Secure communication method between devices, gas meter and alarm

Abstract

The embodiment of the invention discloses a safety communication method between devices, a gas meter and an alarm. The method comprises the following steps: receiving a key negotiation request sent by a second device, and determining a session initial key; encrypting the first handshake information by adopting the session initial secret key, and sending the identification information of the first equipment and the encrypted first handshake information to the second equipment; acquiring encrypted second handshake information and first to-be-verified information sent by a second device; decrypting by adopting the session initial secret key, and analyzing to obtain first handshake information; when the first handshake information passes the verification, fusing the second handshake information and the identification information, and encrypting by adopting the session initial secret key to generate second to-be-verified information; sending the second to-be-verified information to a second device; acquiring negotiation information sent by a second device; decrypting the negotiation information by adopting the session initial secret key, and analyzing to obtain a negotiation secret key; message communication is carried out by adopting the negotiation secret key, plaintext transmission of the secret key is avoided, and the communication security between the devices is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a secure communication method between devices, a gas meter and an alarm. Background Art

[0002] In the communication between devices, data transmission security must be guaranteed. Usually, symmetric encryption algorithms are used for data transmission between devices. Both parties in communication save the same secret key and use the same encryption and decryption algorithm.

[0003] For example, in the linkage between a gas meter and an alarm, the gas meter is injected with a secret key during the production process. The alarm writes the same secret key of the linked gas meter during the account opening process. Alternatively, during the interactive communication process with the gas meter, the gas meter writes the secret key into the alarm.

[0004] However, when the alarm writes the secret key, the secret key is transmitted in plain text, which cannot guarantee the security of the secret key and there is a possibility that the data transmission may be intercepted. Therefore, there are security risks in the data transmission between devices. Summary of the invention

[0005] The present invention provides a secure communication method between devices, a gas meter and an alarm to avoid plain text transmission of a secret key and improve the communication security between devices.

[0006] According to one aspect of the present invention, a method for secure communication between devices is provided. The method is used for secure communication between a first device and a second device. The method is performed by the first device and includes:

[0007] Receive a key negotiation request sent by a second device that has passed authentication and authorization; and determine a session initial key to be used in the key negotiation process;

[0008] Encrypting the first handshake information using the session initialization key, and sending the identification information of the first device and the encrypted first handshake information to the second device;

[0009] Obtaining the encrypted second handshake information sent by the second device when the identification information is verified, and the first information to be verified generated by fusing and encrypting the first handshake information and the identification information;

[0010] Decrypting the first information to be verified and the encrypted second handshake information using the session initial key, and parsing to obtain the first handshake information;

[0011] When the first handshake information is verified, the second handshake information and the identification information are merged, and the second information to be verified is generated by encrypting the session initial key; and the second information to be verified is sent to the second device;

[0012] Obtaining negotiation information generated by fusing and encrypting the first handshake information and the negotiation key, which is sent by the second device when the second handshake information is verified;

[0013] The negotiation information is decrypted using the session initial key, and the negotiation key is obtained by parsing; the negotiation key is used for message communication between devices in this session.

[0014] According to one aspect of the present invention, a method for secure communication between devices is provided. The method is used for secure communication between a first device and a second device. The method is performed by the second device. The method includes:

[0015] Sending a key negotiation request to the first device that has passed the authentication;

[0016] Acquire identification information of the first device and encrypted first handshake information sent by the first device;

[0017] When the identification information is verified, determining the session initialization key; and using the session initialization key to decrypt the encrypted first handshake information;

[0018] The first handshake information and the identification information are merged, and the first information to be verified is generated by encrypting the first information with the session initial key; the second handshake information is encrypted with the session initial key; and the first information to be verified and the encrypted second handshake information are sent to the first device;

[0019] Obtaining second information to be verified, which is generated by fusing and encrypting the second handshake information and the identification information and is sent by the first device when the first handshake information is verified;

[0020] Decrypting the second information to be verified by using the session initial key, and parsing to obtain the second handshake information;

[0021] When the second handshake information is verified, a negotiation key is generated, the first handshake information and the negotiation key are merged, and the negotiation information is generated by encrypting the session initial key;

[0022] The negotiation information is sent to the first device; and the negotiation key is used to perform message communication between devices in this session.

[0023] According to one aspect of the present invention, a method for secure communication between devices is provided, the method being used for secure communication between a first device and a second device, the method comprising:

[0024] The second device sends a key negotiation request to the first device which has passed the authentication;

[0025] The first device receives a key negotiation request sent by the second device that has passed authentication and authorization; and determines a session initial key required to be used in the key negotiation process;

[0026] The first device encrypts the first handshake information using the session initial key, and sends the identification information of the first device and the encrypted first handshake information to the second device;

[0027] When the identification information is verified, the second device determines the session initial key; and uses the session initial key to decrypt the encrypted first handshake information;

[0028] The second device merges the first handshake information and the identification information, and uses the session initial key to encrypt and generate the first information to be verified; uses the session initial key to encrypt the second handshake information; and sends the first information to be verified and the encrypted second handshake information to the first device;

[0029] The first device uses the session initial key to decrypt the first information to be verified and the encrypted second handshake information, and parses them to obtain the first handshake information;

[0030] When the first handshake information is verified, the first device merges the second handshake information and the identification information, and uses the session initial key to encrypt and generate second information to be verified; and sends the second information to be verified to the second device;

[0031] The second device uses the session initial key to decrypt the second information to be verified, and parses it to obtain the second handshake information;

[0032] When the second handshake information is verified, the second device generates a negotiation key, merges the first handshake information and the negotiation key, and uses the session initial key to encrypt and generate negotiation information; and sends the negotiation information to the first device;

[0033] The first device uses the session initial key to decrypt the negotiation information and parses it to obtain the negotiation key;

[0034] The first device and the second device use the negotiated key to perform message communication between the devices in this session.

