Data transmission method

Abstract

The present application discloses a method for transmitting data. The method is applied to a first device and includes: obtaining a first pseudo-identity identifier and a data identifier; sending a first data request to a second device, the first data request including the first pseudo-identity identifier and the data identifier, for instructing the second device to generate a challenge message of the first pseudo-identity identifier based on a target value and a first session key; generating a challenge response message of the first pseudo-identity identifier based on the target value and the second session key; sending the first pseudo-identity identifier and the challenge response message to the second device, so that the second device, when the challenge message and the challenge response message corresponding to the first pseudo-identity identifier are consistent, uses a first private key and a token to encrypt the data corresponding to the data identifier; and decrypts the encrypted data using a first public key and a token to obtain the data corresponding to the data identifier. Even if the pseudo-identity identifier is leaked, the data cannot be obtained using only the pseudo-identity identifier, thereby improving the security of the data.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and in particular relates to a data transmission method. Background Art

[0002] During data transmission, to ensure data security, the data sending device is typically required to add the device identifier of the data requesting device to a data visibility list. The data sending device then sends data to the data requesting device based on the data visibility list. Both the data requesting device and the data sending device can be cloud phones. Cloud phones are virtual phones deployed on cloud servers. Users connect to the cloud phone remotely through a client to access various functions and services, enabling 24 / 7 cloud-based intelligent hosting of applications. This allows users to host various applications in the cloud even when away from their mobile devices, keeping applications online 24 / 7, and virtualizing smartphone applications.

[0003] In conventional data transmission, upon receiving a file send request from a data requester, a data sender determines the file ID and the data requester device identifier in the file database based on the file send request. Based on the ID, the sender determines the file's metadata in the file database, adds the data requester device identifier to the visible metadata attributes of the file, and then sends file receipt information to the data requester device corresponding to the data requester device identifier, allowing the requester device to view the file's metadata through the file receipt information. In other words, data security is ensured by pre-setting visible metadata corresponding to the ID.

[0004] However, with this data transmission method, if the pre-set ID is leaked, the security of the data is difficult to guarantee. Summary of the Invention

[0005] The embodiment of the present application provides a data transmission method, in which a first device and a second device simultaneously generate a challenge response message and a challenge message of a pseudo-identity identifier, and the second device verifies the first device through the challenge message and the challenge response message. After the verification is passed, that is, when the challenge message and the challenge response message corresponding to the first pseudo-identity identifier are consistent, the first device can receive the encrypted data sent by the second device, and after the first device decrypts the encrypted data, it obtains the data corresponding to the data identifier. In other words, the first device not only needs to generate a challenge response message for identity authentication, but also needs a private key and a token to decrypt the data in order to obtain the data corresponding to the data identifier. Even if the pseudo-identity identifier is leaked, the data in the second device cannot be obtained using only the pseudo-identity identifier, thereby improving the security of the data.

[0006] In a first aspect, an embodiment of the present application provides a data transmission method, applied to a first device, comprising:

[0007] Obtaining a first pseudo identity identifier and a data identifier;

[0008] Sending a first data request to the second device, where the first data request includes a first pseudo-identity and a data identifier, and the first data request is used to instruct the second device to generate challenge information for the first pseudo-identity based on a target value and a first session key and in accordance with a first encryption rule, where the target value is a value randomly generated by the second device;

[0009] Upon receiving the target value and the first encryption rule sent by the second device, generating challenge response information of the first pseudo-identity based on the target value and the second session key and in accordance with the first encryption rule;

[0010] Sending the first pseudo-identity and challenge response information to the second device, where the first pseudo-identity and challenge response information are used by the second device to encrypt data corresponding to the data identifier using the first private key and the token to obtain encrypted data when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent;

[0011] Upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier;

[0012] The first session key, the second session key and the token are sent by the device management platform.

[0013] In one possible embodiment, before obtaining the first pseudo identity identifier and the data identifier, the method further includes:

[0014] Sending a second data request to the device management platform, where the second data request includes a device identifier and an operation authority identifier, and the second data request is used to instruct the device management platform to send a first identity authentication request to the first device when the operation authority identifier is the target identifier;

[0015] Upon receiving the first identity authentication request sent by the device management platform, obtaining first identity authentication information;

[0016] Sending first identity authentication information to the device management platform, where the first identity authentication information is used by the device management platform to generate a session key and a token for the first device and the second device when the pre-stored target identity authentication information includes the first identity authentication information, where the session key between the first device and the second device includes the second session key, and the second device is the device corresponding to the device identifier;

[0017] Receive the second session key and token sent by the device management platform.

[0018] In one possible embodiment, before sending the second data request to the device management platform, the method further includes:

[0019] Sending a first registration request to the device management platform, where the first registration request includes an identity of the first device, and the first registration request is used to instruct the device management platform to generate a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and to generate a shared key between the first device and the device management platform according to the third encryption rule;

[0020] Upon receiving the first pseudo-identity and the shared key between the first device and the device management platform sent by the device management platform, obtaining feature information and application information of the first device, generating a second private key according to a first preset key rule using the feature information and application information of the first device, and generating a second public key corresponding to the second private key according to a second preset key rule using the second private key and the shared key between the first device and the device management platform;

[0021] Generate first identity verification information according to a fourth encryption rule using the application information of the first device, the second private key, and the first pseudo-identity identifier;

[0022] Sending the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform. The first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device are used by the device management platform to decrypt the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo-identity. If the second pseudo-identity is consistent with the first pseudo-identity, sending a registration success message to the first device;

[0023] Receive the registration success information sent by the device management platform.

[0024] In one possible embodiment, sending a first registration request to a device management platform includes:

[0025] generating a first pseudo identity corresponding to the identity of the first device according to the second encryption rule;

[0026] Sending a first pseudo-identity to the device management platform, where the first pseudo-identity is used by the device management platform to detect whether the first pseudo-identity is included in pre-stored pseudo-identities, and if the device management platform does not detect the first pseudo-identity in the pre-stored pseudo-identities, sending a registration notification to the first device;

[0027] Upon receiving the registration notification sent by the device management platform, a first registration request is sent to the device management platform.

[0028] In one possible embodiment, the token includes expiration information; upon receiving encrypted data sent by the second device and a first public key corresponding to the first private key, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier, including:

[0029] Upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, and if the token satisfies the expiration information, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier. In one possible embodiment, the token includes expiration information and processing authority information; upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier, the method further includes:

[0030] When it is detected that the token does not meet the timeliness information, or the processing information of the data corresponding to the data identifier does not meet the processing authority information, the token is updated to the target state.

[0031] In a second aspect, an embodiment of the present application provides a data transmission method, applied to a second device, including:

[0032] Upon receiving a first data request sent by the first device, generating a challenge message of the first pseudo-identity identifier according to the first encryption rule based on the target value and the first session key, the first data request including the first pseudo-identity identifier and the data identifier, and the target value being a value randomly generated by the second device;

[0033] Sending a target value and a first encryption rule to the first device, where the target value and the first encryption rule are used by the first device to generate challenge response information of the first pseudo-identity based on the target value and the second session key and according to the first encryption rule;

[0034] Upon receiving the first pseudo-identity and the challenge response information sent by the first device, comparing the challenge information and the challenge response information corresponding to the first pseudo-identity, and if the challenge information and the challenge response information are consistent, encrypting the data corresponding to the data identifier using the first private key and the token to obtain encrypted data;

[0035] Sending the encrypted data and the first public key corresponding to the first private key to the first device, so that the first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier;

[0036] The first session key, the second session key and the token are sent by the device management platform.

[0037] In one possible embodiment, upon receiving the first data request sent by the first device, before generating challenge information corresponding to the first pseudo-identity based on the target value and the first session key according to the first encryption rule, the method further includes:

[0038] Upon receiving the first session key and the second identity authentication request sent by the device management platform, obtaining second identity authentication information;

[0039] Sending second identity authentication information to the device management platform, where the second identity authentication information is used by the device management platform to generate a token when the pre-stored target identity authentication information includes the second identity authentication information;

[0040] A token sent by the device management platform is received, where the first session key is a session key between the first device and the second device.

