A data interaction method and device

Abstract

The application provides a data interaction method and device, and relates to the technical field of cloud computing. A data interaction method is applied to a client and includes the following steps: obtaining a CA certificate and a client certificate issued by a private cloud; performing handshake information verification with a public cloud according to the CA certificate and the client certificate; and performing data interaction with the public cloud after the handshake information verification is successful. According to the embodiment of the application, the client can perform handshake with the public cloud through the certificate issued by the private cloud, and the private cloud can perform identity verification on the client through the handshake process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, in particular to a data interaction method and device. BACKGROUND

[0002] At present, the hybrid cloud combining the powerful computing power of the public cloud and the customizability and data security of the private cloud can meet the increasing demand of enterprises for cloud computing.

[0003] The present application found that the hybrid cloud has certain data security, but the security of the hybrid cloud involves many factors, such as how to ensure the security of local data, how to ensure the security of a large amount of migrated data, etc., so that the public cloud and the private cloud still have security risks in the process of transmitting data through the Internet, and the cloud data has the possibility of leakage. SUMMARY

[0004] According to an aspect of the present application, a data interaction method is provided, applied to a client, comprising: obtaining a CA certificate and a client certificate issued by a private cloud; performing handshake information verification with a public cloud according to the CA certificate and the client certificate; after the handshake information verification is successful, performing data interaction with the public cloud.

[0005] According to some embodiments, the handshake information verification with the public cloud according to the CA certificate and the client certificate comprises: sending a verification request of the handshake information to the public cloud; obtaining a public cloud certificate sent by the public cloud according to the verification request; after the public cloud certificate is verified successfully by the CA certificate, sending the client certificate to the public cloud; after the client certificate is verified successfully by the public cloud, determining an encryption suite supported by the public cloud and the client; verifying the handshake information using the encryption suite.

[0006] According to some embodiments, verifying the handshake information using the encryption suite comprises: generating a verification key after the encryption suite is determined; generating first encrypted information according to the verification key; transmitting the first encrypted information to the public cloud; receiving second encrypted information generated by the public cloud through the encryption suite; in the case that the key obtained according to the encryption suite and the second encrypted information is consistent with the verification key, determining that the handshake information verification is successful.

[0007]

[0008] ​According to some embodiments, after the handshake information verification succeeds, the data interaction with the public cloud includes: encrypting a data application message using a verification key after the handshake information verification succeeds; sending the encrypted data application message to the public cloud; and performing message source authentication with the public cloud and the Internet of Things device, including: obtaining the client certificate issued by the private cloud; configuring the Internet of Things device with the public cloud; after the configuration succeeds, verifying the verification data sent by the Internet of Things device using the client certificate and a device certificate of the Internet of Things device; and requesting data from the public cloud after the message source authentication passes.

[0009] According to some embodiments, the client certificate includes a user public key and a user private key, and the device certificate includes a device public key and a device private key; verifying the verification data sent by the Internet of Things device using the client certificate and the device certificate of the Internet of Things device includes: sending an instruction message signed by the user private key to the Internet of Things device; receiving the verification data, which is obtained by the Internet of Things device after verifying the instruction message in the instruction message using the user public key; and verifying the verification data signed using the device private key using the device public key.

[0010] According to an aspect of the present application, a data interaction method is provided, which is applied to a public cloud and includes: obtaining a CA certificate and a public cloud certificate issued by a private cloud; performing handshake information verification with a client according to the CA certificate and the public cloud certificate; and performing data interaction with the client after the handshake information verification succeeds.

[0011] According to an aspect of the present application, a data interaction method is provided, which is applied to a private cloud and includes: issuing a CA certificate and a public cloud certificate to a public cloud; issuing the CA certificate and a client certificate to a client; and configuring a device certificate of an Internet of Things device and an updated client certificate before performing message source authentication of the public cloud, the client, and the Internet of Things device.

[0012] According to an aspect of the present application, a data interaction device is provided, which is applied to a client and includes: a data sending module that sends a login request to a private cloud; sends user information returned by the private cloud to a public cloud; sends a certificate application file to the private cloud; sends a handshake information verification request, a client certificate obtained by the private cloud, an encrypted encryption suite supported by the client, and first encrypted information to the public cloud; and sends an encrypted data application message.

[0013] to the public cloud; a data receiving module, configured to receive user information returned by the private cloud; receive association data of the user information and an Internet of Things device returned by the public cloud; receive a CA certificate and the client certificate issued by the private cloud according to the certificate application file; receive a public cloud certificate returned by the public cloud according to a verification request of the handshake information; receive an encryption suite and second encryption information supported by both the client and the public cloud returned by the public cloud; a data processing module, configured to generate a user private key of the certificate application file and the client certificate according to the user information and the association data; verify the public cloud certificate by using the CA certificate; encrypt the encryption suite supported by the client by using a public cloud public key; decrypt the encryption suite supported by both the client and the public cloud by using the user private key; generate a verification key, and generate the first encryption information according to the verification key; compare a key obtained according to the encryption suite and the second encryption information with the verification key; and encrypt the data application message by using the verification key.

[0014] According to an aspect of the present application, a data interaction device is provided, which is applied to a public cloud and includes: a data sending module, configured to send association data of user information obtained by a client and an Internet of Things device to the client; send a public cloud certificate to the client; send an encrypted determined encryption suite supported by both the public cloud and the client to the client; send second encryption information to the client; a data receiving module, configured to receive a CA certificate issued by a private cloud and the public cloud certificate; receive user information obtained by the private cloud sent by the client; receive a verification request of handshake information, a client certificate, an encrypted encryption suite supported by the client and first encryption information sent by the client; and receive a data application message sent by the client; and a data processing module, configured to generate a public cloud private key of the public cloud certificate; associate the user information with the Internet of Things device to obtain the association data; verify the client certificate by using the CA certificate; decrypt the encryption suite supported by the client by using the public cloud private key; determine the encryption suite supported by both the public cloud and the client; encrypt the encryption suite supported by both the client and the public cloud by using a user public key of the client certificate; decrypt the first encryption information to obtain a verification key generated by the client; generate the second encryption information according to the encryption suite and the verification key; and decrypt the data application message and execute instructions in the decrypted data application message.