[0035] According to another aspect of the present invention, a secure communication device between devices is provided, the device is used for secure communication between a first device and a second device, the device is executed by the first device, and the device includes:

[0036] The session initial key determination module is used to receive a key negotiation request sent by a second device that has passed authentication and authorization; and determine the session initial key required to be used in the key negotiation process;

[0037] A first handshake information sending module, configured to encrypt the first handshake information by using the session initial key, and send the identification information of the first device and the encrypted first handshake information to the second device;

[0038] A first information-to-be-verified acquisition module, used to acquire the encrypted second handshake information sent by the second device when the identification information is verified, and to merge and encrypt the first handshake information and the identification information to generate the first information to be verified;

[0039] A first information-to-be-verified parsing module, configured to decrypt the first information-to-be-verified and the encrypted second handshake information using the session initial key, and parse the encrypted second handshake information to obtain the first handshake information;

[0040] A second information-to-be-verified sending module, configured to merge the second handshake information and the identification information when the first handshake information is verified, and encrypt the second information-to-be-verified using the session initial key to generate the second information-to-be-verified; and send the second information-to-be-verified to the second device;

[0041] A negotiation information acquisition module, used to acquire the negotiation information generated by fusing and encrypting the first handshake information and the negotiation key, which is sent by the second device when the second handshake information is verified;

[0042] The message communication module is used to decrypt the negotiation information using the session initial key and parse it to obtain the negotiation key; and use the negotiation key to perform message communication between devices in this session.

[0043] According to another aspect of the present invention, there is provided a secure communication device between devices, the device being used for secure communication between a first device and a second device, the device being executed by the second device, the device comprising:

[0044] A key negotiation request sending module, used to send a key negotiation request to the first device that has passed the authentication and verification;

[0045] A first handshake information acquisition module, used to acquire identification information of the first device and encrypted first handshake information sent by the first device;

[0046] A first handshake information determination module, used to determine a session initialization key when the identification information is verified; and use the session initialization key to decrypt the encrypted first handshake information;

[0047] A second handshake information sending module is used to merge the first handshake information and the identification information, and encrypt the first information to be verified using the session initial key; encrypt the second handshake information using the session initial key; and send the first information to be verified and the encrypted second handshake information to the first device;

[0048] A second information-to-be-verified acquisition module, used to acquire second information-to-be-verified, which is generated by fusing and encrypting the second handshake information and the identification information and sent by the first device when the first handshake information is verified;

[0049] A second handshake information determination module, configured to use the session initial key to decrypt the second information to be verified, and parse the information to obtain the second handshake information;

[0050] A negotiation information generation module, used to generate a negotiation key when the second handshake information is verified, merge the first handshake information and the negotiation key, and encrypt the generated negotiation information using the session initial key;

[0051] The message communication module is used to send the negotiation information to the first device; and use the negotiation key to perform message communication between devices in this session.

[0052] According to another aspect of the present invention, a gas meter is provided, the gas meter comprising:

[0053] at least one processor; and

[0054] a memory communicatively connected to the at least one processor; wherein,

[0055] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the secure communication method between devices described in any embodiment of the present invention.

[0056] According to another aspect of the present invention, there is provided an alarm, the alarm comprising:

[0057] at least one processor; and

[0058] a memory communicatively connected to the at least one processor; wherein,

[0059] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the secure communication method between devices described in any embodiment of the present invention.

[0060] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the secure communication method between devices described in any embodiment of the present invention when executed.

[0061] According to another aspect of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method for secure communication between devices according to any embodiment of the present invention.

[0062] The technical solution of the embodiment of the present invention is as follows: receiving a key negotiation request sent by a second device that has passed authentication and authorization; determining a session initial key required for use in the key negotiation process; using the session initial key to encrypt a first handshake message, and sending identification information of the first device and the encrypted first handshake message to the second device; obtaining the encrypted second handshake message sent by the second device when the identification information is verified, and first information to be verified generated by fusing and encrypting the first handshake message and the identification information; using the session initial key to decrypt the first information to be verified and the encrypted second handshake message, and parsing to obtain the first handshake message; in the first handshake message When the information verification is passed, the second handshake information and the identification information are merged, and the session initial key is used to encrypt and generate the second information to be verified; the second information to be verified is sent to the second device; when the second handshake information verification is passed, the negotiation information generated by merging and encrypting the first handshake information and the negotiation key, which is sent by the second device, is obtained; the negotiation information is decrypted using the session initial key, and the negotiation key is parsed to obtain the negotiation key; the negotiation key is used to perform message communication between devices in this session, which solves the security problem of communication between devices, and encrypts the key in the negotiation session when the handshake is passed by encrypting the session handshake, thereby avoiding the plaintext transmission of the key and improving the communication security.

[0063] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 is a flow chart of a secure communication method between devices provided according to Embodiment 1 of the present invention;

[0066] Figure 2 This is a schematic diagram of a key setting strategy provided according to Embodiment 1 of the present invention;

[0067] Figure 3 is a flow chart of a secure communication method between devices provided according to Embodiment 2 of the present invention;

[0068] Figure 4 is a configuration timing diagram when a second device establishes a communication connection with a first device through a user application according to a second embodiment of the present invention;

[0069] Figure 5 is a flowchart of a secure communication method between devices provided according to Embodiment 3 of the present invention;

[0070] Figure 6 This is a timing diagram of an application example of a secure communication method between devices provided in Embodiment 3 of the present invention;

[0071] Figure 7 is a schematic diagram of the structure of a secure communication device between devices provided according to a fourth embodiment of the present invention;

[0072] Figure 8 is a schematic diagram of the structure of a secure communication device between devices provided according to Embodiment 5 of the present invention;

[0073] Fig. 9 It is a structural schematic diagram of a gas meter or an alarm that implements the secure communication method between devices according to an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0075] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0076] Embodiment 1

[0077] Figure 1This is a flow chart of a secure communication method between devices provided according to the first embodiment of the present invention. This embodiment can be applied to situations where data is securely transmitted between devices, such as secure data transmission when a gas meter is linked to an alarm. The method can be executed by a secure communication device between devices, which can be implemented in the form of hardware and / or software, and can be configured in electronic devices, such as gas meters, electricity meters, or water meters.

[0078] like Figure 1 As shown, the method can be performed by a first device such as a gas meter, and the method includes:

[0079] Step 110: Receive a key negotiation request sent by a second device that has passed authentication and authorization; and determine a session initial key required to be used in the key negotiation process.

[0080] Among them, the first device may be a gas meter. The second device may be an alarm. The gas meter and the alarm may perform authentication before performing key negotiation. Authentication may be to determine whether the gas meter communicating with the alarm is correct. For example, the gas meter that needs to be linked may be pre-configured in the alarm. Before the gas meter communicates with the alarm, the alarm may send the pre-configured gas meter information to the gas meter, and the gas meter compares the received gas meter information with its own information to see if it is consistent. When the information is consistent, it can be determined that the authentication is passed. For another example, the gas meter that needs to be linked may be pre-configured in the alarm. Before the gas meter communicates with the alarm, the gas meter may send its own information to the alarm, and the alarm compares the received information with the pre-configured gas meter information for consistency. When the information is consistent, it can be determined that the authentication is passed.

