A method for secure data transmission based on FTTR networking

Abstract

The present application relates to a method for secure data transmission based on FTTR networking, and relates to the technical field of FTTR networking, including: a key management center generates a hardware identifier matching the terminal device for each terminal device that has completed registration and feeds it back to the terminal device; the terminal device sends a data packet containing a timestamp, a random number and a hardware identifier to the key management center; the key management center calculates a temporary key for this data transmission based on the timestamp, random number and hardware identifier received in the data packet through a preset encryption function, and sends the temporary key to the terminal device; the terminal device encrypts the data packet based on the temporary key and sends the encrypted data packet to a target device; the target device extracts the timestamp, random number and hardware identifier based on the encrypted data packet and calculates the temporary key through a preset encryption function to decrypt the data and verify the timestamp and hardware identifier.

Description

Technical Field

[0001] The present application relates to the technical field of FTTR networking, and in particular to a method for secure data transmission based on FTTR networking. Background Art

[0002] Fiber to the Room (FTTR) extends high-speed Internet connections directly to every room in a home or business via optical fiber. Compared with traditional fiber to the home (FTTH), FTTR provides higher bandwidth, lower latency, and more stable network connections, and is suitable for scenarios that require high-performance networks, such as smart homes, high-definition video streaming, online games, and remote offices.

[0003] In scenarios such as enterprise internal networks, smart homes, and the Internet of Things, secure data transmission has become the key to ensuring the normal operation of the business; how to securely transmit data based on FTTR networking is a technical challenge that technical personnel in this field need to overcome. Summary of the invention

[0004] In order to at least partially solve the above technical problems, the present application provides a method for secure data transmission based on FTTR networking.

[0005] The present application provides a method for secure data transmission based on FTTR networking, which adopts the following technical solution.

[0006] A method for secure data transmission based on FTTR networking mode, comprising:

[0007] The terminal device initiates a registration request to the key management center; in the registration request, the terminal device provides device information and user information to complete preliminary identity authentication;

[0008] The key management center generates a hardware identifier matching the terminal device for each terminal device that has completed registration and feeds it back to the terminal device;

[0009] Before each data transmission, the terminal device sends a data packet including a timestamp, a random number and the hardware identifier to the key management center;

[0010] The key management center calculates the temporary key for this data transmission based on the timestamp, random number and hardware identifier in the received data packet through a preset encryption function, and sends the temporary key to the terminal device;

[0011] The terminal device encrypts the data packet based on the temporary key and sends the encrypted data packet to the target device;

[0012] The target device extracts the timestamp, random number and hardware identifier based on the encrypted data packet and calculates a temporary key through the preset encryption function to decrypt the data and verify the timestamp and hardware identifier.

[0013] Optionally, the method further includes:

[0014] The key management center is provided with an update period T;

[0015] At the beginning of each update period T, the key management center generates a new hardware identifier and sends the new hardware identifier to the terminal device;

[0016] The end device receives the new hardware identifier, updates the locally stored hardware identifier, and uses the new hardware identifier in the next data transmission.

[0017] Optionally, after the key management center receives the data packet, the method further includes:

[0018] Get the current system time;

[0019] Calculate the time difference between the timestamp and the current system time;

[0020] Determine whether the time difference is within the preset time window; if so, the timestamp is valid; if not, the timestamp is invalid and the data packet is discarded;

[0021] When the timestamp is valid, the temporary key for this data transmission is calculated using a preset encryption function.

[0022] Optionally, the method further includes:

[0023] The key management center is configured with an access control policy database; the access control policy includes: role definition, attribute definition, resource definition and access rules;

[0024] When the terminal device initiates a registration request to the key management center, the user information includes: user role information and user attribute information;

[0025] The key management center allocates corresponding access rights to the user according to the received user role information and user attribute information combined with the definition in the access control policy database;

[0026] After receiving the data transmission request, the key management center first verifies the validity of the timestamp in the request, and then queries the access control policy database based on the user role information and user attribute information to determine whether the user has the right to access the requested resource;

[0027] If the user has access rights, the access rule is matched; if the user does not have access rights, the data transmission request is rejected and an error code is returned to the terminal device.

