Data transmission method

Abstract

The invention discloses a data transmission method. The method is applied to first equipment and comprises the following steps: acquiring a first pseudo identity identifier and a data identifier; a first data request is sent to the second device, and the first data request comprises the first pseudo-identity identifier and the data identifier and is used for indicating the second device to generate inquiry information of the first pseudo-identity identifier based on the target value and the first session key; based on the target value and the second session key, generating challenge response information of the first pseudo identity label; sending the first pseudo identity identifier and the challenge response information to the second equipment, so that the second equipment encrypts data corresponding to the data identifier by using the first private key and the token under the condition that the challenge information corresponding to the first pseudo identity identifier is consistent with the challenge response information; and decrypting the encrypted data by using the first public key and the token to obtain data corresponding to the data identifier. And even if the false identity label is leaked, the data cannot be obtained only by using the false identity label, so that the data security is improved.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and in particular, relates to a data transmission method. Background Art

[0002] During data transmission, in order to ensure data security, the data sender device is usually required to add the device identifier of the data requester device to the data visible list, and the data sender device sends data to the data requester device according to the data visible list. Among them, the data requester device and the data sender device can be cloud phones. Cloud phones are virtual phones deployed on cloud servers. Users can remotely connect to cloud phones through clients to realize various functions and services, and realize all-weather cloud-based intelligent hosting applications, so that users can host various applications to the cloud even when they are away from mobile terminals, keep applications online 24 hours a day, and realize the virtualization of smartphone applications.

[0003] The data transmission in the prior art is that when the data sending device receives the file sending request sent by the data requesting device, it determines the ID of the file in the file database and the data requesting device identifier according to the file sending request, determines the metadata of the file in the file database according to the ID, adds the data requesting device identifier to the metadata visible attribute of the file, and sends file receiving information to the data requesting device corresponding to the data requesting device identifier, so that the data requesting device can view the metadata of the file through the file receiving information. In other words, the security of the data is guaranteed by presetting the visible metadata corresponding to the ID.

[0004] However, with this data transmission method, if the pre-set ID is leaked, the security of the data is difficult to guarantee. Summary of the invention

[0005] The embodiment of the present application provides a data transmission method, in which a first device and a second device simultaneously generate a challenge response message and a challenge message of a pseudo-identity, and the second device verifies the first device through the challenge message and the challenge response message. After the verification is passed, that is, when the challenge message and the challenge response message corresponding to the first pseudo-identity are consistent, the first device can receive the encrypted data sent by the second device, and the first device decrypts the encrypted data to obtain the data corresponding to the data identifier. In other words, the first device not only needs to generate a challenge response message for identity authentication, but also needs a private key and a token to decrypt the data to obtain the data corresponding to the data identifier. Even if the pseudo-identity is leaked, the data in the second device cannot be obtained using only the pseudo-identity, which improves the security of the data.

[0006] In a first aspect, an embodiment of the present application provides a data transmission method, which is applied to a first device, including:

[0007] Obtaining a first pseudo identity identifier and a data identifier;

[0008] Sending a first data request to the second device, where the first data request includes a first pseudo-identity identifier and a data identifier, and the first data request is used to instruct the second device to generate challenge information of the first pseudo-identity identifier according to a first encryption rule based on a target value and a first session key, where the target value is a value randomly generated by the second device;

[0009] Upon receiving the target value and the first encryption rule sent by the second device, generating challenge response information of the first pseudo-identity identifier according to the first encryption rule based on the target value and the second session key;

[0010] Sending a first pseudo identity and challenge response information to the second device, where the first pseudo identity and challenge response information are used by the second device to encrypt data corresponding to the data identifier using the first private key and the token to obtain encrypted data when the challenge information and the challenge response information corresponding to the first pseudo identity are consistent;

[0011] Upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier;

[0012] The first session key, the second session key and the token are sent by the device management platform.

[0013] In a possible implementation, before obtaining the first pseudo identity identifier and the data identifier, the method further includes:

[0014] Sending a second data request to the device management platform, the second data request including a device identifier and an operation authority identifier, the second data request being used to instruct the device management platform to send a first identity authentication request to the first device when the operation authority identifier is a target identifier;

[0015] Upon receiving a first identity authentication request sent by the device management platform, obtaining first identity authentication information;

[0016] Sending first identity authentication information to the device management platform, where the first identity authentication information is used by the device management platform to generate a session key and a token for the first device and the second device when the pre-stored target identity authentication information includes the first identity authentication information, where the session key for the first device and the second device includes the second session key, and the second device is the device corresponding to the device identifier;

[0017] Receive the second session key and token sent by the device management platform.

[0018] In one possible implementation, before sending the second data request to the device management platform, the method further includes:

[0019] Sending a first registration request to the device management platform, the first registration request including an identity of the first device, the first registration request being used to instruct the device management platform to generate a first pseudo identity corresponding to the identity of the first device according to a second encryption rule, and to generate a shared key between the first device and the device management platform according to a third encryption rule;

[0020] Upon receiving the first pseudo-identity sent by the device management platform and the shared key between the first device and the device management platform, obtaining feature information and application information of the first device, and using the feature information and application information of the first device to generate a second private key according to a first preset key rule, and using the second private key and the shared key between the first device and the device management platform to generate a second public key corresponding to the second private key according to a second preset key rule;

[0021] Generate first identity verification information according to a fourth encryption rule using the application information of the first device, the second private key, and the first pseudo identity identifier;

[0022] Sending the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform, where the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device are used by the device management platform to decrypt the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo identity, and sending registration success information to the first device when the second pseudo identity is consistent with the first pseudo identity;

[0023] Receive the registration success information sent by the device management platform.

[0024] In a possible implementation, sending a first registration request to a device management platform includes:

[0025] Generate a first pseudo identity corresponding to the identity of the first device according to the second encryption rule;

[0026] Sending a first pseudo identity to the device management platform, where the first pseudo identity is used by the device management platform to detect whether the first pseudo identity is included in the pre-stored pseudo identity, and if the device management platform does not detect the first pseudo identity in the pre-stored pseudo identity, sending a registration notification to the first device;

[0027] When receiving the registration notification sent by the device management platform, a first registration request is sent to the device management platform.

[0028] In a possible embodiment, the token includes time validity information; when receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier, including:

[0029] When receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, and the token meets the time limit information, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier. In a possible implementation, the token includes time limit information and processing authority information; when receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier, and the method further includes:

[0030] When it is detected that the token does not satisfy the timeliness information, or the processing information of the data corresponding to the data identifier does not satisfy the processing authority information, the token is updated to the target state.

[0031] In a second aspect, an embodiment of the present application provides a data transmission method, which is applied to a second device, including:

[0032] Upon receiving a first data request sent by a first device, generating challenge information of a first pseudo identity identifier according to a first encryption rule based on a target value and a first session key, the first data request including the first pseudo identity identifier and a data identifier, and the target value being a value randomly generated by the second device;

[0033] Sending a target value and a first encryption rule to the first device, where the target value and the first encryption rule are used by the first device to generate challenge response information of the first pseudo identity according to the first encryption rule based on the target value and the second session key;

[0034] Upon receiving the first pseudo identity and the challenge response information sent by the first device, comparing the challenge information and the challenge response information corresponding to the first pseudo identity, and if the challenge information and the challenge response information are consistent, encrypting the data corresponding to the data identifier using the first private key and the token to obtain encrypted data;

[0035] Sending the encrypted data and the first public key corresponding to the first private key to the first device, so that the first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier;

[0036] The first session key, the second session key and the token are sent by the device management platform.

[0037] In a possible implementation, upon receiving the first data request sent by the first device, before generating the challenge information corresponding to the first pseudo identity according to the first encryption rule based on the target value and the first session key, the method further includes:

[0038] Upon receiving the first session key and the second identity authentication request sent by the device management platform, obtaining second identity authentication information;

[0039] Sending second identity authentication information to the device management platform, where the second identity authentication information is used by the device management platform to generate a token when the pre-stored target identity authentication information includes the second identity authentication information;

[0040] A token sent by the device management platform is received, where the first session key is a session key between the first device and the second device.