[0081] In order to further ensure the security of the gas meter information during authentication, in an optional implementation of an embodiment of the present invention, before receiving the key negotiation request sent by the second device that has passed the authentication, it also includes: establishing a communication connection with the second device, and obtaining the identification information to be authenticated that is encrypted using the target authentication key and sent by the second device; generating the identification information of the first device based on its own identification information; decrypting the encrypted identification information to be authenticated using the target authentication key, and verifying the consistency between the identification information of the first device and the identification information to be authenticated, so as to perform authentication.

[0082] The identification information to be authenticated sent by the second device may be generated by calculation based on the identification information of the first device. The identification information to be authenticated and the identification information of the first device may be generated by the same calculation method. The calculation method may be a logical operation based on the original identification information. The calculation method may be the same method agreed upon in advance by the alarm and the gas meter.

[0083] The target authentication key may be pre-written to the second device. For example, the target authentication key may be written to the second device through a user application. Alternatively, the target authentication key may be written to the second device through the first device. The first device may save the target authentication key. The first device may generate the target authentication key.

[0084] Exemplarily, the first device may determine the basic key according to the production information of the first device, and generate the target authentication key according to the basic key and its own identification information, wherein the production information includes but is not limited to the manufacturer code of the first device. Figure 2 Schematic diagram of a key setting strategy provided according to the first embodiment of the present invention. Figure 2 As shown, the basic key can be determined by combining the root password and the manufacturer code. The target authentication key can be determined by combining the basic key and the self-identification information of the first device. The self-identification information of the first device can be the meter steel number of the gas meter.

[0085] When the first device verifies that the identification information of the first device is consistent with the identification information to be authenticated, it can be determined that the first device and the second device have been authenticated successfully.

[0086] When the first device and the second device pass the authentication, a connection can be established to negotiate a session key. During the negotiation of the session key, a communication handshake can be performed using the session initial key, and the session key negotiation can be performed after the handshake is successful. The session initial key can be a key pre-agreed by the first device and the second device.

[0087] In order to further improve the security of the first device and the second device during the handshake phase, in an optional implementation of an embodiment of the present invention, determining the session initial key required for key negotiation includes: determining the session initial key required for key negotiation based on the target authentication key and key index information in the authentication and verification process; sending the identification information of the first device and the encrypted first handshake information to the second device, including: sending the identification information of the first device, the key index information and the encrypted first handshake information to the second device.

[0088] Among them, multiple group keys can be pre-set in both the first device and the second device. The group key is used to generate a session initial key in combination with the target authentication key. The group key can be determined by the key index information index. For example, Figure 2As shown, the first device and the second device can both set 8 group keys. The selected group key can be determined by the key index information. The first device can combine the target authentication key and the selected group key to generate a session initial key. The first device can send the key index information to the second device. The second device can determine the selected group key according to the key index information. The second device can generate a session initial key according to the target authentication key and the selected group key combination. Thus, the first device and the second device can ensure the consistency of the session initial key on the basis of avoiding the plaintext transmission of the key, thereby further improving the communication security.

[0089] Step 120: Encrypt the first handshake information using the session initialization key, and send the identification information of the first device and the encrypted first handshake information to the second device.

[0090] Among them, the first handshake information can be used by the first device to verify whether the data transmitted by the second device can be received normally. The setting of the first handshake information can be diverse. For example, the first handshake information can be a random number or can be pre-agreed fixed format data, etc., and the embodiment of the present invention does not specifically limit this. The identification information of the first device is used by the second device to verify the correctness of the connected first device. In order to ensure the security of the first device's own identification information in data transmission, the first device's own identification information can be calculated to generate the first device's identification information to avoid the first device's own identification information being directly transmitted in data interaction.

[0091] Optionally, when the first device determines the session initial key required to be used in the key negotiation process according to the key index information, the first device may also send the key index information to the second device.

[0092] Step 130: Obtain the encrypted second handshake information sent by the second device when the identification information is verified, and the first information to be verified generated by fusing and encrypting the first handshake information and the identification information.

[0093] The second device can verify the identification information of the first device to ensure the accuracy of the access of the first device and avoid abnormalities in the communication device, such as errors in connecting to other gas meters. When the second device establishes a connection with the first device, it can write the identification information of the first device through pre-configuration. When the second device obtains the identification information sent by the first device, it can compare the identification information. Alternatively, the second device can restore the identification information to the first device's own identification information and then compare it. When the comparison is consistent, the second device can determine that the identification information verification has passed.

[0094] The second device may merge the identification information and the first handshake information, and encrypt and generate the first information to be verified. The fusion method may be various, for example, the first handshake information and the identification information may be spliced. Alternatively, the first handshake information and the identification information may be subjected to a logical operation. The second device may encrypt the fusion result of the first handshake information and the identification information using the session initial key to generate the first information to be verified.

[0095] The second device may encrypt the second handshake information using the session initialization key. The second handshake information may be used by the second device to verify whether the data transmitted by the first device can be received normally. The second handshake information may be a random number or data in a preset fixed form, which is not specifically limited in the embodiment of the present invention. The second handshake information may be different from the first handshake information.

[0096] Step 140: Decrypt the first information to be verified and the encrypted second handshake information using the session initial key, and parse to obtain the first handshake information.

[0097] The first device can use the session initialization key to decrypt the first information to be verified, and obtain the fusion result of the first handshake information and the identification information. The first device can parse the fusion result of the first handshake information and the identification information to obtain the first handshake information. The parsing method corresponds to the fusion method of the second device. The first device and the second device can pre-agree on the fusion method, and the first device can parse in a manner corresponding to the fusion method. The first handshake information is retransmitted to the first device, so that the first device can verify whether the communication of the second device is normal. The first device obtains the second handshake information by decryption, so that the first device can send the ciphertext of the second handshake information to the second device, so that the second device can verify the communication of the first device.

[0098] Step 150: When the first handshake information is verified, the second handshake information and the identification information are merged, and the second information to be verified is generated by encrypting the information with the session initial key; and the second information to be verified is sent to the second device.