[0028] Optionally, the matching access rule includes:

[0029] After determining that the user has access rights, several access rules are matched and a rule set consisting of access rules is obtained;

[0030] The key management center parses the matched rule set one by one and extracts the rule information in each access rule;

[0031] Compare the parsed access rules in pairs to check whether there are conflicting access rights; if so, record the conflict information of the conflicting access rules;

[0032] Sort the conflicting access rules according to the predefined priority rules; if there are multiple access rules with the same priority, sort the multiple access rules with the same priority according to the rule specificity to obtain the final sorted rule set;

[0033] The user's operation permissions for the requested resources are determined based on the sorted rule set.

[0034] Optionally, the terminal device and the key management center are respectively configured with NTP clients, and the NTP clients are connected to the same NTP server or a group of NTP servers;

[0035] The terminal device and the key management center send time synchronization requests to the NTP server at preset time intervals;

[0036] The NTP server returns the current time, and the terminal device and the key management center adjust the local clock according to the returned time;

[0037] The terminal device and the key management center record the timestamp of the last successful synchronization for subsequent time deviation calculation.

[0038] Optionally, after sending the data packet, the terminal device starts a timeout timer and sets a timeout period;

[0039] The terminal device waits for a confirmation response from the target device;

[0040] If a confirmation response is received within the timeout period, the data packet is considered to have been transmitted successfully and the next data packet is sent;

[0041] If no confirmation response is received within the timeout period, the data packet transmission is considered to have failed and the data packet is retransmitted;

[0042] When the number of retransmissions reaches the preset maximum number of retransmissions, the transmission is abandoned and the transmission failure is reported to the user.

[0043] Optionally, the method further includes:

[0044] Multiple network paths are established between the terminal device and the target device, each path corresponds to a different network interface or a different network operator;

[0045] The terminal device divides the data packet into multiple fragments, and each fragment is transmitted through a different path.

[0046] After receiving all the fragments, the target device reassembles them and verifies the data integrity.

[0047] If a transmission path fails, the terminal device switches to another path and retransmits the failed fragment.

[0048] Optionally, the terminal device and the target device send a heartbeat signal at a preset time interval; the heartbeat signal includes a simple sequence number and timestamp information;

[0049] After receiving the heartbeat signal, the receiver immediately replies with a confirmation response;

[0050] If no heartbeat signal or confirmation response is received from the other party within a preset time interval, the network connection is considered abnormal and a reconnection mechanism is started; the reconnection mechanism includes at least one of reestablishing the connection, resynchronizing the time, and resending the unfinished data packets. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a flow chart of a method for secure data transmission based on FTTR networking mode in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The following is combined with Figure 1 The present application is further described with specific embodiments:

[0053] Reference Figure 1 As an implementation method of a method for secure data transmission based on FTTR networking, the method comprises the following steps:

[0054] Step 101, the terminal device initiates a registration request to the key management center; in the registration request, the terminal device provides device information and user information to complete preliminary identity authentication. Specifically, the terminal device is a variety of electronic devices used by users, such as computers, smart phones, tablets, smart home devices, etc. The terminal device communicates with the key management center through the FTTR network. The registration request is a message sent by the terminal device to the key management center to apply for registration and obtain initial authentication information. The registration request usually contains device information (such as device model, MAC address, etc.) and user information (such as user name, password, etc.). Through the registration request, the terminal device completes the preliminary identity authentication.

[0055] Step 102: The key management center generates a hardware identifier that matches the terminal device for each terminal device that has completed registration and feeds it back to the terminal device. Specifically, the key management center is responsible for processing the registration request of the terminal device, generating the hardware identifier, calculating the temporary key, and verifying the timestamp and the hardware identifier.