[0015] According to an aspect of the present application, a data interaction device is provided, which is applied to a private cloud and includes: a data sending module, configured to send a CA certificate and a public cloud certificate to a public cloud; send user information to the public cloud; send handshake information to the public cloud; send a client certificate to the public cloud; send an encrypted encryption suite supported by the client to the public cloud; and send first encryption information to the public cloud; a data receiving module, configured to receive a data application message sent by the client; and a data processing module, configured to generate a private cloud private key of the CA certificate; generate a public cloud private key of the public cloud certificate; generate a client private key of the client certificate; decrypt the encryption suite supported by the client by using the client private key; decrypt the first encryption information to obtain a verification key generated by the client; generate second encryption information according to the encryption suite and the verification key; decrypt the data application message; and execute instructions in the decrypted data application message.

[0016] sending the CA certificate and the client certificate to the client; a data receiving module, receiving a login request sent by the client; receiving a certificate application file sent by the client; a data processing module, configuring the CA certificate, the public cloud certificate and the client certificate.

[0017] According to the embodiments of the present application, the client can handshake with the public cloud through the certificate issued by the private cloud, and the private cloud can authenticate the client through the handshake process to control the data access permission of the client.

[0018] It should be understood that the above general description and the following detailed description are only exemplary and do not limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application.

[0020] Figure 1 A flow chart of a data interaction method applied to a client according to an example embodiment of the present application is shown.

[0021] Figure 2 A flow chart of a data interaction method applied to a public cloud according to an example embodiment of the present application is shown.

[0022] Figure 3 A flow chart of a data interaction method applied to a private cloud according to an example embodiment of the present application is shown.

[0023] Figure 4 A timing diagram of identity authentication according to an example embodiment of the present application is shown.

[0024] Figure 5 A timing diagram of message source authentication according to an example embodiment of the present application is shown.

[0025] Figure 6 A block diagram of a data interaction device applied to a client according to an example embodiment of the present application is shown.

[0026] Figure 7 A block diagram of a data interaction device applied to a public cloud according to an example embodiment of the present application is shown.

[0027] Figure 8 A block diagram of a data interaction device applied to a private cloud according to an example embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments are available in volume number 220919CI.

[0029] The embodiments are implemented in various forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the concept of exemplary embodiments to those skilled in the art. The same reference numerals in the figures denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0030] The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of these specific details, or other methods, components, materials, apparatus, or operations may be employed. In these cases, well-known structures, methods, apparatuses, implementations, materials, or operations will not be shown or described in detail.

[0031] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0032] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0033] This application provides a data interaction method and apparatus that can identify the client through a private cloud and perform customized handshake interaction with the client through a public cloud to ensure the legitimacy of both parties' identities. When the client interacts with the cloud, the legitimacy of the message source is confirmed and the data is guaranteed not to be tampered with.

[0034] A data interaction method and apparatus according to embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0035] This application contains the following terms:

[0036] Public cloud: refers to a cloud service provided by a third-party provider to customers. It is generally accessible via the Internet and may be free or inexpensive, available across an open public network. (Volume No.: 220919CI)

[0037] Provide services.

[0038] Private cloud: A cloud built for the exclusive use of a single customer, providing effective control over data, security, and quality of service. Its core attribute is dedicated resources.

[0039] CA Certificates: A CA (Certificate Authority) is issued by a certification authority and serves as the technological foundation for digital signatures. It also proves the identity of an online entity, validating its public key and demonstrating the matching relationship between the entity and the public key. The certificate is the carrier of the public key, and the public key on the certificate is bound to the entity's identity.

[0040] Figure 1 A flowchart illustrating a data interaction method applied to a client according to an example embodiment of this application is shown.

[0041] like Figure 1 As shown, in step S110, the client obtains the CA certificate and client certificate issued by the private cloud.

[0042] For example, in step S110, the client logs into the private cloud by calling the login interface and obtains the current user information corresponding to the client from the private cloud.

[0043] After obtaining user information, the client logs into the public cloud using that information. The public cloud then associates the user information with the corresponding device information of the IoT device to generate associated data, which is returned to the client. The user information includes the user ID, and the device information includes the IoT device's UUID (Universally Unique Identifier).

[0044] The client generates a certificate application file and the user's private key for the client certificate based on the user ID and the UUID of the IoT device, and sends the certificate application file to the private cloud. The private cloud issues a client certificate and a CA certificate based on the certificate application file and sends them to the client. The client certificate issued by the private cloud includes the user's public key.

[0045] According to some embodiments, the private cloud pre-configures a certificate authentication system, configures and generates CA certificates, and can issue public cloud certificates, private cloud certificates, client certificates and device certificates to the public cloud, private cloud, client and IoT devices accessing the hybrid cloud upon request, so as to perform identity verification between the cloud and the client, and to perform message source authentication when data is transmitted between the cloud and the client.

[0046] In step S120, the client performs handshake information verification with the public cloud according to the CA certificate and the client certificate.

[0047] For example, in step S120, after obtaining the CA certificate and the client certificate number: 220919CI sent by the private cloud

[0048] Then, the client sends a verification request of handshake information to the public cloud, and receives the public cloud certificate sent by the public cloud according to the verification request, wherein the public cloud certificate sent by the public cloud includes the public cloud public key.

[0049] The client performs legitimacy verification on the public cloud certificate by the CA certificate sent by the private cloud, and sends the client certificate including the user public key to the public cloud after the public cloud certificate verification is successful.

