Method and system for providing national cryptographic algorithm for equipment and platform, equipment and medium

Abstract

The invention provides a method and system for providing a national cryptographic algorithm for equipment and a platform, electronic equipment and a storage medium, and aims to solve the problems that a communication key between the equipment and the platform is quite fixed and encryption communication modes are not unified. Obtaining a first dynamic key sent to the Internet of Things platform by the unified password service platform; encrypting the first original data by using the first dynamic key to obtain a first ciphertext; encrypting the first dynamic key through the equipment public key; and sending the encrypted first dynamic key and the first ciphertext to the Internet of Things equipment, so that the Internet of Things equipment decrypts the encrypted first dynamic key by using the equipment private key to obtain the first dynamic key, and decrypts the first ciphertext by using the first dynamic key to obtain first original data. The cryptographic algorithm can be provided for the equipment and the platform, and the security of data storage is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data encryption technology, and in particular to a method for providing a national encryption algorithm for a device and a platform, a system for providing a national encryption algorithm for a device and a platform, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the rapid development of information technology, the information security situation is becoming increasingly severe. Traditional cryptographic algorithms can no longer meet the growing demand for information security. At present, most of the mainstream cryptographic algorithms in the world are developed by the United States and other Western countries, and there is a risk of being stolen or cracked. Based on the above background, the national secret algorithm began to be developed. The development of the national secret algorithm took many years, and after rigorous security evaluation and trial, it has now been officially released. Including symmetric cryptographic algorithm SM4, asymmetric cryptographic algorithm SM2, hash algorithm SM3, etc. However, there is a lack of platforms in the market that can provide national secret algorithms for all IoT devices and IoT platforms. In addition, there are the following problems:

[0003] 1. Currently, the communication between IoT devices and platforms is generally in plain text or encrypted only during device authentication, and the national encryption algorithm is used.

[0004] 2. Some implementations only implement a single encryption method and cannot provide more options for devices and platforms. The keys are relatively fixed and not flexible enough to use. The encryption method lacks compatibility and scalability.

[0005] 3. The encryption communication method between devices is not unified, which is not conducive to system access and device interaction.

[0006] 4. The existing solutions are all for encryption and decryption of stored data, and rarely involve encryption and decryption of data between device communications and platform interactions. Summary of the invention

[0007] In order to at least solve the problem in the prior art that the communication keys between IoT devices and platforms are quite fixed, and the encrypted communication methods between devices are not unified, the present disclosure provides a method for providing national secret algorithms for devices and platforms, a system, an electronic device, and a computer-readable storage medium for providing national secret algorithms for devices and platforms, adopts a unified password resource pool, provides key exchange and key rotation, provides unified encryption and decryption operations, provides different encryption services for system platform services and hardware devices, improves the security of keys, and prevents keys from being cracked.

[0008] In a first aspect, the present disclosure provides a method for providing a national encryption algorithm for a device and a platform, which is applied to an Internet of Things platform, and the method includes:

[0009] After preparing the first original data to be sent to the IoT device, obtaining the first dynamic key sent by the unified cryptographic service platform to the IoT platform;

[0010] Encrypting the first original data using the first dynamic key through the SDK (Software Development Kit) of the Internet of Things platform to obtain a first ciphertext;

[0011] Encrypting the first dynamic key by using the public key of the Internet of Things device to obtain an encrypted first dynamic key;

[0012] The encrypted first dynamic key and the first ciphertext are sent to the IoT device, so that the IoT device uses the IoT device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0013] Furthermore, the method further comprises:

[0014] Receiving a second ciphertext and an encrypted second dynamic key sent by the IoT device, wherein the second ciphertext is obtained by the IoT device generating a random second dynamic key using a symmetric encryption algorithm, and encrypting the second original data using the generated second dynamic key, and the encrypted second dynamic key is obtained by the IoT device encrypting the second dynamic key using the public key of the IoT platform;

[0015] Decrypting the encrypted second dynamic key using the private key of the Internet of Things platform to obtain the second dynamic key;

[0016] The second ciphertext is decrypted using the second dynamic key obtained through the SDK of the Internet of Things platform to obtain the second original data.

[0017] Furthermore,

[0018] The algorithm for encrypting the first original data using the first dynamic key through the SDK of the Internet of Things platform is the SM4 algorithm;

[0019] The algorithm for encrypting the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key is the SM9 algorithm.

[0020] Furthermore, the method further comprises:

[0021] Receive registration requests sent by IoT devices;

[0022] Generate a random number and return it to the IoT device, so that the IoT device encrypts the random number using the private key of the IoT device to obtain a third ciphertext, and send the random number and the third ciphertext to the IoT platform;

[0023] Decrypting the third ciphertext using the public key of the IoT device to obtain decrypted data of the third ciphertext;

[0024] The decrypted data of the third ciphertext is compared with the random number, and if they are consistent, the IoT device identity is set as verification success.

[0025] Furthermore, the method further comprises:

[0026] Receiving an IoT device ID added by the IoT device in the registration request;

[0027] Storing the association between the IoT device ID and the random number;

[0028] Receiving an IoT device ID sent by the IoT device simultaneously with sending the random number and the third ciphertext;

[0029] Verify whether the correspondence between the IoT device ID and the random number is correct. If correct, decrypt the third ciphertext.

[0030] Furthermore, the method further comprises:

[0031] Receiving an IoT device ID sent by the IoT device when sending the second ciphertext and the encrypted second dynamic key to the IoT platform;

[0032] The IoT device ID is used to determine whether the IoT device is a device registered on the platform, and if it is determined to be, the data is stored in a database corresponding to the IoT device.

[0033] In a second aspect, the present disclosure provides a method for providing a national encryption algorithm for a device and a platform, which is applied to an Internet of Things device, and the method includes:

[0034] Receiving a first ciphertext and an encrypted first dynamic key sent by the Internet of Things platform, wherein the encrypted first dynamic key is obtained by the Internet of Things platform obtaining the first dynamic key from the unified cryptographic service platform after preparing the first original data to be sent to the Internet of Things device, and encrypting the first dynamic key by using the public key of the Internet of Things device, and the first ciphertext is obtained by the Internet of Things platform encrypting the first original data by using the first dynamic key through the SDK of the Internet of Things platform;

[0035] Decrypt the encrypted first dynamic key using the IoT device private key to obtain the first dynamic key;

[0036] The first ciphertext is decrypted using a first dynamic key to obtain first original data.

[0037] Furthermore, the method further comprises:

[0038] Generate a random second dynamic key using a symmetric encryption algorithm;

[0039] The second original data is encrypted using the generated second dynamic key to obtain a second ciphertext;

[0040] Encrypting the second dynamic key using the public key of the Internet of Things platform to obtain an encrypted second dynamic key;

[0041] The second ciphertext and the encrypted second dynamic key are sent to the Internet of Things platform, so that after receiving the data, the Internet of Things platform uses the private key of the Internet of Things platform to decrypt the encrypted second dynamic key to obtain the second dynamic key, and uses the decrypted second dynamic key to decrypt the second ciphertext through the SDK of the Internet of Things platform to obtain the second original data.

