Internet of Things communication method, Internet of Things terminal, quantum cryptography service platform and quantum cryptography service system

Abstract

The invention provides an Internet of Things communication method, an Internet of Things terminal and a quantum cryptography service platform and system, and relates to the technical field of Internet of Things. According to the scheme, the session key of the current period is distributed to the Internet of Things terminal based on the quantum cryptography service platform, that is, the session key is periodically updated by the quantum cryptography service management platform in a dynamic updating mode; and then, encryption processing or decryption processing is performed on the session key and the target service data of the current period by adopting a security encryption technology based on a security module integrated in the Internet of Things terminal, and the target service data is data to be sent to the Internet of Things platform or data issued by the Internet of Things service platform. According to the technical scheme, the secure communication of the Internet of Things is ensured, and when the secret key is used for encryption, the secret key is periodically updated, so that the problem of leakage of all service data caused by secret key cracking is avoided, and the reliability, the security and the integrity in the data transmission process between the Internet of Things terminal and the Internet of Things service platform are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an Internet of Things communication method, an Internet of Things terminal, a quantum cryptography service platform and a system. Background Art

[0002] The Internet of Things refers to a large, intelligent network formed by connecting various information sensing devices (such as radio frequency identification devices, various sensor nodes, and various wireless communication devices) through the Internet to achieve information exchange and communication. Among them, the biggest difference between the Internet of Things and the Internet and mobile Internet is the addition of a large number of nodes in the perception layer and edge layer, which breaks through the original IT architecture. The system boundary is further expanded, which is the organic integration of cloud and perception nodes / edge nodes. Therefore, the security issues and challenges it faces are also quite different from cloud resources and traditional hardware products, mainly manifested in the following aspects: fragmentation of device resources, a wide variety of communication protocols, more openness, and harsh deployment environment. In particular, the identity authentication security and data security mechanisms that run through the three levels of cloud, pipe, and end are the core issues of the current Internet of Things security, and are also practical problems that need to be studied and solved urgently.

[0003] In related technologies, IoT terminal devices generally connect to the network through Bluetooth, WiFi, ZigBee and 4G, and then interact with the IoT business platform for data.

[0004] However, the current data transmission methods are not secure enough, making it difficult to ensure secure communication in IoT systems. Summary of the invention

[0005] The purpose of the present invention is to provide an Internet of Things communication method, an Internet of Things terminal, a quantum cryptography service platform and a system to solve the technical problems existing in the prior art in view of the deficiencies in the above-mentioned prior art.

[0006] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows: In a first aspect, an embodiment of the present application provides an Internet of Things communication method, which is applied to an Internet of Things terminal in an Internet of Things communication system, wherein the Internet of Things terminal is integrated with a security module, and the method includes: Sending a session key request of the current period to the quantum cryptographic service platform, wherein the session key request includes: the current session identifier, the current charging key, and the identifier of the IoT terminal; Receiving a first ciphertext returned by the quantum cryptography service platform, where the first ciphertext is obtained by encrypting the session key of the current period by the quantum cryptography service platform based on the current injection key, wherein the quantum cryptography service platform updates the session key according to a preset period; The security module decrypts the first ciphertext according to the current injection key to obtain the session key of the current period; The security module encrypts or decrypts the target business data based on the session key of the current period.

[0007] Optionally, before sending the session key request of the current period to the quantum cryptographic service platform, the method further includes: Sending a network access authentication request to the quantum cryptography service platform; the network access authentication request at least includes: an identifier of the Internet of Things terminal, an identifier of the charging key, a first random number, and a second ciphertext; Receiving an authentication response message returned by the quantum cryptography service platform, wherein the authentication response message includes: a network access token, a network access validity period, a third ciphertext, and an identifier of the charging key; A session connection is established with the quantum cryptography service platform according to the authentication response message.

[0008] Optionally, the system further comprises: a key charging terminal; Before generating the network access authentication request, the method further includes: Receiving an information acquisition request issued by the key charging terminal; The security module generates a signature key pair according to the information acquisition request, wherein the signature key pair includes: a signature public key and a signature private key; Returning the signature key pair and the identification information of the Internet of Things terminal to the key charging terminal; Receive the encapsulated charging key returned from the quantum cryptography service platform and forwarded via the key charging terminal, wherein the encapsulated charging key includes: an encryption key pair, a charging key ciphertext and a Ka key ciphertext.

