Method for determining replay message, terminal and cloud platform

Abstract

The invention discloses a method, a terminal and a cloud platform for determining to replay a message, and the method comprises the following steps: after the cloud platform or the terminal receives the message, comparing a random character string carried in the message with a random character string which is stored in the cloud platform or the terminal and is associated with a token field; if the random character string carried in the message exists in the random character string which is stored in the message and associated with the token field, the message is determined to be a replay message, the token field is the token field carried in the message, and the random character string which is stored in the message and associated with the token field is carried in other received non-replay messages. According to the embodiment of the invention, the replay message is determined through the random character string and the token field, and compared with the prior art that the replay message is determined through a timestamp, the method is not limited by a terminal or a local clock of a cloud platform, so that the accuracy of determining the replay message can be improved.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technologies, and in particular to a method, a terminal and a cloud platform for determining a replayed message. Background Art

[0002] The Internet of Things (IoT), or "Internet of Things", is an extension and expansion of the Internet. It combines various information sensing devices with the network to form a huge network that can realize the interconnection of people, machines and things at any time and any place.

[0003] The Internet of Things generally consists of three components: terminals, APP applications and cloud platforms. APP applications and cloud platforms use HTTPS to communicate, and APP applications and terminals use BLE or SoftAP for proximal network communication. The communication messages between terminals and cloud platforms have strong real-time requirements, and generally use long connections to create a dedicated two-way message transmission channel.

[0004] A long connection is when the terminal first initiates a connection to the cloud platform. After the cloud platform accepts the terminal connection, the two parties successfully establish a connection. After the terminal and the cloud platform perform a read and write operation, the connection between the two will not be closed actively, and subsequent read and write operations will continue to use this connection. Normally, when a long connection is established, as long as the terminal and the cloud platform do not make a closing request or no abnormal situation occurs, this connection will always exist, and the connection will be maintained through the heartbeat mechanism. Usually, the terminal sends a data packet to the cloud platform every short period of time to notify the cloud platform that it is still online. The terminal and the cloud platform can always use this connection for data communication, so a long connection can save a lot of TCP establishment and closing operations, reducing the impact of network congestion.

[0005] In the long-connection communication process of the Internet of Things, the middleman message replay attack is one of the main security risks. The middleman can control the terminal device by replaying the instructions sent by the cloud platform to the terminal; or report false terminal status information by replaying the message from the terminal to the cloud platform, so that the user cannot know the real operating status of the terminal, resulting in misoperation. Therefore, it is very important to take two-way anti-replay measures for the long connection between the terminal and the cloud platform.

[0006] Currently, timestamp verification is usually used to prevent replay. Since the accuracy of the local time on the terminal side cannot be guaranteed, the accuracy of the timestamp verification method to prevent replay is low. Summary of the invention

[0007] The present invention provides a method, a terminal and a cloud platform for determining a replayed message, so as to solve the problem of low accuracy in preventing replay by using a timestamp verification method in the prior art.

[0008] In a first aspect, the present application provides a method for determining a replayed message, the method comprising:

[0009] After receiving the session credential token field sent by the cloud platform, the terminal saves the token field;

[0010] After the terminal receives the first message sent by the cloud platform and carrying the control instruction, the first random string and the token field, it is determined whether the first random string exists in the random strings associated with the token field stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message;

[0011] If the terminal determines that the first random string exists in the random string associated with the token field stored in the terminal, it determines that the first message is a replay message. If it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, the control instruction in the first message is executed, wherein the random string associated with the token field stored in the terminal is carried in other messages sent by the cloud platform to the terminal.

[0012] In a possible implementation manner, if the terminal determines that the first random string does not exist in the random strings associated with the token field stored in the terminal, the method further includes:

[0013] The terminal stores the first random character string in a random character string associated with the token.

[0014] In a possible implementation manner, after the terminal receives the first message carrying the control instruction, the first random string, and the token field sent by the cloud platform, before determining whether the first random string exists in the random string associated with the token field stored in the terminal, the method further includes:

[0015] If the terminal determines that the number of stored random character strings associated with the token field is greater than or equal to a first preset number, sending a request for applying for a new token field to the cloud platform so that the cloud platform generates a new token field;

[0016] After receiving the new token field sent by the cloud platform, the terminal replaces the currently stored token field with the new token field and deletes the random character string associated with the currently stored token field.

[0017] In a possible implementation, the method further includes:

[0018] The terminal receives a second message greater than or equal to a second preset number sent by the cloud platform within a preset time period;

[0019] During processing of the second preset number of second messages, the terminal sends a request for applying for a new token field to the cloud platform when it is first determined that the number of random character strings associated with the token field is greater than or equal to the first preset number.

[0020] In a second aspect, the present application provides a method for determining a replayed message, the method comprising:

[0021] The cloud platform saves the token field and sends the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful;

[0022] After the cloud platform receives the second message sent by the terminal and carrying the terminal status information, the second random string and the token field, it is determined whether the second random string exists in the random strings associated with the token field stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message;

[0023] If the cloud platform determines that the second random string exists in the random strings stored in the cloud platform, it determines that the second message is a replay message. If it is determined that the second random string does not exist in the random strings stored in the cloud platform, the terminal status information in the second message is saved, wherein the random string stored in the cloud platform is carried in other messages sent by the terminal to the cloud platform.

[0024] In a possible implementation manner, if the cloud platform determines that the second random string does not exist in the random strings stored by the cloud platform, the method further includes:

[0025] The cloud platform saves the random character string in the second message into the random character string associated with the token field.