[0099] The first device can compare the first handshake information obtained by decryption and analysis with the first handshake information originally sent, and when the information is consistent, determine that the first handshake information is verified. The first device can merge the second handshake information with the identification information in the same way as the aforementioned first handshake information and identification information.

[0100] Step 160: Obtain negotiation information generated by fusing and encrypting the first handshake information and the negotiation key, which is sent by the second device when the second handshake information is verified.

[0101] The second device may use the session initial key to decrypt the second information to be verified, and obtain the fusion result of the second handshake information and the identification information. The second device may use a parsing method corresponding to the fusion method to parse the fusion result of the second handshake information and the identification information to obtain the second handshake information. The second device may check whether the parsed second handshake information is consistent with the sent second handshake information, and when the information is consistent, it is determined that the second handshake information is verified.

[0102] The second device can merge the first handshake information and the negotiation key, and then use the session initial key to encrypt it to generate the negotiation information. The fusion method can be the same as the fusion method of the first handshake information and the identification information mentioned above. The embodiment of the present invention does not specifically limit the fusion method. The negotiation key is generated by the second device, and the generation method is not limited. The negotiation key can be used only in this session, which can ensure that the key between the first device and the second device cannot be intercepted and obtained, thereby improving communication security. In different sessions, the negotiation key is also different, which enhances the dynamic nature of the key and improves communication security.

[0103] Step 170: Use the session initial key to decrypt the negotiation information and parse it to obtain the negotiation key; use the negotiation key to perform message communication between devices in this session.

[0104] The first device can parse the decryption result of the negotiation information according to the parsing method corresponding to the fusion method to obtain the negotiation key. In this session, when the first device sends information to the second device, it can use the negotiation key for encryption; when the second device sends information to the first device, it also uses the negotiation key for encryption. When the first device receives information sent by the second device, it uses the negotiation key for decryption; when the second device receives information sent by the first device, it uses the negotiation key for decryption.

[0105] The first device generates a target authentication key by combining its own identification information with the basic key; then determines the session initial key based on the target authentication key and the key index information, thereby improving the security of the session initial key and preventing the session initial key from being illegally discovered; further negotiation is performed on the basis of the session initial key to determine the negotiation key for formal communication between devices, completely hiding the negotiation key, avoiding plaintext transmission of the negotiation key, preventing the negotiation key from being illegally discovered, and improving the communication security between devices.

[0106] The technical solution of this embodiment is as follows: receiving a key negotiation request sent by a second device that has passed authentication and authorization; determining a session initial key to be used in the key negotiation process; encrypting a first handshake message using the session initial key, and sending identification information of the first device and the encrypted first handshake message to the second device; obtaining the encrypted second handshake message sent by the second device when the identification information is verified, and first information to be verified generated by fusing and encrypting the first handshake message and the identification information; decrypting the first information to be verified and the encrypted second handshake message using the session initial key, and parsing to obtain the first handshake message; in the first handshake message When the information verification is passed, the second handshake information and the identification information are merged, and the session initial key is used to encrypt and generate the second information to be verified; the second information to be verified is sent to the second device; when the second handshake information verification is passed, the negotiation information generated by merging and encrypting the first handshake information and the negotiation key, which is sent by the second device, is obtained; the session initial key is used to decrypt the negotiation information, and the negotiation key is obtained by parsing; the negotiation key is used to perform message communication between devices in this session, which solves the security problem of communication between devices, and encrypts the key in the negotiation session when the handshake is passed by encrypting the session, thereby avoiding the plaintext transmission of the key and improving the communication security.

[0107] Embodiment 2

[0108] Figure 3 This is a flow chart of a secure communication method between devices provided according to Embodiment 2 of the present invention. This embodiment can be applied to situations where data is securely transmitted between devices, such as secure data transmission when a gas meter is linked to an alarm. The method can be executed by a secure communication device between devices, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device such as an alarm.

[0109] like Figure 3 As shown, the method can be executed by a second device such as an alarm, and the method includes:

[0110] Step 310: Send a key negotiation request to the first device that has passed authentication and verification.

[0111] Among them, authentication can be to determine whether the first device connected to the second device is correct. For example, the second device can encrypt the identification information of the first device that is pre-configured and stored and send it to the first device. The first device can decrypt the identification information of the first device and compare it with the calculation result of its own identification information to determine whether the authentication is passed.

[0112] In order to improve the reliability of authentication and ensure the security of the first device information during data transmission, in an optional implementation of an embodiment of the present invention, before sending a key negotiation request to the first device that has passed the authentication and authentication, it also includes: establishing a communication connection with the first device, and using the target authentication key to encrypt the identification information to be authenticated; and sending the encrypted identification information to be authenticated to the first device; obtaining the authentication pass information determined by the first device based on the identification information to be authenticated.

[0113] In an optional implementation of an embodiment of the present invention, establishing a communication connection with a first device includes: responding to a user's connection request, establishing a connection with a user application and returning connection data; responding to a user's authentication and authorization request, performing authentication and authorization using an initial authentication key; obtaining a target authentication key encrypted using the initial authentication key and transmitted by the user application, and decrypting using the initial authentication key to obtain the target authentication key; wherein the target authentication key is generated by a basic key and identification information of the first device; obtaining identification information of the first device and encrypted communication address data of the first device encrypted using the target authentication key and transmitted by the user application; decrypting the encrypted identification information of the first device and the encrypted communication address data of the first device using the target authentication key, and establishing a communication connection with the first device based on the identification information of the first device and the communication address data of the first device.

[0114] Figure 4 This is a configuration sequence diagram when a second device establishes a communication connection with a first device through a user application according to the second embodiment of the present invention. Figure 4 As shown, when the second device is initially configured, the second device can be triggered to perform a device scan. The Media Access Control Address (MAC) of the first device is scanned by the user application to establish a connection between the second device and the first device. Among them, the first device and the second device can be connected by wireless means such as Bluetooth communication. When the second device connects to the first device by scanning the MAC address through the application, the second device can return connection data to the application to inform the user that the second device has been connected to the first device. The user can request data from the second device through the application (such as requesting a random number), and the second device can return data to determine that the connection is successful and can communicate. The application can use the initial authentication key to authenticate the second device. For example, the application can use the initial authentication key to encrypt the request data and send it to the second device. The second device can maintain the initial authentication key in advance, and use the initial authentication key to decrypt the request data to obtain the request data, and compare the information with the request data originally sent. If the information comparison passes, it can be determined that the authentication is passed.