[0041] In one possible implementation, upon receiving the first session key and the second identity authentication request sent by the device management platform, before obtaining the second identity authentication information, the method further includes:

[0042] Sending a second registration request to the device management platform, the second registration request including the identity of the second device, the second registration request being used to instruct the device management platform to generate a third pseudo-identity corresponding to the identity of the second device according to the second encryption rule, and to generate a shared key between the second device and the device management platform according to the third encryption rule;

[0043] Upon receiving the third pseudo identity sent by the device management platform and the shared key between the second device and the device management platform, obtaining feature information and application information of the second device, and using the feature information and application information of the second device to generate a first private key according to a first preset key rule, and using the first private key and the shared key between the second device and the device management platform to generate a first public key corresponding to the first private key according to a second preset key rule;

[0044] Generate second identity verification information according to a fourth encryption rule using the application information of the second device, the first private key, and the third pseudo identity identifier;

[0045] Sending the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform, where the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device are used by the device management platform to decrypt the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo-identity, and sending registration success information to the second device when the fourth pseudo-identity is consistent with the third pseudo-identity;

[0046] Receive the registration success information sent by the device management platform.

[0047] In a third aspect, an embodiment of the present application provides a data transmission method, which is applied to a device management platform, comprising:

[0048] A first session key and a token are sent to the second device, and a second session key and a token are sent to the first device. The first session key, the second session key and the token are used by the second device to generate a challenge message of a first pseudo-identity identifier according to a first encryption rule based on a target value and the first session key when the second device receives a first data request sent by the first device. The target value and the first encryption rule are sent to the first device. The target value and the first encryption rule are used by the first device to generate a challenge response message of the first pseudo-identity identifier according to the first encryption rule based on the target value and the second session key. The first pseudo-identity identifier and the challenge response message are sent to the second device. The first pseudo-identity identifier and the challenge response message are used by the second device to encrypt data corresponding to the data identifier using a first private key and the token when the challenge information and the challenge response message corresponding to the first pseudo-identity identifier are consistent to obtain encrypted data. The encrypted data and a first public key corresponding to the first private key are sent to the first device so that the first device can decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier. The first data request includes the first pseudo-identity identifier and the data identifier. The target value is a value randomly generated by the second device.

[0049] In a fourth aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0050] a processor and a memory storing computer program instructions;

[0051] The processor implements any of the above data transmission methods when executing computer program instructions.

[0052] In a fifth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, any of the above-mentioned data transmission methods is implemented.

[0053] In a sixth aspect, an embodiment of the present application provides a computer program product, characterized in that when the instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the above-mentioned data transmission methods.

[0054] The data transmission method of the embodiment of the present application is applied to a first device, comprising: obtaining a first pseudo-identity identifier and a data identifier; sending a first data request to a second device, the first data request including the first pseudo-identity identifier and the data identifier, for instructing the second device to generate a challenge message of the first pseudo-identity identifier according to a first encryption rule based on a target value and a first session key; upon receiving the target value and the first encryption rule sent by the second device, generating a challenge response message of the first pseudo-identity identifier according to the first encryption rule based on the target value and the second session key; sending the first pseudo-identity identifier and the challenge response message to the second device, so that the second device, when the challenge information and the challenge response message corresponding to the first pseudo-identity identifier are consistent, encrypts the data corresponding to the data identifier using a first private key and a token to obtain encrypted data; upon receiving the encrypted data sent by the second device and a first public key corresponding to the first private key, decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier; wherein the first session key, the second session key and the token are sent by a device management platform.

[0055] In this way, the challenge response information and the challenge information of the pseudo-identity are generated simultaneously by the first device and the second device, and the second device verifies the first device through the challenge information and the challenge response information. After the verification is passed, that is, when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent, the first device can receive the encrypted data sent by the second device, and the first device decrypts the encrypted data to obtain the data corresponding to the data identifier. In other words, the first device not only needs to generate the challenge response information for identity authentication, but also needs the private key and token to decrypt the data to obtain the data corresponding to the data identifier. Even if the pseudo-identity is leaked, the data in the second device cannot be obtained using only the pseudo-identity, which improves the security of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0057] Figure 1 It is a flowchart of a data transmission method provided by an embodiment of the present application;

[0058] Figure 2 is a flowchart of a data transmission method provided by another embodiment of the present application;

[0059] Figure 3 is a flowchart of a data transmission method provided by another embodiment of the present application;

[0060] Figure 4 is a flowchart of a data transmission method provided in yet another embodiment of the present application;

[0061] Figure 5 is a schematic diagram of the structure of a data transmission device applied to a first device provided in yet another embodiment of the present application;

[0062] Figure 6 is a structural diagram of a data transmission device applied to a second device provided in yet another embodiment of the present application;

[0063] Figure 7 It is a structural schematic diagram of a data transmission device applied to a device management platform provided in yet another embodiment of the present application;

[0064] Figure 8 It is a structural diagram of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0065] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0066] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0067] During data transmission, in order to ensure data security, the data sender device is usually required to add the device identifier of the data requester device to the data visible list, and the data sender device sends data to the data requester device according to the data visible list. Among them, the data requester device and the data sender device can be cloud phones. Cloud phones are virtual phones deployed on cloud servers. Users can remotely connect to cloud phones through clients to realize various functions and services, and realize all-weather cloud-based intelligent hosting applications, so that users can host various applications to the cloud even when they are away from mobile terminals, keep applications online 24 hours a day, and realize the virtualization of smartphone applications.

[0068] The data transmission in the prior art is that when the data sending device receives the file sending request sent by the data requesting device, it determines the ID of the file in the file database and the data requesting device identifier according to the file sending request, determines the metadata of the file in the file database according to the ID, adds the data requesting device identifier to the metadata visible attribute of the file, and sends file receiving information to the data requesting device corresponding to the data requesting device identifier, so that the data requesting device can view the metadata of the file through the file receiving information. In other words, the security of the data is guaranteed by presetting the visible metadata corresponding to the ID.

[0069] However, with this data transmission method, if the pre-set ID is leaked, the security of the data is difficult to guarantee.

[0070] In order to solve the problems of the prior art, an embodiment of the present application provides a method for transmitting data. The first device and the second device simultaneously generate the challenge response information and the challenge information of the pseudo-identity, and the second device verifies the first device through the challenge information and the challenge response information. After the verification is passed, that is, when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent, the first device can receive the encrypted data sent by the second device, and the first device decrypts the encrypted data to obtain the data corresponding to the data identifier. In other words, the first device not only needs to generate the challenge response information for identity authentication, but also needs the private key and token to decrypt the data to obtain the data corresponding to the data identifier. Even if the pseudo-identity is leaked, the data in the second device cannot be obtained using only the pseudo-identity, which improves the security of the data.

[0071] The following first introduces the data transmission method provided in the embodiment of the present application. Figure 1 A schematic flow chart of a data transmission method provided in one embodiment of the present application is shown.

[0072] like Figure 1 As shown, the data transmission method provided in the embodiment of the present application includes the following steps S110 to S190.

[0073] S110: The first device obtains a first pseudo identity identifier and a data identifier.

[0074] Here, the first device includes a cloud phone as a data requester. The first pseudo identity is a unique identity of the first device, which is set in advance. The data identity is a data identity of the data obtained by the first device.

[0075] In some embodiments, the first pseudo identity may be an ID of the first device, or an ID v Encrypted PID v etc.

[0076] S120: The first device sends a first data request to the second device, where the first data request includes a first pseudo identity identifier and a data identifier.

[0077] Here, the second device includes a cloud phone.

[0078] In some embodiments, the first data request may further include an operation permission identifier to inform the second device of the operation content that the first device needs to perform, such as viewing operation, downloading operation or modifying operation, etc.

[0079] S130: The second device generates challenge information of the first pseudo identity based on the target value and the first session key according to the first encryption rule, where the target value is a value randomly generated by the second device.

[0080] Here, the first session key is the session key between the first device and the second device. The target value is a value randomly generated according to a preset random number generation rule, such as randomly generating a value within a preset range; the number of digits of the target value is not limited here. The first encryption rule is set in advance.

[0081] As an example, the target value may be a pseudo-random number. The preset random number generation rule includes a Monte Carlo algorithm and the like.

[0082] As an example, the second device generates the challenge information of the first pseudo-identity identifier based on the target value and the first session key using formula (1) according to the first encryption rule. Formula (1) is as follows:

[0083] R A =F1(k RG ,N1) (1)

[0084] Among them, R A is the challenge information of the first pseudo identity, F1 is the first encryption rule, for example, a function, k RG is the first session key, and N1 is the target value.

[0085] In some embodiments, the second device records the first pseudo-identity, the challenge information, the first encryption rule, and the first session key.

[0086] S140. The second device sends the target value and the first encryption rule to the first device.

[0087] S150: The first device generates challenge response information of the first pseudo identity based on the target value and the second session key according to the first encryption rule.

[0088] Here, the second session key is a session key between the first device and the second device, and the target value is a value randomly generated by the second device.