[0050] After the legitimacy verification of the client certificate is successful in the public cloud, the client encrypts the encryption suite supported by the client using the public cloud public key, and sends the encrypted encryption suite to the public cloud. The public cloud decrypts the encrypted encryption suite by the public cloud private key, and determines the encryption suite supported by the public cloud in the encryption suite supported by the client after decryption, that is, the encryption suite of the public cloud certificate can be parsed. The public cloud encrypts the encryption suite supported by the client and the public cloud using the user public key, and sends it to the client.

[0051] After obtaining the encryption suite by decrypting using the user private key, the client generates a verification key for handshake verification. The client encrypts the verification key using the public cloud public key to form first encrypted information, and sends it to the public cloud. The public cloud decrypts the first encrypted information using the public cloud private key, and encrypts the decrypted key using the encryption suite supported by the client and the public cloud to form second encrypted information. The public cloud sends the second encrypted information to the client.

[0052] The client decrypts the second encrypted information using the encryption suite supported by the client and the public cloud, and compares the decrypted key with the verification key locally stored in the client. In the case that the key decrypted from the second encrypted information is consistent with the verification key locally stored in the client, the client determines that the handshake information verification with the public cloud is successful.

[0053] In step S130, after the handshake information verification is successful, the client performs data interaction with the public cloud.

[0054] For example, in step S130, after the handshake information verification is successful, the client encrypts the data application message using the verification key, and sends the encrypted data application message to the public cloud to start the message source authentication process with the public cloud and the Internet of Things device.

[0055] The client relogs in the private cloud and applies for a certificate from the private cloud. The client obtains a reissued client certificate including a user public key and user information from the private cloud, and locally generates a user private key of the client certificate.

[0056] After sending the user information and the user public key to the public cloud, the client sends a roll number to the Internet of Things device: 220919CI

[0057] The client applies for network configuration and obtains a device public key and device information sent by the public cloud during the network configuration process. The Internet of Things device obtains a user public key and user information from the public cloud during the network configuration process. The user information and the device information are associated through the public cloud.

[0058] After the network configuration of the client and the Internet of Things device is completed, the client signs an instruction message using a user private key and sends the signed instruction message to the Internet of Things device. The Internet of Things device verifies the signature of the instruction message sent by the client using a user public key obtained during the network configuration process.

[0059] After the verification of the instruction message by the Internet of Things device is passed, the client receives verification data obtained by executing the instruction in the instruction message sent by the Internet of Things device, wherein the Internet of Things device signs the verification data using a device private key after generating the verification data. The client verifies the signature of the verification data sent by the Internet of Things device using a device public key.

[0060] According to some embodiments, the Internet of Things device can also send the verification data obtained by executing the instruction in the instruction message to the public cloud, and the public cloud verifies the signature of the verification data sent by the Internet of Things device using a device public key.

[0061] According to some embodiments, the Internet of Things device can also send the verification data obtained by executing the instruction in the instruction message to the client and the public cloud, respectively, and the client and the public cloud respectively verify the signature of the verification data sent by the Internet of Things device using a device public key.

[0062] After the verification of the verification data is passed, the client signs a data request using a user private key and sends the signed data request to the public cloud. The public cloud executes a data request task between the client after verifying the signature of the data request using a user public key according to the content of the data request.

[0063] According to the embodiments of the present application, in the technical scheme of the present application, the client performs customized handshake interaction with the public cloud through the certificate issued by the private cloud, verifies the certificate information of the public cloud and the client, and determines the encryption suite supported by the public cloud and the client, to ensure the legitimacy of the identity of both parties; when the client and the public cloud perform data interaction, the public cloud verifies the data of the client and the Internet of Things device, to confirm the legitimacy of the message source and ensure that the data is not tampered with.

[0064] Figure 2 A flowchart illustrating a data interaction method applied to a public cloud according to an example embodiment of this application is shown.

[0065] like Figure 2 As shown, in step S210, the public cloud obtains the CA certificate issued by the private cloud and the public cloud certificate.

[0066] For example, in step S210, before the client logs into the private cloud, the public cloud pre-obtains volume number: 220919CI.

[0067] The system obtains a CA certificate issued by the private cloud and a public cloud certificate. The public cloud certificate issued by the private cloud includes the public cloud public key. The public cloud generates its own private key locally on the public cloud.

[0068] In step S220, the public cloud verifies handshake information with the client based on the CA certificate and the public cloud certificate.

[0069] For example, in step S220, after the client logs into the private cloud and obtains user information through the private cloud, the public cloud receives the user information sent by the client and associates it with the device information of the IoT device to generate associated data. The public cloud returns the associated data to the client, enabling the client to generate a certificate application file and the user's private key for the client certificate based on the associated data.

[0070] Upon receiving the verification request for handshake information from the client, the public cloud will send a public cloud certificate, including the public cloud public key, to the client.

[0071] After the client verifies the legitimacy of the public cloud certificate using the CA certificate sent by the private cloud, the public cloud receives the client certificate, which includes the user's public key, and verifies the legitimacy of the client certificate using the CA certificate sent by the private cloud.

[0072] After successfully verifying the validity of the client certificate, the public cloud receives the client-supported encryption suite encrypted using the public cloud's public key. The public cloud decrypts the encrypted suite using its private key and iterates through the list of decrypted suites to determine those that can parse the public cloud certificate—that is, the encryption suites supported by the public cloud. The public cloud then uses these determined encryption suites as those supported by both the client and the public cloud, encrypts them using the user's public key, and sends them to the client.

[0073] The public cloud receives the first encrypted information sent by the client using the public cloud public key for encryption, and decrypts using the public cloud private key. The public cloud re-encrypts the decrypted key using the encryption suite determined to be supported by both the client and the public cloud, to generate second encrypted information. The public cloud sends the second encrypted information to the client, so that the client decrypts the second encrypted information using the encryption suite supported by both the client and the public cloud, and performs handshake information verification.