[0041] In one possible embodiment, upon receiving the first session key and the second identity authentication request sent by the device management platform, before obtaining the second identity authentication information, the method further includes:

[0042] Sending a second registration request to the device management platform, the second registration request including the identity of the second device, the second registration request being used to instruct the device management platform to generate a third pseudo-identity corresponding to the identity of the second device according to the second encryption rule, and to generate a shared key between the second device and the device management platform according to the third encryption rule;

[0043] Upon receiving the third pseudo-identity sent by the device management platform and the shared key between the second device and the device management platform, obtaining feature information and application information of the second device, generating a first private key according to a first preset key rule using the feature information and application information of the second device, and generating a first public key corresponding to the first private key according to a second preset key rule using the first private key and the shared key between the second device and the device management platform;

[0044] Generate second identity verification information according to a fourth encryption rule using the application information of the second device, the first private key, and the third pseudo identity identifier;

[0045] Sending the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform, where the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device are used by the device management platform to decrypt the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo-identity identifier, and sending a registration success message to the second device if the fourth pseudo-identity identifier is consistent with the third pseudo-identity identifier;

[0046] Receive the registration success information sent by the device management platform.

[0047] In a third aspect, the present invention provides a data transmission method, which is applied to a device management platform, including:

[0048] A first session key and a token are sent to the second device, and a second session key and a token are sent to the first device. The first session key, the second session key, and the token are used by the second device, upon receiving a first data request sent by the first device, to generate challenge information of a first pseudo-identity identifier based on a target value and the first session key in accordance with a first encryption rule. The target value and the first encryption rule are sent to the first device. The target value and the first encryption rule are used by the first device, based on the target value and the second session key, to generate challenge response information of the first pseudo-identity identifier based on the target value and the second session key in accordance with the first encryption rule. The first pseudo-identity identifier and the challenge response information are sent to the second device. The first pseudo-identity identifier and the challenge response information are used by the second device, when the challenge information and the challenge response information corresponding to the first pseudo-identity identifier are consistent, to encrypt data corresponding to the data identifier using the first private key and the token to obtain encrypted data. The encrypted data and the first public key corresponding to the first private key are sent to the first device, so that the first device can decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier. The first data request includes the first pseudo-identity identifier and the data identifier. The target value is a value randomly generated by the second device.

[0049] In a fourth aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0050] a processor and a memory storing computer program instructions;

[0051] When the processor executes the computer program instructions, any of the above data transmission methods is implemented.

[0052] In a fifth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, any of the above-mentioned data transmission methods is implemented.

[0053] In a sixth aspect, an embodiment of the present application provides a computer program product, characterized in that when the instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the above-mentioned data transmission methods.

[0054] A data transmission method according to an embodiment of the present application is applied to a first device, comprising: obtaining a first pseudo-identity and a data identifier; sending a first data request to a second device, the first data request including the first pseudo-identity and the data identifier, for instructing the second device to generate challenge information of the first pseudo-identity based on a target value and a first session key in accordance with a first encryption rule; upon receiving the target value and the first encryption rule sent by the second device, generating challenge response information of the first pseudo-identity based on the target value and the second session key in accordance with the first encryption rule; sending the first pseudo-identity and the challenge response information to the second device, so that the second device, when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent, encrypts the data corresponding to the data identifier using the first private key and the token to obtain encrypted data; upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier; wherein the first session key, the second session key and the token are sent by the device management platform.

[0055] In this way, the first device and the second device simultaneously generate challenge-response information and challenge information for the pseudo-identity. The second device verifies the first device using the challenge information and challenge-response information. Only after verification is successful, that is, when the challenge information and challenge-response information corresponding to the first pseudo-identity are consistent, can the first device receive the encrypted data sent by the second device. After the first device decrypts the encrypted data, it obtains the data corresponding to the data identifier. In other words, the first device not only needs to generate challenge-response information for identity authentication, but also needs the private key and token to decrypt the data to obtain the data corresponding to the data identifier. Even if the pseudo-identity is leaked, the data in the second device cannot be obtained using only the pseudo-identity, thereby improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0057] Figure 1 This is a flow chart of a data transmission method provided by an embodiment of the present application;

[0058] Figure 2 is a flowchart of a data transmission method provided by another embodiment of the present application;

[0059] Figure 3 This is a flowchart of a data transmission method provided by another embodiment of the present application;

[0060] Figure 4 1 is a flow chart of a data transmission method provided in yet another embodiment of the present application;

[0061] Figure 5 is a structural diagram of a data transmission apparatus applied to a first device provided in yet another embodiment of the present application;

[0062] Figure 6 is a structural diagram of a data transmission apparatus applied to a second device provided in yet another embodiment of the present application;

[0063] Figure 7 This is a schematic structural diagram of a data transmission device applied to a device management platform provided in yet another embodiment of the present application;

[0064] Figure 8 This is a structural diagram of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0065] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0066] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, the elements defined by the phrase "comprising..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0067] During data transmission, to ensure data security, the data sending device is typically required to add the device identifier of the data requesting device to a data visibility list. The data sending device then sends data to the data requesting device based on the data visibility list. Both the data requesting device and the data sending device can be cloud phones. Cloud phones are virtual phones deployed on cloud servers. Users connect to the cloud phone remotely through a client to access various functions and services, enabling 24 / 7 cloud-based intelligent hosting of applications. This allows users to host various applications in the cloud even when away from their mobile devices, keeping applications online 24 / 7, and virtualizing smartphone applications.

[0068] In conventional data transmission, upon receiving a file send request from a data requester, a data sender determines the file ID and the data requester device identifier in the file database based on the file send request. Based on the ID, the sender determines the file's metadata in the file database, adds the data requester device identifier to the visible metadata attributes of the file, and then sends file receipt information to the data requester device corresponding to the data requester device identifier, allowing the requester device to view the file's metadata through the file receipt information. In other words, data security is ensured by pre-setting visible metadata corresponding to the ID.

[0069] However, with this data transmission method, if the pre-set ID is leaked, the security of the data is difficult to guarantee.

[0070] In order to solve the problems of the prior art, an embodiment of the present application provides a method for transmitting data. The first device and the second device simultaneously generate a challenge response message and a challenge message of a pseudo-identity identifier, and the second device verifies the first device through the challenge message and the challenge response message. After the verification is passed, that is, when the challenge information and the challenge response message corresponding to the first pseudo-identity identifier are consistent, the first device can receive the encrypted data sent by the second device, and the first device decrypts the encrypted data to obtain the data corresponding to the data identifier. In other words, the first device not only needs to generate a challenge response message for identity authentication, but also needs a private key and a token to decrypt the data in order to obtain the data corresponding to the data identifier. Even if the pseudo-identity identifier is leaked, the data in the second device cannot be obtained using only the pseudo-identity identifier, thereby improving the security of the data.

[0071] The following first introduces the data transmission method provided in the embodiment of the present application. Figure 1 A flow chart of a data transmission method provided in one embodiment of the present application is shown.

[0072] like Figure 1 As shown, the data transmission method provided in the embodiment of the present application includes the following steps S110 to S190.

[0073] S110: The first device obtains a first pseudo identity identifier and a data identifier.

[0074] Here, the first device includes a cloud phone, which serves as a data requester. The first pseudo-identity identifier is a unique identity identifier of the first device, which is set in advance. The data identifier is a data identifier of the data obtained by the first device.

[0075] In some embodiments, the first pseudo identity may be the ID of the first device, or the ID v Encrypted PID v etc.

[0076] S120: The first device sends a first data request to the second device, where the first data request includes a first pseudo identity and a data identifier.

[0077] Here, the second device includes a cloud phone.

[0078] In some embodiments, the first data request may further include an operation permission identifier to inform the second device of the operation content that the first device needs to perform, such as viewing operation, downloading operation or modifying operation, etc.

[0079] S130: The second device generates challenge information of the first pseudo identity based on the target value and the first session key according to the first encryption rule, where the target value is a value randomly generated by the second device.

[0080] Here, the first session key is the session key between the first device and the second device. The target value is a value randomly generated according to a preset random number generation rule, such as a value randomly generated within a preset range; the number of digits in the target value is not limited. The first encryption rule is set in advance.

[0081] As an example, the target value may be a pseudo-random number. The preset random number generation rule includes a Monte Carlo algorithm and the like.

[0082] As an example, the second device generates the challenge information of the first pseudo-identity identifier based on the target value and the first session key using formula (1) according to the first encryption rule. Formula (1) is as follows:

[0083] R A =F1(k RG ,N1) (1)

[0084] Among them, R A is the challenge information of the first pseudo identity, F1 is the first encryption rule, for example, a function, k RG is the first session key, and N1 is the target value.

[0085] In some embodiments, the second device records the first pseudo-identity, the challenge information, the first encryption rule, and the first session key.

[0086] S140. The second device sends the target value and the first encryption rule to the first device.

[0087] S150: The first device generates challenge response information of the first pseudo identity based on the target value and the second session key according to the first encryption rule.

[0088] Here, the second session key is a session key between the first device and the second device, and the target value is a value randomly generated by the second device.