[0089] As an example, the first device generates the challenge information of the first pseudo-identity identifier based on the target value and the first session key using formula (2) according to the first encryption rule. Formula (2) is as follows:

[0090] R' A =F1(k RG ,N1) (2)

[0091] Among them, R' A is the challenge response information of the first pseudo identity, F1 is the first encryption rule, for example, a function, k RG is the second session key, and N1 is the target value.

[0092] It should be noted that the first session key and the second session key are sent by the device management platform and may be the same.

[0093] S160: The first device sends a first pseudo identity and challenge response information to the second device.

[0094] S170. The second device compares the challenge information and the challenge response information corresponding to the first pseudo identity identifier, and when the challenge information and the challenge response information are consistent, encrypts the data corresponding to the data identifier using the first private key and the token to obtain encrypted data.

[0095] Here, the first private key and the token are set in advance. The information of the second device includes the first public key corresponding to the first private key. The first public key and the first private key are a pair of key pairs that can realize data encryption and decryption. The first private key is the private key of the second device. The token in the second device is sent by the device management platform.

[0096] In some embodiments, the second device compares the challenge information and the challenge response information corresponding to the first pseudo identity identifier. If the challenge information and the challenge response information are consistent, it indicates that the first device has passed the identity authentication of the second device, that is, the first device is allowed to obtain data in the second device.

[0097] In some embodiments, when the challenge information and the challenge response information are inconsistent, it means that the first device has not passed the identity authentication of the second device, and the second device refuses the first device to obtain data.

[0098] The second device sends target information to the first device to prompt the user that the first device cannot obtain data.

[0099] It is understandable that when the first device passes the identity authentication of the second device, that is, allows the first device to obtain data, the second device will encrypt the data in order to ensure the security of its own data during transmission.

[0100] As an example, using formula (3), the data corresponding to the data identifier is encrypted using the first private key and the token to obtain encrypted data. Formula (3) is as follows:

[0101] D'=h(Token A (fk R , D)) (3)

[0102] Where D' is the encrypted data, h() is the preset encryption rule negotiated in advance between the first device and the second device, and Token A is the token, fk R is the first private key, and D is the data corresponding to the data identifier.

[0103] S180. The second device sends the encrypted data and the first public key corresponding to the first private key to the first device.

[0104] Here, the encrypted data is the encrypted data obtained by the second device encrypting the data corresponding to the data identifier by using the first private key and the token when the challenge information and the challenge response information are consistent.

[0105] S190. The first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier.

[0106] Here, the token in the first device is sent by the device management platform. The first public key is sent by the second device.

[0107] In some embodiments, after receiving the encrypted data, the first device uses the first public key and the token to decrypt the encrypted data based on a preset encryption rule negotiated in advance between the first device and the second device to obtain data corresponding to the data identifier.

[0108] In this way, the challenge response information and the challenge information of the pseudo-identity are generated simultaneously by the first device and the second device, and the second device verifies the first device through the challenge information and the challenge response information. After the verification is passed, that is, when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent, the first device can receive the encrypted data sent by the second device, and the first device decrypts the encrypted data to obtain the data corresponding to the data identifier. In other words, the first device not only needs to generate the challenge response information for identity authentication, but also needs the private key and token to decrypt the data to obtain the data corresponding to the data identifier. Even if the pseudo-identity is leaked, the data in the second device cannot be obtained using only the pseudo-identity, which improves the security of the data.

[0109] Based on this, in some embodiments, such as Figure 2 As shown, before the above S110, the method may further include the following steps S201 to S210.

[0110] S201. A first device sends a second data request to a device management platform, where the second data request includes a device identifier and an operation authority identifier.

[0111] Here, the device identifier is the identifier of the second device. The operation permission identifier represents the operation content that the first device needs to perform on the data of the second device.

[0112] Specifically, before the second device authenticates the first device, the first device needs to be authenticated by the device management platform first.

[0113] In some embodiments, the second data request may further include a data identifier, and the device management platform may determine the device identifier of the second device through the data identifier. The device management platform records the relationship information between the device identifier and the data identifier.

[0114] S202: When the operation authority identifier is a target identifier, the device management platform sends a first identity authentication request to the first device.

[0115] Here, the target identifier includes an identifier of a download operation or a modification operation.

[0116] S203: The first device obtains first identity authentication information.

[0117] In some embodiments, when the first device receives the first identity authentication request sent by the device management platform, the first identity authentication information is obtained. The first identity authentication information may be set in advance by the first device.

[0118] S204. The first device sends first identity authentication information to the device management platform.

[0119] S205. The device management platform compares the first identity authentication information with the pre-stored target identity authentication information, and generates a session key between the first device and the second device when the target identity authentication information includes the first identity authentication information. The session key between the first device and the second device includes the first session key and the second session key. The second device is the device corresponding to the device identifier.

[0120] In some embodiments, when the target identity authentication information includes the first identity authentication information, it indicates that the first device has passed the authentication of the device management platform, and the device management platform allows the first device to authenticate the second device. The device management platform sends a verification pass message to the first device to prompt the user that the first device can authenticate the second device.

[0121] In some embodiments, when the target identity authentication information does not include the first identity authentication information, it indicates that the first device has not passed the verification of the device management platform, and the device management platform refuses the first device to perform identity authentication of the second device. The device management platform sends a prompt message to the first device to prompt the user that the first device cannot perform identity authentication of the second device.

[0122] Here, the first session key and the second session key are used for the second device to authenticate the first device. The second device generates challenge information of the first pseudo-identity based on the target value and the first session key according to the first encryption rule. The first device generates challenge response information of the first pseudo-identity based on the target value and the second session key according to the first encryption rule.

[0123] S206: The device management platform sends the second session key to the first device, and sends the first session key and the second identity authentication request to the second device.

[0124] In some embodiments, in order to ensure the security of data transmission, the device management platform may further verify the second device after verifying the first device. The second device may be a virtual mobile phone storing the data to be obtained by the first device. Similar to the verification of the first device, the device management platform sends a second identity authentication request to the second device.

[0125] S207: The second device obtains second identity authentication information.

[0126] In some embodiments, when the second device receives the second identity authentication request sent by the device management platform, the second identity authentication information is obtained. The second identity authentication information may be set in advance by the second device.

[0127] S208. The second device sends second identity authentication information to the device management platform.

[0128] S209: The device management platform compares the second identity authentication information with the pre-stored target identity authentication information, and generates a token when the target identity authentication information includes the second identity authentication information.

[0129] Here, the token is used by the second device to encrypt the data corresponding to the data identifier to obtain the encrypted data; the token is used by the first device to decrypt the encrypted data to obtain the data corresponding to the data identifier.

[0130] In some embodiments, when the target identity authentication information includes the second identity authentication information, it indicates that the second device has passed the authentication of the device management platform. When the second device has also passed the authentication of the device management platform, the device management platform generates a token for the data transmission process between the first device and the second device. As an example, the token may include length, Tm expire SK VA PID v and k RG . length is the length of the token, Tm expire SK is the validity information of the token. VA is the operation authority key of the second device for data, corresponding to the operation authority identifier, k RG The session key between the first device and the second device, PID v is a pseudo-identity of the first device.

[0131] It should be noted that the validity information of the token can be the preset validity period of the token, which can be determined based on the time when the first device requests data, or a preset time threshold can be set based on actual experience, which is not specifically limited here. The operation permission key can only decrypt the operation permission of the data that matches the operation permission key.

[0132] In some embodiments, if the second device fails authentication, that is, if the target identity authentication information pre-stored in the device management platform does not include the second identity authentication information, the device management platform interrupts the communication connection with the second device.

[0133] S210: The device management platform sends a token to the first device, and sends a token to the second device.

[0134] In this way, before the first device performs identity authentication of the second device, the first device is first verified through the device management platform. After the verification is passed, the first device can receive the session key and token sent by the device management platform, so that the first device can obtain the data corresponding to the data identifier based on the session key and token, thereby further improving the security of the data in the second device; moreover, the second device also needs to be verified by the device management platform before it can obtain the token, encrypt and transmit the data, thereby further improving the security of data transmission.

[0135] Based on this, in some embodiments, such as Figure 3 As shown, before the above S201, the method may further include the following steps S101 to S108.

[0136] S101. A first device sends a first registration request to a device management platform, where the first registration request includes an identity identifier of the first device.

[0137] Here, the identity identifier is a unique identity identifier of the first device, which is set in advance. For example, the identity identifier is an ID of the first device.

[0138] Specifically, before the device management platform verifies the first device, the first device needs to be registered on the device management platform first.