[0009] Optionally, sending the network access authentication request to the quantum cryptography service platform includes: Sending a first frame request for network access to the quantum cryptography service platform, wherein the first frame request for network access includes: an identifier of the Internet of Things terminal; Receiving a response message sent by the quantum cryptography service platform, and generating a first random number, wherein the response message includes a second random number generated by the quantum cryptography service platform; Obtaining an unused target charging key, and generating a second ciphertext by the security module according to the target charging key, the first random number, and the second random number; Generate a second frame request for network access according to the identifier of the Internet of Things terminal, the identifier of the key injection, the first random number and the second ciphertext, and send the second frame request for network access to the quantum cryptography service platform; Wherein, establishing a session connection with the quantum cryptography service platform according to the authentication response message includes: Generate a fifth ciphertext according to the charging key corresponding to the identification of the charging key, the first random number, and the second random number; The fourth ciphertext is compared with the fifth ciphertext, and if the comparison result is consistent, a session connection is established with the quantum cryptography service platform.

[0010] In a second aspect, an embodiment of the present application provides an Internet of Things communication method, which is applied to a quantum cryptography service platform in an Internet of Things communication system, and the method includes: Receive a session key request sent by the Internet of Things terminal, the session key request including: a current session identifier, a current charging key, and an identifier of the Internet of Things terminal; Obtaining the session key of the IoT terminal in the current period; According to the current charging key in the session key request, the session key of the Internet of Things terminal in the current period is encrypted to obtain a first ciphertext, and a mapping relationship between the session key of the Internet of Things terminal in the current period and the identifier of the Internet of Things terminal and the current session identifier is established and stored, wherein the quantum cryptography service platform updates the session key according to a preset period; Returning the second ciphertext to the Internet of Things terminal; According to the mapping relationship between the session key of the Internet of Things terminal in the current cycle, the identifier of the Internet of Things terminal and the identifier of this session, the business data to be sent to the Internet of Things terminal and the business data from the Internet of Things terminal are encrypted or decrypted.

[0011] Optionally, before receiving the session key request sent by the Internet of Things terminal, the method further includes: Receiving a network access authentication request sent by the Internet of Things terminal, wherein the network access authentication request includes: the network access authentication request at least includes: an identifier of the Internet of Things terminal, an identifier of a charging key, a first random number, and a second ciphertext; Determine the authentication response message of the Internet of Things terminal according to the network access authentication request, wherein the authentication response message includes: a network access token, a network access validity period, a third ciphertext and an identifier of the charging key; The authentication response message is returned to the Internet of Things terminal.

[0012] Optionally, the system further comprises: a key charging terminal; The receiving the network access authentication request sent by the Internet of Things terminal also includes: Receiving a key charging request for the Internet of Things terminal sent by the key charging terminal; Generate an encapsulated charging key, wherein the encapsulated charging key includes: an encryption key pair, a charging key ciphertext and a Ka key ciphertext; The packaged charging key is sent to the key charging terminal.

[0013] Optionally, the receiving a network access authentication request sent by the Internet of Things terminal includes: Receive a first frame request for network access sent by the Internet of Things terminal, where the first frame request for network access includes: an identifier of the Internet of Things terminal; Generate a response request message according to the first frame request for network access, wherein the response message includes a second random number generated by the quantum cryptography service platform; Returning the response request message to the Internet of Things terminal; Receive a second frame request for network access sent by the Internet of Things terminal.

[0014] Optionally, determining an authentication response message of the Internet of Things terminal according to the network access authentication request includes: Parsing the second frame request for network access to obtain the identifier of the Internet of Things terminal, the identifier of the key injection, the first random number and the second ciphertext; Determine the charging key corresponding to the identification of the charging key sequence according to the identification of the Internet of Things terminal and the identification of the charging key; Obtaining a third ciphertext according to the charging key corresponding to the charging key identifier, the first random number, and the second random number; Comparing the third ciphertext with the second ciphertext, if the comparison result is consistent, generating a network access token and network access validity period for the Internet of Things terminal; Generate a fourth ciphertext according to the charging key corresponding to the identification of the charging key, the first random number, and the second random number; An authentication response message of the Internet of Things terminal is determined according to the network access token, the network access validity period, the fourth ciphertext and the identifier of the charging key.