[0026] In a third aspect, the present application provides a terminal, the terminal comprising a processor and a memory;

[0027] The processor is configured to, after receiving a session credential token field sent by a cloud platform, save the token field to the memory; after receiving a first message sent by the cloud platform carrying a control instruction, a first random string and the token field, determine whether the first random string exists in the random string associated with the token field stored in the memory, wherein the first random string is randomly generated before the cloud platform sends the first message; if it is determined that the first random string exists in the random string associated with the token field stored in the memory, determine that the first message is a replay message, and if it is determined that the first random string does not exist in the random string associated with the token field stored in the memory, execute the control instruction in the first message, wherein the random string associated with the token field stored in the memory is carried in other messages sent by the cloud platform to the processor;

[0028] The memory is used to store the token field and a random character string associated with the token field.

[0029] In a fourth aspect, the present application provides a cloud platform, the cloud platform comprising a processor and a memory;

[0030] The processor is used to send the token field stored in the memory to the terminal, wherein the token field is randomly generated by the processor after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful; after receiving a second message sent by the terminal carrying terminal status information, a second random string and the token field, determine whether the second random string exists in the random string associated with the token field stored in the memory, wherein the second random string is randomly generated before the terminal sends the second message; if it is determined that the second random string exists in the random string stored in the processor, determine that the second message is a replay message, and if it is determined that the second random string does not exist in the random string stored in the processor, save the terminal status information in the second message, wherein the random string stored in the processor is carried in other messages sent by the terminal to the processor;

[0031] The memory is used to store the token field, a random character string associated with the token field, and the terminal status information.

[0032] In a fifth aspect, the present application provides another terminal, the terminal comprising:

[0033] A first storage module, configured to store a session credential token field after receiving the token field sent by the cloud platform;

[0034] A first judgment module is configured to, after receiving a first message carrying a control instruction, a first random string and the token field sent by the cloud platform, determine whether the first random string exists in the random strings associated with the token field stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message;

[0035] A first execution module is used to determine that the first message is a replay message if it is determined that the first random string exists in the random string associated with the token field stored in the terminal, and to execute a control instruction in the first message if it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, wherein the random string associated with the token field stored in the terminal is carried in other messages sent by the cloud platform to the terminal.

[0036] In a sixth aspect, the present application provides another cloud platform, the cloud platform comprising:

[0037] A second storage module is used to store a token field and send the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful;

[0038] A second judgment module is configured to, after receiving a second message sent by the terminal carrying terminal status information, a second random string and the token field, judge whether the second random string exists in the random strings associated with the token field stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message;

[0039] The second execution module is used to determine that the second message is a replay message if it is determined that the second random string exists in the random strings stored in the cloud platform, and save the terminal status information in the second message if it is determined that the second random string does not exist in the random strings stored in the cloud platform, wherein the random string stored in the cloud platform is carried in other messages sent by the terminal to the cloud platform.

[0040] The beneficial effects of the present invention are as follows:

[0041] The present application provides a method, terminal and cloud platform for determining a replayed message. After receiving a message, the cloud platform or terminal compares the random string carried in the message with the random string associated with the token field stored by itself. If the random string carried in the message exists in the random string associated with the token field stored by itself, the message is determined to be a replayed message, wherein the token field is the token field carried in the message, and the random string associated with the token field stored by itself is carried in other non-replayed messages received. Since the embodiment of the present application determines the replayed message through the random string and the token field, compared with the related art of determining the replayed message through the timestamp, it is not limited by the local clock of the terminal or cloud platform, so the accuracy of determining the replayed message can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0043] Figure 1 A structural diagram of an Internet of Things system provided for related technologies;

[0044] Figure 2 An interactive schematic diagram of receiving a replayed message provided in an embodiment of the present application;

[0045] Figure 3 Another interactive schematic diagram of receiving a replayed message provided in an embodiment of the present application;

[0046] Figure 4 A schematic diagram of an interaction between a terminal and a cloud platform to establish a connection provided in an embodiment of the present application;

[0047] Figure 5 An interactive diagram of identity authentication provided in an embodiment of the present application;

[0048] Figure 6 An interactive schematic diagram of generating a token field provided in an embodiment of the present application;

[0049] Figure 7 A schematic diagram of an interactive process for performing anti-replay verification on a terminal provided in an embodiment of the present application;

[0050] Figure 8 A schematic diagram of an interaction for a terminal to apply for a new token field provided in an embodiment of the present application;

[0051] Fig. 9 A schematic diagram of an interactive process for performing anti-replay verification on a cloud platform provided in an embodiment of the present application;

[0052] Fig.10 A complete flow chart of determining a replay message provided in an embodiment of the present application;

[0053] Fig.11 A schematic flow chart of a method for determining a replayed message provided in an embodiment of the present application;

[0054] Fig.12 A flowchart of another method for determining a replayed message provided in an embodiment of the present application;

[0055] Fig.13 A schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0056] Fig.14 A schematic diagram of the structure of a cloud platform provided in an embodiment of the present application;

[0057] Fig.15 A schematic diagram of the structure of another terminal provided in an embodiment of the present application;

[0058] Fig.16 A schematic diagram of the structure of another cloud platform provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0060] In the description of the embodiments of the present application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more.

[0061] The following introduces an application scenario of a method for determining a replayed message provided in an embodiment of the present application in conjunction with the accompanying drawings.

[0062] like Figure 1 As shown, it is a structural diagram of an Internet of Things system provided by the related technology. Figure 1It can be seen that the Internet of Things system includes a terminal 10, an APP application 11 and a cloud platform 12, wherein the APP application 11 and the cloud platform 12 use HTTPS connection communication, the APP application 11 and the terminal 10 use BLE or SoftAP for proximal network communication, and the terminal 10 and the cloud platform 12 use long connection communication.

[0063] Before the terminal 10 and the cloud platform 12 transmit messages, a long connection is first established. The long connection is established by the terminal 10 initiating a connection to the cloud platform 12. After the cloud platform 12 accepts the connection from the terminal 10, the two parties successfully establish a connection. After the terminal 10 and the cloud platform 12 perform a read and write operation, the connection between the two will not be actively closed, and subsequent read and write operations will continue to use this connection.