[0139] In some embodiments, the first registration request may also include information such as a user name and password of the first device on the device management platform, which is used to identify the first device.

[0140] S102: The device management platform generates a first pseudo identity identifier corresponding to the identity identifier of the first device according to the second encryption rule, and generates a shared key between the first device and the device management platform according to the third encryption rule.

[0141] Here, the first pseudo identity is a pseudo identity used by the first device when performing identity authentication of the second device.

[0142] As an example, the device management platform generates a first pseudo identity corresponding to the identity of the first device using formula (4) according to the second encryption rule. Formula (4) is as follows:

[0143] PID V =h(ID v ) (4)

[0144] Among them, PID v is the first pseudo-identity, ID v is the identity of the first device, and h() is the second encryption rule, which can be set in advance, such as a function.

[0145] In another example, the device management platform generates a shared key between the first device and the device management platform using formula (5) according to the third encryption rule. Formula (5) is as follows:

[0146] k AS =F2(ID v ,T) (5)

[0147] Among them, k ASis the shared key between the first device and the device management platform, F2() is the third encryption rule, which can be set in advance, such as a function, ID v is the identity of the first device, and T is the timestamp when the device management platform receives the first registration request or the first device sends the first registration request.

[0148] In some embodiments, the device management platform generates a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and generates a shared key between the first device and the device management platform according to the third encryption rule, and then stores the first pseudo-identity and the shared key between the first device and the device management platform.

[0149] In some embodiments, before the device management platform stores the first pseudo-identity and the shared key between the first device and the device management platform, the device management platform may also issue a smart card (virtual smart card) or other forms of identity authentication information to the first device for subsequent identity authentication steps. These identity authentication information are also encrypted and stored in the device management platform and shared with the first device for use in future data requests or data processing operations. The smart card issued by the device management platform refers to a virtual smart card used in the service, which can be used for security functions such as identity authentication, data encryption, and application authorization. This smart card may be digital and implement its functions through software, rather than a physical card. It is issued to the first device so that users using the first device can use these smart cards on the first device to access the service. Here, the smart card (virtual smart card) or other forms of identity authentication information may include the first pseudo-identity and the shared key between the first device and the device management platform.

[0150] S103: The device management platform sends a first pseudo identity and a shared key between the first device and the device management platform to the first device.

[0151] S104. The first device obtains characteristic information and application information of the first device, and uses the characteristic information and application information of the first device to generate a second private key according to a first preset key rule, and uses the second private key and the shared key of the first device and the device management platform to generate a second public key corresponding to the second private key according to a second preset key rule.

[0152] Here, the characteristic information is the mobile application service characteristic information of the first device, which may include at least one of the following information: 1. Application identity information: application name, version number, developer information, application ID (application ID), etc., used to identify the basic identity characteristics of the application; 2. Application behavior data: record the application usage frequency, startup time, running time, background operation status and other behavior information. Including user interaction data, such as user clicks, slides, input and other operation behaviors. 3. Application permission information: a list of permissions requested by the application, such as access to contacts, storage, location, camera, microphone and other permissions. The authorization status and change record of each permission.

[0153] In addition, it can also include application performance indicators, application data synchronization indicators, network connection information, application update information and application push services, etc. For example, the resource usage of the application: such as the proportion of CPU (Central Processing Unit), memory, network bandwidth, storage space, etc. Performance parameters such as startup speed, response time, and interface rendering speed. The data synchronization mechanism of the application: the synchronization frequency with cloud data, the synchronization type (full synchronization, incremental synchronization), and the synchronization content (such as user data, settings, historical records, etc.). The connection status of the application with the cloud or other servers: including IP address, transmission protocol (such as HTTP / HTTPS), connection delay, data packet sending and receiving rate, etc. Application update records: such as update time, update content, patch information, new function list, etc. Security features of the application: such as the use of encrypted communication, data storage and transmission encryption method, whether two-factor authentication is supported, and other security-related information.

[0154] The application information may be an introduction to the first device, such as information of included applications.

[0155] As an example, the first device uses formula (6) to generate the second private key according to the first preset key rule by using the feature information and application information of the first device. Formula (6) is as follows:

[0156] (K MAS ,hd v )=FE.Gen(MAS) (6)

[0157] Among them, K MAS For the second private key, hd v is the application information of the first device, MAS is the characteristic information of the first device, and FE.Gen is the irreversibility generation function, that is, once the original data is processed by this function, the original data cannot be recovered or reconstructed from the output.

[0158] In another example, the first device uses formula (7) to generate a second public key corresponding to the second private key according to a second preset key rule using the second private key and a shared key between the first device and the device management platform. Formula (7) is as follows:

[0159] P K =K MAS ·G·k AS (7)

[0160] Among them, P K is the second public key, K MAS is the second private key, k AS is a shared key between the first device and the device management platform, and G is a pre-selected base point of an elliptic curve.

[0161] S105: The first device generates first identity authentication information according to a fourth encryption rule by using the application information of the first device, the second private key, and the first pseudo identity identifier.

[0162] Here, the fourth encryption rule is set in advance.

[0163] As an example, the first device uses formula (8) to generate first identity authentication information according to the fourth encryption rule using the application information of the first device, the second private key and the first pseudo identity identifier. Formula (8) is as follows:

[0164] V=h(hd v ‖K MAS ‖PID V ) (8)

[0165] Where V is the first identity authentication information, K MAS For the second private key, hd v Application information for the first device, PID v is the first pseudo-identity, h() is the fourth encryption rule, such as a hash function, and || is a data concatenation operation commonly used in the identity authentication process.

[0166] S106. The first device sends the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform.

[0167] In some embodiments, the first device may also use the second public key to encrypt the first identity authentication information to obtain encrypted identity authentication information. The first device sends the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform, including:

[0168] The first device sends encrypted identity authentication information, a second public key, a fourth encryption rule, and application information of the first device to the device management platform.

[0169] S107: The device management platform decrypts the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo identity.

[0170] In some embodiments, the device management platform performs a reverse operation according to the fourth encryption rule to obtain a second pseudo identity, and compares the obtained second pseudo identity with the previously stored first pseudo identity to determine whether the two are the same.

[0171] In some embodiments, if the first device sends encrypted identity authentication information, the device management platform decrypts the first identity authentication information based on the second public key and the application information of the first device according to the decryption rule corresponding to the fourth encryption rule to obtain the second pseudo-identity identifier. The device management platform decrypts the encrypted identity authentication information based on the second public key to obtain the first identity authentication information.

[0172] S108: When the second pseudo-identity identifier is consistent with the first pseudo-identity identifier, the device management platform sends a registration success message to the first device.

[0173] In some embodiments, when the second pseudo-identity is consistent with the first pseudo-identity, the device management platform sends a registration success message to the first device to complete the registration of the first device. When the second pseudo-identity is inconsistent with the first pseudo-identity, the device management platform sends a registration failure message to the first device to reject the registration of the first device.

[0174] It is understandable that the shared key is to ensure the communication security between the first device and the device management platform, and the second private key is to ensure the security of the data in the first device.

[0175] In this way, by registering the first device to the device management platform, communication of the first device can be achieved. During the registration process, the device management platform verifies the first device, thereby improving the security of data transmission.

[0176] Based on this, in some embodiments, the above S101 may specifically include:

[0177] The first device generates a first pseudo identity identifier corresponding to the identity identifier of the first device according to the second encryption rule;

[0178] The first device sends a first pseudo identity to the device management platform;

[0179] The device management platform detects whether the pre-stored pseudo-identities include the first pseudo-identity, and if the device management platform does not detect the first pseudo-identity in the pre-stored pseudo-identities, sends a registration notification to the first device;

[0180] When receiving the registration notification sent by the device management platform, the first device sends a first registration request to the device management platform.

[0181] In some embodiments, before the above S101, the method may also include: the first device generates a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and sends the first pseudo-identity to the device management platform, and the device management platform detects whether the pre-stored pseudo-identity includes the first pseudo-identity. If the device management platform detects that the pre-stored pseudo-identity does not include the first pseudo-identity, the device management platform sends a registration notification to the first device, instructing the first device to execute the above S101. If the device management platform detects that the pre-stored pseudo-identity includes the first pseudo-identity, the device management platform sends a registered notification to the first device, indicating that the first device can directly execute the above S201.

[0182] In some embodiments, before the above S101, the method may also include: the first device sends the identity of the first device to the device management platform, the device management platform generates a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and detects whether the pre-stored pseudo-identity includes the first pseudo-identity. If the device management platform detects that the pre-stored pseudo-identity does not include the first pseudo-identity, the device management platform sends a registration notification to the first device, instructing the first device to execute the above S101. If the device management platform detects that the pre-stored pseudo-identity includes the first pseudo-identity, the device management platform sends a registered notification to the first device, indicating that the first device can directly execute the above S201.