[0015] In a third aspect, an embodiment of the present application further provides an Internet of Things terminal, in which a security module is integrated, and the Internet of Things terminal performs data processing based on the Internet of Things communication method provided in the embodiment of the first aspect.

[0016] In a fourth aspect, an embodiment of the present application further provides a quantum cryptography service platform, comprising: a processor and a memory, the memory storing machine-readable instructions executable by the processor, and when the quantum cryptography service platform is running, the processor executes the machine-readable instructions to perform the steps of the Internet of Things communication method provided in the embodiment of the second aspect.

[0017] In the fifth aspect, the embodiments of the present application also provide an Internet of Things communication system, including: the Internet of Things terminal provided by the third aspect embodiment, the quantum cryptography service platform and the Internet of Things business platform provided by the fourth aspect embodiment, and the quantum cryptography service platform is respectively communicated with the Internet of Things terminal and the Internet of Things business platform.

[0018] The beneficial effects of this application are: The present application provides an Internet of Things communication method, an Internet of Things terminal, a quantum cryptography service platform and a system. The present solution is based on the quantum cryptography service platform and distributes the session key of the current period to the Internet of Things terminal, that is, the quantum cryptography service management platform periodically updates the session key in a dynamic update manner; then, based on the security module integrated in the Internet of Things terminal, a security encryption technology is adopted to encrypt or decrypt the session key of the current period and the target business data, wherein the target business data is the data to be sent to the Internet of Things platform or the data issued by the Internet of Things business platform, so that the secure communication of the Internet of Things is ensured, and when the key is used for encryption, the key is periodically updated, so as to avoid the problem of all business data being leaked due to key cracking, and ensure the reliability, security and integrity of the data transmission process between the Internet of Things terminal and the Internet of Things business platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A schematic diagram of the structure of an Internet of Things communication system provided in an embodiment of the present application; Figure 2 A schematic diagram of a flow chart of an Internet of Things communication method provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of another Internet of Things communication system provided in an embodiment of the present application; Figure 4 A flowchart of another Internet of Things communication method provided in an embodiment of the present application; Figure 5 A flow chart of another Internet of Things communication method provided in an embodiment of the present application; Figure 6 A flowchart of another Internet of Things communication method provided in an embodiment of the present application; Figure 7 A flow chart of another Internet of Things communication method provided in an embodiment of the present application; Figure 8 A flowchart of another Internet of Things communication method provided in an embodiment of the present application; Fig. 9 A schematic diagram of the interactive process of key injection in an Internet of Things communication method provided in an embodiment of the present application; Fig.10 A schematic diagram of the interactive process of Internet of Things terminal network access authentication in an Internet of Things communication method provided in an embodiment of the present application; Fig.11 A schematic diagram of an interactive process of a session key negotiation in an Internet of Things communication method provided in an embodiment of the present application; Fig.12 A schematic diagram of the structure of an Internet of Things terminal provided in an embodiment of the present application; Fig.13 A schematic diagram of the structure of a quantum cryptography service platform provided in an embodiment of the present application.

[0021] Icons: 100-Internet of Things communication system; 101-Internet of Things terminal; 102-quantum cryptography service platform; 103-Internet of Things business platform; 301-key charging terminal. DETAILED DESCRIPTION

[0022] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0023] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0024] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0025] First, the professional terms involved in this application are introduced.

[0026] 1. Quantum Cryptographic Service Provider (CSP) platform: a platform that provides cryptographic and key services for mobile Internet, Internet of Things and other services based on the quantum key network, including subsystems such as cryptographic service platform software, exchange cipher machines, and charging terminal software.

[0027] 2. Session key: The key used for encryption and decryption when data is transmitted.

[0028] 3. Charge key: The key used to protect the session key negotiation is pre-charged and stored in the security module in the IoT terminal. Generally, multiple keys are stored.

[0029] Secondly, the prior art involved in this application is introduced.

[0030] In related technologies, IoT terminal devices generally connect to the network through Bluetooth, WiFi, ZigBee and 4G, and then interact with the IoT business platform for data.