[0064] Normally, once a persistent connection is established, as long as the terminal 10 and the cloud platform 12 do not request to close or encounter any abnormal situation, the connection will always exist, and the connection can be maintained through the heartbeat mechanism. Usually, the terminal 10 sends a data packet to the cloud platform 12 every short period of time to notify the cloud platform 12 that it is still online. The terminal 10 and the cloud platform 12 can always use the connection for data communication, so the persistent connection can save a lot of TCP establishment and closing operations, reducing the impact of network congestion.

[0065] During the process of message transmission between terminal 10 and cloud platform 12, other terminals or other servers may send messages to terminal 10 or cloud platform 12 that have been received by terminal 10 or cloud platform 12. For example, terminal 10 is an air conditioner, and cloud platform 12 sends a control instruction to control the air conditioner to 25 degrees at 12:00 noon to terminal 10. If other terminals or other servers intercept the control instruction of "control the air conditioner to 25 degrees", then other terminals or other servers send a control instruction to terminal 10 at 5:00 pm to control the air conditioner to 25 degrees. The control instruction sent by other terminals or other servers is the replay message. If terminal 10 controls the temperature of the air conditioner to 25 degrees after receiving the control instruction at 5:00 pm, then the operation is an erroneous operation.

[0066] like Figure 2 As shown, it is a schematic diagram of an interaction for receiving a replayed message provided in an embodiment of the present application, which specifically includes the following steps:

[0067] S201, the terminal sends a message carrying terminal status information to the cloud platform;

[0068] For example, if the terminal is an air conditioner, the terminal status information may be a dehumidification status.

[0069] S202, other terminals or other servers obtain from the terminal a message carrying terminal status information sent by the terminal to the cloud platform;

[0070] S203: After receiving the message carrying the terminal status information sent by the terminal, the cloud platform saves the terminal status information;

[0071] S204, other terminals or other servers send to the cloud platform a message carrying terminal status information sent from the terminal to the cloud platform;

[0072] S205: After receiving a message sent by other terminals or other servers, the cloud platform saves the terminal status information carried in the message.

[0073] If the current state of the terminal is heating state, and the terminal state information currently saved by the cloud platform is dehumidification state, the terminal state information saved by the cloud platform will be wrong, resulting in erroneous operation of the cloud platform, and the messages sent by other terminals or other servers received by the cloud platform are replay messages.

[0074] like Figure 3 As shown, another interactive schematic diagram of receiving a replayed message provided in an embodiment of the present application specifically includes the following steps:

[0075] S301, the cloud platform sends a message carrying a control instruction to the terminal;

[0076] For example, if the terminal is an air conditioner, the control instruction may be "adjust the temperature to 25 degrees".

[0077] 302. Other terminals or other servers obtain, from the cloud platform, a message carrying a control instruction sent by the cloud platform to the terminal;

[0078] S303, after receiving the message carrying the control instruction sent by the cloud platform, the terminal executes the control instruction;

[0079] S304, other terminals or other servers send to the terminal a message carrying a control instruction obtained from the cloud platform and sent from the cloud platform to the terminal;

[0080] S305: After receiving a message sent by another terminal or another server, the terminal executes a control instruction carried in the message.

[0081] After the terminal receives a message carrying a control instruction sent by other terminals or other servers, it may cause erroneous operation. The message sent by other terminals or other servers received by the terminal is a replay message.

[0082] Based on the above problems, the embodiment of the present application provides a method for determining a replay message, which is applied to an Internet of Things system, referring to Figure 1 The terminal 10 and the cloud platform 12 in the embodiment are as follows:

[0083] Terminal 10 is used to save the token field after receiving it sent by the cloud platform; after receiving the first message sent by the cloud platform carrying a control instruction, a first random string and the token field, the terminal determines whether the first random string exists in the random strings stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message; if it is determined that the first random string exists in the random strings stored in the terminal, it is determined that the first message is a replay message, and if it is determined that the first random string does not exist in the random strings stored in the terminal, the control instruction in the first message is executed, wherein the random string stored in the terminal is a random string carried in other messages sent by the cloud platform to the terminal and associated with the token field.

[0084] The cloud platform 12 is used to save a token field and send the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful; after the cloud platform receives a second message sent by the terminal carrying terminal status information, a second random string and the token field, it determines whether the second random string exists in the random strings stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message; if the cloud platform determines that the second random string exists in the random strings stored in the cloud platform, it determines that the second message is a replay message, and if it determines that the second random string does not exist in the random strings stored in the cloud platform, it saves the terminal status information in the second message, wherein the random string stored in the cloud platform is a random string carried in other messages sent by the terminal to the cloud platform and associated with the token field.

[0085] In an embodiment of the present application, after receiving a message, the cloud platform or terminal compares the random string carried in the message with the random string associated with the token field stored by itself. If the random string carried in the message exists in the random string associated with the token field stored by itself, the message is determined to be a replayed message, wherein the token field is the token field carried in the message, and the random string associated with the token field stored by itself is carried in other non-replayed messages received. Since the embodiment of the present application determines the replayed message through the random string and the token field, compared with the related art of determining the replayed message through the timestamp, it is not limited by the local clock of the terminal or cloud platform, and thus the accuracy of determining the replayed message can be improved.

[0086] In a specific embodiment, before the cloud platform and the terminal interact with each other through messages, a long connection needs to be established, such as Figure 4 As shown, it is a schematic diagram of an interaction between a terminal 10 and a cloud platform 12 to establish a connection provided by an embodiment of the present application, and the specific steps are as follows:

[0087] S401, the terminal sends a request to establish a long connection to the cloud platform;

[0088] S402: After receiving the request to establish a persistent connection, the cloud platform establishes a persistent connection;

[0089] S403: The cloud platform sends a long connection establishment success message to the terminal.