[0183] In this way, for the first device that has not been registered with the device management platform, the device management platform will send a registration notification to realize the registration of the first device, thereby realizing the communication between the first device and the device management platform and the second device. For the first device that has been registered, it can communicate directly, improving data transmission efficiency.

[0184] It should be noted that before the device management platform verifies the first device, the second device needs to be registered on the device management platform. The registration process of the second device is similar to the registration process of the first device, as follows.

[0185] Based on this, in some embodiments, such as Figure 4 As shown, before the above S201, the method may further include the following steps S211 to S218.

[0186] S211. The second device sends a second registration request to the device management platform, where the second registration request includes an identity identifier of the second device.

[0187] Here, the identity identifier is a unique identity identifier of the second device, which is set in advance. For example, the identity identifier is an ID of the second device.

[0188] Specifically, before the device management platform verifies the first device, the second device needs to be registered on the device management platform first.

[0189] In some embodiments, the first registration request may also include information such as a user name and password of the second device on the device management platform, which is used to identify the second device.

[0190] S212: The device management platform generates a third pseudo identity identifier corresponding to the identity identifier of the second device according to the second encryption rule, and generates a shared key between the second device and the device management platform according to the third encryption rule.

[0191] Here, the third pseudo identity is a pseudo identity used by the second device when performing identity authentication of the second device.

[0192] As an example, the device management platform generates a third pseudo identity corresponding to the identity of the second device using the above formula (4) according to the second encryption rule. v is the third pseudo-identity, ID v is the identity of the second device, and h() is the second encryption rule, which can be set in advance, such as a function.

[0193] In another example, the device management platform generates a shared key between the second device and the device management platform using formula (5) according to the third encryption rule. AS is the shared key between the second device and the device management platform, F2() is the third encryption rule, which can be set in advance, such as a function, ID v is the identity of the second device, and T is the timestamp when the device management platform receives the second registration request or the second device sends the second registration request.

[0194] In some embodiments, the device management platform generates a third pseudo-identity corresponding to the identity of the second device according to the second encryption rule, and after generating a shared key between the second device and the device management platform according to the third encryption rule, stores the third pseudo-identity and the shared key between the second device and the device management platform.

[0195] In some embodiments, before the device management platform stores the third pseudo-identity and the shared key between the second device and the device management platform, the device management platform may also issue a smart card (virtual smart card) or other forms of identity authentication information to the second device for subsequent identity authentication steps. These identity authentication information are also encrypted and stored in the device management platform and shared with the second device for use in future data requests or data processing operations. The smart card issued by the device management platform refers to a virtual smart card used in the service, which can be used for security functions such as identity authentication, data encryption, and application authorization. This smart card may be digital and implement its functions through software, rather than a physical card. It is issued to the second device so that users using the second device can use these smart cards on the second device to access the service. Here, the smart card (virtual smart card) or other forms of identity authentication information may include a third pseudo-identity and a shared key between the second device and the device management platform.

[0196] S213: The device management platform sends a third pseudo identity and a shared key between the second device and the device management platform to the second device.

[0197] S214. The second device obtains characteristic information and application information of the second device, and uses the characteristic information and application information of the second device to generate a first private key according to a first preset key rule, and uses the first private key and the shared key of the second device and the device management platform to generate a first public key corresponding to the first private key according to a second preset key rule.

[0198] Here, the characteristic information is the mobile application service characteristic information of the second device, which may include at least one of the following information: 1. Application identity information: application name, version number, developer information, application ID (App ID), etc., used to identify the basic identity characteristics of the application; 2. Application behavior data: record the application usage frequency, startup time, running time, background operation status and other behavior information. Including user interaction data, such as user clicks, slides, inputs and other operation behaviors. 3. Application permission information: a list of permissions requested by the application, such as access to contacts, storage, location, camera, microphone and other permissions. The authorization status and change records of each permission.

[0199] In addition, it can also include application performance indicators, application data synchronization indicators, network connection information, application update information and application push services, etc. For example, the resource usage of the application: such as the proportion of CPU, memory, network bandwidth, storage space, etc. Performance parameters such as startup speed, response time, and interface rendering speed. The data synchronization mechanism of the application: the synchronization frequency with cloud data, the synchronization type (full synchronization, incremental synchronization), and the synchronization content (such as user data, settings, historical records, etc.). The connection status of the application with the cloud or other servers: including IP address, transmission protocol (such as HTTP / HTTPS), connection delay, data packet sending and receiving rate, etc. Application update records: such as update time, update content, patch information, new function list, etc. Security features of the application: such as the use of encrypted communication, data storage and transmission encryption method, whether two-factor authentication is supported, and other security-related information.

[0200] The application information may be an introduction to the second device, such as information of included applications.

[0201] As an example, the second device uses formula (9) to generate the first private key according to the first preset key rule by using the feature information and application information of the second device. Formula (9) is as follows:

[0202] (fk R ,hd R )=FE.Gen(MAS R ) (9)

[0203] Among them, fk R is the first private key, hd R Application information for the second device, MAS R is the characteristic information of the second device, and FE.Gen is the irreversibility generation function, that is, once the original data is processed by this function, the original data cannot be recovered or reconstructed from the output.

[0204] In another example, the second device uses formula (10) to generate a first public key corresponding to the first private key according to the second preset key rule using the first private key and the shared key of the second device and the device management platform. Formula (10) is as follows:

[0205] P R =fk R ·G2·k RS (10)

[0206] Among them, P R is the first public key, fk R is the first private key, k RS It is a shared key between the second device and the device management platform, and G2 is a pre-selected base point of an elliptic curve.

[0207] Here, the first private key is also used by the second device to encrypt the data corresponding to the data identifier to obtain the encrypted data; the first public key is also used by the first device to decrypt the encrypted data to obtain the data corresponding to the data identifier.

[0208] S215. The second device generates second identity authentication information according to the fourth encryption rule by using the application information of the second device, the first private key and the third pseudo identity identifier.

[0209] Here, the fourth encryption rule is set in advance.

[0210] As an example, the second device uses formula (11) to generate first identity authentication information according to the fourth encryption rule using the application information of the second device, the first private key and the first pseudo identity identifier. Formula (11) is as follows:

[0211] V=h(hd R ‖fk R ‖PID V ) (11)

[0212] Where V is the second identity authentication information, fk R is the first private key, hd R Application information for the second device, PID v is the third pseudo-identity, h() is the fourth encryption rule, such as a hash function, and || is a data concatenation operation commonly used in the identity authentication process.

[0213] S216. The second device sends the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform.

[0214] In some embodiments, the second device may also use the first public key to encrypt the second identity authentication information to obtain encrypted identity authentication information. The second device sends the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform, including:

[0215] The second device sends the encrypted identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform.

[0216] S217: The device management platform decrypts the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo identity.

[0217] In some embodiments, the device management platform performs a reverse operation according to the fourth encryption rule to obtain a fourth pseudo identity, and compares the obtained fourth pseudo identity with the previously stored third pseudo identity to determine whether the two are the same.

[0218] In some embodiments, if the second device sends encrypted identity authentication information, the device management platform decrypts the second identity authentication information based on the first public key and the application information of the second device according to the decryption rule corresponding to the fourth encryption rule to obtain the fourth pseudo-identity identifier. The device management platform decrypts the encrypted identity authentication information based on the first public key to obtain the second identity authentication information.

[0219] S218: When the fourth pseudo identity identifier is consistent with the third pseudo identity identifier, the device management platform sends a registration success message to the second device.

[0220] In some embodiments, when the fourth pseudo-identity identifier and the third pseudo-identity identifier are consistent, the device management platform sends a registration success message to the second device to complete the registration of the second device. When the fourth pseudo-identity identifier and the third pseudo-identity identifier are inconsistent, the device management platform sends a registration failure message to the second device to reject the registration of the second device.

[0221] It is understandable that the shared key is to ensure the communication security between the second device and the device management platform, and the first private key is to ensure the security of the data in the second device.

[0222] In this way, by registering the second device to the device management platform, communication of the second device can be achieved. During the registration process, the device management platform verifies the second device, thereby improving the security of data transmission.