[0031] However, the current data transmission methods basically do not use secure encryption technology or use software encryption methods with very low security levels, which are insufficient to meet their own security needs; in addition, when using keys for encryption, the use of keys cannot be updated in a timely and convenient manner. Once the key is cracked, all data will be leaked, which seriously threatens the secure communication of the Internet of Things system. Therefore, the current data transmission method has the problem of insufficient security and it is difficult to ensure the secure communication of the Internet of Things system.

[0032] The embodiments of the present application are based on the above-mentioned problems. The present application provides a new method for communication in the Internet of Things. The scheme is based on a quantum cryptography service platform and distributes the session key of the current period to the Internet of Things terminal, that is, the quantum cryptography service management platform periodically updates the session key in a dynamic update manner; then, based on the security module integrated in the Internet of Things terminal, a security encryption technology is adopted to encrypt or decrypt the session key of the current period and the target business data, wherein the target business data is the data to be sent to the Internet of Things platform or the data issued by the Internet of Things business platform. In this way, the secure communication of the Internet of Things is ensured, and when the key is used for encryption, the key is periodically updated to avoid the problem of all business data being leaked due to key cracking, thereby ensuring the reliability, security and integrity of the data transmission process between the Internet of Things terminal and the Internet of Things business platform.

[0033] Before elaborating on the technical solution provided by the present application, a brief description is first given of the application scenarios of the Internet of Things communication involved in the present application.

[0034] refer to Figure 1 As shown, it is a schematic diagram of the structure of the Internet of Things communication system provided in the embodiment of the present application; Figure 1 As shown, the Internet of Things communication system 100 includes: an Internet of Things terminal 101, a quantum cryptography service platform 102 and an Internet of Things business platform 103.

[0035] Optionally, in order to improve the secure communication of the IoT communication system, the IoT terminal provided in the present application is integrated with a security module, the security module is integrated with a security chip and a communication module, and the security chip is a hardware product that stores a secure encryption algorithm and has a certain secure storage space; for example, the IoT terminal is integrated with a main control chip ( Figure 1 The security module communicates with the main control chip in the IoT terminal, and the main control chip in the IoT terminal makes a function call to the security module to obtain session keys, encrypt uplink data, and decrypt downlink data. For example, the security module may be an NB-IoT module or a 4G Cat.1 module.

[0036] Optionally, the Internet of Things service platform 103 includes: a communication module and a service module, wherein the communication module is used to send and receive data, and the service module is used to process the sent and received data.

[0037] The Internet of Things terminal 101 includes: a security module and a business module, and the business module is used for processing business data.

[0038] The quantum cryptography service platform 102 is respectively connected to the Internet of Things terminal 101 and the Internet of Things business platform 103 in communication, and the Internet of Things terminal 101 and the Internet of Things business platform 103 are also connected in communication.

[0039] In the prior art, the Internet of Things service platform 103 is used to issue service instructions to the Internet of Things terminal 101 or receive service data collected by the Internet of Things terminal 101 .

[0040] In the IoT communication method provided in the present application, in order to provide communication security, the session key of the current period is distributed to the IoT terminal with the help of the quantum cryptography service platform 102, that is, the quantum cryptography service management platform periodically updates the session key in a dynamic update manner; then, based on the security module integrated in the IoT terminal 101, a security encryption technology is adopted to encrypt or decrypt the session key of the current period and the target business data, thereby ensuring the security of IoT communication, and when using the key for encryption, the key is periodically updated to avoid the problem of all business data being leaked due to key cracking, thereby ensuring the reliability, security and integrity of data transmission between the IoT terminal and the IoT business platform.

[0041] Understandably, Figure 1 The structure described is for illustration only. The IoT communication system may also include Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0042] The implementation principles and corresponding beneficial effects of the IoT communication method steps provided in this application will be described below through a number of specific embodiments.

[0043] In one embodiment, reference Figure 2 As shown, a method for Internet of Things communication is provided. Optionally, the execution subject of the method can be Figure 1 The IoT terminal and quantum cryptography service platform in the IoT communication system shown in .

[0044] It should be understood that in other embodiments, the order of some steps in the IoT communication method can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2 As shown, the method includes: S201. The IoT terminal sends a session key request for the current period to the quantum cryptography service platform.