[0090] After the persistent connection between the cloud platform and the terminal is successfully established, the cloud platform needs to authenticate the terminal. For example, Figure 5 As shown, it is a schematic diagram of an interaction of identity authentication provided in an embodiment of the present application, which specifically includes the following steps:

[0091] S501, the terminal sends an identity authentication request to the cloud platform;

[0092] S502: The cloud platform authenticates the identity of the terminal according to the received identity authentication request;

[0093] S503: If the cloud platform fails to authenticate the terminal, the long connection between the cloud platform and the terminal is disconnected;

[0094] S504: The cloud platform successfully authenticates the terminal.

[0095] After the cloud platform successfully authenticates the terminal, it generates a random token field, saves the token field, and sends the token field to the terminal. After the terminal receives the token field, it clears the random string list.

[0096] like Figure 6 As shown, it is an interactive schematic diagram of generating a token field provided in an embodiment of the present application, which specifically includes the following steps:

[0097] S601, the cloud platform generates a token field;

[0098] S602, the cloud platform saves the token field;

[0099] S603, the cloud platform sends the token field to the terminal;

[0100] S604: After receiving the token field, the terminal saves the token field and clears the random character string list.

[0101] After the terminal and the cloud platform save the token field, if the cloud platform sends a control command to the terminal, the terminal performs an anti-replay check. If the terminal sends terminal status information to the cloud platform, the cloud platform performs an anti-replay check. The following describes these two situations separately.

[0102] Case 1: The cloud platform sends control instructions to the terminal.

[0103] Before the cloud platform sends a control instruction to the terminal, it generates a random string and sends a message carrying the control instruction, the random string and the token field to the terminal. After receiving the message sent by the cloud platform, the terminal compares the random string in the message with the random string associated with the token field stored by the cloud platform. If the random string carried in the message does not exist in the random string associated with the token field stored by the cloud platform, the random string carried in the message is saved in the random string associated with the token field, and the control instruction carried in the message is executed; if the random string carried in the message exists in the random string associated with the token field stored by the cloud platform, the message is determined to be a replayed message.

[0104] In one embodiment, before the cloud platform sends a control instruction to the terminal, the cloud platform receives a request device control instruction sent by the APP. After receiving the request device control instruction sent by the APP, the cloud platform generates a random string, and the cloud platform places the random string, token field and control instruction in a first message, and then sends the first message to the terminal. After the terminal receives the first message, it takes out a list of tokens and random strings, and compares the random string carried in the first message with the random strings in the list. If the random string carried in the first message does not exist in the random string in the list, the terminal executes the control instruction carried in the first message and saves the random string to the list. If the random string carried in the first message exists in the random string in the list, the terminal determines that the first message is a replay message.

[0105] like Figure 7 As shown, it is a schematic diagram of an interactive process of performing anti-replay verification on a terminal provided in an embodiment of the present application, which specifically includes the following steps:

[0106] S701, the cloud platform receives a device control request instruction triggered by a user through an APP;

[0107] S702: After receiving the device control request instruction, the cloud platform generates a random string and retrieves the token field of this long connection from the storage unit;

[0108] S703, the cloud platform places the control instruction, the random string and the token field in the first message;

[0109] S704, the cloud platform sends a first message to the terminal;

[0110] S705. After receiving the first message, the terminal compares the token field carried in the first message with the token field stored in the terminal. If they are the same, the terminal compares the random string carried in the first message with the random string associated with the token field. If the random string associated with the token field does not contain the random string carried in the first message, the terminal saves the random string carried in the first message to the random string associated with the token field, and executes the control instruction carried in the first message. If the random string associated with the token field contains the random string carried in the first message, the terminal determines that the first message is a replayed message.

[0111] It should be noted that if the random string carried in the first message does not exist in the random string associated with the token field, the first message is determined to be a normal message, and the random string in the first message is saved so that anti-replay verification can be performed after the message is received next time. Since the terminal saves the random string in the message after determining that the received message sent by the cloud platform is a normal message, if the random string carried in the first message exists in the random string associated with the token field, it means that the terminal has received the message before, that is, the message has been sent by the cloud platform before and is a replayed message.

[0112] After the terminal determines that the received message is a replay message, it does not execute the control instruction carried in the replay message. Since the message is a replay message, that is, the message is an illegal message, the terminal can perform an alarm operation.

[0113] In a specific implementation, due to the limited terminal memory, it is impossible to store random strings indefinitely. Therefore, a first preset storage limit can be set. For example, a storage limit of 100 can be set. When the number of random strings stored in the terminal reaches 100, the terminal sends a request for a new token field to the cloud platform. The request for a new token field carries the current token field. After the cloud platform receives the request for a new token field, it verifies the current token field carried in the request for a new token field. If the current token field is the same as the token field stored in itself, the verification passes, and the cloud platform generates a new token field, saves the new token field, and sends the new token field to the terminal. After receiving the new token field, the terminal replaces the current token field with the new token field and deletes all stored random strings.

[0114] like Figure 8As shown, it is a schematic diagram of an interaction for a terminal to apply for a new token field provided in an embodiment of the present application, which specifically includes the following steps:

[0115] S801, the terminal determines that the number of random character strings stored in the terminal reaches a first preset number;

[0116] S802, the terminal sends a request for applying for a new token field to the cloud platform, wherein the request for applying for a new token field carries the current token field;

[0117] S803. After receiving the request for applying for a new token field carrying the current token field sent by the terminal, the cloud platform verifies the current token field carried in the request for applying for a new token field. If the verification is successful, a new token field is generated.

[0118] S804, the cloud platform saves the new token field;

[0119] S805, the cloud platform sends the new token field to the terminal;

[0120] S806. After receiving the new token field, the terminal replaces the current token field with the new token field and deletes all stored random character strings.

[0121] In the embodiment of the present application, the terminal saves the new token field and deletes all random strings. The cloud platform also saves the new token field. When sending a message next time, the message carries the new token field.