[0115] After the authentication is passed, in order to further ensure the reliability and security of the authentication in the session, the application can encrypt the target authentication key with the initial authentication key and transmit it to the second device. When the application determines the target authentication key, it can do so by Figure 2 The key generation method shown is determined, that is, the target authentication key is generated by combining the basic key and the identification information of the first device. The second device uses the initial authentication key to decrypt and obtain the target authentication key. The application can encrypt the identification information of the first device and the communication address data of the first device respectively by the target authentication key, and send them to the second device. The second device uses the target authentication key to decrypt and obtain the identification information of the first device and the communication address data of the first device.

[0116] The communication address data of the first device can be used by the second device to find the first device to establish a connection. The identification information of the first device can be used by the second device to authenticate the connected first device to determine that the connected device is correct.

[0117] After the configuration is completed through the application, the second device and the first device can be connected for authentication through the target authentication key. For example, when a gas meter fails or is abnormal and an alarm is required, the alarm can establish a connection through the communication address data of the gas meter and authenticate the identification information of the gas meter through the target authentication key.

[0118] By updating the initial authentication key during the configuration phase to generate a target authentication key, and using the target authentication key for subsequent authentication, it is possible to further prevent the key from being illegally discovered, improve the reliability and security of authentication, and thus ensure the security of communication between the first device and the second device.

[0119] Step 320: Acquire identification information of the first device and encrypted first handshake information sent by the first device.

[0120] Optionally, obtaining identification information of the first device and encrypted first handshake information sent by the first device includes: obtaining identification information of the first device, key index information, and encrypted first handshake information sent by the first device.

[0121] Step 330: When the identification information is verified, determine the session initial key; and use the session initial key to decrypt the encrypted first handshake information.

[0122] Optionally, when the identification information is verified, determining the session initial key includes: determining the session initial key according to the target authentication key and key index information in the authentication and certification.

[0123] Step 340: merge the first handshake information and the identification information, and encrypt the first information to be verified using the session initial key; encrypt the second handshake information using the session initial key; and send the first information to be verified and the encrypted second handshake information to the first device.

[0124] Step 350: Obtain second information to be verified, which is generated by fusing and encrypting the second handshake information and the identification information and sent by the first device when the first handshake information is verified.

[0125] Step 360: Decrypt the second information to be verified using the session initial key, and parse to obtain the second handshake information.

[0126] Step 370: When the second handshake information is verified, a negotiation key is generated, the first handshake information and the negotiation key are merged, and the negotiation information is generated by encrypting the session initial key.

[0127] Step 380: Send the negotiation information to the first device; and use the negotiation key to perform message communication between devices in this session.

[0128] The technical solution of the embodiment of the present invention includes sending a key negotiation request to a first device that has passed authentication and verification; obtaining identification information of the first device and encrypted first handshake information sent by the first device; determining a session initial key when the identification information is verified; and using the session initial key to decrypt the encrypted first handshake information; fusing the first handshake information and the identification information, and encrypting the first information to be verified using the session initial key; encrypting the second handshake information using the session initial key; sending the first information to be verified and the encrypted second handshake information to the first device; obtaining the information sent by the first device when the first handshake information is verified The second handshake information and the identification information are merged and encrypted to generate the second information to be verified; the second information to be verified is decrypted using the session initial key, and the second handshake information is parsed; when the second handshake information is verified, a negotiation key is generated, the first handshake information and the negotiation key are merged, and the negotiation information is encrypted using the session initial key; the negotiation information is sent to the first device; and the negotiation key is used for message communication between devices in this session, which solves the security problem in communication between devices, and encrypts the key in the negotiation session when the handshake passes by encrypting the session handshake, thereby avoiding plaintext transmission of the key and improving communication security.

[0129] Embodiment 3

[0130] Figure 5 1 is a flowchart of a secure communication method between devices provided according to Embodiment 3 of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with each optional solution in one or more of the above embodiments. Figure 5As shown, the method is used for secure communication between a first device and a second device, and the method includes:

[0131] Step 510: The second device sends a key negotiation request to the first device that has passed authentication.

[0132] Optionally, before the second device sends a key negotiation request to the first device that has passed the authentication, it also includes: the first device establishes a communication connection with the second device, and the second device sends the identification information to be authenticated that is encrypted using the target authentication key to the first device; the first device performs calculations based on its own identification information to generate the identification information of the first device; the first device uses the target authentication key to decrypt the encrypted identification information to be authenticated, and verifies the consistency between the identification information of the first device and the identification information to be authenticated, so as to perform authentication.

[0133] Optionally, the first device establishes a communication connection with the second device, including: the second device responds to the user's connection request, establishes a connection with the user application and returns connection data; the second device responds to the user's authentication and authorization request, and uses the initial authentication key to perform authentication and authorization; the second device obtains the target authentication key encrypted with the initial authentication key and transmitted by the user application, and decrypts it with the initial authentication key to obtain the target authentication key; wherein the target authentication key is generated by the basic key and the identification information of the first device; the second device obtains the identification information of the first device and the encrypted communication address data of the first device encrypted with the target authentication key and transmitted by the user application; the second device uses the target authentication key to decrypt the encrypted identification information of the first device and the encrypted communication address data of the first device, and establishes a communication connection with the first device based on the identification information of the first device and the communication address data of the first device.

[0134] Step 520: The first device receives a key negotiation request sent by the second device that has passed authentication and verification; and determines a session initial key required to be used in the key negotiation process.

[0135] Optionally, the first device determines a session initial key required for use in a key negotiation process, including: the first device determines the session initial key required for use in a key negotiation process according to a target authentication key and key index information in the authentication and verification process.

[0136] Step 530: The first device encrypts the first handshake information using the session initialization key, and sends the identification information of the first device and the encrypted first handshake information to the second device.

[0137] Optionally, the first device sends the identification information of the first device and the encrypted first handshake information to the second device, including: the first device sends the identification information of the first device, key index information, and the encrypted first handshake information to the second device.

[0138] Step 540: When the identification information is verified, the second device determines the session initialization key; and uses the session initialization key to decrypt the encrypted first handshake information.

[0139] Optionally, when the identification information is verified, the second device determines the session initial key, including: the second device determines the session initial key according to the target authentication key and key index information in the authentication.