[0089] As an example, the first device generates challenge information of the first pseudo-identity identifier based on the target value and the first session key using formula (2) according to the first encryption rule. Formula (2) is as follows:

[0090] R' A =F1(k RG ,N1) (2)

[0091] Among them, R' A is the challenge response information of the first pseudo identity, F1 is the first encryption rule, for example, a function, k RG is the second session key, and N1 is the target value.

[0092] It should be noted that the first session key and the second session key are sent by the device management platform and may be the same.

[0093] S160: The first device sends a first pseudo identity and challenge response information to the second device.

[0094] S170: The second device compares the challenge information and the challenge response information corresponding to the first pseudo identity identifier. If the challenge information and the challenge response information are consistent, the second device encrypts the data corresponding to the data identifier using the first private key and the token to obtain encrypted data.

[0095] Here, the first private key and token are pre-set. The second device's information includes the first public key corresponding to the first private key. The first public key and the first private key form a key pair that enables data encryption and decryption. The first private key is the private key of the second device. The token in the second device is sent by the device management platform.

[0096] In some embodiments, the second device compares the challenge information and challenge response information corresponding to the first pseudo identity identifier. If the challenge information and the challenge response information are consistent, it indicates that the first device has passed the identity authentication of the second device, that is, the first device is allowed to obtain data in the second device.

[0097] In some embodiments, when the challenge information and the challenge response information are inconsistent, it indicates that the first device has not passed the authentication of the second device, and the second device refuses the first device from obtaining data.

[0098] The second device sends target information to the first device to prompt the user that the first device cannot obtain data.

[0099] It is understandable that when the first device passes the identity authentication of the second device, that is, allows the first device to obtain data, the second device will encrypt the data in order to ensure the security of its own data during transmission.

[0100] As an example, using formula (3), the data corresponding to the data identifier is encrypted using the first private key and the token to obtain encrypted data. Formula (3) is as follows:

[0101] D'=h(Token A (fk R , D)) (3)

[0102] Where D' is the encrypted data, h() is the preset encryption rule negotiated in advance between the first device and the second device, and Token A is the token, fk R is the first private key, and D is the data corresponding to the data identifier.

[0103] S180. The second device sends the encrypted data and the first public key corresponding to the first private key to the first device.

[0104] Here, the encrypted data is the encrypted data obtained by the second device encrypting the data corresponding to the data identifier using the first private key and the token when the challenge information and the challenge response information are consistent.

[0105] S190. The first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier.

[0106] Here, the token in the first device is sent by the device management platform, and the first public key is sent by the second device.

[0107] In some embodiments, after receiving the encrypted data, the first device uses the first public key and the token to decrypt the encrypted data based on a preset encryption rule negotiated in advance between the first device and the second device to obtain data corresponding to the data identifier.

[0108] In this way, the first device and the second device simultaneously generate challenge-response information and challenge information for the pseudo-identity. The second device verifies the first device using the challenge information and challenge-response information. Only after verification is successful, that is, when the challenge information and challenge-response information corresponding to the first pseudo-identity are consistent, can the first device receive the encrypted data sent by the second device. After the first device decrypts the encrypted data, it obtains the data corresponding to the data identifier. In other words, the first device not only needs to generate challenge-response information for identity authentication, but also needs the private key and token to decrypt the data to obtain the data corresponding to the data identifier. Even if the pseudo-identity is leaked, the data in the second device cannot be obtained using only the pseudo-identity, thereby improving data security.

[0109] Based on this, in some embodiments, such as Figure 2 As shown, before the above S110, the method may further include the following steps S201 to S210.

[0110] S201: A first device sends a second data request to a device management platform, where the second data request includes a device identifier and an operation authority identifier.

[0111] Here, the device identifier is the identifier of the second device. The operation permission identifier represents the content of the operation that the first device needs to perform on the data of the second device.

[0112] Specifically, before the second device authenticates the first device, the first device needs to first pass the verification of the device management platform.

[0113] In some embodiments, the second data request may further include a data identifier, and the device management platform may determine the device identifier of the second device through the data identifier. The device management platform records the relationship information between the device identifier and the data identifier.

[0114] S202: When the operation authority identifier is a target identifier, the device management platform sends a first identity authentication request to the first device.

[0115] Here, the target identifier includes an identifier of a download operation or a modification operation.

[0116] S203: The first device obtains first identity authentication information.

[0117] In some embodiments, when the first device receives the first identity authentication request sent by the device management platform, the first identity authentication information is obtained. The first identity authentication information may be set in advance by the first device.

[0118] S204. The first device sends first identity authentication information to the device management platform.

[0119] S205. The device management platform compares the first identity authentication information with the pre-stored target identity authentication information. If the target identity authentication information includes the first identity authentication information, the device management platform generates a session key for the first device and the second device. The session key for the first device and the second device includes the first session key and the second session key. The second device is the device corresponding to the device identifier.

[0120] In some embodiments, if the target identity authentication information includes the first identity authentication information, it indicates that the first device has passed the authentication of the device management platform, and the device management platform allows the first device to perform the identity authentication of the second device. The device management platform sends a verification pass message to the first device to prompt the user that the first device can perform the identity authentication of the second device.

[0121] In some embodiments, if the target identity authentication information does not include the first identity authentication information, it indicates that the first device has failed authentication by the device management platform, and the device management platform refuses the first device from performing identity authentication on the second device. The device management platform sends a prompt message to the first device to inform the user that the first device cannot perform identity authentication on the second device.

[0122] Here, the first session key and the second session key are used for the second device to authenticate the first device. The second device generates challenge information of the first pseudo-identity based on the target value and the first session key according to the first encryption rule. The first device generates challenge response information of the first pseudo-identity based on the target value and the second session key according to the first encryption rule.

[0123] S206: The device management platform sends the second session key to the first device, and sends the first session key and the second identity authentication request to the second device.

[0124] In some embodiments, to ensure data security during transmission, the device management platform may further verify a second device after verifying the first device. The second device may be a virtual phone that stores the data to be retrieved from the first device. Similar to verifying the first device, the device management platform sends a second identity verification request to the second device.

[0125] S207: The second device obtains second identity authentication information.

[0126] In some embodiments, when the second device receives the second identity authentication request sent by the device management platform, the second identity authentication information is obtained. The second identity authentication information may be set in advance by the second device.

[0127] S208. The second device sends second identity authentication information to the device management platform.

[0128] S209: The device management platform compares the second identity authentication information with pre-stored target identity authentication information, and generates a token if the target identity authentication information includes the second identity authentication information.

[0129] Here, the token is used by the second device to encrypt the data corresponding to the data identifier to obtain the encrypted data; the token is used by the first device to decrypt the encrypted data to obtain the data corresponding to the data identifier.

[0130] In some embodiments, when the target authentication information includes the second authentication information, it indicates that the second device has passed the authentication of the device management platform. When the second device also passes the authentication of the device management platform, the device management platform generates a token for the data transmission process between the first device and the second device. As an example, the token may include length, Tm expire SK VA PID v and k RG . length is the length of the token, Tm expire SK is the validity information of the token. VA k is the operation authority key of the second device for data, corresponding to the operation authority identifier, RG The session key between the first device and the second device, PID v is a pseudo-identity of the first device.

[0131] It should be noted that the expiration information of the token can be a preset validity period of the token, which can be determined based on the time when the first device requests data, or a preset time threshold can be set based on actual experience, and no specific limitation is made here. The operation permission key can only decrypt the operation permission of the data that matches the operation permission key.

[0132] In some embodiments, if the second device fails authentication, that is, if the target identity authentication information pre-stored in the device management platform does not include the second identity authentication information, the device management platform terminates the communication connection with the second device.

[0133] S210: The device management platform sends a token to the first device and sends a token to the second device.

[0134] In this way, before the first device performs identity authentication of the second device, the first device is first verified through the device management platform. After the verification is passed, the first device can receive the session key and token sent by the device management platform, so that the first device can obtain the data corresponding to the data identifier based on the session key and token, further improving the security of the data in the second device; moreover, the second device also needs to pass the verification of the device management platform before it can obtain the token, encrypt and transmit the data, further improving the security of data transmission.

[0135] Based on this, in some embodiments, such as Figure 3 As shown, before the above S201, the method may further include the following steps S101 to S108.

[0136] S101: A first device sends a first registration request to a device management platform, where the first registration request includes an identity identifier of the first device.

[0137] Here, the identity identifier is a unique identity identifier of the first device, which is set in advance. For example, the identity identifier is the ID of the first device.

[0138] Specifically, before the device management platform verifies the first device, the first device needs to be registered on the device management platform first.

[0139] In some embodiments, the first registration request may further include information such as a user name and password of the first device on the device management platform, for identifying the first device.