[0056] Step 103. Before each data transmission, the terminal device sends a data packet containing a timestamp, a random number and the hardware identifier to the key management center. Specifically, the hardware identifier is a unique identifier generated by the key management center for each registered terminal device, which is used to distinguish different terminal devices. The hardware identifier is used to verify the identity of the terminal device during the data transmission process to ensure the security of data transmission. The timestamp refers to the precise time when the data packet is generated, usually in milliseconds. The timestamp is used to verify the freshness of the data and prevent replay attacks. The key management center determines whether the data packet is within the valid time window by comparing the timestamp with the current system time. The random number is a random value generated during the data transmission process, which is used to prevent attackers from obtaining keys by guessing or replaying known data packets, thereby improving the security of data transmission.

[0057] Step 104, the key management center calculates the temporary key for this data transmission through a preset encryption function based on the timestamp, random number and hardware identifier received in the data packet, and sends the temporary key to the terminal device. Specifically, a data packet refers to a data unit encapsulated in network transmission, which contains actual data to be transmitted and related control information; a data packet usually contains a timestamp, a random number, a hardware identifier, actual data, etc. The preset encryption function is a predefined encryption algorithm used to generate and verify temporary keys. This function is usually based on a symmetric encryption algorithm or a hash function to ensure that the terminal device and the target device can generate the same temporary key based on the same information (timestamp, random number, hardware identifier), thereby realizing data encryption and decryption. The temporary key is a short-term key generated before each data transmission and is used to encrypt and decrypt data.

[0058] Step 105: The terminal device encrypts the data packet based on the temporary key and sends the encrypted data packet to the target device. Specifically, the target device refers to a device that receives the data packet sent by the terminal device, which may be another terminal device, a server or other network device.

[0059] Step 106: The target device extracts the timestamp, random number and hardware identifier based on the encrypted data packet and calculates a temporary key through the preset encryption function to decrypt the data and verify the timestamp and hardware identifier.

[0060] Specifically, the terminal device initiates a registration request to the key management center and provides device information and user information to complete the preliminary identity authentication. The key management center generates a unique hardware identifier for each registered terminal device and feeds it back to the terminal device. Before each data transmission, the terminal device sends a data packet containing a timestamp, a random number and a hardware identifier to the key management center, and effectively prevents replay attacks through the timestamp and random number. The key management center calculates the temporary key for this data transmission based on the timestamp, random number and hardware identifier in the received data packet through a preset encryption function, and sends the temporary key to the terminal device. The terminal device encrypts the data packet based on the temporary key and sends it to the target device, ensuring the confidentiality of the data during the transmission process. The target device extracts the timestamp, random number and hardware identifier based on the encrypted data packet, and calculates the temporary key through a preset encryption function to decrypt the data and verify the timestamp and hardware identifier. Through the above steps, the present invention not only realizes efficient and secure data transmission, but also effectively prevents replay attacks and data tampering through a multiple verification mechanism, ensures the integrity and freshness of data transmission, and provides a highly secure and reliable FFTR networking data transmission solution.

[0061] The following is a specific example.

[0062] A smart home system includes multiple terminal devices (such as smart cameras, smart door locks, etc.) and a key management center. Users hope to achieve secure data transmission through this system, such as transmitting videos captured by smart cameras to cloud servers.

[0063] The user installs a smart camera for the first time and connects it to the home network. The smart camera sends a registration request to the key management center. The registration request contains device information and user information. The key management center performs preliminary identity authentication on the received device information and user information. After the key management center passes the verification, it generates a unique hardware identifier for the smart camera. The key management center generates a unique hardware identifier and sends the generated hardware identifier back to the smart camera through a secure channel (such as HTTPS). The smart camera receives and stores the hardware identifier for subsequent data transmission. The smart camera is ready to transmit video data to the cloud server. The smart camera generates a current timestamp and a random number, encapsulates the timestamp, random number and hardware identifier in a data packet and sends the data packet to the key management center. The key management center receives the data packet sent by the smart camera and extracts the timestamp, random number and hardware identifier in the data packet. Get the current system time and calculate the time difference between the timestamp and the current system time. Determine whether the time difference is within the preset time window. If it is within the time window, the timestamp is valid; otherwise, the timestamp is invalid and the data packet is discarded. If the timestamp is valid, the key management center uses a preset encryption function (e.g., SHA-256) to calculate the temporary key for this data transmission and sends the temporary key back to the smart camera through a secure channel. The smart camera receives the temporary key and prepares to encrypt the video data and send it to the cloud server. The smart camera encrypts the video data using the received temporary key. The encrypted data packet is sent to the cloud server. The target device decrypts the data and verifies the timestamp and hardware identifier. The cloud server extracts the timestamp, random number, and hardware identifier from the encrypted data packet and calculates the temporary key using the same preset encryption function. The encrypted data packet is decrypted using the calculated temporary key to restore the original video data. Through the above steps, the data transmission between the smart camera and the cloud server is effectively secured, ensuring the integrity and confidentiality of the data.

