform of a manufacturer of the first device; the method comprising: The second cloud platform receives a first random number and a second random number, the first random number is generated by the first device, and the second random number is allocated to the first device by the first cloud platform; The second cloud platform generates a second key using the first random number, the second random number and the first key, wherein the first key is pre-stored in the second cloud platform and the first device, and the generating of the second key includes: the second cloud platform combines the first random number and the second random number; The second cloud platform encrypts the combined data using the first key to obtain the second key; The second cloud platform sends the second key to the first cloud platform.

18. The method according to claim 17, wherein: The combining the first random number and the second random number comprises: The first random number and the second random number are combined using a predefined algorithm.

19. The method according to claim 18, wherein: The predefined algorithm includes at least one of the following: Data splicing; Multiplication operation; Using the first random number as a key, encrypting the second random number; The first random number is encrypted using the second random number as a key.

20. The method according to any one of claims 17 to 19, wherein: The combined data is encrypted using a key generation algorithm.

21. A first device, belonging to a communication system, the communication system further comprising a first cloud platform, a second cloud platform, and a second device, the first cloud platform being an access cloud platform, the second cloud platform being a cloud platform of a manufacturer of the first device; the first device comprising: an acquisition module, configured to acquire a ciphertext of an access key and a second random number, wherein the ciphertext of the access key is generated by the access key, a first random number, the second random number and a first key, the access key and the second random number are allocated by the first cloud platform to the first device, the first random number is generated by the first device, the first key is pre-stored in the second cloud platform and the first device, and a generation method of the ciphertext of the access key includes: the second cloud platform combines the first random number and the second random number; the second cloud platform encrypts the combined data using the first key to obtain the second key, and the second cloud platform sends the second key to the first cloud platform; the first cloud platform encrypts the access key using the second key to obtain the ciphertext of the access key; A generation module, configured to generate the access key using the ciphertext of the access key, the second random number, the first random number and the first key, wherein the generation of the access key comprises: the generation module combining the first random number and the second random number; the generation module encrypting the combined data using the first key to obtain the second key; the generation module decrypting the ciphertext of the access key using the second key to obtain the access key; An access module is used to access the first cloud platform using the access key.

22. The first device according to claim 21, wherein The generating module is used to combine the first random number and the second random number by using a predefined algorithm.

23. The first device according to claim 22, wherein: The predefined algorithm includes at least one of the following: Data splicing; Multiplication operation; Using the first random number as a key, encrypting the second random number; The first random number is encrypted using the second random number as a key.

24. The first device according to claim 21, wherein: Encrypting the access key using a symmetric encryption algorithm; The generation module adopts the symmetric encryption algorithm and decrypts the ciphertext of the access key.

25. The first device according to claim 21, wherein The combined data is encrypted using a key generation algorithm.

26. The first device according to claim 21, wherein: The access module is used to establish a connection with the first cloud platform using the access key in a PSK manner.

27. The first device according to claim 26, wherein: The connection includes at least one of the following: TLS connection; DTLS connections; Application layer encrypted connection.

28. The first device according to claim 21, wherein the acquisition module is further used to acquire an identifier assigned by the first cloud platform to the first device; The access module is used to access the first cloud platform using the access key and the identifier.

29. The first device according to claim 21, wherein: The acquisition module is used for: Receive, from the second device, the ciphertext of the access key, the second random number, and an identifier assigned by the first cloud platform to the first device; or, Scan and parse the QR code generated by the second device to obtain the ciphertext of the access key, the second random number, and the identifier assigned by the first cloud platform to the first device.

30. The first device according to claim 21, wherein: The acquisition module is used for: Receive the ciphertext of the access key, the second random number, and an identifier assigned by the first cloud platform to the first device from the first cloud platform.

31. The first device according to claim 21, wherein: When the first device is in an unconfigured state or does not have the access key, the acquisition module acquires the ciphertext of the access key and the second random number.

32. The first device according to claim 21, wherein: When the first device is in a configured state and has the access key, the access module uses the access key to access the first cloud platform.

33. A cloud platform device, wherein a first cloud platform of the cloud platform device belongs to a communication system, the communication system further comprises a second cloud platform, a first device, and a second device, the first cloud platform is an access cloud platform, and the second cloud platform is a cloud platform of a manufacturer of the first device; the device comprises: an allocation module, configured to allocate an access key and a second random number to the first device; A first sending module, configured to send the second random number and a first random number of the first device to a second cloud platform, wherein the first random number is generated by the first device; a first receiving module, configured to receive a second key from the second cloud platform, the second key being generated by the first random number, the second random number and the first key, the first key being pre-stored in the second cloud platform and the first device, and the second key being generated in a manner that: the second cloud platform combines the first random number and the second random number; the second cloud platform encrypts the combined data using the first key to obtain the second key, and the second cloud platform sends the second key to the first cloud platform; An encryption module, used for encrypting the access key with the second key to obtain a ciphertext of the access key; The second sending module is used to send the ciphertext of the access key and the second random number.

34. The cloud platform device according to claim 33, wherein: The encryption module uses a symmetric encryption algorithm to encrypt the access key.

35. The cloud platform device according to claim 33, wherein the allocation module is further used to allocate an identifier to the first device; The second sending module is further used to send the identifier.

36. The cloud platform device according to claim 33, wherein: The second sending module is used for: Sending the ciphertext of the access key, the second random number, and the identifier to the first device; Alternatively, the ciphertext of the access key, the second random number, and the identifier are sent to the second device.

37. A cloud platform device, wherein the second cloud platform of the cloud platform device belongs to a communication system, the communication system further comprises a first cloud platform, a first device, and a second device, the first cloud platform is an access cloud platform, and the second cloud platform is a cloud platform of a manufacturer of the first device; the device comprises: A second receiving module, configured to receive a first random number and a second random number, wherein the first random number is generated by the first device, and the second random number is allocated to the first device by the first cloud platform; a generating module, configured to generate a second key by using the first random number, the second random number and a first key, wherein the first key is pre-stored in the second cloud platform and the first device, and generating the second key comprises: the second cloud platform combines the first random number and the second random number; the second cloud platform encrypts the combined data by using the first key to obtain the second key; The third sending module is used to send the second key to the first cloud platform.

38. The cloud platform device according to claim 37, wherein: The generating module is used to combine the first random number and the second random number by using a predefined algorithm.

39. The cloud platform device according to claim 38, wherein: The predefined algorithm includes at least one of the following: Data splicing; Multiplication operation; Using the first random number as a key, encrypting the second random number; The first random number is encrypted using the second random number as a key.

40. The cloud platform device according to claim 37, wherein: The generating module uses a key generating algorithm to encrypt the combined data.

41. An apparatus comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 12.

42. A cloud platform device, comprising: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 13 to 20.

43. A chip, comprising: A processor, configured to call and run a computer program from a memory, so that a device equipped with the chip executes the method according to any one of claims 1 to 12.

44. A chip, comprising: A processor, configured to call and run a computer program from a memory, so that a device equipped with the chip executes a method as claimed in any one of claims 13 to 20.

45. A computer-readable storage medium for storing a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 12.

46. ​​A computer-readable storage medium for storing a computer program, the computer program causing a computer to execute the method according to any one of claims 13 to 20.

47. A computer program product comprising computer program instructions for causing a computer to perform the method of any one of claims 1 to 12.

48. A computer program product comprising computer program instructions for causing a computer to perform the method of any one of claims 13 to 20.

Images