[0140] S102: The device management platform generates a first pseudo identity corresponding to the identity of the first device according to the second encryption rule, and generates a shared key between the first device and the device management platform according to the third encryption rule.

[0141] Here, the first pseudo identity is a pseudo identity used by the first device when performing identity authentication of the second device.

[0142] As an example, the device management platform generates a first pseudo identity corresponding to the identity of the first device using formula (4) according to the second encryption rule. Formula (4) is as follows:

[0143] PID V =h(ID v ) (4)

[0144] Among them, PID v is the first pseudo identity, ID v is the identity of the first device, h() is the second encryption rule, which can be set in advance, such as a function.

[0145] In another example, the device management platform generates a shared key between the first device and the device management platform using formula (5) according to the third encryption rule. Formula (5) is as follows:

[0146] k AS =F2(ID v ,T) (5)

[0147] Among them, k ASis the shared key between the first device and the device management platform, F2() is the third encryption rule, which can be set in advance, such as a function, ID v is the identity identifier of the first device, and T is the timestamp when the device management platform receives the first registration request or the first device sends the first registration request.

[0148] In some embodiments, the device management platform generates a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and generates a shared key between the first device and the device management platform according to the third encryption rule, and then stores the first pseudo-identity and the shared key between the first device and the device management platform.

[0149] In some embodiments, before the device management platform stores the first pseudo-identity and the shared key between the first device and the device management platform, the device management platform may also issue a smart card (virtual smart card) or other forms of authentication information to the first device for subsequent authentication steps. These authentication information are also encrypted and stored in the device management platform and shared with the first device for use in future data requests or data processing operations. The smart card issued by the device management platform refers to a virtual smart card used in the service, which can be used for security functions such as identity authentication, data encryption, and application authorization. This smart card may be digital and implement its functions through software, rather than a physical card. It is issued to the first device so that users using the first device can use these smart cards on the first device to access the service. Here, the smart card (virtual smart card) or other forms of authentication information may include the first pseudo-identity and the shared key between the first device and the device management platform.

[0150] S103: The device management platform sends a first pseudo identity and a shared key between the first device and the device management platform to the first device.

[0151] S104. The first device obtains the characteristic information and application information of the first device, and uses the characteristic information and application information of the first device to generate a second private key according to the first preset key rule, and uses the second private key and the shared key of the first device and the device management platform to generate a second public key corresponding to the second private key according to the second preset key rule.

[0152] Here, the feature information is the mobile application service feature information of the first device, which may include at least one of the following information: 1. Application identity information: application name, version number, developer information, application ID (application ID), etc., used to identify the basic identity characteristics of the application; 2. Application behavior data: records the application's usage frequency, startup time, runtime, background operation status and other behavioral information. This includes user interaction data, such as user clicks, swipes, input and other operation behaviors. 3. Application permission information: a list of permissions requested by the application, such as access to contacts, storage, location, camera, microphone, etc. The authorization status and change records of each permission.

[0153] In addition, it can also include application performance indicators, application data synchronization indicators, network connection information, application update information and application push services, etc. For example, the resource usage of the application: such as the proportion of CPU (Central Processing Unit), memory, network bandwidth, storage space, etc. Performance parameters such as startup speed, response time, and interface rendering speed. The data synchronization mechanism of the application: the synchronization frequency with cloud data, the synchronization type (full synchronization, incremental synchronization), and the synchronization content (such as user data, settings, history records, etc.). The connection status of the application with the cloud or other servers: including IP address, transmission protocol (such as HTTP / HTTPS), connection delay, data packet sending and receiving rate, etc. Application update records: such as update time, update content, patch information, new function list, etc. The security features of the application: such as the use of encrypted communication, data storage and transmission encryption method, whether two-factor authentication is supported, and other security-related information.

[0154] The application information may be an introduction to the first device, such as information of included applications.

[0155] As an example, the first device uses formula (6) to generate the second private key according to the first preset key rule using the feature information and application information of the first device. Formula (6) is as follows:

[0156] (K MAS ,hd v )=FE.Gen(MAS) (6)

[0157] Among them, K MAS For the second private key, hd v is the application information of the first device, MAS is the feature information of the first device, and FE.Gen is the irreversibility generation function, that is, once the original data is processed by this function, the original data cannot be recovered or reconstructed from the output.

[0158] In another example, the first device uses formula (7) to generate a second public key corresponding to the second private key using the second private key and the shared key between the first device and the device management platform according to the second preset key rule. Formula (7) is as follows:

[0159] P K =K MAS ·G·k AS (7)

[0160] Among them, P K is the second public key, K MAS is the second private key, k AS is a shared key between the first device and the device management platform, and G is a pre-selected base point of an elliptic curve.

[0161] S105: The first device generates first identity authentication information according to a fourth encryption rule using the application information of the first device, the second private key, and the first pseudo identity identifier.

[0162] Here, the fourth encryption rule is set in advance.

[0163] As an example, the first device uses formula (8) to generate first authentication information using the application information of the first device, the second private key, and the first pseudo-identity according to the fourth encryption rule. Formula (8) is as follows:

[0164] V=h(hd v ‖K MAS ‖PID V ) (8)

[0165] Among them, V is the first identity authentication information, K MAS For the second private key, hd v Application information for the first device, PID v is the first pseudo-identity, h() is the fourth encryption rule, such as a hash function, and || is a data concatenation operation commonly used in the identity authentication process.

[0166] S106. The first device sends the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform.

[0167] In some embodiments, the first device may further encrypt the first identity authentication information using the second public key to obtain encrypted identity authentication information. The first device sends the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform, including:

[0168] The first device sends encrypted identity authentication information, the second public key, the fourth encryption rule, and application information of the first device to the device management platform.

[0169] S107: The device management platform decrypts the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo identity.

[0170] In some embodiments, the device management platform performs a reverse operation according to the fourth encryption rule to obtain a second pseudo-identity, and compares the obtained second pseudo-identity with the previously stored first pseudo-identity to determine whether the two are identical.

[0171] In some embodiments, if the first device sends encrypted authentication information, the device management platform decrypts the first authentication information based on the second public key and the application information of the first device according to the decryption rule corresponding to the fourth encryption rule to obtain the second pseudo identity identifier, and then decrypts the encrypted authentication information based on the second public key to obtain the first authentication information.

[0172] S108: When the second pseudo-identity identifier is consistent with the first pseudo-identity identifier, the device management platform sends a registration success message to the first device.

[0173] In some embodiments, if the second pseudo-identity identifier is consistent with the first pseudo-identity identifier, the device management platform sends a registration success message to the first device to complete the registration of the first device. If the second pseudo-identity identifier is inconsistent with the first pseudo-identity identifier, the device management platform sends a registration failure message to the first device to reject the registration of the first device.

[0174] It is understandable that the shared key is used to ensure the communication security between the first device and the device management platform, while the second private key is used to ensure the security of the data in the first device.

[0175] In this way, by registering the first device with the device management platform, communication of the first device can be achieved. During the registration process, the device management platform verifies the first device, thereby improving the security of data transmission.

[0176] Based on this, in some embodiments, the above S101 may specifically include:

[0177] The first device generates a first pseudo identity corresponding to the identity of the first device according to the second encryption rule;

[0178] The first device sends a first pseudo identity to the device management platform;

[0179] The device management platform detects whether the pre-stored pseudo-identities include the first pseudo-identity, and if the device management platform does not detect the first pseudo-identity in the pre-stored pseudo-identities, sends a registration notification to the first device;

[0180] When the first device receives the registration notification sent by the device management platform, it sends a first registration request to the device management platform.

[0181] In some embodiments, before S101 above, the method may further include: the first device generates a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and sends the first pseudo-identity to the device management platform, and the device management platform detects whether the first pseudo-identity is included in the pre-stored pseudo-identities. If the device management platform detects that the pre-stored pseudo-identities do not include the first pseudo-identity, the device management platform sends a registration notification to the first device, instructing the first device to execute S101 above. If the device management platform detects that the pre-stored pseudo-identities include the first pseudo-identity, the device management platform sends a registered notification to the first device, instructing the first device to directly execute S201 above.

[0182] In some embodiments, before S101 above, the method may further include: the first device sends the identity identifier of the first device to the device management platform, the device management platform generates a first pseudo-identity identifier corresponding to the identity identifier of the first device according to the second encryption rule, and detects whether the first pseudo-identity identifier is included in the pre-stored pseudo-identity identifiers. If the device management platform detects that the pre-stored pseudo-identity identifiers do not include the first pseudo-identity identifier, the device management platform sends a registration notification to the first device, instructing the first device to execute S101 above. If the device management platform detects that the pre-stored pseudo-identity identifiers include the first pseudo-identity identifier, the device management platform sends a registered notification to the first device, instructing the first device to directly execute S201 above.