[0074] In step S230, after the handshake information verification is successful, the public cloud performs data interaction with the client.

[0075] For example, in step S230, after the handshake information verification is successful, the public cloud receives a data application message sent by the client using the verification key for encryption, to start a message source authentication process with the client.

[0076] Volume No. 220919CI

[0077] After the client obtains the client certificate including the user public key and the user information from the private cloud, the public cloud receives the user information and the user public key sent by the client.

[0078] After the client sends a network configuration application to the Internet of Things device, the public cloud obtains the device public key and the device information pre-stored in the Internet of Things device sent by the Internet of Things device when activated. During the network configuration process of the client and the Internet of Things device, the public cloud sends the user public key and the user information to the Internet of Things device, and sends the device public key and the device information to the client, wherein the user information and the device information are associated with each other.

[0079] After the Internet of Things device passes the signature verification of the instruction message, the public cloud receives the verification data obtained by executing the instruction in the instruction message sent by the Internet of Things device, wherein the Internet of Things device signs the verification data using the device private key after generating the verification data. The public cloud verifies the verification data sent by the Internet of Things device using the device public key.

[0080] According to some embodiments, the Internet of Things device can also send the verification data obtained by executing the instruction in the instruction message to the client, and the client verifies the verification data sent by the Internet of Things device using the device public key.

[0081] According to some embodiments, the Internet of Things device can also send the verification data obtained by executing the instruction in the instruction message to the client and the public cloud, respectively, and the client and the public cloud respectively verify the verification data sent by the Internet of Things device using the device public key.

[0082] After the verification data passes the signature verification, the public cloud receives a data request sent by the client using the user private key for signature, and after the signature verification using the user public key, performs a data request task with the client according to the content of the data request.

[0083] According to the embodiments of this application, in the technical solution of this application, the public cloud performs a customized handshake interaction with the client through a certificate issued by the private cloud, verifies the certificate information of the public cloud and the client, and determines the encryption suite supported by both the public cloud and the client to ensure the legitimacy of the identities of both parties; when the public cloud and the client interact with data, data signature verification is performed on the client and the IoT device to confirm the legitimacy of the message source and ensure that the data is not tampered with.

[0084] Figure 3 A flowchart illustrating a data interaction method applied to a private cloud according to an example embodiment of this application is shown.

[0085] like Figure 3 As shown, in step S310, the private cloud issues a CA certificate and a public cloud certificate to the public cloud.

[0086] Volume Number: 220919CI

[0087] For example, in step S310, before the client logs into the private cloud to obtain user information, the private cloud pre-issues a CA certificate and a public cloud certificate to the public cloud, wherein the public cloud certificate issued by the private cloud includes the public cloud public key.

[0088] In step S320, the private cloud issues a CA certificate and a client certificate to the client.

[0089] For example, in step S320, after the client logs into the private cloud through the login interface, the private cloud sends the current user information corresponding to the client to the client, wherein the user information includes the user ID.

[0090] After the client generates a certificate application file and the user's private key for the client certificate based on the user ID and the UUID of the IoT device, the private cloud receives the certificate application file sent by the client and issues a CA certificate and a client certificate to the client based on the certificate application file. The client certificate issued by the private cloud includes the user's public key.

[0091] In step S330, before the public cloud, client, and IoT device perform message source authentication, the private cloud configures the device certificate of the IoT device and the updated client certificate.

[0092] For example, in step S330, before the public cloud, client, and IoT device perform message source authentication, the private cloud pre-generates the device certificate and device information for the IoT device. The device certificate includes a device public key and a device private key. The private cloud then configures the device certificate and device information onto the IoT device.

[0093] After the client relogs in the private cloud, the private cloud reissues the client certificate and user information according to the request of the client to complete the update of the client certificate, wherein the client certificate reissued by the private cloud comprises the user public key.

[0094] According to the embodiments of the present application, the private cloud issues the certificate to the client and the public cloud, so that the client and the public cloud perform handshake interaction to perform identity authentication, and only the client that passes the verification can have data access permission; when the client and the public cloud perform data interaction, the certificate is issued to the client and the Internet of Things device, so that the client and the Internet of Things device can perform data signature verification, effectively preventing data leakage.

[0095] Figure 4 A timing diagram of identity authentication according to an example embodiment of the present application is shown.

[0096] As shown in Figure 4 Step S401, the private cloud preconfigures a CA certificate.

[0097] In step S402, the private cloud sends the CA certificate and a public cloud certificate comprising a public cloud public key to the public cloud. The public cloud locally generates a public cloud private key.

[0098] Atoll number: 220919CI

[0099] In step S403, the client logs in the private cloud by calling a login interface.

[0100] In step S404, after the client successfully logs in the private cloud, the private cloud returns the current user information corresponding to the client to the client.

[0101] In step S405, the client logs in the public cloud by using the user information obtained from the private cloud.

[0102] In step S406, the public cloud associates the user information and device information of the Internet of Things device, and returns the generated association data to the client.

[0103] In step S407, the client generates a certificate application file and a private key of the client certificate according to the user ID in the association data and the UUID of the Internet of Things device.

[0104] In step S408, the client sends the certificate application file to the private cloud to request the private cloud to issue the certificate.

[0105] In step S409, the private cloud sends the CA certificate and the client certificate comprising the user public key to the client according to the certificate application file.

[0106] In step S410, the client sends a verification request of handshake information to the public cloud.

[0107] In step S411, the public cloud sends a public cloud certificate including a public cloud public key to the client after receiving the verification request.

[0108] In step S412, the client verifies the legality of the public cloud certificate by the CA certificate.

[0109] In step S413, after the client successfully verifies the legality of the public cloud certificate, the client sends a client certificate including a user public key to the public cloud.

[0110] In step S414, the public cloud verifies the legality of the client certificate by the CA certificate.