[0042] Furthermore, the method further comprises:

[0043] Send a registration request to the IoT platform, so that the IoT platform generates a random number and returns it to the IoT device;

[0044] Encrypt the random number using the private key of the IoT device to obtain a third ciphertext;

[0045] The random number and the third ciphertext are sent to the IoT platform, so that the IoT platform uses the public key of the IoT device to decrypt the third ciphertext to obtain decrypted data of the third ciphertext, and compares the decrypted data of the third ciphertext with the random number. If they are consistent, the identity of the IoT device is set to be successfully verified.

[0046] Furthermore, the method further comprises:

[0047] Adding the IoT device ID to the registration request so that the IoT platform stores the association between the IoT device ID and the random number;

[0048] When sending the random number and the third ciphertext, the IoT device ID is simultaneously sent to the IoT platform, so that the IoT platform verifies whether the corresponding relationship between the IoT device ID and the random number is correct. If correct, the third ciphertext is decrypted.

[0049] Furthermore, the method further comprises:

[0050] When sending the second ciphertext and the encrypted second dynamic key, the IoT device ID is sent to the IoT platform at the same time, so that the IoT platform determines whether the IoT device is a device registered on this platform through the IoT device ID, and stores the data in a database corresponding to the IoT device after determining that it is.

[0051] In a third aspect, the present disclosure provides a method for providing a national secret algorithm for a device and a platform, which is applied to a unified cryptographic service platform, and the method includes:

[0052] After the IoT platform prepares the first original data to be sent to the IoT device, the first dynamic key is sent to the IoT platform, so that the IoT platform uses the first dynamic key to encrypt the first original data through the SDK of the IoT platform to obtain the first ciphertext, and encrypts the first dynamic key through the public key of the IoT device to obtain the encrypted first dynamic key, and sends the encrypted first dynamic key and the first ciphertext to the IoT device; the IoT device uses the private key of the IoT device to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0053] In a fourth aspect, the present disclosure provides a system for providing a national secret algorithm for a device and a platform, the system comprising an Internet of Things platform, the Internet of Things platform comprising:

[0054] An acquisition module, configured to acquire a first dynamic key sent by the unified cryptographic service platform to the Internet of Things platform after preparing the first original data to be sent to the Internet of Things device;

[0055] A first encryption and decryption module is configured to encrypt the first original data using a first dynamic key through the SDK of the Internet of Things platform to obtain a first ciphertext; and

[0056] Encrypting the first dynamic key by using the public key of the Internet of Things device to obtain an encrypted first dynamic key;

[0057] The first sending module is configured to send the encrypted first dynamic key and the first ciphertext to the Internet of Things device, so that the Internet of Things device uses the Internet of Things device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0058] In a fifth aspect, the present disclosure provides a system for providing a national secret algorithm for a device and a platform, the system comprising an Internet of Things device, the Internet of Things device comprising:

[0059] a first receiving module, configured to receive a first ciphertext and an encrypted first dynamic key sent by the Internet of Things platform, wherein the encrypted first dynamic key is obtained by the Internet of Things platform obtaining the first dynamic key from the unified cryptographic service platform after preparing the first original data to be sent to the Internet of Things device, and encrypting the first dynamic key by using the public key of the Internet of Things device, and the first ciphertext is obtained by the Internet of Things platform encrypting the first original data by using the first dynamic key through the SDK of the Internet of Things platform;

[0060] A second encryption and decryption module is configured to use the private key of the IoT device to decrypt the encrypted first dynamic key to obtain the first dynamic key; and

[0061] The first ciphertext is decrypted using a first dynamic key to obtain first original data.

[0062] In a sixth aspect, the present disclosure provides a system for providing a national secret algorithm for a device and a platform, the system comprising a unified cryptographic service platform, the unified cryptographic service platform comprising:

[0063] The second sending module is configured to send the first dynamic key to the Internet of Things platform after the Internet of Things platform prepares the first original data to be sent to the Internet of Things device, so that the Internet of Things platform uses the first dynamic key to encrypt the first original data through the SDK of the Internet of Things platform to obtain the first ciphertext, and encrypts the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key, and sends the encrypted first dynamic key and the first ciphertext to the Internet of Things device; enables the Internet of Things device to decrypt the encrypted first dynamic key using the private key of the Internet of Things device to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0064] In a seventh aspect, the present disclosure provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes a method for providing a national encryption algorithm for a device and a platform as described in any one of the first aspect, the second aspect, and the third aspect.

[0065] In an eighth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method of providing a national encryption algorithm for a device and a platform as described in any one of the first aspects above is implemented.

[0066] Beneficial effects:

[0067] The method for providing a national secret algorithm for a device and platform, the system, electronic device and storage medium for providing a national secret algorithm for a device and platform provided by the present disclosure provide a device and system SDK, which facilitates device and system developers to integrate the national secret algorithm function, reduces the development difficulty, and can also uniformly manage the national secret algorithm keys of devices and systems to improve security; adopt a unified password resource pool, provide key exchange and key rotation, support scheduled key rotation, and can also configure the key rotation cycle as needed to improve the security of the key and prevent the key from being cracked. For different platforms, one key pool can be implemented for each platform to meet the security needs of different users. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 A flowchart of a method for providing a national encryption algorithm for a device and a platform provided in Embodiment 1 of the present disclosure;

[0069] Figure 2 A flowchart of a method for providing a national encryption algorithm for a device and a platform provided in Embodiment 2 of the present disclosure;

[0070] Figure 3 A flowchart of a method for providing a national encryption algorithm for a device and a platform provided in Embodiment 3 of the present disclosure;

[0071] Figure 4 A schematic diagram of an architecture for a terminal to interact with a unified cryptographic service platform via an SDK provided in an embodiment of the present disclosure;

[0072] Figure 5 A schematic diagram of a key management module function implementation flow provided in an embodiment of the present disclosure;

[0073] Figure 6 A schematic diagram of the overall architecture of an IoT device and a platform interacting to perform data encryption transmission provided by an embodiment of the present disclosure;

[0074] Figure 7 A schematic diagram of a process step of direct connection of a device provided in an embodiment of the present disclosure;

[0075] Figure 8 A schematic diagram of the steps of a digital envelope encryption transmission process from a device to a platform provided in an embodiment of the present disclosure;

[0076] Fig. 9 A schematic diagram of the steps of a digital envelope encryption transmission process from a platform to a device provided in an embodiment of the present disclosure;

[0077] Fig.10 This is an architecture diagram of an Internet of Things platform provided in Embodiment 5 of the present disclosure;

[0078] Fig.11 An architecture diagram of an Internet of Things device provided in Embodiment 6 of the present disclosure;

[0079] Fig.12 An architecture diagram of a unified cryptographic service platform provided in Embodiment 7 of the present disclosure;

[0080] Fig.13 This is an architectural diagram of an electronic device provided in Embodiment 8 of the present disclosure. DETAILED DESCRIPTION

[0081] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the present disclosure is further described in detail below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention, rather than to limit the present invention.

[0082] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence; and, in the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be arbitrarily combined with each other.

[0083] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. The singular forms of "a", "said" and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings.