[0183] In this way, for first devices that have not been registered with the device management platform, the device management platform will send a registration notification to enable the first device to be registered, thereby enabling communication between the first device and the device management platform and the second device. For first devices that have already been registered, communication can be carried out directly, improving data transmission efficiency.

[0184] It should be noted that before the device management platform verifies the first device, the second device needs to be registered on the device management platform. The registration process for the second device is similar to that for the first device, as follows.

[0185] Based on this, in some embodiments, such as Figure 4 As shown, before the above S201, the method may further include the following steps S211 to S218.

[0186] S211. The second device sends a second registration request to the device management platform, where the second registration request includes an identity identifier of the second device.

[0187] Here, the identity identifier is a unique identity identifier of the second device, which is set in advance. For example, the identity identifier is the ID of the second device.

[0188] Specifically, before the device management platform verifies the first device, the second device needs to be registered on the device management platform first.

[0189] In some embodiments, the first registration request may further include information such as a user name and password of the second device on the device management platform, for identifying the second device.

[0190] S212: The device management platform generates a third pseudo identity corresponding to the identity of the second device according to the second encryption rule, and generates a shared key between the second device and the device management platform according to the third encryption rule.

[0191] Here, the third pseudo identity is a pseudo identity used by the second device when performing identity authentication of the second device.

[0192] As an example, the device management platform uses the above formula (4) to generate a third pseudo identity corresponding to the identity of the second device according to the second encryption rule. v is the third pseudo identity, ID v is the identity of the second device, h() is the second encryption rule, which can be set in advance, such as a function.

[0193] In another example, the device management platform generates a shared key between the second device and the device management platform using formula (5) according to the third encryption rule. AS is the shared key between the second device and the device management platform, F2() is the third encryption rule, which can be set in advance, such as a function, ID v is the identity of the second device, and T is the timestamp when the device management platform receives the second registration request or the second device sends the second registration request.

[0194] In some embodiments, the device management platform generates a third pseudo identity corresponding to the identity of the second device according to the second encryption rule, and generates a shared key between the second device and the device management platform according to the third encryption rule, and then stores the third pseudo identity and the shared key between the second device and the device management platform.

[0195] In some embodiments, before the device management platform stores the third pseudo-identity and the shared key between the second device and the device management platform, the device management platform may also issue a smart card (virtual smart card) or other forms of authentication information to the second device for subsequent authentication steps. These authentication information are also encrypted and stored in the device management platform and shared with the second device for use in future data requests or data processing operations. The smart card issued by the device management platform refers to a virtual smart card used in the service, which can be used for security functions such as identity authentication, data encryption, and application authorization. This smart card may be digital and implement its functions through software, rather than a physical card. It is issued to the second device so that users of the second device can use these smart cards on the second device to access the service. Here, the smart card (virtual smart card) or other forms of authentication information may include the third pseudo-identity and the shared key between the second device and the device management platform.

[0196] S213: The device management platform sends the third pseudo identity and the shared key between the second device and the device management platform to the second device.

[0197] S214. The second device obtains the characteristic information and application information of the second device, and uses the characteristic information and application information of the second device to generate a first private key according to the first preset key rule, and uses the first private key and the shared key of the second device and the device management platform to generate a first public key corresponding to the first private key according to the second preset key rule.

[0198] Here, the characteristic information refers to the mobile application service characteristic information of the second device, and may include at least one of the following information: 1. Application identity information: application name, version number, developer information, application ID (App ID), etc., used to identify the basic identity characteristics of the application; 2. Application behavior data: records behavioral information such as application usage frequency, startup time, runtime, and background operation status. This includes user interaction data, such as user clicks, swipes, and input operations. 3. Application permission information: a list of permissions requested by the application, such as access to contacts, storage, location, camera, microphone, etc., and the authorization status and change records of each permission.

[0199] In addition, it can also include application performance indicators, application data synchronization indicators, network connection information, application update information and application push services, etc. For example, the resource usage of the application: such as the proportion of CPU, memory, network bandwidth, storage space, etc. Performance parameters such as startup speed, response time, and interface rendering speed. The data synchronization mechanism of the application: the synchronization frequency with cloud data, the synchronization type (full synchronization, incremental synchronization), and the synchronization content (such as user data, settings, history records, etc.). The connection status of the application with the cloud or other servers: including IP address, transmission protocol (such as HTTP / HTTPS), connection delay, data packet sending and receiving rate, etc. Application update records: such as update time, update content, patch information, new function list, etc. The security features of the application: such as the use of encrypted communication, data storage and transmission encryption method, whether two-factor authentication is supported, and other security-related information.

[0200] The application information may be an introduction to the second device, such as information of included applications.

[0201] As an example, the second device uses formula (9) to generate the first private key according to the first preset key rule using the feature information and application information of the second device. Formula (9) is as follows:

[0202] (fk R ,hd R )=FE.Gen(MAS R ) (9)

[0203] Among them, fk R is the first private key, hd R Application information for the second device, MAS R is the characteristic information of the second device, and FE.Gen is the irreversibility generation function, that is, once the original data is processed by this function, the original data cannot be recovered or reconstructed from the output.

[0204] In another example, the second device uses formula (10) to generate a first public key corresponding to the first private key according to a second preset key rule using the first private key and the shared key between the second device and the device management platform. Formula (10) is as follows:

[0205] P R =fk R ·G2·k RS (10)

[0206] Among them, P R is the first public key, fk R is the first private key, k RS It is a shared key between the second device and the device management platform, and G2 is a pre-selected base point of an elliptic curve.

[0207] Here, the first private key is also used by the second device to encrypt data corresponding to the data identifier to obtain encrypted data; the first public key is also used by the first device to decrypt the encrypted data to obtain data corresponding to the data identifier.

[0208] S215. The second device uses the application information of the second device, the first private key, and the third pseudo identity identifier to generate second identity authentication information according to the fourth encryption rule.

[0209] Here, the fourth encryption rule is set in advance.

[0210] As an example, the second device uses formula (11) to generate the first authentication information according to the fourth encryption rule using the application information of the second device, the first private key, and the first pseudo-identity. Formula (11) is as follows:

[0211] V=h(hd R ‖fk R ‖PID V ) (11)

[0212] Among them, V is the second identity authentication information, fk R is the first private key, hd R Application information for the second device, PID v is the third pseudo-identity, h() is the fourth encryption rule, such as a hash function, and || is a data concatenation operation commonly used in the identity authentication process.

[0213] S216. The second device sends the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform.

[0214] In some embodiments, the second device may further encrypt the second identity authentication information using the first public key to obtain encrypted identity authentication information. The second device sends the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform, including:

[0215] The second device sends the encrypted identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform.

[0216] S217: The device management platform decrypts the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo identity.

[0217] In some embodiments, the device management platform performs a reverse operation according to the fourth encryption rule to obtain a fourth pseudo-identity, and compares the obtained fourth pseudo-identity with the previously stored third pseudo-identity to determine whether the two are identical.

[0218] In some embodiments, if the second device sends encrypted authentication information, the device management platform decrypts the second authentication information based on the first public key and the application information of the second device according to the decryption rule corresponding to the fourth encryption rule to obtain the fourth pseudo identity identifier, and the device management platform decrypts the encrypted authentication information based on the first public key to obtain the second authentication information.

[0219] S218: When the fourth pseudo identity identifier is consistent with the third pseudo identity identifier, the device management platform sends a registration success message to the second device.

[0220] In some embodiments, if the fourth pseudo-identity identifier and the third pseudo-identity identifier are consistent, the device management platform sends a registration success message to the second device to complete the registration of the second device. If the fourth pseudo-identity identifier and the third pseudo-identity identifier are inconsistent, the device management platform sends a registration failure message to the second device to reject the registration of the second device.

[0221] It is understandable that the shared key is used to ensure the communication security between the second device and the device management platform, while the first private key is used to ensure the security of the data in the second device.

[0222] In this way, by registering the second device with the device management platform, communication of the second device can be achieved. During the registration process, the device management platform verifies the second device, thereby improving the security of data transmission.

[0223] In some embodiments, before the above S211, the method may further include: the second device generates a third pseudo-identity corresponding to the identity of the second device according to the second encryption rule, and sends the third pseudo-identity to the device management platform, and the device management platform detects whether the third pseudo-identity is included in the pre-stored pseudo-identities. If the device management platform detects that the pre-stored pseudo-identities do not include the third pseudo-identity, the device management platform sends a registration notification to the second device, instructing the second device to execute the above S211. If the device management platform detects that the pre-stored pseudo-identities include the third pseudo-identity, the device management platform sends a registered notification to the second device, indicating that the second device does not need to register and the first device can directly execute the above S201.