[0140] Step 550: The second device merges the first handshake information and the identification information, and generates the first information to be verified by encrypting the information with the session initial key; encrypts the second handshake information with the session initial key; and sends the first information to be verified and the encrypted second handshake information to the first device.

[0141] Step 560: The first device uses the session initialization key to decrypt the first information to be verified and the encrypted second handshake information, and parses them to obtain the first handshake information.

[0142] Step 570: When the first handshake information is verified, the first device merges the second handshake information and the identification information, and encrypts the second information to be verified using the session initial key; and sends the second information to be verified to the second device.

[0143] Step 580: The second device uses the session initial key to decrypt the second information to be verified, and parses it to obtain the second handshake information.

[0144] Step 590: When the second handshake information is verified, the second device generates a negotiation key, merges the first handshake information and the negotiation key, and encrypts the generated negotiation information using the session initial key; and sends the negotiation information to the first device.

[0145] Step 5100: The first device uses the session initial key to decrypt the negotiation information and parses it to obtain the negotiation key.

[0146] Step 5110: The first device and the second device use the negotiated key to perform message communication between the devices in this session.

[0147] The technical solution of the embodiment of the present invention is as follows: a second device sends a key negotiation request to a first device that has passed authentication and authentication; the first device receives the key negotiation request sent by the second device that has passed authentication and authentication; and determines the session initial key required for the key negotiation process; the first device uses the session initial key to encrypt the first handshake information, and sends the identification information of the first device and the encrypted first handshake information to the second device; when the identification information is verified, the second device determines the session initial key; and uses the session initial key to decrypt the encrypted first handshake information; the second device merges the first handshake information and the identification information, and uses the session initial key to encrypt and generate the first information to be verified; uses the session initial key to encrypt the second handshake information; sends the first information to be verified and the encrypted second handshake information to the first device; the first device uses the session initial key to decrypt the first information to be verified and the encrypted second handshake information, and The first handshake information is obtained by parsing; when the first handshake information is verified, the first device merges the second handshake information and the identification information, and uses the session initial key to encrypt and generate the second information to be verified; the second information to be verified is sent to the second device; the second device uses the session initial key to decrypt the second information to be verified, and parses to obtain the second handshake information; when the second handshake information is verified, the second device generates a negotiation key, merges the first handshake information and the negotiation key, and uses the session initial key to encrypt and generate the negotiation information; the negotiation information is sent to the first device; the first device uses the session initial key to decrypt the negotiation information, and parses to obtain the negotiation key; the first device and the second device use the negotiation key to perform message communication between devices in this session, which solves the security problem when communicating between devices, and encrypts the key in the negotiation session when the handshake passes by encrypting the session handshake, avoiding the plaintext transmission of the key, and improving the communication security.

[0148] Figure 6 1 is a timing diagram of an application example of a secure communication method between devices provided according to Embodiment 3 of the present invention. Figure 6 As shown, the first device is a gas meter and the second device is an alarm. The alarm can be Figure 4 The timing diagram shown is pre-configured. When the gas meter and the alarm negotiate the session key, the alarm and the gas meter can first establish a connection via Bluetooth. The alarm can initiate authentication for the gas meter, encrypt the identification information to be authenticated by using the target authentication key, and send it to the gas meter. The gas meter can generate the identification information of the gas meter based on its own identification information to avoid direct transmission of its own identification information in communication, which may cause information leakage. The gas meter determines the target authentication key through the basic key and its own identification information, and uses the target authentication key to decrypt and obtain the identification information to be authenticated. The gas meter compares the identification information to be authenticated with the identification information of the gas meter to determine whether the two are the same. If the two are the same, it is determined that the authentication is passed.

[0149] like Figure 6 As shown, when the authentication is passed, the alarm can send a key negotiation request to the gas meter. The gas meter can generate a first random number and determine the key index information. The gas meter determines the session initial key required for the key negotiation process through the target authentication key and the key index information. The gas meter encrypts the first random number with the session initial key and sends it to the alarm. At the same time, the gas meter sends the key index information and the identification information of the gas meter to the alarm.

[0150] like Figure 6 As shown, the alarm verifies the identification information of the gas meter. When it is determined that it is consistent with the identification information stored in the pre-configuration, the alarm determines the session initial key according to the key index information, and uses the session initial key to decrypt to obtain the first random number. The alarm concatenates the first random number and the identification information of the gas meter and encrypts it using the session initial key to generate the first information to be verified. The alarm generates a second random number and encrypts the second random number using the session initial key. The alarm sends the first information to be verified and the encrypted second random number to the gas meter.

[0151] like Figure 6 As shown, the gas meter uses the session initial key to decrypt the first information to be verified and parses it to obtain a first random number. The gas meter verifies the consistency of the first random number. When the verification is passed, the gas meter uses the session initial key to decrypt and obtain a second random number. The gas meter concatenates the second random number and the identification information of the gas meter and encrypts it using the session initial key to generate the second information to be verified. The gas meter sends the second information to the alarm.

[0152] like Figure 6 As shown, the alarm uses the session initial key to decrypt the second verification information and parses it to obtain a second random number. The alarm verifies the consistency of the second random number. When the verification is passed, the alarm generates a negotiation key, merges the first random number and the negotiation key, and uses the session initial key to encrypt and generate negotiation information. The alarm sends the negotiation information to the gas meter.

[0153] like Figure 6 As shown in the figure, the gas meter uses the session initial key to decrypt the negotiation information and parse it to obtain the negotiation key. The alarm and the gas meter encrypt the subsequent message communication of this session with the negotiation key. By updating the authentication key in the authentication stage, determining the session initial key based on the target authentication key, and then negotiating the session key based on the session initial key, the negotiation key is finally used for the formal conversation between the alarm and the gas meter. On the basis of being able to effectively verify the correctness of the connection between the two parties, the key is prevented from being discovered, ensuring the communication security between the alarm and the gas meter.