[0084] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present disclosure, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0085] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned technical problems existing in the prior art are described in detail below with specific embodiments. It is understandable that in the embodiments of the present application, the execution subject can perform some or all of the steps in the embodiments of the present application, and these steps or operations are only examples. The embodiments of the present application can also perform other operations or deformations of various operations. In addition, each step can be performed in a different order presented in the embodiments of the present application, and it is possible not to perform all the operations in the embodiments of the present application. And, the following several specific embodiments can be combined with each other, and may not be repeated in some embodiments for the same or similar concepts or processes.

[0086] Figure 1 A flowchart of a method for providing a national encryption algorithm for a device and a platform provided in the first embodiment of the present disclosure is applied to an Internet of Things platform, such as Figure 4 As shown, the method includes:

[0087] Step S101: After preparing the first original data to be sent to the IoT device, obtaining the first dynamic key sent by the unified cryptographic service platform to the IoT platform;

[0088] Step S102: Encrypting the first original data using the first dynamic key through the SDK of the Internet of Things platform to obtain a first ciphertext;

[0089] Step S103: encrypting the first dynamic key by using the public key of the IoT device to obtain an encrypted first dynamic key;

[0090] Step S104: Send the encrypted first dynamic key and the first ciphertext to the IoT device, so that the IoT device uses the IoT device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0091] After the IoT device initiates registration with the IoT platform and completes identity authentication, the IoT device and the platform can perform encrypted data communication, providing the device and system SDKs for both parties of communication respectively. The IoT platform and the unified cryptographic service platform interact through the SDK, and the unified cryptographic service platform provides the data encryption key, and the data encryption and decryption calculations are performed in the SDK.

[0092] In order to ensure the security of data transmission, the disclosed embodiment encrypts data through two encryption algorithms. First, the data is symmetric encrypted by the national secret algorithm through the dynamic key provided by the unified cryptographic service platform, and then the dynamic key is asymmetrically encrypted by the public key of the other end. The two encryption methods are used to ensure the secure transmission of data. In addition, the device and system SDK facilitates device and system developers to integrate the national secret algorithm function and reduce the difficulty of development. The national secret algorithm keys of devices and systems can be managed uniformly to improve security.

[0093] When applied to the IoT platform, the platform sends encrypted data to the device, and the device decrypts it. The entire process involves two encryption methods, symmetric encryption and asymmetric encryption, to ensure the secure transmission of data. The detailed process includes:

[0094] 1. The platform (i.e. IoT platform) prepares data:

[0095] The platform prepares the original data (Text1, ie, the first original data) to be sent to the device.

[0096] 2. The platform obtains the dynamic key:

[0097] The platform obtains a random dynamic key Key1 (ie, the first dynamic key) generated by the unified cryptographic service platform using a symmetric encryption algorithm, which is used to encrypt data.

[0098] 3. Platform encrypted data:

[0099] The platform uses the dynamic key Key1 generated by the SDK to encrypt the original data Text1 to obtain the ciphertext S-Text1 (ie, the first ciphertext).

[0100] 4. Platform encryption dynamic key:

[0101] The platform uses an asymmetric encryption algorithm and uses the public key of the device (IoT device) to encrypt the dynamic key Key1 to obtain the ciphertext S-Key1 (i.e. the encrypted first dynamic key).

[0102] 5. The platform sends data:

[0103] The platform sends the encrypted data S-Text1 and the encrypted dynamic key S-Key1 to the device.

[0104] 6. The device receives data:

[0105] The device receives the data sent by the platform.

[0106] 7. Device decryption dynamic key:

[0107] The device uses its own private key to decrypt the received S-Key1 to obtain the original dynamic key Key1.

[0108] 8. Device decryption data:

[0109] The device uses the dynamic key Key1 obtained by decryption to decrypt S-Text1 and restore the original data Text1.

[0110] 9 devices process data:

[0111] The device performs subsequent processing on the decrypted data Text1.

[0112] Among them, dynamic key (Key1): the key randomly generated by the unified cryptographic service platform is received by the platform each time it sends data, which is used to encrypt data. Platform public key / private key: the key pair used by the platform for encryption and decryption. Device public key / private key: the key pair used by the device for encryption and decryption.

[0113] During the transmission process, an asymmetric encryption algorithm is used to encrypt the dynamic key to ensure the security of key transmission. Each time data is sent, a randomly generated dynamic key is used to improve the security of the system. Data is encrypted during transmission to ensure the confidentiality of the data.

[0114] The disclosed embodiments provide device and system SDKs to facilitate device and system developers to integrate national secret algorithm functions, reduce development difficulty, and can also uniformly manage national secret algorithm keys for devices and systems to improve security; a unified password resource pool is used to provide key exchange and key rotation, support timed key rotation, and configure key rotation cycles as needed to improve key security and prevent keys from being cracked. For different platforms, one key pool can be implemented for each platform to meet the security needs of different users.

[0115] Furthermore, the method further comprises:

[0116] Receiving a second ciphertext and an encrypted second dynamic key sent by the IoT device, wherein the second ciphertext is obtained by the IoT device generating a random second dynamic key using a symmetric encryption algorithm, and encrypting the second original data using the generated second dynamic key, and the encrypted second dynamic key is obtained by the IoT device encrypting the second dynamic key using the public key of the IoT platform;

[0117] Decrypting the encrypted second dynamic key using the private key of the Internet of Things platform to obtain the second dynamic key;

[0118] The second ciphertext is decrypted using the second dynamic key obtained through the SDK of the Internet of Things platform to obtain the second original data.

[0119] IoT devices can generate dynamic keys by setting up the Aolin cryptographic module, etc., or they can obtain a second dynamic key by interacting with the added SDK and unified cryptographic service platform.

[0120] The process of data transmission and identity authentication between IoT devices and IoT platforms is mainly divided into two stages:

[0121] IoT device data encryption stage: The device encrypts the data to be transmitted and re-encrypts the encryption key.

[0122] IoT platform data decryption phase: The platform decrypts the received data and verifies the device identity.

[0123] The detailed process includes:

[0124] 1. Equipment preparation data:

[0125] The device prepares the data to be sent (Text2, ie, the second original data).

[0126] 2. The device generates a dynamic key:

[0127] The device uses a symmetric encryption algorithm to generate a random dynamic key (Key2, ie, the second dynamic key) for encrypting data.

[0128] 3. Device Encryption Data:

[0129] The device uses the generated dynamic key Key2 to encrypt the original data Text2 to obtain the ciphertext S-Text2 (ie, the second ciphertext).

[0130] 4. Device encryption dynamic key:

[0131] The device uses an asymmetric encryption algorithm to encrypt the dynamic key Key2 using the platform's public key to obtain the ciphertext S-Key2 (ie, the encrypted second dynamic key).

[0132] 5. The device sends data:

[0133] Send the encrypted data S-Text2 and the encrypted dynamic key S-Key2 to the platform.

[0134] 6. Platform decryption dynamic key:

[0135] After receiving the data, the platform uses the platform's private key to decrypt S-Key2 to obtain the original dynamic key Key2.

[0136] 7. Platform decrypts data:

[0137] The platform uses the dynamic key Key2 obtained by decryption through the SDK to decrypt S-Text2 and restore the original data Text2.