[0224] In some embodiments, before the above S211, the method may further include: the second device sends the identity identifier of the second device to the device management platform, the device management platform generates a third pseudo-identity identifier corresponding to the identity identifier of the second device according to the second encryption rule, and detects whether the third pseudo-identity identifier is included in the pre-stored pseudo-identity identifiers. If the device management platform detects that the third pseudo-identity identifier is not included in the pre-stored pseudo-identity identifiers, the device management platform sends a registration notification to the second device, instructing the second device to execute the above S211. If the device management platform detects that the third pseudo-identity identifier is included in the pre-stored pseudo-identity identifiers, the device management platform sends a registered notification to the second device, indicating that the second device does not need to register and the first device can directly execute the above S201.

[0225] In this way, for a second device that has not been registered with the device management platform, the device management platform will send a registration notification to enable the second device to register, thereby enabling the second device to communicate with the device management platform and the first device. For a second device that has already been registered, communication can be carried out directly, improving data transmission efficiency.

[0226] Based on this, in some embodiments, when applied to a device management platform, the method may further include:

[0227] Upon receiving a third registration request sent by the target device, generating a fifth pseudo-identity corresponding to the identity of the target device according to the second encryption rule, and generating a shared key between the target device and the device management platform according to the third encryption rule, the third registration request including the identity of the target device, the target device including the first device and the second device, the third registration request including the first registration request sent by the first device and the second registration request sent by the second device, and the fifth pseudo-identity including the first pseudo-identity and the third pseudo-identity;

[0228] Sending a fifth pseudo-identity and a shared key between the target device and the device management platform to the target device, so that the target device can obtain feature information and application information of the target device, and using the feature information and application information of the target device to generate a target private key according to a first preset key rule, using the target private key and the shared key between the target device and the device management platform to generate a target public key corresponding to the target private key according to a second preset key rule, and using the application information of the target device, the target private key, and the fifth pseudo-identity to generate target identity authentication information according to a fourth encryption rule, the target private key including the first private key and the second private key, the target public key including the first public key and the second public key, and the target identity authentication information including the first identity authentication information and the second identity authentication information;

[0229] Upon receiving the target identity information, the target public key, the fourth encryption rule, and the application information of the target device sent by the target device, decrypting the target identity information according to a decryption rule corresponding to the fourth encryption rule based on the target public key and the application information of the target device to obtain a sixth pseudo identity, where the sixth pseudo identity includes the second pseudo identity and the fourth pseudo identity;

[0230] When the sixth pseudo identity identifier is consistent with the fifth pseudo identity identifier, a registration success message is sent to the target device.

[0231] It is understood that the target device can be registered on the device management platform to enable communication and data transmission between devices. The target device includes at least one device. Here, the target device includes a first device and a second device.

[0232] In this way, by registering the target device to the device management platform, communication with the target device can be achieved. During the registration process, the device management platform verifies the target device, thereby improving the security of data transmission.

[0233] Based on this, in some embodiments, the token includes expiration information; upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier includes:

[0234] Upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, and when the token satisfies the timeliness information, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier.

[0235] Here, the token Token A ={PID V ,length,SK VA ,Tm expire ,K RG}. Where length is the length of the token, Tm expire SK is the validity information of the token. VA k is the operation authority key of the second device for data, corresponding to the operation authority identifier, RG The session key between the first device and the second device, PID v is a pseudo-identity of the first device.

[0236] It should be noted that the expiration information of the token can be a preset validity period of the token, which can be determined based on the time when the first device requests data, or a preset time threshold can be set based on actual experience, and no specific limitation is made here. The operation permission key can only decrypt the operation permission of the data that matches the operation permission key.

[0237] In this way, the security of the data is further guaranteed by the expiration information of the token. Based on this, in some embodiments, the token includes expiration information and processing authority information; after the above S190, the method may further include:

[0238] When it is detected that the token does not meet the timeliness information, or the processing information of the data corresponding to the data identifier does not meet the processing authority information, the token is updated to the target state.

[0239] Here, the expiration information includes the preset validity period of the token, which is set in advance. The target state indicates that the token is invalid and cannot be used.

[0240] In some embodiments, the first device operates on or views data based on a token sent by the device management platform. If the token expires after a preset expiration date, the token becomes invalid, and the first device will no longer be able to operate on or view the data. Furthermore, if the scope of the device management platform's operations on the data exceeds the operating permissions corresponding to the processing permission information in the token, the operation permission key will immediately become invalid. At this point, even if the token has not expired before the preset expiration date, the first device will no longer be able to operate on or view the data.

[0241] In this way, setting time limit information and processing authority information for the use of the token further improves data security.

[0242] In the embodiment provided in the present application, the device management platform receives a data request from a data requester (i.e., a first device), and the data request may include a data identifier of the data to be obtained, a device identifier of the data sender (i.e., a second device), and an operation permission identifier for the data to be obtained. Different operation permission identifiers correspond to different operation permissions. The data requester can be a cloud phone or a real device. This method can be used for data transmission between cloud phones, and can also be used for data transmission between cloud phones and real devices.

[0243] Specifically, the data requester can be recorded as the first device, and the data sender can be recorded as the second device. The operating permissions for the data to be obtained include permissions such as reading, writing, modifying, querying and downloading. In actual applications, different operating permission identifiers can be determined for different operating permissions. When the first device sends a data request to the second device, the operating permission identifier can be carried in the data request. After the device management platform receives the data request from the data requester, it determines the operating permission that the data requester expects to obtain based on the operating permission identifier in the data request; if the data requester expects to modify the acquired data or download the data, the data requester is verified. In addition to authenticating the data requester requesting the data, the data sender machine that stores the data to be accessed can also be verified. In this way, the security of both the data requester and the data sender can be guaranteed at the same time.

[0244] In the embodiment provided in the present application, the specific implementation process of the device management platform verifying the data requester includes a registration stage and an identity verification stage.

[0245] When the data requester's identity is authenticated, the device management platform sends a token to the data requester. After receiving the token, the data requester can access the data from the target cloud phone based on the token. If the token expires after the preset validity period, it will become invalid and the data requester will no longer be able to operate or view the data.

[0246] At the same time, if the data requester's scope of operation on the data exceeds the preset operation permissions, the operation permission key will immediately expire. At this time, even if the token has not yet reached the preset validity period, the data requester will no longer be able to operate or view the data. This can, on the one hand, meet the data requester's needs to operate on the requested data; on the other hand, it can effectively limit the data requester's operation scope and operation permissions, thereby improving data security.

[0247] Based on the data transmission method provided in the above embodiment, the present application also provides a specific implementation of a data transmission device. Please refer to the following embodiment.

[0248] See also Figure 5 The data transmission device 300 provided in an embodiment of the present application is applied to a first device and includes:

[0249] An acquisition module 310 is configured to acquire a first pseudo identity identifier and a data identifier;

[0250] a sending module 320 configured to send a first data request to a second device, the first data request including a first pseudo-identity and a data identifier, the first data request instructing the second device to generate challenge information for the first pseudo-identity based on a target value and a first session key and in accordance with a first encryption rule, wherein the target value is a value randomly generated by the second device;

[0251] A generating module 330 is configured to generate, upon receiving the target value and the first encryption rule sent by the second device, challenge response information of the first pseudo-identity based on the target value and the second session key and in accordance with the first encryption rule;

[0252] The sending module 320 is further configured to send the first pseudo-identity identifier and the challenge response information to the second device. The first pseudo-identity identifier and the challenge response information are used by the second device to encrypt the data corresponding to the data identifier using the first private key and the token to obtain encrypted data when the challenge information and the challenge response information corresponding to the first pseudo-identity identifier are consistent.

[0253] a decryption module 340 configured to, upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier;

[0254] The first session key, the second session key and the token are sent by the device management platform.

[0255] Based on this, in some embodiments, the apparatus 300 may further include:

[0256] The sending module 320 is further configured to send a second data request to the device management platform before obtaining the first pseudo-identity identifier and the data identifier, where the second data request includes the device identifier and the operation authority identifier, and the second data request is configured to instruct the device management platform to send a first identity authentication request to the first device when the operation authority identifier is the target identifier;

[0257] The acquisition module 310 is further configured to acquire first identity authentication information upon receiving a first identity authentication request sent by the device management platform;

[0258] The sending module 320 is further configured to send first identity authentication information to the device management platform. The first identity authentication information is used by the device management platform to generate a session key and a token for the first device and the second device when the pre-stored target identity authentication information includes the first identity authentication information. The session key between the first device and the second device includes the second session key. The second device is the device corresponding to the device identifier.