[0154] Embodiment 4

[0155] Figure 7 1 is a schematic diagram of the structure of a secure communication device between devices provided according to Embodiment 4 of the present invention. Figure 7 As shown, the apparatus is executed by the first device, and includes: a session initial key determination module 710, a first handshake information sending module 720, a first to-be-verified information acquisition module 730, a first to-be-verified information parsing module 740, a second to-be-verified information sending module 750, a negotiation information acquisition module 760 and a message communication module 770. Among them:

[0156] The session initial key determination module 710 is used to receive a key negotiation request sent by a second device that has passed authentication and verification; and determine the session initial key to be used in the key negotiation process;

[0157] A first handshake information sending module 720 is used to encrypt the first handshake information by using the session initial key, and send the identification information of the first device and the encrypted first handshake information to the second device;

[0158] The first information to be verified acquisition module 730 is used to acquire the encrypted second handshake information sent by the second device when the identification information is verified, and to merge and encrypt the first handshake information and the identification information to generate the first information to be verified;

[0159] The first verification information parsing module 740 is used to decrypt the first verification information and the encrypted second handshake information using the session initial key, and parse to obtain the first handshake information;

[0160] The second information to be verified sending module 750 is used to merge the second handshake information and the identification information when the first handshake information is verified, and encrypt the second information to be verified using the session initial key; and send the second information to be verified to the second device;

[0161] The negotiation information acquisition module 760 is used to obtain the negotiation information generated by fusing and encrypting the first handshake information and the negotiation key, which is sent by the second device when the second handshake information is verified;

[0162] The message communication module 770 is used to decrypt the negotiation information using the session initial key and parse it to obtain the negotiation key; and use the negotiation key to perform message communication between devices in this session.

[0163] Optionally, the session initial key determination module 710 includes:

[0164] The session initial key determination unit is used to determine the session initial key required to be used in the key negotiation process according to the target authentication key and key index information in the authentication process;

[0165] The first handshake information sending module 720 includes:

[0166] The first handshake information sending unit is used to send the identification information, key index information and encrypted first handshake information of the first device to the second device.

[0167] Optionally, the device further includes:

[0168] The module for acquiring identification information to be authenticated is used to establish a communication connection with the second device before receiving a key negotiation request sent by the second device that has passed the authentication, and to acquire the identification information to be authenticated encrypted with the target authentication key sent by the second device;

[0169] An identification information generating module, used to generate identification information of the first device by performing calculations based on its own identification information;

[0170] The authentication module is used to decrypt the encrypted identification information to be authenticated using the target authentication key, and verify the consistency between the identification information of the first device and the identification information to be authenticated, so as to perform authentication.

[0171] Optionally, the device further includes:

[0172] The target authentication key generation module is used to determine the basic key according to the production information of the first device, and generate the target authentication key according to the basic key and its own identification information.

[0173] The device for secure communication between devices provided in the embodiment of the present invention can execute the method for secure communication between devices provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0174] Embodiment 5

[0175] Figure 8 1 is a schematic diagram of the structure of a secure communication device between devices provided according to Embodiment 5 of the present invention. Figure 8 As shown, the apparatus is executed by the second device, and includes: a key negotiation request sending module 810, a first handshake information acquisition module 820, a first handshake information determination module 830, a second handshake information sending module 840, a second to-be-verified information acquisition module 850, a second handshake information determination module 860, a negotiation information generation module 870, and a message communication module 880. Among them:

[0176] A key negotiation request sending module 810 is used to send a key negotiation request to the first device that has passed the authentication and verification;

[0177] A first handshake information acquisition module 820, configured to acquire identification information of the first device and encrypted first handshake information sent by the first device;

[0178] The first handshake information determination module 830 is used to determine the session initial key when the identification information is verified; and use the session initial key to decrypt the encrypted first handshake information;

[0179] The second handshake information sending module 840 is used to merge the first handshake information and the identification information, and encrypt the first information to be verified using the session initial key; encrypt the second handshake information using the session initial key; and send the first information to be verified and the encrypted second handshake information to the first device;

[0180] The second information to be verified acquisition module 850 is used to acquire the second information to be verified, which is generated by fusing and encrypting the second handshake information and the identification information and sent by the first device when the first handshake information is verified;

[0181] A second handshake information determination module 860 is used to decrypt the second information to be verified using the session initial key and parse it to obtain the second handshake information;

[0182] The negotiation information generation module 870 is used to generate a negotiation key when the second handshake information is verified, merge the first handshake information and the negotiation key, and encrypt the generated negotiation information using the session initial key;

[0183] The message communication module 880 is used to send the negotiation information to the first device; and use the negotiation key to perform message communication between devices in this session.

[0184] Optionally, the first handshake information acquisition module 820 includes:

[0185] A first handshake information acquisition unit, configured to acquire identification information of the first device, key index information, and encrypted first handshake information sent by the first device;

[0186] The first handshake information determining module 830 includes:

[0187] The session initial key determination unit is used to determine the session initial key according to the target authentication key and key index information in the authentication and certification.

[0188] Optionally, the device further includes:

[0189] The module for sending identification information to be authenticated is used to establish a communication connection with the first device before sending a key negotiation request to the first device that has passed the authentication, encrypt the identification information to be authenticated using the target authentication key; and send the encrypted identification information to be authenticated to the first device;

[0190] The authentication and authorization information acquisition module is used to obtain the authentication and authorization information determined by the first device according to the identification information to be authenticated.

[0191] Optionally, the module for sending identification information to be authenticated includes:

[0192] A connection establishing unit, for responding to a user's connection request, establishing a connection with a user application and returning connection data;

[0193] An authentication unit, used to respond to an authentication request from a user and perform authentication using an initial authentication key;

[0194] A determination unit, used to obtain a target authentication key encrypted with an initial authentication key and transmitted by a user application, and decrypt the target authentication key with the initial authentication key;

[0195] Wherein, the target authentication key is generated by the basic key and the identification information of the first device;

[0196] A first device information acquisition unit, used to acquire identification information of the first device and encrypted communication address data of the first device transmitted by a user application using a target authentication key;

[0197] The communication connection establishing unit is used to decrypt the encrypted identification information of the first device and the encrypted communication address data of the first device using the target authentication key, and establish a communication connection with the first device according to the identification information of the first device and the communication address data of the first device.

[0198] The device for secure communication between devices provided in the embodiment of the present invention can execute the method for secure communication between devices provided in any embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method.

[0199] Embodiment 6

[0200] Fig. 9 The structural diagram of a gas meter or alarm that can be used to implement an embodiment of the present invention is shown. The components, their connections and relationships, and their functions shown herein are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0201] like Fig. 9As shown, the gas meter or alarm includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the gas meter or alarm can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0202] A number of components in the gas meter or alarm are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the gas meter or alarm to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0203] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as secure communication between devices.