[0138] 8. Platform business processing:

[0139] The platform performs subsequent business processing on the decrypted data Text2.

[0140] The process of IoT devices sending data to the platform corresponds to the process of the platform replying data to the device; encrypting and decrypting data through symmetric national secret algorithms can facilitate and flexibly implement data processing, and the algorithm is relatively simple to implement, consumes less resources, has little impact on system performance, and can configure the key rotation cycle as needed to enhance key security and meet different security requirements; encrypting and decrypting encrypted data with dynamic keys through asymmetric national secret algorithms can prevent key leakage, protect the security of keys and make the data transmission process safer.

[0141] At the same time, since the asymmetric national secret algorithm only needs to encrypt and decrypt dynamic keys, it can overcome the problem of slow asymmetric encryption and decryption speed; at the same time, it can solve the disadvantage that the leakage of symmetric keys will threaten the security of encrypted information. Therefore, the embodiment of the present disclosure can combine the advantages of the symmetric national secret algorithm to process large amounts of data at high speed, and can ensure the security of keys and data transmission through the asymmetric national secret algorithm.

[0142] Furthermore,

[0143] The algorithm for encrypting the first original data using the first dynamic key through the SDK of the Internet of Things platform is the SM4 algorithm;

[0144] The algorithm for encrypting the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key is the SM9 algorithm.

[0145] The SM4 algorithm is a symmetric encryption algorithm used to encrypt and decrypt data. The SM4 algorithm mainly includes encryption and decryption algorithms and key expansion algorithms, and adopts a 32-round nonlinear iterative mathematical structure. The mathematical architecture, operation rules, and operation operations of the encryption and decryption algorithms are exactly the same. The decryption operation only needs to use the round keys generated in the encryption algorithm in reverse order. It can easily process the data to be transmitted at high speed and reduce the impact on the equipment.

[0146] The SM9 algorithm is an asymmetric encryption algorithm used to encrypt keys. It has high security and reliability, and runs very efficiently on resource-constrained IoT devices, making it suitable for mobile devices and embedded systems.

[0147] Furthermore, the method further comprises:

[0148] Receive registration requests sent by IoT devices;

[0149] Generate a random number and return it to the IoT device, so that the IoT device encrypts the random number using the private key of the IoT device to obtain a third ciphertext, and send the random number and the third ciphertext to the IoT platform;

[0150] Decrypting the third ciphertext using the public key of the IoT device to obtain decrypted data of the third ciphertext;

[0151] The decrypted data of the third ciphertext is compared with the random number, and if they are consistent, the IoT device identity is set as verification success.

[0152] When using IoT devices, they must first register with the unified password service platform and perform identity authentication. The IoT device sends a registration request to the platform, the platform generates a random number and returns it to the device, and the device encrypts the random number and returns it to the platform. The platform verifies the data returned by the device to confirm the device's identity.

[0153] The detailed process includes:

[0154] 1. The device initiates a registration request:

[0155] The device sends a registration request to the unified password service platform.

[0156] 2. The platform generates a random number and returns:

[0157] After receiving the registration request, the platform generates a random number R1.

[0158] The platform returns R1 to the device.

[0159] 3. The device is encrypted and returned:

[0160] After receiving R1, the device uses the device's private key (sm9PrivateKey) to encrypt R1 to obtain ciphertext S1 (the third ciphertext).

[0161] Devices R1 and S1 are sent together to the platform.

[0162] 4. Platform Verification:

[0163] After the platform receives the data sent by the device, it uses the public key (deviceID) of the device to decrypt S1 and obtain the decrypted data S2.

[0164] The platform compares S2 with the initially generated random number R1. If S2 is equal to R1, the device authentication is successful, otherwise the authentication fails.

[0165] Explanation of the algorithms and terminology used in the flowchart

[0166] Private key: A device-specific private key used to encrypt and sign data.

[0167] Public key: corresponds to the private key and is used to verify the signature.

[0168] R1: A random number generated by the platform, used to verify the device identity.

[0169] S1: The ciphertext obtained by encrypting R1 using the private key.

[0170] S2: The platform uses the public key to decrypt the data obtained from S1.

[0171] Through the above registration process and verification process, the registration and verification of the device can be completed, and the verification process has the following advantages,

[0172] High security: Adopts asymmetric encryption algorithm SM9 to ensure the confidentiality and integrity of data.

[0173] Reliable identity authentication: Random number challenge and signature verification can effectively prevent spoofing and replay attacks.

[0174] Furthermore, the method further comprises:

[0175] Receiving an IoT device ID added by the IoT device in the registration request;

[0176] Storing the association between the IoT device ID and the random number;

[0177] Receiving an IoT device ID sent by the IoT device simultaneously with sending the random number and the third ciphertext;

[0178] Verify whether the correspondence between the IoT device ID and the random number is correct. If correct, decrypt the third ciphertext.

[0179] After obtaining the device ID in the registration request, the platform stores the association between the device ID and R1. After receiving the data sent by the device, it first verifies whether the corresponding relationship between the device ID and R1 is correct. The device identity can be confirmed in advance to effectively prevent disguise. By completing the registration and identity authentication of IoT devices, it ensures that only authorized devices can access the system, thereby reducing potential security risks and protecting the security of sensitive data transmission.

[0180] Furthermore, the method further comprises:

[0181] Receiving an IoT device ID sent by the IoT device when sending the second ciphertext and the encrypted second dynamic key to the IoT platform;

[0182] The IoT device ID is used to determine whether the IoT device is a device registered on the platform, and if it is determined to be, the data is stored in a database corresponding to the IoT device.

[0183] The IoT device ID is the unique identifier of the device. By sending the IoT device ID during data transmission, the device identity can be confirmed, ensuring that the request is a normal request, making the device data independent, and ensuring that the data is stored in the corresponding database.

[0184] Embodiment 2 of the present disclosure also provides a method for providing a national secret algorithm for a device and a platform, which is applied to an IoT device, such as Figure 2 As shown, the method includes:

[0185] Step S201: receiving a first ciphertext and an encrypted first dynamic key sent by the Internet of Things platform, wherein the encrypted first dynamic key is obtained by the Internet of Things platform after preparing first original data to be sent to the Internet of Things device, obtaining the first dynamic key from the unified cryptographic service platform, and encrypting the first dynamic key by using the public key of the Internet of Things device, and the first ciphertext is obtained by the Internet of Things platform after encrypting the first original data by using the first dynamic key through the SDK of the Internet of Things platform;

[0186] Step S202: decrypting the encrypted first dynamic key using the IoT device private key to obtain the first dynamic key;

[0187] Step S203: Use the first dynamic key to decrypt the first ciphertext to obtain first original data.

[0188] Furthermore, the method further comprises:

[0189] Generate a random second dynamic key using a symmetric encryption algorithm;

[0190] The second original data is encrypted using the generated second dynamic key to obtain a second ciphertext;

[0191] Encrypting the second dynamic key using the public key of the Internet of Things platform to obtain an encrypted second dynamic key;

[0192] The second ciphertext and the encrypted second dynamic key are sent to the Internet of Things platform, so that after receiving the data, the Internet of Things platform uses the private key of the Internet of Things platform to decrypt the encrypted second dynamic key to obtain the second dynamic key, and uses the decrypted second dynamic key to decrypt the second ciphertext through the SDK of the Internet of Things platform to obtain the second original data.