[0259] The receiving module is used to receive the second session key and token sent by the device management platform.

[0260] Based on this, in some embodiments, the apparatus 300 may further include:

[0261] The sending module 320 is further configured to send a first registration request to the device management platform before sending the second data request to the device management platform, where the first registration request includes the identity of the first device, and the first registration request is configured to instruct the device management platform to generate a first pseudo-identity corresponding to the identity of the first device according to the second encryption rule, and to generate a shared key between the first device and the device management platform according to the third encryption rule;

[0262] a determination module configured to, upon receiving the first pseudo-identity and the shared key between the first device and the device management platform sent by the device management platform, obtain characteristic information and application information of the first device, generate a second private key using the characteristic information and application information of the first device in accordance with a first preset key rule, and generate a second public key corresponding to the second private key using the second private key and the shared key between the first device and the device management platform in accordance with a second preset key rule;

[0263] The generating module 330 is further configured to generate first identity authentication information according to a fourth encryption rule using the application information of the first device, the second private key, and the first pseudo-identity identifier;

[0264] The sending module 320 is further configured to send the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform. The first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device are used by the device management platform to decrypt the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo-identity. If the second pseudo-identity is consistent with the first pseudo-identity, a registration success message is sent to the first device.

[0265] The receiving module is also used to receive the registration success information sent by the device management platform.

[0266] Based on this, in some embodiments, the sending module 320 may specifically include:

[0267] A generating unit, configured to generate a first pseudo identity corresponding to the identity of the first device according to a second encryption rule;

[0268] a sending unit, configured to send a first pseudo-identity identifier to the device management platform, where the first pseudo-identity identifier is used by the device management platform to detect whether the first pseudo-identity identifier is included in pre-stored pseudo-identities, and if the device management platform does not detect the first pseudo-identity identifier in the pre-stored pseudo-identities, sending a registration notification to the first device;

[0269] Upon receiving the registration notification sent by the device management platform, a first registration request is sent to the device management platform.

[0270] Based on this, in some embodiments, the token includes expiration information; the decryption module 340 may specifically include:

[0271] The decryption unit is used to decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier when the encrypted data and the first public key corresponding to the first private key sent by the second device are received and the token meets the time limit information.

[0272] Based on this, in some embodiments, the token includes time validity information and processing authority information; the apparatus 300 may further include:

[0273] The update module is used to decrypt the encrypted data using the first public key and the token upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, and after obtaining the data corresponding to the data identifier, update the token to the target state when it is detected that the token does not meet the time limit information or the processing information of the data corresponding to the data identifier does not meet the processing authority information.

[0274] See also Figure 6 The data transmission device 400 provided in the embodiment of the present application is applied to a second device and includes:

[0275] a generating module 410 configured to generate, upon receiving a first data request from a first device, a challenge message for a first pseudo-identity identifier based on a target value and a first session key and in accordance with a first encryption rule, wherein the first data request includes the first pseudo-identity identifier and a data identifier, and the target value is a value randomly generated by the second device;

[0276] A sending module 420 is configured to send a target value and a first encryption rule to the first device, where the target value and the first encryption rule are used by the first device to generate a challenge response message of the first pseudo-identity based on the target value and the second session key and in accordance with the first encryption rule;

[0277] The encryption module 430 is configured to, upon receiving the first pseudo-identity and the challenge response information sent by the first device, compare the challenge information and the challenge response information corresponding to the first pseudo-identity, and, if the challenge information and the challenge response information are consistent, encrypt the data corresponding to the data identifier using the first private key and the token to obtain encrypted data;

[0278] The sending module 420 is further configured to send the encrypted data and the first public key corresponding to the first private key to the first device, so that the first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier;

[0279] The first session key, the second session key and the token are sent by the device management platform.

[0280] Based on this, in some embodiments, the apparatus 400 may further include:

[0281] an acquisition module, configured to, upon receiving a first data request from the first device, generate challenge information corresponding to the first pseudo-identity identifier based on the target value and the first session key in accordance with the first encryption rule, and, upon receiving the first session key and the second identity authentication request from the device management platform, obtain second identity authentication information;

[0282] The sending module 420 is further configured to send the second identity authentication information to the device management platform, where the second identity authentication information is used by the device management platform to generate a token when the pre-stored target identity authentication information includes the second identity authentication information;

[0283] The receiving module is configured to receive a token sent by the device management platform, wherein the first session key is a session key between the first device and the second device.

[0284] Based on this, in some embodiments, the apparatus 400 may further include:

[0285] The sending module 420 is further configured to, upon receiving the first session key and the second identity authentication request sent by the device management platform, send a second registration request to the device management platform before obtaining the second identity authentication information, the second registration request including the identity of the second device, the second registration request being configured to instruct the device management platform to generate a third pseudo-identity corresponding to the identity of the second device according to the second encryption rule, and to generate a shared key between the second device and the device management platform according to the third encryption rule;

[0286] a determination module configured to, upon receiving the third pseudo-identity sent by the device management platform and the shared key between the second device and the device management platform, obtain feature information and application information of the second device, generate a first private key using the feature information and application information of the second device in accordance with a first preset key rule, and generate a first public key corresponding to the first private key using the first private key and the shared key between the second device and the device management platform in accordance with a second preset key rule;

[0287] The generating module 410 is further configured to generate second identity authentication information according to a fourth encryption rule using the application information of the second device, the first private key, and the third pseudo identity identifier;

[0288] The sending module 420 is further configured to send the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform. The second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device are used by the device management platform to decrypt the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo-identity. If the fourth pseudo-identity is consistent with the third pseudo-identity, a registration success message is sent to the second device.

[0289] The receiving module is also used to receive the registration success information sent by the device management platform.

[0290] See also Figure 7 The data transmission device 500 provided in the embodiment of the present application is applied to the device management platform, including

[0291] A sending module 510 is configured to send a first session key and a token to a second device, and to send a second session key and a token to the first device. The first session key, the second session key, and the token are used by the second device, upon receiving a first data request sent by the first device, to generate challenge information of a first pseudo-identity based on a target value and the first session key in accordance with a first encryption rule. The target value and the first encryption rule are sent to the first device. The target value and the first encryption rule are used by the first device, based on the target value and the second session key, to generate challenge response information of the first pseudo-identity based on the target value and the second session key in accordance with the first encryption rule. The first pseudo-identity and the challenge response information are sent to the second device. The first pseudo-identity and the challenge response information are used by the second device, when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent, to encrypt data corresponding to the data identifier using the first private key and the token to obtain encrypted data. The encrypted data and the first public key corresponding to the first private key sent to the first device are used by the first device, using the first public key and the token, to decrypt the encrypted data to obtain data corresponding to the data identifier. The first data request includes the first pseudo-identity and the data identifier. The target value is a value randomly generated by the second device.

[0292] The various modules of the data transmission device provided in the embodiment of the present application can implement the functions of the various steps of the data transmission method provided above and achieve the corresponding technical effects. For the sake of brevity, they will not be repeated here.

[0293] Based on the same inventive concept, an embodiment of the present application also provides an electronic device.

[0294] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0295] The electronic device may include a processor 601 and a memory 602 storing computer program instructions.

[0296] Specifically, the processor 601 may include a central processing unit (CPU) or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0297] The memory 602 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 602 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 602 may include removable or non-removable (or fixed) media. Where appropriate, the memory 602 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 602 is a non-volatile solid-state memory.

[0298] The memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0299] The processor 601 implements any one of the data transmission methods in the above embodiments by reading and executing computer program instructions stored in the memory 602 .

[0300] In one example, the electronic device may further include a communication interface 603 and a bus 610. Figure 8 As shown, the processor 601, the memory 602, and the communication interface 603 are connected via a bus 610 and communicate with each other.

[0301] The communication interface 603 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0302] The bus 610 includes hardware, software, or both that couples components of the electronic device to each other. By way of example and not limitation, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Linear Predictive Coding (LPC) bus, a memory bus, a MicroChannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (Peripheral Component Interconnect-X, PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VESA Local Bus, VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, the bus 610 may include one or more buses. Although the embodiments of the present application describe and illustrate a specific bus, the present application contemplates any suitable bus or interconnect. The electronic device can execute the data transmission method of the embodiments of the present invention, thereby implementing the above-mentioned data transmission method.

[0303] In addition, in conjunction with the data transmission method in the above embodiments, the present application embodiment may provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any of the data transmission methods in the above embodiments is implemented.

[0304] The present application also provides a computer program product. When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes each process of implementing any one of the above-mentioned data transmission method embodiments.