[0111] In step S415, after the public cloud successfully verifies the legality of the client certificate, the client sends a client supported encryption suite encrypted by the public cloud public key to the public cloud.

[0112] In step S416, the public cloud decrypts the encryption suite sent by the client by using the public cloud private key, and traverses the list of the decrypted encryption suite to determine the encryption suite that can resolve the public cloud certificate, i.e., the encryption suite supported by the public cloud.

[0113] In step S417, the public cloud encrypts the determined encryption suite supported by both the client and the public cloud by using the user public key, and sends it to the client.

[0114] In step S418, the client decrypts the encryption suite supported by both the client and the public cloud by using the user private key, and generates a verification key for handshake information verification. The client encrypts the verification key by using the public cloud public key to form first encrypted information, and sends it to the public cloud.

[0115] In step S419, the public cloud decrypts the first encrypted information by using the public cloud private key, and encrypts the decrypted key by using the encryption suite supported by both the client and the public cloud to form second encrypted information. The public cloud sends the second encrypted information to the client.

[0116]

[0117] In step S420, the client decrypts the second encrypted information by using the encryption suite supported by both the client and the public cloud, and compares the decrypted key with the local verification key of the client. In the case that the key decrypted from the second encrypted information is consistent with the local verification key of the client, the client determines that the handshake information verification with the public cloud is successful.

[0118] In step S421, after the handshake information verification is successful, the client encrypts a data application message by using the verification key, and sends the encrypted data application message to the public cloud.​

[0119] Figure 5 A timing diagram showing message source authentication according to an example embodiment of the application.

[0120] As shown in FIG. 5, in step S501, the private cloud pre-generates a device certificate and device information of the IoT device, wherein the device certificate includes a device public key and a device private key. Figure 5

[0121] In step S502, the private cloud configures the device certificate and the device information to the IoT device.

[0122] In step S503, the client relogs in the private cloud and requests the private cloud to issue a certificate.

[0123] In step S504, the private cloud reissues a client certificate including a user public key and sends the client certificate and user information to the client.

[0124] In step S505, the client sends the user public key of the client certificate obtained by the private cloud and the user information to the public cloud.

[0125] In step S506, the client issues a network configuration application to the IoT device.

[0126] In step S507, after the client issues the network configuration application, the IoT device is activated and sends a device public key and device information to the public cloud.

[0127] In step S508, after confirming that the IoT device is activated successfully, the public cloud sends a user public key and user information to the IoT device.

[0128] In step S509, the public cloud sends the device public key and the device information to the client, and the network configuration process of the client and the IoT device ends.

[0129] In step S510, the client sends an instruction message signed by a user private key to the IoT device.

[0130] In step S511, the IoT device verifies the instruction message using the user public key obtained by the public cloud. After the verification is passed, the IoT device executes the instructions in the instruction message to obtain verification data.

[0131] In step S512, the IoT device sends the verification data signed by the device private key to the public cloud.

[0132] In step S513, the public cloud verifies the verification data using the device public key.

[0133] In step S514, the public cloud sends the verification data to the private cloud.

[0134] ​In step S514, the Internet of Things device sends the verification data signed using the device private key to the client.

[0135] In step S515, the client verifies the signature of the verification data using the device public key.

[0136] According to some embodiments, the Internet of Things device can report the verification data to the public cloud through step S512, and then the public cloud verifies the signature of the verification data through step S513.

[0137] According to some embodiments, the Internet of Things device can also report the verification data to the client through step S514, and then the client verifies the signature of the verification data through step S515.

[0138] According to some embodiments, the Internet of Things device can also report the verification data to the public cloud through step S512 and to the client through step S514, and then the public cloud verifies the signature of the verification data through step S513 and the client verifies the signature of the verification data through step S515.

[0139] In step S516, after the verification passes, the client sends a data request message signed using the user private key to the public cloud.

[0140] In step S517, after the public cloud decrypts using the user public key, the public cloud performs the data request task with the client according to the content in the data request message.

[0141] Figure 6 A block diagram of a data interaction device applied to a client according to an example embodiment of the present application is shown.

[0142] As shown in Figure 6 The data interaction device 800 includes a data sending module 810, a data receiving module 820, and a data processing module 830.

[0143] The data sending module 810 sends a login request to the private cloud to log in to the private cloud by calling a login interface.

[0144] The data receiving module 820 obtains the current user information corresponding to the client from the private cloud.

[0145] The data sending module 810 sends the user information obtained by the private cloud to the public cloud.

[0146] The data receiving module 820 receives the association data generated by the public cloud by associating the user information with the device information corresponding to the Internet of Things device, wherein the user information includes a user ID, and the device information includes a UUID (i.e., a universal unique identifier) of the Internet of Things device.

[0147] DOCKET NO. 220919CI

[0148] The data processing module 830 generates a certificate application file and a user private key of a client certificate according to the user ID and the UUID of the Internet of Things device.

[0149] The data sending module 810 sends the certificate application file to the private cloud.

[0150] The data receiving module 820 receives a client certificate and a CA certificate issued by the private cloud according to the certificate application file, wherein the client certificate issued by the private cloud includes a user public key.

[0151] The data sending module 810 sends a verification request of handshake information to the public cloud.

[0152] The data receiving module 820 receives a public cloud certificate sent by the public cloud according to the verification request, wherein the public cloud certificate sent by the public cloud includes a public cloud public key.

[0153] The data processing module 830 performs legality verification on the public cloud certificate through the CA certificate sent by the private cloud.

[0154] After the legality verification on the public cloud certificate is successful, the data sending module 810 sends the client certificate including the user public key to the public cloud.

[0155] After the legality verification on the client certificate by the public cloud is successful, the data processing module 830 encrypts the encryption suite supported by the client using the public cloud public key.