[0193] Furthermore, the method further comprises:

[0194] Send a registration request to the IoT platform, so that the IoT platform generates a random number and returns it to the IoT device;

[0195] Encrypt the random number using the private key of the IoT device to obtain a third ciphertext;

[0196] The random number and the third ciphertext are sent to the IoT platform, so that the IoT platform uses the public key of the IoT device to decrypt the third ciphertext to obtain decrypted data of the third ciphertext, and compares the decrypted data of the third ciphertext with the random number. If they are consistent, the identity of the IoT device is set to be successfully verified.

[0197] Furthermore, the method further comprises:

[0198] Adding the IoT device ID to the registration request so that the IoT platform stores the association between the IoT device ID and the random number;

[0199] When sending the random number and the third ciphertext, the IoT device ID is simultaneously sent to the IoT platform, so that the IoT platform verifies whether the corresponding relationship between the IoT device ID and the random number is correct. If correct, the third ciphertext is decrypted.

[0200] Furthermore, the method further comprises:

[0201] When sending the second ciphertext and the encrypted second dynamic key, the IoT device ID is sent to the IoT platform at the same time, so that the IoT platform determines whether the IoT device is a device registered on this platform through the IoT device ID, and stores the data in a database corresponding to the IoT device after determining that it is.

[0202] The above processes are to implement device registration verification from the device side, as well as data encryption, transmission and decryption between the device and the platform, which correspond to the processes in Example 1 and will not be repeated here.

[0203] In order to ensure the security during data transmission, the disclosed embodiment encrypts data through two encryption algorithms. First, the data is symmetric encrypted by the national secret algorithm through the dynamic key provided by the unified cryptographic service platform, and then the dynamic key is asymmetrically encrypted by the public key of the other end. The two encryption methods can combine the advantages of the symmetric national secret algorithm to process large amounts of data at high speed, and can ensure the key security and data transmission security through the asymmetric national secret algorithm. In addition, through the device and system SDK, it is convenient for device and system developers to integrate the national secret algorithm function and reduce the difficulty of development. The national secret algorithm keys of devices and systems can be managed uniformly to improve security, support scheduled key rotation, improve the security of keys, and prevent keys from being cracked. Support one platform and one key pool to meet the security needs of different users.

[0204] The third embodiment of the present disclosure also provides a method for providing a national secret algorithm for a device and a platform, which is applied to a unified cryptographic service platform, such as Figure 3 As shown, the method includes:

[0205] Step S301: After the IoT platform prepares the first original data to be sent to the IoT device, the first dynamic key is sent to the IoT platform, so that the IoT platform uses the first dynamic key to encrypt the first original data through the SDK of the IoT platform to obtain the first ciphertext, and encrypts the first dynamic key through the public key of the IoT device to obtain the encrypted first dynamic key, and sends the encrypted first dynamic key and the first ciphertext to the IoT device; the IoT device uses the private key of the IoT device to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0206] By providing dynamic keys for the IoT platform, the platform's keys can be better managed.

[0207] Embodiment 4 of the present disclosure also provides a method for providing national encryption algorithms for devices and platforms.

[0208] like Figure 4 As shown, by adding SDK to the terminal (device and platform), interacting with the unified cryptographic service platform, the key management server in the unified cryptographic service platform provides the key ID, manages the keys of different encryption methods, and the cryptographic machine of the unified cryptographic service platform provides keys and key rotation and other functions; the application in the SDK introduces cryptographic package dependency, exchanges keys through key modules (key management layer module and key operation layer module) and key servers, and encrypts information at the operation layer.

[0209] Figure 5The following is a description of the key management layer module. The key management layer module provides key management for different encryption methods and methods for exchanging keys with key IDs; it provides a simple way to use encryption methods, by introducing encryption packages and setting different key IDs to the password platform to use different encryption methods for encryption. It also provides adaptation to different development languages ​​to cope with the use of different devices or system applications.

[0210] The encryption process of data exchange between IoT devices and IoT platforms is as follows: Figure 6 As shown. Each IoT device and IoT platform perform encrypted data exchange. At the same time, IoT devices and IoT platforms interact with each other through the National Cryptography SDK and the cryptographic platform respectively. The cryptographic platform provides key management, including providing keys and key rotation functions.

[0211] The method of providing national encryption algorithms for devices and platforms includes a device direct connection process and a digital envelope encryption transmission process:

[0212] The specific process steps for device direct connection are as follows:

[0213] Process Overview

[0214] This process mainly describes the process of IoT devices registering with the IoT platform and performing identity authentication. The entire process is mainly divided into two stages:

[0215] Device registration phase: The IoT device sends a registration request to the IoT platform. The platform generates a random number and returns it to the device. The device (IoT device) encrypts the random number and returns it to the platform (IoT platform).

[0216] Authentication phase: The platform verifies the data returned by the device to confirm the device's identity.

[0217] Detailed process as Figure 7 As shown:

[0218] 1. The device initiates a registration request:

[0219] The device sends a registration request to the IoT platform, which contains the device's unique identifier (device ID).

[0220] 2. The platform generates a random number and returns:

[0221] After receiving the registration request, the platform generates a random number R1 and stores the association between the device ID and R1.

[0222] The platform returns R1 to the device.

[0223] 3. The device is encrypted and returned:

[0224] After receiving R1, the device uses the device's private key (sm9PrivateKey) to encrypt R1 to obtain the ciphertext S1.

[0225] The device sends the device ID, R1, and S1 to the platform.

[0226] 4. Platform Verification:

[0227] After the platform receives the data sent by the device, it first verifies whether the correspondence between the device ID and R1 is correct.

[0228] Then, the platform uses the device's public key (deviceID) to decrypt S1 and obtain the decrypted data S2.

[0229] The platform compares S2 with the initially generated random number R1. If S2 is equal to R1, the device authentication is successful, otherwise the authentication fails.

[0230] The algorithms and terms used in the flowchart are explained below:

[0231] SM9 algorithm: a national secret algorithm used for asymmetric encryption.

[0232] Private key: A device-specific private key used to encrypt and sign data.

[0233] Public key: corresponds to the private key and is used to verify the signature.

[0234] R1: A random number generated by the platform, used to verify the device identity.

[0235] S1: The ciphertext obtained by encrypting R1 using the private key.

[0236] S2: The platform uses the public key to decrypt the data obtained from S1.

[0237] Features and advantages of this process

[0238] High security: Adopts asymmetric encryption algorithm SM9 to ensure the confidentiality and integrity of data.

[0239] Reliable identity authentication: Random number challenge and signature verification can effectively prevent spoofing and replay attacks.

[0240] The digital envelope encryption transmission process includes device->platform and platform->device.

[0241] Among them, device->platform:

[0242] Process overview: Figure 8 As shown,

[0243] process Figure 8This article describes the process of data transmission and authentication between an IoT device and an IoT platform. The entire process is mainly divided into two stages:

[0244] Device data encryption stage: The device encrypts the data to be transmitted and re-encrypts the encryption key.