[0122] In one embodiment, if the cloud platform sends multiple control instructions to the terminal in a short period of time, the terminal may find that the number of stored random strings has exceeded the first preset number, and the terminal has not received the new token field issued by the cloud platform. At this time, in order to reduce resource waste, it is not necessary to repeatedly apply for a new token field from the cloud platform. The processing method is the same as when the number of random strings is less than the first preset number. After receiving the new token field, the new token field is used for anti-replay verification.

[0123] For example, within 1 second, the terminal receives 5 messages carrying control instructions, random strings and token fields. When processing the messages, the terminal finds that the number of stored random strings in the third message is greater than the first preset number. The terminal sends a request for a new token field to the cloud platform. When the cloud platform has not returned the new token field, the terminal continues to process the fourth message. When processing the fourth message, it also finds that the number of stored random strings is greater than the first preset number. Since the terminal has already sent a request for a new token field to the cloud platform, in order to save resources, there is no need to send a request for a new token field to the terminal.

[0124] Case 2: The terminal reports the operating status to the cloud platform, and the cloud platform performs anti-replay verification.

[0125] After the cloud platform randomly generates the token field, it saves the token field. When the terminal needs to report the terminal status information to the cloud platform, the terminal randomly generates a random string, and then places the terminal status information, the random string and the token field in the second message, and sends the second message to the cloud platform. After receiving the second message, the cloud platform takes out the stored list of tokens and random strings, and compares the token field carried in the second message with the token field carried in the second message. If they are the same, the random string carried in the second message is compared with the random string in the list. If the random string carried in the second message does not exist in the random string in the list, the cloud platform saves the terminal status information carried in the second message and saves the random string to the list. If the random string carried in the second message exists in the random string in the list, the cloud platform determines that the second message is a replay message.

[0126] like Fig. 9 As shown, it is a schematic diagram of an interactive process of performing anti-replay verification on a cloud platform provided in an embodiment of the present application, which specifically includes the following steps:

[0127] S901. After receiving the instruction to trigger reporting of device status, the terminal generates a random string and retrieves the token field of this long connection from the storage unit;

[0128] S902, the terminal places the terminal status information, the random character string and the token field in the second message;

[0129] S903, the terminal sends a second message to the cloud platform;

[0130] S904. After receiving the second message, the cloud platform compares the token field carried in the second message with the token field stored in itself. If they are the same, the random string carried in the second message is compared with the random string associated with the token field. If the random string carried in the second message does not exist in the random string associated with the token field, the random string carried in the second message is saved in the random string associated with the token field, and the terminal status information carried in the second message is saved. If the random string carried in the second message exists in the random string associated with the token field, it is determined that the second message is a replayed message.

[0131] It should be noted that if the random string carried in the second message does not exist in the random string associated with the token field, the second message is determined to be a normal message, and the random string in the second message is saved so that anti-replay verification can be performed the next time the message is received. Since the cloud platform saves the random string in the message after determining that the message sent by the received terminal is a normal message, if the random string carried in the second message exists in the random string associated with the token field, it means that the cloud platform has received the message before, that is, the message has been sent by the terminal before and is a replayed message.

[0132] After the cloud platform determines that the received message is a replayed message, it does not save the terminal status information carried in the replayed message. Since the message is a replayed message, that is, the message is an illegal message, the cloud platform can perform an alarm operation.

[0133] like Fig.10 As shown, it is a complete flow chart of determining a replay message provided in an embodiment of the present application, which specifically includes the following steps:

[0134] S1001, the terminal sends a request to establish a long connection to the cloud platform;

[0135] S1002: After receiving the request to establish a persistent connection, the cloud platform establishes a persistent connection;

[0136] S1003. The cloud platform sends a long connection establishment success message to the terminal.

[0137] S1004, the terminal sends an identity authentication request to the cloud platform;

[0138] S1005. The cloud platform authenticates the identity of the terminal according to the received identity authentication request;

[0139] S1006. The cloud platform successfully authenticates the terminal.

[0140] S1007, the cloud platform generates a token field;

[0141] S1008. The cloud platform saves the token field;

[0142] S1009, the cloud platform sends the token field to the terminal;

[0143] S1010. After receiving the token field, the terminal saves the token field and clears the random character string list;

[0144] S1011, the cloud platform receives a device control request instruction triggered by the user through the APP;

[0145] S1012: After receiving the device control request instruction, the cloud platform generates a random string and retrieves the token field of this long connection from the storage unit;

[0146] S1013, the cloud platform places the control instruction, the random string and the token field in the first message;

[0147] S1014. The cloud platform sends a first message to the terminal;

[0148] S1015. After receiving the first message, the terminal compares the token field carried in the first message with the token field stored in the terminal. If they are the same, the terminal compares the random string carried in the first message with the random string associated with the token field. If the random string associated with the token field does not contain the random string carried in the first message, the terminal saves the random string carried in the first message to the random string associated with the token field, and executes the control instruction carried in the first message. If the random string associated with the token field contains the random string carried in the first message, the terminal determines that the first message is a replayed message.

[0149] S1016. After receiving the instruction to trigger reporting of the device status, the terminal generates a random string and retrieves the token field of this long connection from the storage unit;

[0150] S1017. The terminal places the terminal status information, the random character string and the token field in the second message;

[0151] S1018. The terminal sends a second message to the cloud platform;

[0152] S1019. After receiving the second message, the cloud platform compares the token field carried in the second message with the token field stored in itself. If they are the same, the random string carried in the second message is compared with the random string associated with the token field. If the random string carried in the second message does not exist in the random string associated with the token field, the random string carried in the second message is saved in the random string associated with the token field, and the terminal status information carried in the second message is saved. If the random string carried in the second message exists in the random string associated with the token field, it is determined that the second message is a replayed message.