[0223] In some embodiments, before the above S211, the method may also include: the second device generates a third pseudo-identity identifier corresponding to the identity identifier of the second device according to the second encryption rule, and sends the third pseudo-identity identifier to the device management platform, and the device management platform detects whether the third pseudo-identity identifier is included in the pre-stored pseudo-identity identifiers. If the device management platform detects that the pre-stored pseudo-identity identifiers do not include the third pseudo-identity identifier, the device management platform sends a registration notification to the second device, instructing the second device to execute the above S211. If the device management platform detects that the pre-stored pseudo-identity identifiers include the third pseudo-identity identifier, the device management platform sends a registered notification to the second device, indicating that the second device does not need to be registered, and the first device can directly execute the above S201.

[0224] In some embodiments, before the above S211, the method may also include: the second device sends the identity of the second device to the device management platform, the device management platform generates a third pseudo-identity corresponding to the identity of the second device according to the second encryption rule, and detects whether the pre-stored pseudo-identity includes the third pseudo-identity. If the device management platform detects that the pre-stored pseudo-identity does not include the third pseudo-identity, the device management platform sends a registration notification to the second device, instructing the second device to execute the above S211. If the device management platform detects that the pre-stored pseudo-identity includes the third pseudo-identity, the device management platform sends a registered notification to the second device, indicating that the second device does not need to be registered, and the first device can directly execute the above S201.

[0225] In this way, for the second device that has not been registered with the device management platform, the device management platform will send a registration notification to realize the registration of the second device, thereby realizing the communication between the second device and the device management platform and the first device. For the second device that has been registered, it can communicate directly, improving data transmission efficiency.

[0226] Based on this, in some embodiments, applied to a device management platform, the method may further include:

[0227] upon receiving a third registration request sent by the target device, generating a fifth pseudo-identity corresponding to the identity of the target device according to the second encryption rule, and generating a shared key between the target device and the device management platform according to the third encryption rule, the third registration request including the identity of the target device, the target device including the first device and the second device, the third registration request including the first registration request sent by the first device and the second registration request sent by the second device, and the fifth pseudo-identity including the first pseudo-identity and the third pseudo-identity;

[0228] Sending a fifth pseudo-identity and a shared key between the target device and the device management platform to the target device so that the target device can obtain feature information and application information of the target device, and using the feature information and application information of the target device to generate a target private key according to a first preset key rule, using the target private key and the shared key between the target device and the device management platform to generate a target public key corresponding to the target private key according to a second preset key rule, using the application information of the target device, the target private key and the fifth pseudo-identity to generate target identity authentication information according to a fourth encryption rule, the target private key including a first private key and a second private key, the target public key including a first public key and a second public key, and the target identity authentication information including first identity authentication information and second identity authentication information;

[0229] Upon receiving the target identity authentication information, the target public key, the fourth encryption rule, and the application information of the target device sent by the target device, decrypting the target identity authentication information according to the decryption rule corresponding to the fourth encryption rule based on the target public key and the application information of the target device to obtain a sixth pseudo identity, where the sixth pseudo identity includes the second pseudo identity and the fourth pseudo identity;

[0230] When the sixth pseudo identity identifier is consistent with the fifth pseudo identity identifier, a registration success message is sent to the target device.

[0231] It is understandable that the target device can be registered on the device management platform to perform communication and data transmission between devices. The target device includes at least one device. Here, the target device includes a first device and a second device.

[0232] In this way, by registering the target device to the device management platform, communication of the target device can be achieved. During the registration process, the device management platform verifies the target device, thereby improving the security of data transmission.

[0233] Based on this, in some embodiments, the token includes time validity information; when receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier includes:

[0234] When the encrypted data sent by the second device and the first public key corresponding to the first private key are received, and the token meets the time limit information, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier.

[0235] Here, the token Token A ={PID V ,length,SK VA ,Tm expire ,K RG}. Where length is the length of the token, Tm expire SK is the validity information of the token. VA is the operation authority key of the second device for data, corresponding to the operation authority identifier, k RG The session key between the first device and the second device, PID v is a pseudo-identity of the first device.

[0236] It should be noted that the validity information of the token can be the preset validity period of the token, which can be determined based on the time when the first device requests data, or a preset time threshold can be set based on actual experience, which is not specifically limited here. The operation permission key can only decrypt the operation permission of the data that matches the operation permission key.

[0237] In this way, the security of data is further guaranteed by the timeliness information of the token. Based on this, in some embodiments, the token includes timeliness information and processing authority information; after the above S190, the method may further include:

[0238] When it is detected that the token does not satisfy the timeliness information, or the processing information of the data corresponding to the data identifier does not satisfy the processing authority information, the token is updated to the target state.

[0239] Here, the validity information includes the preset validity period of the token, which is set in advance. The target state indicates that the token is invalid and cannot be used.

[0240] In some embodiments, the first device operates on or views the data based on the token sent by the device management platform. If the token reaches the preset validity period, the token becomes invalid, and the first device will no longer be able to operate on or view the data. At the same time, if the device management platform's operation scope on the data exceeds the operation authority corresponding to the processing authority information in the token, the operation authority key will become invalid immediately. At this time, even if the token has not reached the preset validity period, the first device will no longer be able to operate on or view the data.

[0241] In this way, setting time validity information and processing authority information for the use of the token further improves data security.

[0242] In the embodiment provided in the present application, the device management platform receives a data request from a data requester (i.e., a first device), and the data request may include a data identifier of the data to be obtained, a device identifier of the data sender (i.e., a second device), and an operation permission identifier for the data to be obtained. Different operation permission identifiers correspond to different operation permissions. The data requester can be a cloud phone or a real machine. This method can be used for data transmission between cloud phones, and can also be used for data transmission between cloud phones and real machines.

[0243] Specifically, the data requester can be recorded as the first device, and the data sender can be recorded as the second device. The operating permissions for the data to be acquired include permissions such as reading, writing, modifying, querying and downloading. In actual applications, different operating permission identifiers can be determined for different operating permissions. When the first device sends a data request to the second device, the operating permission identifier can be carried in the data request. After the device management platform receives the data request from the data requester, it determines the operating permission that the data requester expects to obtain based on the operating permission identifier in the data request; if the data requester expects to modify the acquired data or download the data, the data requester is verified. In addition to authenticating the data requester requesting the data, the data sender storing the data to be accessed can also be verified. In this way, the security of both the data requester and the data sender can be guaranteed at the same time.

[0244] In the embodiment provided in the present application, the specific implementation process of the device management platform verifying the data requester includes a registration phase and an identity verification phase.

[0245] When the data requester's identity verification is passed, the device management platform sends a token to the data requester. After receiving the token, the data requester can access the data from the target cloud phone based on the token. If the token reaches the preset validity period, the token will become invalid and the data requester will no longer be able to operate or view the data.

[0246] At the same time, if the data requester's operation scope on the data exceeds the preset operation authority, the operation authority key will become invalid immediately. At this time, even if the token has not reached the preset validity period, the data requester will no longer be able to operate or view the data. In this way, on the one hand, it can meet the needs of the data requester to operate the requested data; on the other hand, it can well limit the operation scope and operation authority of the data requester, thereby improving data security.

[0247] Based on the data transmission method provided in the above embodiment, the present application also provides a specific implementation of a data transmission device. Please refer to the following embodiment.

[0248] See also Figure 5 The data transmission device 300 provided in the embodiment of the present application is applied to a first device, including:

[0249] An acquisition module 310, configured to acquire a first pseudo identity identifier and a data identifier;

[0250] A sending module 320 is used to send a first data request to a second device, where the first data request includes a first pseudo identity and a data identity, and the first data request is used to instruct the second device to generate challenge information of the first pseudo identity according to a first encryption rule based on a target value and a first session key, and the target value is a value randomly generated by the second device;

[0251] A generating module 330 is configured to generate, upon receiving the target value and the first encryption rule sent by the second device, the challenge response information of the first pseudo-identity identifier based on the target value and the second session key and in accordance with the first encryption rule;

[0252] The sending module 320 is further used to send the first pseudo identity and the challenge response information to the second device, where the first pseudo identity and the challenge response information are used by the second device to encrypt the data corresponding to the data identifier using the first private key and the token to obtain encrypted data when the challenge information and the challenge response information corresponding to the first pseudo identity are consistent;

[0253] The decryption module 340 is used to decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier when receiving the encrypted data sent by the second device and the first public key corresponding to the first private key;

[0254] The first session key, the second session key and the token are sent by the device management platform.