[0064] As a specific implementation of a method for secure data transmission based on FTTR networking, the method further includes:

[0065] The key management center is provided with an update period T;

[0066] At the beginning of each update period T, the key management center generates a new hardware identifier and sends the new hardware identifier to the terminal device;

[0067] The end device receives the new hardware identifier, updates the locally stored hardware identifier, and uses the new hardware identifier in the next data transmission.

[0068] Specifically, by regularly updating the hardware identifier, security risks caused by long-term use of the same identifier, such as the hardware identifier being cracked or abused, can be effectively prevented. Each updated hardware identifier makes the authentication of the terminal device more reliable and reduces potential security vulnerabilities, further improving the security of data transmission.

[0069] As a specific implementation of a method for secure data transmission based on FTTR networking, after the key management center receives the data packet, the method further includes:

[0070] Get the current system time;

[0071] Calculate the time difference between the timestamp and the current system time;

[0072] Determine whether the time difference is within the preset time window; if so, the timestamp is valid; if not, the timestamp is invalid and the data packet is discarded;

[0073] When the timestamp is valid, the temporary key for this data transmission is calculated using a preset encryption function.

[0074] Specifically, the timestamp verification mechanism ensures that the data packet is generated within a reasonable time range by comparing the time difference between the timestamp in the data packet and the current system time, thereby preventing attackers from using old data packets for replay attacks. Only when the timestamp is valid will the key management center calculate the temporary key and perform subsequent data transmission.

[0075] As a specific implementation of a method for secure data transmission based on FTTR networking, the method further includes:

[0076] The key management center is configured with an access control policy database; the access control policy includes: role definition, attribute definition, resource definition and access rules;

[0077] When the terminal device initiates a registration request to the key management center, the user information includes: user role information and user attribute information;

[0078] The key management center allocates corresponding access rights to the user according to the received user role information and user attribute information combined with the definition in the access control policy database;

[0079] After receiving the data transmission request, the key management center first verifies the validity of the timestamp in the request, and then queries the access control policy database based on the user role information and user attribute information to determine whether the user has the right to access the requested resource;

[0080] If the user has access rights, the access rule is matched; if the user does not have access rights, the data transmission request is rejected and an error code is returned to the terminal device.

[0081] Specifically, through fine-grained access control policies, it is ensured that only authorized users can access specific resources. Access control policies enable the system to dynamically assign access rights based on user roles and attributes, preventing unauthorized access and reducing the risk of data leakage and abuse.

[0082] As one implementation method of a method for secure data transmission based on FTTR networking, the matching access rule includes:

[0083] After determining that the user has access rights, several access rules are matched and a rule set consisting of access rules is obtained;

[0084] The key management center parses the matched rule set one by one and extracts the rule information in each access rule;

[0085] Compare the parsed access rules in pairs to check whether there are conflicting access rights; if so, record the conflict information of the conflicting access rules;

[0086] Sort the conflicting access rules according to the predefined priority rules; if there are multiple access rules with the same priority, sort the multiple access rules with the same priority according to the rule specificity to obtain the final sorted rule set;

[0087] The user's operation permissions for the requested resources are determined based on the sorted rule set.

[0088] Specifically, parsing and comparing access rules one by one can effectively detect and record conflicting access rights and prevent permission management errors caused by rule conflicts. The comprehensive sorting of priority rules and rule specificity ensures that when there are multiple applicable rules, the system can select the optimal rule combination, avoiding access rights errors caused by rule conflicts and improving the accuracy of user access rights.