[0153] The embodiment of the present application provides a two-way anti-replay long connection secure communication method, relying on a long connection session credential (token) and a random string (nonce), the terminal and the cloud platform maintain a certain number of nonce lists in a token life cycle, and if the number of nonce reaches the maximum value, the session credential is refreshed. The present application does not rely on timestamp information, and can well play the effect of anti-replay of messages when the terminal and the cloud platform communicate in both directions.

[0154] Based on the same inventive concept, an embodiment of the present application also provides a method for determining a replayed message. Since this method is the method executed by a terminal in the Internet of Things system in the embodiment of the present disclosure, and the principle of solving the problem by this method is similar to that of the terminal in the Internet of Things system, the implementation of this method can refer to the implementation of the terminal in the system, and the repeated parts will not be repeated.

[0155] like Fig.11 As shown, a method for determining a replayed message provided in an embodiment of the present application includes the following steps:

[0156] S1101. After receiving the session credential token field sent by the cloud platform, the terminal saves the token field;

[0157] S1102, after the terminal receives the first message carrying the control instruction, the first random string and the token field sent by the cloud platform, it is determined whether the first random string exists in the random strings associated with the token field stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message;

[0158] S1103. If the terminal determines that the first random string exists in the random string associated with the token field stored in the terminal, it determines that the first message is a replay message; if it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, execute the control instruction in the first message, wherein the random string associated with the token field stored in the terminal is carried in other messages sent by the cloud platform to the terminal.

[0159] In a possible implementation manner, if the terminal determines that the first random string does not exist in the random strings associated with the token field stored in the terminal, the method further includes:

[0160] The terminal stores the first random character string in a random character string associated with the token.

[0161] In a possible implementation manner, after the terminal receives the first message carrying the control instruction, the first random string, and the token field sent by the cloud platform, before determining whether the first random string exists in the random string associated with the token field stored in the terminal, the method further includes:

[0162] If the terminal determines that the number of stored random character strings associated with the token field is greater than or equal to a first preset number, sending a request for applying for a new token field to the cloud platform so that the cloud platform generates a new token field;

[0163] After receiving the new token field sent by the cloud platform, the terminal replaces the currently stored token field with the new token field and deletes the random character string associated with the currently stored token field.

[0164] In a possible implementation, the method further includes:

[0165] The terminal receives a second message greater than or equal to a second preset number sent by the cloud platform within a preset time period;

[0166] During processing of the second preset number of second messages, the terminal sends a request for applying for a new token field to the cloud platform when it is first determined that the number of random character strings associated with the token field is greater than or equal to the first preset number.

[0167] Based on the same inventive concept, the embodiment of the present application also provides another method for determining the replay message. Since this method is the method executed by the cloud platform in the Internet of Things system in the embodiment of the present disclosure, and the principle of solving the problem by this method is similar to that of the cloud platform in the Internet of Things system, the implementation of this method can refer to the implementation of the cloud platform in the system, and the repeated parts will not be repeated.

[0168] like Fig.12 As shown, another method for determining a replayed message provided in an embodiment of the present application includes the following steps:

[0169] S1201. The cloud platform saves a token field and sends the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful;

[0170] S1202: After receiving the second message sent by the terminal and carrying the terminal status information, the second random string and the token field, the cloud platform determines whether the second random string exists in the random strings associated with the token field stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message;

[0171] S1203. If the cloud platform determines that the second random string exists in the random strings stored in the cloud platform, it determines that the second message is a replay message. If it determines that the second random string does not exist in the random strings stored in the cloud platform, it saves the terminal status information in the second message, wherein the random string stored in the cloud platform is carried in other messages sent by the terminal to the cloud platform.

[0172] In a possible implementation manner, if the cloud platform determines that the second random string does not exist in the random strings stored by the cloud platform, the method further includes:

[0173] The cloud platform saves the random character string in the second message into the random character string associated with the token field.

[0174] Based on the same inventive concept, the embodiment of the present application also provides a terminal. Since the terminal is the terminal in the Internet of Things system of the embodiment of the present disclosure, and the principle of solving the problem by the terminal is similar to that of the terminal in the Internet of Things system, the implementation of the terminal can refer to the implementation of the terminal in the system, and the repeated parts will not be repeated.

[0175] like Fig.13 , which is a schematic diagram of the structure of a terminal provided in an embodiment of the present application, wherein the terminal includes a processor 1301 and a memory 1302;

[0176] The processor 1301 is used for, after receiving the session credential token field sent by the cloud platform, saving the token field to the memory; after receiving the first message carrying the control instruction, the first random string and the token field sent by the cloud platform, determining whether the first random string exists in the random string associated with the token field stored in the memory, wherein the first random string is randomly generated before the cloud platform sends the first message; if it is determined that the first random string exists in the random string associated with the token field stored in the memory, determining that the first message is a replay message, and if it is determined that the first random string does not exist in the random string associated with the token field stored in the memory, executing the control instruction in the first message, wherein the random string associated with the token field stored in the memory is carried in other messages sent by the cloud platform to the processor;

[0177] The memory 1302 is used to store the token field and the random character string associated with the token field.

[0178] In a possible implementation manner, if it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, the processor 1301 is further configured to:

[0179] The first random string is stored in a random string associated with the token.

[0180] In a possible implementation manner, after receiving the first message carrying the control instruction, the first random string, and the token field sent by the cloud platform, before determining whether the first random string exists in the random string associated with the token field stored in the terminal, the processor 1301 is further used to:

[0181] If it is determined that the number of stored random character strings associated with the token field is greater than or equal to a first preset number, sending a request for applying for a new token field to the cloud platform so that the cloud platform generates a new token field;

[0182] After receiving the new token field sent by the cloud platform, the new token field replaces the currently stored token field, and deletes the random string associated with the currently stored token field.