[0245] Platform data decryption stage: The platform decrypts the received data and verifies the device identity.

[0246] Detailed process

[0247] 1. Equipment preparation data:

[0248] The device prepares the data to be sent (Text2).

[0249] 2. The device generates a dynamic key:

[0250] The device uses the symmetric encryption algorithm SM4 to generate a random dynamic key (sm4Key2) for encrypting data.

[0251] 3. Device Encryption Data:

[0252] The device uses the generated dynamic key sm4Key2 to encrypt the original data Text2 to obtain the ciphertext S-Text2.

[0253] 4. Device encryption dynamic key:

[0254] The device uses the asymmetric encryption algorithm SM9 and the platform's public key to encrypt the dynamic key sm4Key2 to obtain the ciphertext S-Key2.

[0255] 5. The device sends data:

[0256] The device sends the device ID, encrypted data S-Text2, and encrypted dynamic key S-Key2 to the platform.

[0257] 6. Platform decryption dynamic key:

[0258] After receiving the data, the platform uses the platform's private key to decrypt S-Key2 and obtain the original dynamic key sm4Key2.

[0259] 7. Platform decrypts data:

[0260] The platform uses the dynamic key sm4Key2 obtained by decryption to decrypt S-Text2 and restore the original data Text2.

[0261] 8. Platform business processing:

[0262] The platform performs subsequent business processing on the decrypted data Text2.

[0263] The algorithms and terms used in the process are explained below:

[0264] SM4 algorithm: A symmetric encryption algorithm used to encrypt and decrypt data.

[0265] Dynamic key (sm4Key): A key randomly generated each time the device sends data and used to encrypt data.

[0266] S-Text: Data encrypted using sm4Key.

[0267] S-Key: dynamic key encrypted using the SM9 algorithm.

[0268] Device ID: The unique identifier of the device.

[0269] Platform public key / private key: The key pair used by the platform for encryption and decryption.

[0270] Device public key / private key: A key pair used by the device for encryption and decryption.

[0271] Platform -> Device:

[0272] Process overview: Fig. 9 As shown,

[0273] This flowchart describes the process of sending encrypted data from the platform to the device and decrypting it by the device. The whole process involves two encryption methods, symmetric encryption (SM4) and asymmetric encryption (SM9), to ensure the secure transmission of data.

[0274] Detailed process

[0275] 1. Platform preparation data:

[0276] The platform prepares raw data (Text1) to be sent to the device.

[0277] 2. The platform generates a dynamic key:

[0278] The platform obtains the unified password service platform using the symmetric encryption algorithm SM4 to generate a random dynamic key (sm4Key1) for encrypting data.

[0279] 3. Platform encrypted data:

[0280] The platform uses the generated dynamic key sm4Key1 to encrypt the original data Text1 to obtain the ciphertext S-Text1.

[0281] 4. Platform encryption dynamic key:

[0282] The platform uses the asymmetric encryption algorithm SM9 and the public key of the device to encrypt the dynamic key sm4Key1 to obtain the ciphertext S-Key1.

[0283] 5. The platform sends data:

[0284] The platform sends the encrypted data S-Text1, the encrypted dynamic key S-Key1 and the device ID to the device.

[0285] 6. The device receives data:

[0286] The device receives the data sent by the platform.

[0287] 7. Device decryption dynamic key:

[0288] The device uses its own private key to decrypt the received S-Key1 and obtain the original dynamic key sm4Key1.

[0289] 8. Device decryption data:

[0290] The device uses the dynamic key sm4Key1 obtained by decryption to decrypt S-Text1 and restore the original data Text1.

[0291] 9 devices process data:

[0292] The device performs subsequent processing on the decrypted data Text1.

[0293] Process characteristics and advantages

[0294] High security: The asymmetric encryption algorithm SM9 is used to encrypt dynamic keys, ensuring the security of key transmission.

[0295] Dynamic key: A randomly generated dynamic key is used each time data is sent, which improves the security of the system.

[0296] Data confidentiality: Data is encrypted during transmission, ensuring data confidentiality.

[0297] The embodiments of the present disclosure have the following advantages:

[0298] 1. Provide device and system SDK

[0299] It is convenient for device and system developers to integrate national encryption algorithm functions and reduce the difficulty of development;

[0300] The national secret algorithm keys of devices and systems can be managed in a unified manner to improve security.

[0301] 2. Support scheduled key rotation

[0302] Improve the security of keys and prevent them from being cracked;

[0303] The key rotation period can be configured as needed to meet different security requirements.

[0304] 3. One key per platform

[0305] Enhance the security of the platform and prevent key leakage;

[0306] It can meet the security needs of different users, such as different departments, different application scenarios, etc.

[0307] The fifth embodiment of the present disclosure also provides a system for providing a national secret algorithm for devices and platforms, the system including an Internet of Things platform, such as Fig.10 As shown, the Internet of Things platform includes:

[0308] An acquisition module 11 is configured to acquire a first dynamic key sent by the unified cryptographic service platform to the Internet of Things platform after preparing the first original data to be sent to the Internet of Things device;

[0309] A first encryption and decryption module 12 is configured to encrypt the first original data using a first dynamic key through the SDK of the Internet of Things platform to obtain a first ciphertext; and

[0310] Encrypting the first dynamic key by using the public key of the Internet of Things device to obtain an encrypted first dynamic key;

[0311] The first sending module 13 is configured to send the encrypted first dynamic key and the first ciphertext to the Internet of Things device, so that the Internet of Things device uses the Internet of Things device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0312] Furthermore, the Internet of Things platform also includes a second receiving module 14:

[0313] The second receiving module 14 is configured to receive a second ciphertext and an encrypted second dynamic key sent by the IoT device, wherein the second ciphertext is generated by the IoT device using a symmetric encryption algorithm to generate a random second dynamic key, and the second original data is encrypted using the generated second dynamic key, and the encrypted second dynamic key is obtained by the IoT device using the public key of the IoT platform to encrypt the second dynamic key;

[0314] The first encryption / decryption module 12 is further configured to use the private key of the Internet of Things platform to decrypt the encrypted second dynamic key to obtain the second dynamic key; and

[0315] The second ciphertext is decrypted using the second dynamic key obtained through the SDK of the Internet of Things platform to obtain the second original data.

[0316] Furthermore,

[0317] The algorithm used by the first encryption / decryption module 12 to encrypt the first original data using the first dynamic key through the SDK of the Internet of Things platform is the SM4 algorithm; and

[0318] The algorithm for encrypting the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key is the SM9 algorithm.

[0319] Furthermore, the Internet of Things platform also includes a device registration management module 15:

[0320] The second receiving module 14 is further configured to receive a registration request sent by an IoT device;

[0321] The device registration management module 15 is configured to generate a random number and return it to the IoT device, so that the IoT device encrypts the random number using the private key of the IoT device to obtain a third ciphertext, and sends the random number and the third ciphertext to the IoT platform;

[0322] The first encryption and decryption module 12 is further configured to use the public key of the IoT device to decrypt the third ciphertext to obtain decrypted data of the third ciphertext;

[0323] The device registration management module 15 is further configured to compare the decrypted data of the third ciphertext with the random number, and if they are consistent, the IoT device identity is set as verification success.