[0045] The session key request includes: the current session identifier, the current recharge key and the identifier of the IoT terminal.

[0046] Optionally, in order to achieve the security of data transmission between the IoT terminal and the IoT business platform, before the IoT terminal processes business data, the IoT terminal can first obtain the session identification ID and the identification of the charging key, where the identification of the charging key can be a serial number; and obtain the current charging key based on the identification of the charging key, and then send the current session identification, the current charging key and the identification of the IoT terminal as the session key request of the current period to the IoT business platform, which is forwarded by the IoT business platform to the quantum cryptography service platform.

[0047] S202. The quantum cryptography service platform obtains the session key of the IoT terminal in the current period.

[0048] Among them, the quantum cryptography service platform is a platform that provides cryptography and key management services for mobile Internet, Internet of Things and other businesses based on the quantum key network, including cryptographic service platform software, exchange ciphers, charging terminal software and other subsystems. The quantum cryptography service platform provides terminal access authentication, encryption and decryption operations for the Internet of Things business platform, and provides key charging and other functions for the Internet of Things terminals.

[0049] Optionally, after receiving the session key request for the current period sent by the IoT terminal, the quantum cryptography service platform distributes the session key for the current period to the IoT terminal using a dynamic key update method, that is, the session keys for different periods are different.

[0050] Exemplarily, for example, the key update cycle is generally set to 24 hours. When the used charging key exceeds 24 hours, the security module in the IoT terminal actively adopts an unused charging key and initiates a new round of session key application. The previously used charging key will be destroyed, and the corresponding session key will also be destroyed and updated.

[0051] Therefore, in this solution, it is proposed that the quantum cryptography service platform provide a dynamic key update method to regularly and quickly update the session key and the injection key used to protect the session key, which can effectively reduce the risk of data leakage.

[0052] S203. The quantum cryptography service platform encrypts the session key of the Internet of Things terminal in the current period according to the current charging key in the session key request to obtain a first ciphertext, and establishes and stores a mapping relationship between the session key of the Internet of Things terminal in the current period and the identifier of the Internet of Things terminal and the identifier of this session.

[0053] The quantum cryptography service platform updates the session key according to a preset period. For example, based on a quantum random number generator in the quantum cryptography service platform, the session key of the current period is randomly generated according to a preset period.

[0054] Optionally, in order to provide the security of the session key of the current cycle, the quantum cryptography service platform needs to encrypt the session key of the IoT terminal in the current cycle according to the current injection key in the session key request to obtain the first ciphertext; at the same time, establish and store the mapping relationship between the session key of the IoT terminal in the current cycle and the identifier of the IoT terminal and the identifier of this session. Exemplarily, the identifier of the IoT terminal is W1, the identifier of this session is H1, and the session key of the IoT terminal in the current cycle is M1, then the mapping relationship between the identifier W1 of the IoT terminal, the identifier H1 of this session, and the session key M1 of the IoT terminal in the current cycle can be established.

[0055] Optionally, in a feasible manner, for example, multiple sessions may be included in the same cycle, and there is only one session key corresponding to the same cycle, that is, multiple sessions in the same cycle share one session key.

[0056] S204. The quantum cryptography service platform sends the first ciphertext to the Internet of Things terminal.

[0057] The first ciphertext is obtained by encrypting the session key of the current period by the quantum cryptography service platform based on the current injection key, wherein the quantum cryptography service platform updates the session key according to a preset period.

[0058] S205. The security module in the IoT terminal decrypts the first ciphertext according to the currently injected key to obtain the session key of the current period.

[0059] Among them, the security module in the IoT terminal is a hardware product of a 4G Cat.1 communication module. The module includes a radio frequency transceiver, a power amplifier, a filter, a baseband processor, a main controller MCU / CPU, a security chip, etc.; the security module is directly integrated on the circuit board of the IoT terminal.

[0060] The security chip integrated inside the security module is a national secret chip. This security chip adopts a 32-bit CPU architecture, supports 7816, SPI, UART, and I2C interfaces, and supports multiple algorithms such as SM1, SM2, SM3, SM4, SM7, SHA, DES, AES, RSA, and ECC. It has established a multi-level chip security protection system from the algorithm level, circuit level, system level to the software layer, which complies with the commercial secret level 2 security standard and can meet the industrial-grade reliability requirements.