[0255] Based on this, in some embodiments, the apparatus 300 may further include:

[0256] The sending module 320 is further used to send a second data request to the device management platform before obtaining the first pseudo identity identifier and the data identifier, the second data request including the device identifier and the operation authority identifier, and the second data request is used to instruct the device management platform to send a first identity authentication request to the first device when the operation authority identifier is the target identifier;

[0257] The acquisition module 310 is further configured to acquire first identity authentication information upon receiving a first identity authentication request sent by the device management platform;

[0258] The sending module 320 is further used to send the first identity authentication information to the device management platform, where the first identity authentication information is used by the device management platform to generate a session key and a token for the first device and the second device when the pre-stored target identity authentication information includes the first identity authentication information, where the session key between the first device and the second device includes the second session key, and the second device is the device corresponding to the device identifier;

[0259] The receiving module is used to receive the second session key and token sent by the device management platform.

[0260] Based on this, in some embodiments, the apparatus 300 may further include:

[0261] The sending module 320 is further used to send a first registration request to the device management platform before sending the second data request to the device management platform, the first registration request including the identity of the first device, and the first registration request is used to instruct the device management platform to generate a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and generate a shared key between the first device and the device management platform according to the third encryption rule;

[0262] a determination module, configured to, upon receiving a first pseudo-identity sent by the device management platform and a shared key between the first device and the device management platform, obtain feature information and application information of the first device, generate a second private key according to a first preset key rule using the feature information and application information of the first device, and generate a second public key corresponding to the second private key according to a second preset key rule using the second private key and the shared key between the first device and the device management platform;

[0263] The generating module 330 is further used to generate first identity authentication information according to a fourth encryption rule by using the application information of the first device, the second private key and the first pseudo identity identifier;

[0264] The sending module 320 is further used to send the first identity authentication information, the second public key, the fourth encryption rule and the application information of the first device to the device management platform. The first identity authentication information, the second public key, the fourth encryption rule and the application information of the first device are used by the device management platform to decrypt the first identity authentication information based on the second public key and the application information of the first device according to the decryption rule corresponding to the fourth encryption rule to obtain the second pseudo identity identifier. When the second pseudo identity identifier is consistent with the first pseudo identity identifier, a registration success message is sent to the first device;

[0265] The receiving module is also used to receive the registration success information sent by the device management platform.

[0266] Based on this, in some embodiments, the sending module 320 may specifically include:

[0267] A generating unit, configured to generate a first pseudo identity identifier corresponding to the identity identifier of the first device according to a second encryption rule;

[0268] a sending unit, configured to send a first pseudo identity to the device management platform, wherein the first pseudo identity is used by the device management platform to detect whether the first pseudo identity is included in the pre-stored pseudo identity, and if the device management platform does not detect the first pseudo identity in the pre-stored pseudo identity, then sending a registration notification to the first device;

[0269] When receiving the registration notification sent by the device management platform, a first registration request is sent to the device management platform.

[0270] Based on this, in some embodiments, the token includes time information; the decryption module 340 may specifically include:

[0271] The decryption unit is used to decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier when the encrypted data and the first public key corresponding to the first private key sent by the second device are received and the token meets the time limit information.

[0272] Based on this, in some embodiments, the token includes time validity information and processing authority information; the apparatus 300 may also include:

[0273] The update module is used to decrypt the encrypted data using the first public key and the token upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, and after obtaining the data corresponding to the data identifier, update the token to the target state upon detecting that the token does not meet the time limit information, or the processing information of the data corresponding to the data identifier does not meet the processing authority information.

[0274] See also Figure 6 The data transmission device 400 provided in the embodiment of the present application is applied to a second device, including:

[0275] A generating module 410 is configured to generate, upon receiving a first data request sent by a first device, challenge information of a first pseudo identity identifier based on a target value and a first session key according to a first encryption rule, wherein the first data request includes the first pseudo identity identifier and a data identifier, and the target value is a value randomly generated by the second device;

[0276] A sending module 420, configured to send a target value and a first encryption rule to the first device, where the target value and the first encryption rule are used by the first device to generate challenge response information of a first pseudo identity based on the target value and the second session key according to the first encryption rule;

[0277] The encryption module 430 is used to, upon receiving the first pseudo identity and the challenge response information sent by the first device, compare the challenge information and the challenge response information corresponding to the first pseudo identity, and when the challenge information and the challenge response information are consistent, encrypt the data corresponding to the data identifier using the first private key and the token to obtain encrypted data;

[0278] The sending module 420 is further used to send the encrypted data and the first public key corresponding to the first private key to the first device, so that the first device uses the first public key and the token to decrypt the encrypted data to obtain data corresponding to the data identifier;

[0279] The first session key, the second session key and the token are sent by the device management platform.

[0280] Based on this, in some embodiments, the apparatus 400 may further include:

[0281] an acquisition module, configured to acquire second identity authentication information upon receiving a first session key and a second identity authentication request sent by a device management platform, before generating challenge information corresponding to a first pseudo-identity identifier according to a first encryption rule based on a target value and a first session key upon receiving a first data request sent by a first device;

[0282] The sending module 420 is further used to send second identity authentication information to the device management platform, where the second identity authentication information is used by the device management platform to generate a token when the pre-stored target identity authentication information includes the second identity authentication information;

[0283] The receiving module is used to receive a token sent by the device management platform, and the first session key is a session key between the first device and the second device.

[0284] Based on this, in some embodiments, the apparatus 400 may further include:

[0285] The sending module 420 is further used to send a second registration request to the device management platform before obtaining the second identity authentication information when receiving the first session key and the second identity authentication request sent by the device management platform, the second registration request including the identity of the second device, and the second registration request is used to instruct the device management platform to generate a third pseudo identity corresponding to the identity of the second device according to the second encryption rule, and generate a shared key between the second device and the device management platform according to the third encryption rule;

[0286] a determination module, configured to, upon receiving a third pseudo identity sent by the device management platform and a shared key between the second device and the device management platform, obtain feature information and application information of the second device, generate a first private key according to a first preset key rule using the feature information and application information of the second device, and generate a first public key corresponding to the first private key according to a second preset key rule using the first private key and the shared key between the second device and the device management platform;

[0287] The generating module 410 is further used to generate second identity authentication information according to a fourth encryption rule by using the application information of the second device, the first private key and the third pseudo identity identifier;

[0288] The sending module 420 is further used to send the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform. The second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device are used by the device management platform to decrypt the second identity authentication information based on the first public key and the application information of the second device according to the decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo identity. When the fourth pseudo identity is consistent with the third pseudo identity, a registration success message is sent to the second device.

[0289] The receiving module is also used to receive the registration success information sent by the device management platform.

[0290] See also Figure 7 The data transmission device 500 provided in the embodiment of the present application is applied to a device management platform, including

[0291] The sending module 510 is used to send a first session key and a token to the second device, and send a second session key and a token to the first device. The first session key, the second session key and the token are used by the second device to generate a challenge message of a first pseudo-identity identifier according to a first encryption rule based on a target value and a first session key when receiving a first data request sent by the first device, send the target value and the first encryption rule to the first device, the target value and the first encryption rule are used by the first device to generate a challenge response message of the first pseudo-identity identifier according to the first encryption rule based on the target value and the second session key, and send the first pseudo-identity identifier and the challenge response message to the second device. The first pseudo-identity identifier and the challenge response message are used by the second device to encrypt data corresponding to the data identifier using a first private key and the token when the challenge information and the challenge response message corresponding to the first pseudo-identity identifier are consistent to obtain encrypted data. The encrypted data and the first public key corresponding to the first private key sent to the first device are used by the first device to decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier. The first data request includes the first pseudo-identity identifier and the data identifier. The target value is a value randomly generated by the second device.

[0292] The various modules of the data transmission device provided in the embodiment of the present application can implement the functions of the various steps of the data transmission method provided above and achieve the corresponding technical effects, which will not be repeated here for the sake of concise description.

[0293] Based on the same inventive concept, an embodiment of the present application also provides an electronic device.

[0294] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0295] The electronic device may include a processor 601 and a memory 602 storing computer program instructions.

[0296] Specifically, the processor 601 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0297] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 602 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory.

[0298] The memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present disclosure.

[0299] The processor 601 implements any one of the data transmission methods in the above embodiments by reading and executing the computer program instructions stored in the memory 602 .

[0300] In one example, the electronic device may further include a communication interface 603 and a bus 610. Figure 8 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 610 and communicate with each other.