[0156] The data sending module 810 sends the encrypted encryption suite to the public cloud. The public cloud decrypts the encrypted encryption suite through the public cloud private key, and determines the encryption suite supported by the public cloud in the client-supported encryption suite obtained after decryption, that is, the encryption suite of the public cloud certificate can be parsed.

[0157] The data receiving module 820 receives the encryption suite supported by the client and the public cloud, which is encrypted by the user public key by the public cloud.

[0158] The data processing module 830 decrypts and obtains the encryption suite supported by the client and the public cloud using the user private key. Further, the data processing module 830 generates a verification key for handshake verification, and encrypts the verification key using the public cloud public key to form first encrypted information.

[0159] The data sending module 810 sends the first encrypted information to the public cloud.

[0160] The data receiving module 820 receives second encrypted information formed by the public cloud re-encrypting the decrypted key using the encryption suite supported by the client and the public cloud.

[0161] The data processing module 830 decrypts the second encrypted information using an encryption suite supported by both the client and the public cloud, and compares the decrypted key with the local verification key to determine whether the handshake information verification is successful.

[0162] After the handshake information verification is successful, the data processing module 830 encrypts the data application message using the verification key.

[0163] Volume number: 220919CI

[0164] The data sending module 810 sends the encrypted data application message to the public cloud to start the message source authentication process with the public cloud and the Internet of Things device.

[0165] The data sending module 810 re-sends the login and certificate issuance application to the private cloud.

[0166] The data receiving module 820 obtains the re-issued client certificate including the user public key and the user information from the private cloud.

[0167] The data processing module 830 generates the user private key of the client certificate.

[0168] The data sending module 810 sends the user information and the user public key to the public cloud. Further, the data sending module 810 sends the network configuration application to the Internet of Things device.

[0169] The data receiving module 820 obtains the device public key and the device information of the Internet of Things device sent by the public cloud in the network configuration process, and the network configuration of the client and the Internet of Things device is completed.

[0170] The data processing module 830 signs the instruction message using the user private key.

[0171] The data sending module 810 sends the signed instruction message to the Internet of Things device.

[0172] After the Internet of Things device verifies the signature of the instruction message, the data receiving module 820 receives the verification data obtained by executing the instruction in the instruction message sent by the Internet of Things device, wherein the Internet of Things device generates the verification data and signs the verification data using the device private key.

[0173] The data processing module 830 verifies the signature of the verification data sent by the Internet of Things device using the device public key.

[0174] After the verification data signature verification is passed, the data processing module 830 signs the data request using the user private key.

[0175] The data sending module 810 sends the signed data request to the public cloud.

[0176] According to the embodiment of the application, the client applies for a certificate to the private cloud, and performs handshake information verification with the public cloud through the certificate issued by the private cloud, to confirm the identity legitimacy of the client and the public cloud and obtain data access permission; when the client and the public cloud perform data interaction, data signature verification is performed between the public cloud and the Internet of Things device according to the certificate issued by the private cloud, to ensure the legitimacy of the accessed data and ensure that the data is not tampered with.

[0177] Figure 7 A block diagram of a data interaction device applied to a public cloud according to an example embodiment of the application is shown.

[0178] As shown in Figure 7 The data interaction device 900 includes a data sending module 910, a data receiving module 920, and a data processing module 930.

[0179] Before the client logs in to the private cloud, the data receiving module 920 obtains a CA certificate number issued by the private cloud: 220919CI

[0180] and a public cloud certificate, wherein the public cloud certificate issued by the private cloud includes a public cloud public key.

[0181] The data processing module 930 generates a public cloud private key of the public cloud certificate.

[0182] The data receiving module 920 receives user information sent by the client and obtained through the private cloud.

[0183] The data processing module 930 associates the user information with device information of the Internet of Things device, to generate associated data.

[0184] The data sending module 910 sends the associated data to the client, so that the client generates a certificate application file and a user private key of a client certificate according to the associated data.

[0185] The data receiving module 920 receives a verification request of handshake information sent by the client.

[0186] The data sending module 910 sends the public cloud certificate including the public cloud public key to the client.

[0187] After the client performs legitimacy verification on the public cloud certificate through the CA certificate sent by the private cloud, the data receiving module 920 receives a client certificate including a user public key sent by the client.

[0188] The data processing module 930 performs legitimacy verification on the client certificate through the CA certificate sent by the private cloud.

[0189] After the legitimacy verification on the client certificate is successful, the data receiving module 920 receives an encryption suite supported by the client and encrypted by the public cloud public key.

[0190] The data processing module 930 decrypts the encrypted encryption suite using the public cloud private key, and traverses the list of decrypted encryption suites to determine an encryption suite supported by both the client and the public cloud. The data processing module 930 encrypts the encryption suite supported by both the client and the public cloud using the user public key.

[0191] The data sending module 910 sends the encrypted encryption suite supported by both the client and the public cloud to the client.

[0192] The data receiving module 920 receives first encrypted information encrypted using the public cloud public key and sent by the client.

[0193] The data processing module 930 decrypts the first encrypted information using the public cloud private key to obtain the verification key generated by the client. Then, the data processing module 930 re-encrypts the decrypted verification key using the determined encryption suite supported by both the client and the public cloud to generate second encrypted information.

[0194] The data sending module 910 sends the second encrypted information to the client, so that the client decrypts the second encrypted information using the encryption suite supported by both the client and the public cloud and performs handshake information verification.

[0195] VOL.: 220919CI

[0196] After the handshake information verification succeeds, the data receiving module 920 receives a data application message encrypted using the verification key and sent by the client to start a message source authentication process with the client.

[0197] After the client obtains the client certificate including the user public key and the user information from the private cloud, the data receiving module 920 receives the user information and the user public key sent by the client.

[0198] After the client sends a network configuration application to the Internet of Things device, the data receiving module 920 obtains the device public key and the device information pre-stored in the Internet of Things device when the Internet of Things device is activated.