[0089] As one implementation method of a method for secure data transmission based on FTTR networking, a terminal device and a key management center are respectively configured with an NTP client, and the NTP client is connected to the same NTP server or a group of NTP servers;

[0090] The terminal device and the key management center send time synchronization requests to the NTP server at preset time intervals;

[0091] The NTP server returns the current time, and the terminal device and the key management center adjust the local clock according to the returned time;

[0092] The terminal device and the key management center record the timestamp of the last successful synchronization for subsequent time deviation calculation.

[0093] As one implementation method of a method for secure data transmission based on FTTR networking mode, after sending a data packet, a terminal device starts a timeout timer and sets a timeout time;

[0094] The terminal device waits for a confirmation response from the target device;

[0095] If a confirmation response is received within the timeout period, the data packet is considered to have been transmitted successfully and the next data packet is sent;

[0096] If no confirmation response is received within the timeout period, the data packet transmission is considered to have failed and the data packet is retransmitted;

[0097] When the number of retransmissions reaches the preset maximum number of retransmissions, the transmission is abandoned and the transmission failure is reported to the user.

[0098] Specifically, the combination of the timeout timer and the confirmation response ensures that the terminal device can detect whether the data packet is successfully transmitted in time, avoiding data loss caused by network delay or packet loss. The retransmission mechanism automatically retransmits when the data packet transmission fails, improving the success rate of data transmission. At the same time, the preset maximum number of retransmissions prevents resource waste and system burden caused by unlimited retransmissions.

[0099] As one implementation of a method for secure data transmission based on FTTR networking, the method further includes:

[0100] Multiple network paths are established between the terminal device and the target device, each path corresponds to a different network interface or a different network operator;

[0101] The terminal device divides the data packet into multiple fragments, and each fragment is transmitted through a different path.

[0102] After receiving all the fragments, the target device reassembles them and verifies the data integrity.

[0103] If a transmission path fails, the terminal device switches to another path and retransmits the failed fragment.

[0104] Specifically, multi-path transmission utilizes different network interfaces or operators to disperse the risk of data transmission, reduce the impact of single point failures, and ensure that data can still be transmitted smoothly in the case of network instability or partial path failure. The fragment transmission and reassembly mechanism ensures the integrity and correctness of the data. Even if some fragments are lost or damaged during transmission, they can be retransmitted through other paths to ensure the integrity and consistency of the final data.

[0105] As one implementation method of a method for secure data transmission based on FTTR networking, a terminal device and a target device send a heartbeat signal at a preset time interval; the heartbeat signal contains a simple sequence number and timestamp information;

[0106] After receiving the heartbeat signal, the receiver immediately replies with a confirmation response;

[0107] If no heartbeat signal or confirmation response is received from the other party within a preset time interval, the network connection is considered abnormal and a reconnection mechanism is started; the reconnection mechanism includes at least one of reestablishing the connection, resynchronizing the time, and resending the unfinished data packets.