[0183] In a possible implementation manner, the processor 1301 is further configured to:

[0184] Receiving a second message greater than or equal to a second preset number sent by the cloud platform within a preset time period;

[0185] In the process of processing the second preset number of second messages, when it is first determined that the number of random character strings associated with the token field is greater than or equal to the first preset number, a request for applying for a new token field is sent to the cloud platform.

[0186] Based on the same inventive concept, the embodiment of the present application also provides a cloud platform. Since the cloud platform is the cloud platform in the Internet of Things system of the embodiment of the present disclosure, and the principle of solving the problem by the cloud platform is similar to that of the cloud platform in the Internet of Things system, the implementation of the cloud platform can refer to the implementation of the cloud platform in the system, and the repeated parts will not be repeated.

[0187] like Fig.14 As shown, a cloud platform provided in an embodiment of the present application includes a processor 1401 and a memory 1402;

[0188] The processor 1401 is used to send the token field stored in the memory to the terminal, wherein the token field is randomly generated by the processor after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful; after receiving the second message sent by the terminal carrying terminal status information, a second random string and the token field, determine whether the second random string exists in the random string associated with the token field stored in the memory, wherein the second random string is randomly generated before the terminal sends the second message; if it is determined that the second random string exists in the random string stored in the processor, determine that the second message is a replay message, and if it is determined that the second random string does not exist in the random string stored in the processor, save the terminal status information in the second message, wherein the random string stored in the processor is carried in other messages sent by the terminal to the processor;

[0189] The memory 1402 is used to store the token field, the random character string associated with the token field, and the terminal status information.

[0190] In a possible implementation, if it is determined that the second random string does not exist in the random strings stored in the cloud platform, the processor 1401 is further configured to:

[0191] The random character string in the second message is saved in the random character string associated with the token field.

[0192] Based on the same inventive concept, the embodiment of the present application also provides a terminal. Since the terminal is the terminal in the Internet of Things system of the embodiment of the present disclosure, and the principle of solving the problem by the terminal is similar to that of the terminal in the Internet of Things system, the implementation of the terminal can refer to the implementation of the terminal in the system, and the repeated parts will not be repeated.

[0193] like Fig.15 FIG. 1 is a schematic diagram of the structure of another terminal provided in an embodiment of the present application, wherein the terminal includes:

[0194] The first storage module 1501 is used to store the session credential token field after receiving the token field sent by the cloud platform;

[0195] A first judgment module 1502 is configured to, after receiving a first message carrying a control instruction, a first random string and the token field sent by the cloud platform, determine whether the first random string exists in the random strings associated with the token field stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message;

[0196] The first execution module 1503 is used to determine that the first message is a replay message if it is determined that the first random string exists in the random string associated with the token field stored in the terminal, and to execute the control instruction in the first message if it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, wherein the random string associated with the token field stored in the terminal is carried in other messages sent by the cloud platform to the terminal.

[0197] In a possible implementation, if it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, the first execution module 1503 is further used to:

[0198] The first random string is stored in a random string associated with the token.

[0199] In a possible implementation, after receiving the first message carrying the control instruction, the first random string, and the token field sent by the cloud platform, before determining whether the random string associated with the token field stored in the terminal includes the first random string, the first determination module 1502 is further configured to:

[0200] If it is determined that the number of stored random character strings associated with the token field is greater than or equal to a first preset number, sending a request for applying for a new token field to the cloud platform so that the cloud platform generates a new token field;

[0201] After receiving the new token field sent by the cloud platform, the new token field replaces the currently stored token field, and deletes the random string associated with the currently stored token field.

[0202] In a possible implementation, the first execution module 1503 is further configured to:

[0203] Receiving a second message greater than or equal to a second preset number sent by the cloud platform within a preset time period;

[0204] In the process of processing the second preset number of second messages, when it is first determined that the number of random character strings associated with the token field is greater than or equal to the first preset number, a request for applying for a new token field is sent to the cloud platform.

[0205] Based on the same inventive concept, the embodiment of the present application also provides another cloud platform. Since the cloud platform is the cloud platform in the Internet of Things system of the embodiment of the present disclosure, and the principle of solving the problem by the cloud platform is similar to that of the cloud platform in the Internet of Things system, the implementation of the cloud platform can refer to the implementation of the cloud platform in the system, and the repeated parts will not be repeated.

[0206] like Fig.16 FIG. 1 is a schematic diagram of the structure of another cloud platform provided in an embodiment of the present application, wherein the cloud platform includes:

[0207] The second storage module 1601 is used to store a token field and send the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful;

[0208] A second judgment module 1602 is configured to, after receiving a second message sent by the terminal carrying terminal status information, a second random string and the token field, determine whether the second random string exists in the random strings associated with the token field stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message;

[0209] The second execution module 1603 is used to determine that the second message is a replay message if it is determined that the second random string exists in the random strings stored in the cloud platform, and to save the terminal status information in the second message if it is determined that the second random string does not exist in the random strings stored in the cloud platform, wherein the random string stored in the cloud platform is carried in other messages sent by the terminal to the cloud platform.

[0210] In a possible implementation, if it is determined that the second random string does not exist in the random strings stored in the cloud platform, the second execution module 1603 is further used to:

[0211] The random character string in the second message is saved in the random character string associated with the token field.

[0212] The present application is described above with reference to the block diagrams and / or flow charts showing the methods, devices (systems) and / or computer program products according to the embodiments of the present application. It should be understood that a block of the block diagram and / or flow chart diagram and a combination of blocks of the block diagram and / or flow chart diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer and / or other programmable data processing device to produce a machine, so that the instructions executed by the computer processor and / or other programmable data processing device create a method for implementing the functions / actions specified in the block diagram and / or flow chart block.