[0199] During the network configuration process of the client and the Internet of Things device, the data sending module 910 sends the user public key and the user information to the Internet of Things device, and sends the device public key and the device information to the client, wherein the user information and the device information are associated with each other.

[0200] After the Internet of Things device verifies the signature of the instruction message, the data receiving module 920 receives verification data obtained by executing the instruction in the instruction message and sent by the Internet of Things device, wherein the Internet of Things device signs the verification data using the device private key after generating the verification data.

[0201] The data processing module 930 verifies the authentication data sent by the Internet of Things device using the device public key.

[0202] After the verification of the authentication data is passed, the data receiving module 920 receives the data request signed by the user private key sent by the client.

[0203] The data processing module 930 verifies the data request using the user public key, and performs the data request task between the client according to the content of the data request.

[0204] According to the embodiments of the present application, the public cloud verifies the handshake information with the client through the certificate issued by the private cloud to confirm the identity legitimacy of the client and the public cloud and obtain data access permission; when the client and the public cloud interact with data, the data of the client and the Internet of Things device is verified to ensure the legitimacy of the access data and ensure that the data is not tampered with.

[0205] Figure 8 A block diagram of a data interaction device applied to a private cloud according to an example embodiment of the present application is shown.

[0206] As shown in Figure 8 The data interaction device 1000 includes a data sending module 1100, a data receiving module 1200, and a data processing module 1300.

[0207] Before the client logs in, the data processing module 1300 configures the CA certificate and the public cloud certificate.

[0208] The data sending module 1100 sends the CA certificate and the public cloud certificate to the public cloud, wherein the public cloud certificate includes the public cloud public key.

[0209] The data receiving module 1200 receives the login request sent by the client.

[0210] Volume number: 220919CI

[0211] The data sending module 1100 sends the current user information corresponding to the client to the client, wherein the user information includes the user ID.

[0212] The data receiving module 1200 receives the certificate application file generated according to the user ID and the UUID of the Internet of Things device sent by the client.

[0213] The data processing module 1300 configures the client certificate according to the certificate application file.

[0214] The data sending module 1100 sends the CA certificate and the client certificate to the client, wherein the client certificate includes the user public key.

[0215] Before the public cloud, the client and the Internet of Things device authenticate the message source, the data processing module 1300 configures the device certificate and the device information of the Internet of Things device, wherein the device certificate comprises a device public key and a device private key.

[0216] The data sending module 1100 sends the device certificate and the device information to the Internet of Things device.

[0217] The data receiving module 1200 receives the request for re-login and the request for re-issuing the certificate sent by the client.

[0218] The data processing module 1300 reconfigures the client certificate and the user information according to the request for re-issuing the certificate.

[0219] The data sending module 1100 sends the client certificate and the user information to the client to complete the update of the client certificate.

[0220] According to the embodiments of the present application, the private cloud issues the certificate to the client and the public cloud, so that the client and the public cloud perform handshake information verification to confirm the identity legality of the client and the public cloud and obtain data access permission; when the client and the public cloud perform data interaction, the certificate is issued to the client and the Internet of Things device, so that the client performs data signature verification with the Internet of Things device through the public cloud, to ensure the legality of the accessed data and ensure that the data is not tampered with.

[0221] According to some embodiments of the present application, the technical scheme of the present application realizes that the data is accessed only at the authorized access end by identifying the client through the private cloud, and ensures the identity legality of both parties through the customized handshake interaction of the public cloud and the client, confirms the legality of the message source when the client and the cloud perform data interaction, and ensures that the data is not tampered with.

[0222] The above embodiments of the present application are described in detail, and the above embodiment descriptions are only used to help understand the method of the present application and its core idea. Meanwhile, the changes or deformations made by the person skilled in the art according to the idea of the present application, based on the specific implementation and application range of the present application, are all within the protection scope of the present application.

[0223] The above description of the present application is not to be understood as a limitation of the present application.

Claims

1. A data interaction method applied to a client, characterized in that, The method comprises the following steps: obtaining a CA certificate and a client certificate issued by a private cloud; verifying handshake information with a public cloud according to the CA certificate and the client certificate; interacting with the public cloud for data after the handshake information is verified successfully; verifying handshake information with a public cloud according to the CA certificate and the client certificate, comprising: sending a verification request of the handshake information to the public cloud; obtaining a public cloud certificate sent by the private cloud according to the verification request sent by the public cloud; sending the client certificate to the public cloud after the public cloud certificate is verified successfully by the CA certificate; determining an encryption suite supported by the public cloud and the client after the client certificate is verified successfully by the public cloud; verifying the handshake information by using the encryption suite; verifying the handshake information by using the encryption suite, comprising: generating a verification key after the encryption suite is determined; generating first encrypted information according to the verification key; transmitting the first encrypted information to the public cloud; receiving second encrypted information generated by the public cloud through the encryption suite; determining that the verification of the handshake information is successful in the case that the key obtained according to the encryption suite and the second encrypted information is consistent with the verification key.

2. The method of claim 1, wherein, interacting with the public cloud for data after the handshake information is verified successfully, comprising: encrypting a data application message by using a verification key after the handshake information is verified successfully; sending the encrypted data application message to the public cloud; performing message source authentication with the public cloud and an Internet of Things device, comprising: obtaining the client certificate issued by the private cloud; configuring a network with the Internet of Things device through the public cloud; verifying verification data sent by the Internet of Things device through the client certificate and a device certificate of the Internet of Things device after the network configuration is successful; requesting data from the public cloud after the message source authentication is passed.

3. The method of claim 2, wherein, The client certificate comprises a user public key and a user private key, and the device certificate comprises a device public key and a device private key; verifying the verification data sent by the Internet of Things device through the client certificate and the device certificate of the Internet of Things device, comprising: sending an instruction message signed by the user private key to the Internet of Things device; receiving the verification data, which is obtained by the Internet of Things device after verifying the signature by using the user public key according to the instruction in the instruction message; verifying the verification data signed by using the device private key by using the device public key.