[0301] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0302] The bus 610 includes hardware, software or both, coupling the components of the electronic device to each other. For example, but not limitation, the bus may include an accelerated graphics port (Accelerated Graphics Port, AGP) or other graphics bus, an enhanced industry standard architecture (Extended Industry Standard Architecture, EISA) bus, a front side bus (Front Side Bus, FSB), a hypertransport (Hyper Transport, HT) interconnection, an industry standard architecture (Industry Standard Architecture, ISA) bus, an infinite bandwidth interconnection, a low pin count (Linear Predictive Coding, LPC) bus, a memory bus, a micro channel architecture (MicroChannel Architecture, MCA) bus, a peripheral component interconnect (Peripheral Component Interconnect, PCI) bus, a PCI-Express (Peripheral Component Interconnect-X, PCI-X) bus, a serial advanced technology attachment (Serial Advanced Technology Attachment, SATA) bus, a video electronics standard association local (VESA Local Bus, VLB) bus or other suitable buses or a combination of two or more of these. Where appropriate, the bus 610 may include one or more buses. Although the embodiments of the present application describe and illustrate a specific bus, the present application considers any suitable bus or interconnection. The electronic device can execute the data transmission method in the embodiments of the present invention, thereby realizing the above-mentioned data transmission method.

[0303] In addition, in combination with the data transmission method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the data transmission methods in the above embodiment is implemented.

[0304] The present application also provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes each process of implementing any one of the above-mentioned data transmission method embodiments.

[0305] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0306] The functional blocks shown in the structural block diagram described above can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), appropriate firmware, plug-in, function card, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or communication link by a data signal carried in a carrier. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (Read-Only Memory, ROM), flash memory, erasable read-only memory (Erasable ReadOnly Memory, EROM), floppy disks, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical discs, hard disks, optical fiber media, radio frequency (Radio Frequency, RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0307] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0308] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0309] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A data transmission method, characterized in that: Applied to a first device, comprising: Obtaining a first pseudo identity identifier and a data identifier; Sending a first data request to a second device, where the first data request includes the first pseudo-identity and the data identifier, and the first data request is used to instruct the second device to generate challenge information of the first pseudo-identity based on a target value and a first session key according to a first encryption rule, where the target value is a value randomly generated by the second device; Upon receiving the target value and the first encryption rule sent by the second device, generating challenge response information of the first pseudo-identity identifier according to the first encryption rule based on the target value and the second session key; Sending the first pseudo identity and the challenge response information to the second device, where the first pseudo identity and the challenge response information are used by the second device to encrypt the data corresponding to the data identifier using the first private key and the token to obtain encrypted data when the challenge information and the challenge response information corresponding to the first pseudo identity are consistent; Upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier; The first session key, the second session key and the token are sent by a device management platform.

2. The data transmission method according to claim 1, characterized in that: Before obtaining the first pseudo identity identifier and the data identifier, the method further includes: Sending a second data request to the device management platform, the second data request including a device identifier and an operation authority identifier, the second data request being used to instruct the device management platform to send a first identity authentication request to the first device when the operation authority identifier is a target identifier; Upon receiving a first identity authentication request sent by the device management platform, obtaining first identity authentication information; Sending the first identity authentication information to the device management platform, the first identity authentication information is used by the device management platform to generate a session key and a token for the first device and the second device when the pre-stored target identity authentication information includes the first identity authentication information, the session key between the first device and the second device includes a second session key, and the second device is a device corresponding to the device identifier; Receive the second session key and the token sent by the device management platform.

3. The data transmission method according to claim 2, characterized in that: Before sending the second data request to the device management platform, the method further includes: Sending a first registration request to a device management platform, where the first registration request includes an identity of the first device, and the first registration request is used to instruct the device management platform to generate a first pseudo identity corresponding to the identity of the first device according to a second encryption rule, and to generate a shared key between the first device and the device management platform according to a third encryption rule; Upon receiving the first pseudo-identity sent by the device management platform and the shared key between the first device and the device management platform, obtaining feature information and application information of the first device, and using the feature information and application information of the first device to generate a second private key according to a first preset key rule, and using the second private key and the shared key between the first device and the device management platform to generate a second public key corresponding to the second private key according to a second preset key rule; Generate first identity authentication information according to a fourth encryption rule using the application information of the first device, the second private key, and the first pseudo-identity identifier; Sending the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform, where the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device are used by the device management platform to decrypt the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo identity, and sending registration success information to the first device when the second pseudo identity is consistent with the first pseudo identity; Receive the registration success information sent by the device management platform.

4. The data transmission method according to claim 3, characterized in that: The sending a first registration request to the device management platform includes: Generate a first pseudo identity corresponding to the identity of the first device according to a second encryption rule; Sending the first pseudo identity to a device management platform, where the first pseudo identity is used by the device management platform to detect whether the first pseudo identity is included in pre-stored pseudo identities, and if the device management platform does not detect the first pseudo identity in the pre-stored pseudo identities, sending a registration notification to the first device; When the registration notification sent by the device management platform is received, a first registration request is sent to the device management platform.

5. The data transmission method according to claim 2, characterized in that: The token includes time validity information; when receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier includes: When the encrypted data sent by the second device and the first public key corresponding to the first private key are received, and the token meets the time limit information, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier.

6. The data transmission method according to claim 2, characterized in that: The token includes time validity information and processing authority information; upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier, the method further includes: When it is detected that the token does not satisfy the timeliness information, or the processing information of the data corresponding to the data identifier does not satisfy the processing authority information, the token is updated to a target state.

7. A data transmission method, characterized in that: Applied to the second device, comprising: upon receiving a first data request sent by a first device, generating challenge information of a first pseudo identity according to a first encryption rule based on a target value and a first session key, wherein the first data request includes the first pseudo identity and a data identifier, and the target value is a value randomly generated by the second device; Sending the target value and the first encryption rule to the first device, where the target value and the first encryption rule are used by the first device to generate challenge response information of the first pseudo-identity identifier based on the target value and the second session key and according to the first encryption rule; Upon receiving the first pseudo identity and the challenge response information sent by the first device, comparing the challenge information and the challenge response information corresponding to the first pseudo identity, and if the challenge information and the challenge response information are consistent, encrypting the data corresponding to the data identifier using the first private key and the token to obtain encrypted data; Sending the encrypted data and a first public key corresponding to the first private key to the first device, so that the first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier; The first session key, the second session key and the token are sent by a device management platform.

8. The data transmission method according to claim 7, characterized in that: In the case of receiving the first data request sent by the first device, before generating the challenge information corresponding to the first pseudo identity according to the first encryption rule based on the target value and the first session key, the method further includes: Upon receiving the first session key and the second identity authentication request sent by the device management platform, obtaining second identity authentication information; Sending the second identity authentication information to the device management platform, where the second identity authentication information is used by the device management platform to generate the token when the pre-stored target identity authentication information includes the second identity authentication information; The token sent by the device management platform is received, where the first session key is a session key between the first device and the second device.

9. The data transmission method according to claim 8, characterized in that: In the case of receiving the first session key and the second identity authentication request sent by the device management platform, before obtaining the second identity authentication information, the method further includes: Sending a second registration request to the device management platform, the second registration request including the identity of the second device, the second registration request being used to instruct the device management platform to generate a third pseudo-identity corresponding to the identity of the second device according to a second encryption rule, and to generate a shared key between the second device and the device management platform according to the third encryption rule; Upon receiving the third pseudo identity sent by the device management platform and the shared key between the second device and the device management platform, obtaining feature information and application information of the second device, and using the feature information and application information of the second device to generate a first private key according to a first preset key rule, and using the first private key and the shared key between the second device and the device management platform to generate a first public key corresponding to the first private key according to a second preset key rule; Generate second identity authentication information according to a fourth encryption rule using the application information of the second device, the first private key, and the third pseudo identity identifier; Sending the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform, where the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device are used by the device management platform to decrypt the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo-identity identifier, and sending registration success information to the second device when the fourth pseudo-identity identifier is consistent with the third pseudo-identity identifier; Receive the registration success information sent by the device management platform.

10. A data transmission method, characterized in that: Applied to device management platforms, including A first session key and a token are sent to a second device, and a second session key and the token are sent to the first device, wherein the first session key, the second session key and the token are used by the second device to generate challenge information of a first pseudo identity according to a first encryption rule based on a target value and the first session key when receiving a first data request sent by the first device, the target value and the first encryption rule are sent to the first device, the target value and the first encryption rule are used by the first device to generate challenge response information of the first pseudo identity according to the first encryption rule based on the target value and the second session key, the first pseudo identity and the challenge response information are sent to the second device, the first pseudo identity and the challenge response information are used by the second device to encrypt data corresponding to a data identifier using a first private key and the token when the challenge information and the challenge response information corresponding to the first pseudo identity are consistent to obtain encrypted data, the encrypted data and the first public key corresponding to the first private key are sent to the first device, so that the first device can decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier, the first data request includes the first pseudo identity and the data identifier, and the target value is a value randomly generated by the second device.

Images