[0204] In some embodiments, secure communication between devices may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on a gas meter or alarm via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of secure communication between devices described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform secure communication between devices in any other appropriate manner (e.g., by means of firmware).

[0205] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0206] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0207] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0208] To provide interaction with a user, the systems and techniques described herein may be implemented on a gas meter or alarm having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which a user may provide input to the gas meter or alarm. Other types of devices may also be used to provide interaction with a user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0209] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0210] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0211] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0212] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A secure communication method between devices, characterized in that: The method is used for secure communication between a first device and a second device, and the method is performed by the first device. The method includes: Receive a key negotiation request sent by a second device that has passed authentication and authorization; and determine a session initial key to be used in the key negotiation process; Encrypting the first handshake information using the session initialization key, and sending the identification information of the first device and the encrypted first handshake information to the second device; Obtaining the encrypted second handshake information sent by the second device when the identification information is verified, and the first information to be verified generated by fusing and encrypting the first handshake information and the identification information; Decrypting the first information to be verified and the encrypted second handshake information using the session initial key, and parsing to obtain the first handshake information; When the first handshake information is verified, the second handshake information and the identification information are merged, and the second information to be verified is generated by encrypting the session initial key; and the second information to be verified is sent to the second device; Obtaining negotiation information generated by fusing and encrypting the first handshake information and the negotiation key, which is sent by the second device when the second handshake information is verified; The negotiation information is decrypted using the session initial key, and the negotiation key is obtained by parsing; the negotiation key is used for message communication between devices in this session.

2. The method according to claim 1, characterized in that Determine the session initial key to be used during key negotiation, including: Determine the session initial key required for key negotiation based on the target authentication key and key index information in the authentication process; Sending the identification information of the first device and the encrypted first handshake information to the second device includes: The identification information of the first device, the key index information, and the encrypted first handshake information are sent to the second device.

3. The method according to claim 1, characterized in that: Before receiving the key negotiation request sent by the second device that has passed the authentication, the method further includes: Establishing a communication connection with a second device, and obtaining identification information to be authenticated that is encrypted using a target authentication key and sent by the second device; Generate identification information of the first device by performing calculation according to its own identification information; The target authentication key is used to decrypt the encrypted identification information to be authenticated, and the consistency between the identification information of the first device and the identification information to be authenticated is verified to perform authentication.

4. A secure communication method between devices, characterized in that: The method is used for secure communication between a first device and a second device, and the method is performed by the second device. The method includes: Sending a key negotiation request to the first device that has passed the authentication; Acquire identification information of the first device and encrypted first handshake information sent by the first device; When the identification information is verified, determining the session initialization key; and using the session initialization key to decrypt the encrypted first handshake information; The first handshake information and the identification information are merged, and the first information to be verified is generated by encrypting the first information with the session initial key; the second handshake information is encrypted with the session initial key; and the first information to be verified and the encrypted second handshake information are sent to the first device; Obtaining second information to be verified, which is generated by fusing and encrypting the second handshake information and the identification information and sent by the first device when the first handshake information is verified; Decrypting the second information to be verified by using the session initial key, and parsing to obtain the second handshake information; When the second handshake information is verified, a negotiation key is generated, the first handshake information and the negotiation key are merged, and the negotiation information is generated by encrypting the session initial key; The negotiation information is sent to the first device; and the negotiation key is used to perform message communication between devices in this session.

5. The method according to claim 4, characterized in that Acquiring identification information of the first device and encrypted first handshake information sent by the first device, including: Obtaining identification information of the first device, key index information, and encrypted first handshake information sent by the first device; When the identification information is verified, the session initial key is determined, including: Determine the session initial key based on the target authentication key in the authentication and the key index information.

6. The method according to claim 4, characterized in that Before sending a key negotiation request to the first device that has passed the authentication, the method further includes: Establishing a communication connection with the first device, encrypting the identification information to be authenticated using the target authentication key; and sending the encrypted identification information to be authenticated to the first device; Acquire authentication and authorization passing information determined by the first device according to the identification information to be authenticated.

7. The method according to claim 6, characterized in that Establishing a communication connection with a first device, comprising: In response to the user's connection request, establish a connection with the user application and return connection data; In response to the user's authentication request, the initial authentication key is used to perform authentication; Obtaining a target authentication key encrypted with the initial authentication key and transmitted by a user application, and decrypting the target authentication key with the initial authentication key; Wherein, the target authentication key is generated by the basic key and the identification information of the first device; Obtaining identification information of a first device and encrypted communication address data of the first device transmitted by a user application using a target authentication key; The encrypted identification information of the first device and the encrypted communication address data of the first device are decrypted using the target authentication key, and a communication connection is established with the first device according to the identification information of the first device and the communication address data of the first device.

8. A secure communication method between devices, characterized in that: The method is used for secure communication between a first device and a second device, and the method comprises: The second device sends a key negotiation request to the first device which has passed the authentication; The first device receives a key negotiation request sent by the second device that has passed authentication and authorization; and determines a session initial key required to be used in the key negotiation process; The first device encrypts the first handshake information using the session initial key, and sends the identification information of the first device and the encrypted first handshake information to the second device; When the identification information is verified, the second device determines the session initial key; and uses the session initial key to decrypt the encrypted first handshake information; The second device merges the first handshake information and the identification information, and uses the session initial key to encrypt and generate the first information to be verified; uses the session initial key to encrypt the second handshake information; and sends the first information to be verified and the encrypted second handshake information to the first device; The first device uses the session initial key to decrypt the first information to be verified and the encrypted second handshake information, and parses them to obtain the first handshake information; When the first handshake information is verified, the first device merges the second handshake information and the identification information, and uses the session initial key to encrypt and generate second information to be verified; and sends the second information to be verified to the second device; The second device uses the session initial key to decrypt the second information to be verified, and parses it to obtain the second handshake information; When the second handshake information is verified, the second device generates a negotiation key, merges the first handshake information and the negotiation key, and uses the session initial key to encrypt and generate negotiation information; and sends the negotiation information to the first device; The first device uses the session initial key to decrypt the negotiation information and parses it to obtain the negotiation key; The first device and the second device use the negotiated key to perform message communication between the devices in this session.

9. A gas meter, characterized in that: The gas meter comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for secure communication between devices according to any one of claims 1 to 3.

10. An alarm, characterized in that: The alarm comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for secure communication between devices according to any one of claims 4 to 7.

Images