4. A data interaction method applied to a public cloud, characterized in that, The method comprises the following steps: obtaining a CA certificate and a public cloud certificate issued by a private cloud; verifying handshake information with a client according to the CA certificate and the public cloud certificate; interacting with the client for data after the handshake information is verified successfully; wherein verifying handshake information with a client according to the CA certificate and the public cloud certificate sent by the private cloud comprises: sending the public cloud certificate comprising a public cloud public key to the client after receiving a verification request of the handshake information sent by the client. receive the client certificate including the user public key sent by the client, and verify the legality of the client certificate according to the CA certificate; after the legality of the client certificate is verified successfully, receive the encryption suite supported by the client encrypted by the public cloud public key; use the encryption suite as the encryption suite supported by both the client and the public cloud, encrypt the encryption suite using the user public key and send it to the client; receive the first encrypted information sent by the client, and decrypt it using the public cloud private key; re-encrypt the key obtained after decryption using the encryption suite determined to be supported by both the client and the public cloud, generate second encrypted information and send it to the client for handshake information verification.

5. A data interaction method applied to a private cloud, characterized in that, comprise: issue a CA certificate and a public cloud certificate to the public cloud; issue the CA certificate and a client certificate to the client; configure the device certificate of the Internet of Things device and the updated client certificate before the public cloud, the client and the Internet of Things device perform message source authentication; wherein updating the client certificate comprises: reissuing the client certificate and user information for updating according to the request of the client after the client logs in again; the client performs handshake information verification according to the CA certificate and the client certificate and the public cloud certificate sent by the private cloud to the public cloud; wherein, after the client successfully verifies the handshake information, the client performs data interaction with the public cloud, comprising: after the handshake information verification is successful, encrypt the data application message using the verification key; send the encrypted data application message to the public cloud; the client performs message source authentication with the public cloud and the Internet of Things device, comprising: obtain the client certificate issued by the private cloud; network with the Internet of Things device through the public cloud; after the network is successfully configured, verify the verification data sent by the Internet of Things device through the client certificate and the device certificate of the Internet of Things device; after the message source authentication is passed, request data from the public cloud.

6. A data interaction apparatus, applied to a client, characterized in that, comprise: a data sending module, which sends a login request to the private cloud; send the user information returned by the private cloud to the public cloud; send a certificate application file to the private cloud; send a handshake information verification request, a client certificate obtained by the private cloud, an encrypted encryption suite supported by the client, and first encrypted information to the public cloud; and send the encrypted data application message to the public cloud; a data receiving module, which receives the user information returned by the private cloud; receive the user information and the associated data of the Internet of Things device returned by the public cloud; receive the CA certificate and the client certificate issued by the private cloud according to the certificate application file; receive the public cloud certificate sent by the private cloud returned by the public cloud according to the handshake information verification request; receive the encryption suite supported by both the client and the public cloud and the second encrypted information returned by the public cloud; a data processing module, which generates the user private key of the certificate application file and the client certificate according to the user information and the associated data; verify the public cloud certificate by using the CA certificate; encrypt the encryption suite supported by the client by using the public cloud public key; decrypt the encryption suite supported by the client and the public cloud by using the user private key; generate a verification key and generate the first encryption information according to the verification key; compare the key obtained according to the encryption suite and the second encryption information with the verification key; and encrypt the data application message by using the verification key.

7. A data interaction device applied to a public cloud, characterized in that, comprise: a data sending module, which sends association data obtained by a client and user information to the client, and associates the user information with an Internet of Things device; send a public cloud certificate to the client; send an encrypted determined encryption suite supported by the public cloud and the client to the client; send second encryption information to the client; a data receiving module, which receives a CA certificate issued by a private cloud and the public cloud certificate; receive the user information obtained by the private cloud sent by the client; receive the verification request of the handshake information, the client certificate, the encrypted encryption suite supported by the client and the first encryption information sent by the client; and, receive the data application message sent by the client; a data processing module, which generates a public cloud private key of the public cloud certificate; associate the user information with the Internet of Things device to obtain the association data; verify the client certificate by using the CA certificate; decrypt the encryption suite supported by the client by using the public cloud private key; determine the encryption suite supported by the public cloud and the client; encrypt the encryption suite supported by the client and the public cloud by using the user public key of the client certificate; decrypt the first encryption information to obtain the verification key generated by the client; generate the second encryption information according to the encryption suite and the verification key; and decrypt the data application message and execute the instructions in the decrypted data application message.

8. A data interaction device applied to a private cloud, characterized in that, comprise: a data sending module, which sends a CA certificate and a public cloud certificate to a public cloud; send user information to a client; send the CA certificate and a client certificate to the client; a data receiving module, which receives a login request sent by the client; receive the certificate application file sent by the client; a data processing module, which configures the CA certificate, the public cloud certificate and the client certificate; a data sending module sends a device certificate and device information to an Internet of Things device; a data receiving module receives a request for re-login and a request for re-issuing a certificate sent by the client; a data processing module reconfigures the client certificate and user information according to the request for re-issuing a certificate; a data sending module sends the client certificate and user information to the client to complete the update of the client certificate; wherein the client performs handshake information verification according to the CA certificate and the client certificate and the public cloud certificate sent by the private cloud obtained by the public cloud; wherein the client performs data interaction with the public cloud after the handshake information verification is successful, comprising: encrypt a data application message by using a verification key after the handshake information verification is successful; Send the encrypted data application message to the public cloud; The client and the public cloud and the Internet of Things device perform message source authentication, comprising: Obtain the client certificate issued by the private cloud; Through the public cloud, the Internet of Things device is configured with network; After the network configuration is successful, the verification data sent by the Internet of Things device is verified through the client certificate and the device certificate of the Internet of Things device; After the message source authentication is passed, request data from the public cloud.

Images