[0108] It should be noted that the above embodiments are only used to illustrate the present application and are not intended to limit the technical solutions described in the present application. Although the present application has been described in detail in this specification with reference to the above embodiments, a person of ordinary skill in the art should understand that a person of ordinary skill in the art can still modify or make equivalent substitutions to the present application, and all technical solutions and improvements thereof that do not depart from the spirit and scope of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for secure data transmission based on FTTR networking, characterized in that: include: The terminal device initiates a registration request to the key management center; In the registration request, the terminal device provides device information and user information to complete preliminary identity verification; The key management center generates a hardware identifier matching the terminal device for each terminal device that has completed registration and feeds it back to the terminal device; Before each data transmission, the terminal device sends a data packet including a timestamp, a random number and the hardware identifier to the key management center; The key management center calculates the temporary key for this data transmission based on the timestamp, random number and hardware identifier in the received data packet through a preset encryption function, and sends the temporary key to the terminal device; The terminal device encrypts the data packet based on the temporary key and sends the encrypted data packet to the target device; The target device extracts the timestamp, random number and hardware identifier based on the encrypted data packet and calculates a temporary key through the preset encryption function to decrypt the data and verify the timestamp and hardware identifier; The method further comprises: The key management center is configured with an access control policy database; the access control policy includes: role definition, attribute definition, resource definition and access rules; When the terminal device initiates a registration request to the key management center, the user information includes: user role information and user attribute information; The key management center allocates corresponding access rights to the user according to the received user role information and user attribute information combined with the definition in the access control policy database; After receiving the data transmission request, the key management center first verifies the validity of the timestamp in the request, and then queries the access control policy database based on the user role information and user attribute information to determine whether the user has the right to access the requested resource; If the user has access rights, the access rule is matched; if the user does not have access rights, the data transmission request is rejected and an error code is returned to the terminal device; The matching access rules include: After determining that the user has access rights, several access rules are matched and a rule set consisting of access rules is obtained; The key management center parses the matched rule set one by one and extracts the rule information in each access rule; Compare the parsed access rules in pairs to check whether there are conflicting access rights; if so, record the conflict information of the conflicting access rules; Sort the conflicting access rules according to the predefined priority rules; if there are multiple access rules with the same priority, sort the multiple access rules with the same priority according to the rule specificity to obtain the final sorted rule set; The user's operation permissions for the requested resources are determined based on the sorted rule set.

2. According to claim 1, a method for secure data transmission based on FTTR networking mode is characterized in that: The method further comprises: The key management center is provided with an update period T; At the beginning of each update period T, the key management center generates a new hardware identifier and sends the new hardware identifier to the terminal device; The end device receives the new hardware identifier, updates the locally stored hardware identifier, and uses the new hardware identifier in the next data transmission.

3. The method for secure data transmission based on FTTR networking mode according to claim 2 is characterized in that: After the key management center receives the data packet, the method further includes: Get the current system time; Calculate the time difference between the timestamp and the current system time; Determine whether the time difference is within the preset time window; if so, the timestamp is valid; if not, the timestamp is invalid and the data packet is discarded; When the timestamp is valid, the temporary key for this data transmission is calculated using a preset encryption function.

4. The method for secure data transmission based on FTTR networking mode according to claim 3 is characterized in that: The terminal device and the key management center are respectively configured with NTP clients, and the NTP clients are connected to the same NTP server or a group of NTP servers; The terminal device and the key management center send time synchronization requests to the NTP server at preset time intervals; The NTP server returns the current time, and the terminal device and the key management center adjust the local clock according to the returned time; The terminal device and the key management center record the timestamp of the last successful synchronization for subsequent time deviation calculation.

5. The method for secure data transmission based on FTTR networking mode according to claim 4 is characterized in that: After sending a data packet, the terminal device starts a timeout timer and sets the timeout period; The terminal device waits for a confirmation response from the target device; If a confirmation response is received within the timeout period, the data packet is considered to have been transmitted successfully and the next data packet is sent; If no confirmation response is received within the timeout period, the data packet transmission is considered to have failed and the data packet is retransmitted; When the number of retransmissions reaches the preset maximum number of retransmissions, the transmission is abandoned and the transmission failure is reported to the user.

6. The method for secure data transmission based on FTTR networking mode according to claim 5 is characterized in that: The method further comprises: Multiple network paths are established between the terminal device and the target device, each path corresponds to a different network interface or a different network operator; The terminal device divides the data packet into multiple fragments, and each fragment is transmitted through a different path; After receiving all the fragments, the target device reassembles and verifies the data integrity; If a transmission path fails, the terminal device switches to another path and retransmits the failed fragment.

7. The method for secure data transmission based on FTTR networking mode according to claim 6 is characterized in that: The terminal device and the target device send heartbeat signals at preset time intervals; the heartbeat signals contain simple sequence number and timestamp information; After receiving the heartbeat signal, the receiver immediately replies with a confirmation response; If no heartbeat signal or confirmation response is received from the other party within a preset time interval, the network connection is considered abnormal and a reconnection mechanism is started; the reconnection mechanism includes at least one of reestablishing the connection, resynchronizing the time, and resending the unfinished data packets.

Images