[0324] Furthermore,

[0325] The second receiving module 14 is further configured to receive an IoT device ID added by the IoT device in the registration request;

[0326] The device registration management module 15 is also configured to store the association between the IoT device ID and the random number;

[0327] The second receiving module 14 is further configured to receive an IoT device ID sent by the IoT device simultaneously when sending the random number and the third ciphertext;

[0328] The device registration management module 15 is also configured to verify whether the corresponding relationship between the IoT device ID and the random number is correct. If correct, the first encryption and decryption module 12 is enabled to decrypt the third ciphertext.

[0329] Furthermore, the IoT platform also includes a verification module 16;

[0330] The second receiving module 14 is further configured to receive an IoT device ID sent simultaneously by the IoT device when sending the second ciphertext and the encrypted second dynamic key to the IoT platform;

[0331] The verification module 16 is configured to determine whether the IoT device is a device registered on the platform through the IoT device ID, and store the data in a database corresponding to the IoT device after determining that it is.

[0332] Embodiment 6 of the present disclosure also provides a system for providing a national secret algorithm for a device and a platform, the system including an Internet of Things device, such as Fig.11 As shown, the IoT device includes:

[0333] A first receiving module 21 is configured to receive a first ciphertext and an encrypted first dynamic key sent by the Internet of Things platform, wherein the encrypted first dynamic key is obtained by the Internet of Things platform obtaining the first dynamic key from the unified cryptographic service platform after preparing the first original data to be sent to the Internet of Things device, and encrypting the first dynamic key by using the public key of the Internet of Things device, and the first ciphertext is obtained by the Internet of Things platform encrypting the first original data by using the first dynamic key through the SDK of the Internet of Things platform;

[0334] A second encryption and decryption module 22 is configured to use the IoT device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key; and

[0335] The first ciphertext is decrypted using a first dynamic key to obtain first original data.

[0336] Furthermore, the IoT device further includes a third sending module 23:

[0337] The second encryption and decryption module 22 is further configured to generate a random second dynamic key using a symmetric encryption algorithm; and

[0338] Encrypting the second original data using the generated second dynamic key to obtain a second ciphertext; and,

[0339] Encrypting the second dynamic key using the public key of the Internet of Things platform to obtain an encrypted second dynamic key;

[0340] The third sending module 23 is configured to send the second ciphertext and the encrypted second dynamic key to the Internet of Things platform, so that after receiving the data, the Internet of Things platform uses the private key of the Internet of Things platform to decrypt the encrypted second dynamic key to obtain the second dynamic key, and uses the decrypted second dynamic key to decrypt the second ciphertext through the SDK of the Internet of Things platform to obtain the second original data.

[0341] Furthermore, the IoT device further includes a registration module 24:

[0342] The registration module 24 is configured to send a registration request to the Internet of Things platform through the third sending module 23, so that the Internet of Things platform generates a random number and returns it to the Internet of Things device; and

[0343] The second encryption / decryption module 22 uses the private key of the IoT device to encrypt the random number to obtain a third ciphertext; and

[0344] The random number and the third ciphertext are sent to the Internet of Things platform through the third sending module 23, so that the Internet of Things platform uses the public key of the Internet of Things device to decrypt the third ciphertext to obtain the decrypted data of the third ciphertext, and compares the decrypted data of the third ciphertext with the random number. If they are consistent, the identity of the Internet of Things device is set to verification success.

[0345] Furthermore,

[0346] The registration module 24 is further configured to add the IoT device ID to the registration request so that the IoT platform stores the association between the IoT device ID and the random number; and

[0347] The third sending module 23 sends the IoT device ID to the IoT platform at the same time as sending the random number and the third ciphertext, so that the IoT platform verifies whether the corresponding relationship between the IoT device ID and the random number is correct. If correct, the third ciphertext is decrypted.

[0348] Furthermore,

[0349] The third sending module 23 is also configured to send the IoT device ID to the IoT platform at the same time as sending the second ciphertext and the encrypted second dynamic key, so that the IoT platform determines whether the IoT device is a device registered on this platform through the IoT device ID, and stores the data in a database corresponding to the IoT device after determining that it is.

[0350] Embodiment 7 of the present disclosure also provides a system for providing national secret algorithms for devices and platforms, the system including a unified cryptographic service platform, such as Fig.12 As shown, the unified password service platform includes:

[0351] The second sending module 31 is configured to send the first dynamic key to the Internet of Things platform after the Internet of Things platform prepares the first original data to be sent to the Internet of Things device, so that the Internet of Things platform uses the first dynamic key to encrypt the first original data through the SDK of the Internet of Things platform to obtain the first ciphertext, and encrypts the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key, and sends the encrypted first dynamic key and the first ciphertext to the Internet of Things device; enables the Internet of Things device to decrypt the encrypted first dynamic key using the private key of the Internet of Things device to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

[0352] The system for providing national encryption algorithms for devices and platforms in the embodiments of the present disclosure is used to implement the method for providing national encryption algorithms for devices and platforms in the method embodiments, so the description is relatively simple. For details, please refer to the relevant description in the previous method embodiments, which will not be repeated here.

[0353] In addition, if Fig.13 As shown, the eighth embodiment of the present disclosure further provides an electronic device, including a memory 100 and a processor 200, wherein the memory 100 stores a computer program, and when the processor 200 runs the computer program stored in the memory 100, the processor 200 executes the above-mentioned various possible methods.

[0354] The memory 100 is connected to the processor 200. The memory 100 may be a flash memory, a read-only memory or other memory, and the processor 200 may be a central processing unit or a single-chip microcomputer.

[0355] In addition, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to perform the above-mentioned various possible methods.

[0356] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), Digital Video Disc (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0357] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A method for providing national encryption algorithms for devices and platforms, characterized in that: Applied to the Internet of Things platform, the method includes: After preparing the first original data to be sent to the IoT device, obtaining the first dynamic key sent by the unified cryptographic service platform to the IoT platform; The first original data is encrypted using a first dynamic key through a software development kit SDK of the Internet of Things platform to obtain a first ciphertext; Encrypting the first dynamic key by using the public key of the Internet of Things device to obtain an encrypted first dynamic key; The encrypted first dynamic key and the first ciphertext are sent to the IoT device, so that the IoT device uses the IoT device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

2. The method according to claim 1, characterized in that The method further comprises: Receiving a second ciphertext and an encrypted second dynamic key sent by the IoT device, wherein the second ciphertext is obtained by the IoT device generating a random second dynamic key using a symmetric encryption algorithm, and encrypting the second original data using the generated second dynamic key, and the encrypted second dynamic key is obtained by the IoT device encrypting the second dynamic key using the public key of the IoT platform; Decrypting the encrypted second dynamic key using the private key of the Internet of Things platform to obtain the second dynamic key; The second ciphertext is decrypted using the second dynamic key obtained through the SDK of the Internet of Things platform to obtain the second original data.

3. The method according to claim 1 or 2, characterized in that: The algorithm for encrypting the first original data using the first dynamic key through the SDK of the Internet of Things platform is the SM4 algorithm; The algorithm for encrypting the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key is the SM9 algorithm.