[0213] Accordingly, the present application may also be implemented with hardware and / or software (including firmware, resident software, microcode, etc.). Furthermore, the present application may take the form of a computer program product on a computer-usable or computer-readable storage medium, which has a computer-usable or computer-readable program code implemented in the medium, for use by an instruction execution system or in conjunction with an instruction execution system. In the context of the present application, a computer-usable or computer-readable medium may be any medium that may contain, store, communicate, transmit, or convey a program for use by an instruction execution system, device, or apparatus, or in conjunction with an instruction execution system, device, or apparatus.

[0214] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for determining a replayed message, It is characterized in that The method includes: After receiving the session credential token field sent by the cloud platform, the terminal saves the token field; After the terminal receives the first message sent by the cloud platform and carrying the control instruction, the first random string and the token field, it is determined whether the first random string exists in the random strings associated with the token field stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message; If the terminal determines that the first random string exists in the random string associated with the token field stored in the terminal, it determines that the first message is a replay message. If it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, the control instruction in the first message is executed, wherein the random string associated with the token field stored in the terminal is carried in other messages sent by the cloud platform to the terminal.

2. The method according to claim 1, It is characterized in that If the terminal determines that the first random string does not exist in the random strings associated with the token field stored in the terminal, the method further includes: The terminal stores the first random character string in a random character string associated with the token.

3. The method according to claim 1, It is characterized in that After the terminal receives the first message carrying the control instruction, the first random string and the token field sent by the cloud platform, before determining whether the first random string exists in the random string associated with the token field stored in the terminal, the method further includes: If the terminal determines that the number of stored random character strings associated with the token field is greater than or equal to a first preset number, sending a request for applying for a new token field to the cloud platform so that the cloud platform generates a new token field; After receiving the new token field sent by the cloud platform, the terminal replaces the currently stored token field with the new token field and deletes the random character string associated with the currently stored token field.

4. The method according to any one of claims 1 to 3, It is characterized in that The method further includes: The terminal receives a second message greater than or equal to a second preset number sent by the cloud platform within a preset time period; During processing of the second preset number of second messages, the terminal sends a request for applying for a new token field to the cloud platform when it is first determined that the number of random character strings associated with the token field is greater than or equal to the first preset number.

5. A method for determining a replayed message, It is characterized in that The method includes: The cloud platform saves the token field and sends the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful; After the cloud platform receives the second message sent by the terminal and carrying the terminal status information, the second random string and the token field, it is determined whether the second random string exists in the random strings associated with the token field stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message; If the cloud platform determines that the second random string exists in the random strings stored in the cloud platform, it determines that the second message is a replay message. If it is determined that the second random string does not exist in the random strings stored in the cloud platform, the terminal status information in the second message is saved, wherein the random string stored in the cloud platform is carried in other messages sent by the terminal to the cloud platform.

6. The method according to claim 5, It is characterized in that If the cloud platform determines that the second random string does not exist in the random strings stored by the cloud platform, the method further includes: The cloud platform saves the random character string in the second message into the random character string associated with the token field.

7. A terminal, It is characterized in that The terminal includes a processor and a memory; The processor is configured to, after receiving a session credential token field sent by a cloud platform, save the token field to the memory; after receiving a first message sent by the cloud platform carrying a control instruction, a first random string and the token field, determine whether the first random string exists in the random string associated with the token field stored in the memory, wherein the first random string is randomly generated before the cloud platform sends the first message; if it is determined that the first random string exists in the random string associated with the token field stored in the memory, determine that the first message is a replay message, and if it is determined that the first random string does not exist in the random string associated with the token field stored in the memory, execute the control instruction in the first message, wherein the random string associated with the token field stored in the memory is carried in other messages sent by the cloud platform to the processor; The memory is used to store the token field and a random character string associated with the token field.

8. A cloud platform, It is characterized in that The cloud platform includes a processor and a memory; The processor is used to send the token field stored in the memory to the terminal, wherein the token field is randomly generated by the processor after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful; after receiving a second message sent by the terminal carrying terminal status information, a second random string and the token field, determine whether the second random string exists in the random string associated with the token field stored in the memory, wherein the second random string is randomly generated before the terminal sends the second message; if it is determined that the second random string exists in the random string stored in the processor, determine that the second message is a replay message, and if it is determined that the second random string does not exist in the random string stored in the processor, save the terminal status information in the second message, wherein the random string stored in the processor is carried in other messages sent by the terminal to the processor; The memory is used to store the token field, a random character string associated with the token field, and the terminal status information.

9. A terminal, It is characterized in that The terminal comprises: A first storage module, configured to store a session credential token field after receiving the token field sent by the cloud platform; A first judgment module is configured to, after receiving a first message carrying a control instruction, a first random string and the token field sent by the cloud platform, determine whether the first random string exists in the random strings associated with the token field stored in the terminal, wherein the first random string is randomly generated before the cloud platform sends the first message; A first execution module is used to determine that the first message is a replay message if it is determined that the first random string exists in the random string associated with the token field stored in the terminal, and to execute a control instruction in the first message if it is determined that the first random string does not exist in the random string associated with the token field stored in the terminal, wherein the random string associated with the token field stored in the terminal is carried in other messages sent by the cloud platform to the terminal.

10. A cloud platform, It is characterized in that The cloud platform includes: A second storage module is used to store a token field and send the token field to the terminal, wherein the token field is randomly generated by the cloud platform after a long connection is established between the cloud platform and the terminal and the identity authentication of the terminal is successful; A second judgment module is configured to, after receiving a second message sent by the terminal carrying terminal status information, a second random string and the token field, judge whether the second random string exists in the random strings associated with the token field stored in the cloud platform, wherein the second random string is randomly generated before the terminal sends the second message; The second execution module is used to determine that the second message is a replay message if it is determined that the second random string exists in the random strings stored in the cloud platform, and save the terminal status information in the second message if it is determined that the second random string does not exist in the random strings stored in the cloud platform, wherein the random string stored in the cloud platform is carried in other messages sent by the terminal to the cloud platform.

Images