[0305] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0306] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of the present application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium, or transmitted on a transmission medium or communication link via a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memories (ROMs), flash memories, erasable read-only memories (EROMs), floppy disks, compact disc read-only memories (CD-ROMs), optical discs, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segments can be downloaded via computer networks such as the Internet and intranets.

[0307] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0308] Aspects of the present disclosure have been described above with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit. It is also understood that each box in the block diagram and / or flowchart and the combination of the boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs the specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0309] The above is only a specific implementation method of the present application. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited to this. Any technician familiar with this technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the scope of protection of this application.

Claims

1. A data transmission method, characterized in that: Applied to a first device, comprising: Obtaining a first pseudo identity identifier and a data identifier; Sending a first data request to the second device, where the first data request includes the first pseudo-identity and the data identifier, and the first data request is used to instruct the second device to generate challenge information for the first pseudo-identity based on a target value and a first session key and in accordance with a first encryption rule, where the target value is a value randomly generated by the second device; Upon receiving the target value and the first encryption rule sent by the second device, generating challenge response information of the first pseudo-identity based on the target value and the second session key and in accordance with the first encryption rule; Sending the first pseudo-identity and the challenge response information to the second device, where the first pseudo-identity and the challenge response information are used by the second device to encrypt data corresponding to the data identifier using the first private key and the token to obtain encrypted data when the challenge information and the challenge response information corresponding to the first pseudo-identity are consistent; Upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier; The first session key, the second session key and the token are sent by a device management platform.

2. The data transmission method according to claim 1, characterized in that: Before obtaining the first pseudo identity identifier and the data identifier, the method further includes: Sending a second data request to the device management platform, where the second data request includes a device identifier and an operation authority identifier, and the second data request is used to instruct the device management platform to send a first identity authentication request to the first device when the operation authority identifier is a target identifier; Upon receiving the first identity authentication request sent by the device management platform, obtaining first identity authentication information; Sending the first authentication information to the device management platform, where the first authentication information is used by the device management platform to generate a session key and a token for the first device and the second device when pre-stored target authentication information includes the first authentication information, the session key between the first device and the second device including the second session key, and the second device being the device corresponding to the device identifier; Receive the second session key and the token sent by the device management platform.

3. The data transmission method according to claim 2, characterized in that: Before sending the second data request to the device management platform, the method further includes: Sending a first registration request to the device management platform, where the first registration request includes an identity of the first device, and the first registration request is used to instruct the device management platform to generate a first pseudo-identity corresponding to the identity of the first device according to a second encryption rule, and to generate a shared key between the first device and the device management platform according to a third encryption rule; Upon receiving the first pseudo-identity and the shared key between the first device and the device management platform sent by the device management platform, obtaining feature information and application information of the first device, generating a second private key according to a first preset key rule using the feature information and application information of the first device, and generating a second public key corresponding to the second private key according to a second preset key rule using the second private key and the shared key between the first device and the device management platform; Generate first identity verification information according to a fourth encryption rule using the application information of the first device, the second private key, and the first pseudo-identity; Sending the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device to the device management platform, where the first identity authentication information, the second public key, the fourth encryption rule, and the application information of the first device are used by the device management platform to decrypt the first identity authentication information based on the second public key and the application information of the first device according to a decryption rule corresponding to the fourth encryption rule to obtain a second pseudo-identity identifier, and sending a registration success message to the first device if the second pseudo-identity identifier is consistent with the first pseudo-identity identifier; Receive the registration success information sent by the device management platform.

4. The data transmission method according to claim 3, characterized in that: The sending of the first registration request to the device management platform includes: generating a first pseudo identity corresponding to the identity of the first device according to a second encryption rule; Sending the first pseudo-identity to a device management platform, where the first pseudo-identity is used by the device management platform to detect whether the first pseudo-identity is included in pre-stored pseudo-identities, and if the device management platform does not detect the first pseudo-identity in the pre-stored pseudo-identities, sending a registration notification to the first device; Upon receiving the registration notification sent by the device management platform, a first registration request is sent to the device management platform.

5. The data transmission method according to claim 2, characterized in that: The token includes time validity information; upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier, including: Upon receiving the encrypted data sent by the second device and the first public key corresponding to the first private key, and when the token satisfies the timeliness information, the encrypted data is decrypted using the first public key and the token to obtain data corresponding to the data identifier.

6. The data transmission method according to claim 2, characterized in that: The token includes time validity information and processing authority information; upon receiving the encrypted data and the first public key corresponding to the first private key sent by the second device, decrypting the encrypted data using the first public key and the token to obtain data corresponding to the data identifier, the method further includes: When it is detected that the token does not satisfy the timeliness information, or the processing information of the data corresponding to the data identifier does not satisfy the processing authority information, the token is updated to a target state.

7. A data transmission method, characterized in that: Applied to the second device, comprising: upon receiving a first data request sent by a first device, generating, based on a target value and a first session key, a challenge message of a first pseudo-identity identifier in accordance with a first encryption rule, wherein the first data request includes the first pseudo-identity identifier and a data identifier, and the target value is a value randomly generated by the second device; Sending the target value and the first encryption rule to the first device, where the target value and the first encryption rule are used by the first device to generate challenge response information of the first pseudo-identity based on the target value and the second session key and according to the first encryption rule; Upon receiving the first pseudo-identity and the challenge response information sent by the first device, comparing the challenge information and the challenge response information corresponding to the first pseudo-identity, and if the challenge information and the challenge response information are consistent, encrypting the data corresponding to the data identifier using the first private key and the token to obtain encrypted data; Sending the encrypted data and a first public key corresponding to the first private key to the first device, so that the first device decrypts the encrypted data using the first public key and the token to obtain data corresponding to the data identifier; The first session key, the second session key and the token are sent by a device management platform.

8. The data transmission method according to claim 7, characterized in that: Upon receiving the first data request sent by the first device, before generating challenge information corresponding to the first pseudo identity according to the first encryption rule based on the target value and the first session key, the method further includes: Upon receiving the first session key and the second identity authentication request sent by the device management platform, obtaining second identity authentication information; Sending the second identity authentication information to the device management platform, where the second identity authentication information is used by the device management platform to generate the token when the pre-stored target identity authentication information includes the second identity authentication information; The token sent by the device management platform is received, where the first session key is a session key between the first device and the second device.

9. The data transmission method according to claim 8, characterized in that: Upon receiving the first session key and the second identity authentication request sent by the device management platform, before obtaining the second identity authentication information, the method further includes: Sending a second registration request to the device management platform, where the second registration request includes the identity of the second device, and the second registration request is used to instruct the device management platform to generate a third pseudo-identity corresponding to the identity of the second device according to a second encryption rule, and to generate a shared key between the second device and the device management platform according to the third encryption rule; Upon receiving the third pseudo-identity sent by the device management platform and the shared key between the second device and the device management platform, obtaining feature information and application information of the second device, generating a first private key according to a first preset key rule using the feature information and application information of the second device, and generating a first public key corresponding to the first private key according to a second preset key rule using the first private key and the shared key between the second device and the device management platform; generating second identity authentication information according to a fourth encryption rule using the application information of the second device, the first private key, and the third pseudo identity identifier; Sending the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device to the device management platform, where the second identity authentication information, the first public key, the fourth encryption rule, and the application information of the second device are used by the device management platform to decrypt the second identity authentication information based on the first public key and the application information of the second device according to a decryption rule corresponding to the fourth encryption rule to obtain a fourth pseudo identity identifier, and sending a registration success message to the second device if the fourth pseudo identity identifier is consistent with the third pseudo identity identifier; Receive the registration success information sent by the device management platform.

10. A data transmission method, characterized in that: Applied to device management platforms, including A first session key and a token are sent to a second device, and a second session key and the token are sent to the first device. The first session key, the second session key, and the token are used by the second device, upon receiving a first data request sent by the first device, to generate challenge information of a first pseudo-identity identifier based on a target value and the first session key and in accordance with a first encryption rule. The target value and the first encryption rule are sent to the first device. The target value and the first encryption rule are used by the first device, based on the target value and the second session key, to generate challenge response information of the first pseudo-identity identifier based on the target value and the second session key and in accordance with the first encryption rule. The first pseudo-identity identifier and the challenge response information are sent to the second device. The first pseudo-identity identifier and the challenge response information are used by the second device, when the challenge information and the challenge response information corresponding to the first pseudo-identity identifier are consistent, to encrypt data corresponding to the data identifier using a first private key and the token to obtain encrypted data. The encrypted data and a first public key corresponding to the first private key are sent to the first device, so that the first device can decrypt the encrypted data using the first public key and the token to obtain data corresponding to the data identifier. The first data request includes the first pseudo-identity identifier and the data identifier. The target value is a value randomly generated by the second device.

Images