4. The method according to claim 2, characterized in that: The method further comprises: Receive registration requests sent by IoT devices; Generate a random number and return it to the IoT device, so that the IoT device encrypts the random number using the private key of the IoT device to obtain a third ciphertext, and send the random number and the third ciphertext to the IoT platform; Decrypting the third ciphertext using the public key of the IoT device to obtain decrypted data of the third ciphertext; The decrypted data of the third ciphertext is compared with the random number, and if they are consistent, the IoT device identity is set as verification success.

5. The method according to claim 4, characterized in that The method further comprises: Receiving an IoT device ID added by the IoT device in the registration request; Storing the association between the IoT device ID and the random number; Receiving an IoT device ID sent by the IoT device simultaneously with sending the random number and the third ciphertext; Verify whether the correspondence between the IoT device ID and the random number is correct. If correct, decrypt the third ciphertext.

6. The method according to claim 5, characterized in that The method further comprises: Receiving an IoT device ID sent by the IoT device when sending the second ciphertext and the encrypted second dynamic key to the IoT platform; The IoT device ID is used to determine whether the IoT device is a device registered on the platform, and if it is determined to be, the data is stored in a database corresponding to the IoT device.

7. A method for providing national encryption algorithms for devices and platforms, characterized in that: Applied to an IoT device, the method comprises: Receiving a first ciphertext and an encrypted first dynamic key sent by the Internet of Things platform, wherein the encrypted first dynamic key is obtained by the Internet of Things platform obtaining the first dynamic key from the unified cryptographic service platform after preparing the first original data to be sent to the Internet of Things device, and encrypting the first dynamic key by using the public key of the Internet of Things device, and the first ciphertext is obtained by the Internet of Things platform encrypting the first original data by using the first dynamic key through the SDK of the Internet of Things platform; Decrypt the encrypted first dynamic key using the IoT device private key to obtain the first dynamic key; The first ciphertext is decrypted using a first dynamic key to obtain first original data.

8. The method according to claim 7, characterized in that The method further comprises: Generate a random second dynamic key using a symmetric encryption algorithm; The second original data is encrypted using the generated second dynamic key to obtain a second ciphertext; Encrypting the second dynamic key using the public key of the Internet of Things platform to obtain an encrypted second dynamic key; The second ciphertext and the encrypted second dynamic key are sent to the Internet of Things platform, so that after receiving the data, the Internet of Things platform uses the private key of the Internet of Things platform to decrypt the encrypted second dynamic key to obtain the second dynamic key, and uses the decrypted second dynamic key to decrypt the second ciphertext through the SDK of the Internet of Things platform to obtain the second original data.

9. The method according to claim 8, characterized in that The method further comprises: Send a registration request to the IoT platform, so that the IoT platform generates a random number and returns it to the IoT device; Encrypt the random number using the private key of the IoT device to obtain a third ciphertext; The random number and the third ciphertext are sent to the IoT platform, so that the IoT platform uses the public key of the IoT device to decrypt the third ciphertext to obtain decrypted data of the third ciphertext, and compares the decrypted data of the third ciphertext with the random number. If they are consistent, the identity of the IoT device is set to be successfully verified.

10. The method according to claim 9, characterized in that The method further comprises: Adding the IoT device ID to the registration request so that the IoT platform stores the association between the IoT device ID and the random number; When sending the random number and the third ciphertext, the IoT device ID is simultaneously sent to the IoT platform, so that the IoT platform verifies whether the corresponding relationship between the IoT device ID and the random number is correct. If correct, the third ciphertext is decrypted.

11. The method according to claim 10, characterized in that The method further comprises: When sending the second ciphertext and the encrypted second dynamic key, the IoT device ID is sent to the IoT platform at the same time, so that the IoT platform determines whether the IoT device is a device registered on this platform through the IoT device ID, and stores the data in a database corresponding to the IoT device after determining that it is.

12. A method for providing national encryption algorithms for devices and platforms, characterized in that: Applied to a unified password service platform, the method includes: After the IoT platform prepares the first original data to be sent to the IoT device, the first dynamic key is sent to the IoT platform, so that the IoT platform uses the first dynamic key to encrypt the first original data through the SDK of the IoT platform to obtain the first ciphertext, and encrypts the first dynamic key through the public key of the IoT device to obtain the encrypted first dynamic key, and sends the encrypted first dynamic key and the first ciphertext to the IoT device; the IoT device uses the private key of the IoT device to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

13. A system for providing national encryption algorithms for devices and platforms, characterized in that: The system includes an Internet of Things platform, and the Internet of Things platform includes: An acquisition module, configured to acquire a first dynamic key sent by the unified cryptographic service platform to the Internet of Things platform after preparing the first original data to be sent to the Internet of Things device; A first encryption and decryption module is configured to encrypt the first original data using a first dynamic key through the SDK of the Internet of Things platform to obtain a first ciphertext; and Encrypting the first dynamic key by using the public key of the Internet of Things device to obtain an encrypted first dynamic key; The first sending module is configured to send the encrypted first dynamic key and the first ciphertext to the Internet of Things device, so that the Internet of Things device uses the Internet of Things device private key to decrypt the encrypted first dynamic key to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

14. A system for providing national encryption algorithms for devices and platforms, characterized in that: The system includes an Internet of Things device, and the Internet of Things device includes: a first receiving module, configured to receive a first ciphertext and an encrypted first dynamic key sent by the Internet of Things platform, wherein the encrypted first dynamic key is obtained by the Internet of Things platform obtaining the first dynamic key from the unified cryptographic service platform after preparing the first original data to be sent to the Internet of Things device, and encrypting the first dynamic key by using the public key of the Internet of Things device, and the first ciphertext is obtained by the Internet of Things platform encrypting the first original data by using the first dynamic key through the SDK of the Internet of Things platform; A second encryption and decryption module is configured to use the private key of the IoT device to decrypt the encrypted first dynamic key to obtain the first dynamic key; and The first ciphertext is decrypted using a first dynamic key to obtain first original data.

15. A system for providing national secret algorithms for devices and platforms, characterized in that: The system includes a unified password service platform, and the unified password service platform includes: The second sending module is configured to send the first dynamic key to the Internet of Things platform after the Internet of Things platform prepares the first original data to be sent to the Internet of Things device, so that the Internet of Things platform uses the first dynamic key to encrypt the first original data through the SDK of the Internet of Things platform to obtain the first ciphertext, and encrypts the first dynamic key through the public key of the Internet of Things device to obtain the encrypted first dynamic key, and sends the encrypted first dynamic key and the first ciphertext to the Internet of Things device; enables the Internet of Things device to decrypt the encrypted first dynamic key using the private key of the Internet of Things device to obtain the first dynamic key, and uses the first dynamic key to decrypt the first ciphertext to obtain the first original data.

16. An electronic device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the method for providing a national encryption algorithm for a device and a platform as described in any one of claims 1-6, or claims 7-11, or claim 12.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements a method for providing a national encryption algorithm for a device and a platform as described in any one of claims 1-6, or claims 7-11, or claim 12.

Images