[0061] Optionally, after the IoT terminal receives the first ciphertext returned by the quantum cryptography service platform, the security module decrypts the first ciphertext according to the currently injected key to obtain the session key of the current period.

[0062] S206: The security module in the IoT terminal encrypts or decrypts the target business data based on the session key of the current period.

[0063] The target business data may be: business data collected by the IoT terminal or instructions issued by the IoT platform. For example, the IoT terminal is a gas meter terminal, the instruction issued by the IoT platform is to read the remaining gas volume, and the business data collected is the current remaining gas volume.

[0064] In one possible implementation, for example, (1) encryption of uploaded data is as follows: The first step is to use the session key of the current period to encrypt the collected service data by the security module in the IoT terminal to obtain the encrypted service number, and encapsulate the encrypted service number, the IoT terminal identifier and the current session identifier into a first data packet; In the second step, the IoT terminal sends the first data packet to the IoT service platform, thereby ensuring the security of data transmission between the IoT terminal and the IoT service platform.

[0065] (2) Decryption of the sent data, as follows: The first step is that the IoT business platform sends the second data packet encrypted by the quantum cryptography service platform to the IoT terminal; In the second step, the IoT terminal obtains the session key corresponding to the current session key according to the current session identifier, and uses the session key corresponding to the current session key to decrypt the second data packet, obtain the instruction data, and perform related business processing.

[0066] In this solution, the IoT terminal uses a periodically updated session key to encrypt or decrypt the target business data, effectively reducing the risk of business data leakage, thereby improving the security of business data transmission and solving the problem that the current data transmission method is insufficiently secure, making it difficult to ensure secure communication of the IoT system.

[0067] S207. The quantum cryptography service platform encrypts or decrypts the business data to be sent to the IoT terminal and the business data from the IoT terminal according to the mapping relationship between the session key of the IoT terminal in the current cycle and the identifier of the IoT terminal and the identifier of this session.

[0068] In one achievable method, for example, (1) the service data from the IoT terminal is decrypted. Specifically, as follows: First, the Internet of Things service platform receives a first data packet sent by the Internet of Things terminal, wherein the first data packet is obtained by encapsulating the encrypted service data, the identifier of the Internet of Things terminal, and the current session identifier; Step 2: The IoT business platform forwards the first data packet to the quantum cryptography service platform; Step 3: The quantum cryptography service platform verifies the IoT terminal according to the identifier of the IoT terminal in the first data packet to determine whether the IoT terminal is a terminal device in the preset whitelist; Step 4: If the whitelist verification is passed, the quantum cryptography service platform obtains the session key of the IoT terminal in the current period according to the current session identifier in the first data packet and the mapping relationship between the session key of the IoT terminal in the current period and the identifier of the IoT terminal and the current session identifier; Step 5. Use the session key of the current period to decrypt the encrypted business data in the first data packet to obtain the business data, and return the business data to the IoT business platform to ensure the confidentiality of the data. At the same time, after obtaining the business data, the IoT business platform requests the quantum cryptography service platform to perform HMAC-SM3 calculation on the business data, obtain the summary value, and compare it with the summary value in the first data packet. If they are consistent, the integrity check is successful; if they are inconsistent, it means that the business data may be tampered with.

[0069] (2) Encryption of business data sent to IoT terminals is as follows: First, the IoT service platform generates and issues instruction data, and according to the previously established connection with the IoT terminal, encapsulates the obtained IoT terminal ID, the current session ID, and the instruction data into a second data packet, and sends an encryption request to the quantum cryptography service platform; Step 2: The quantum cryptography service platform obtains a session key corresponding to the session identifier according to the session identifier in the second data packet, and then encrypts the instruction data using the session key corresponding to the session identifier to obtain an encrypted second data packet. Step 3: The quantum cryptography service platform returns the session identifier and the encrypted second data packet to the IoT service platform; Step 4: The IoT service platform sends the encrypted second data to the IoT terminal.

[0070] Optionally, after receiving the encrypted second data, the Internet of Things terminal decrypts the encrypted second data, obtains the instruction data, and performs business processing.

[0071] Optionally, in this solution, the IoT terminal periodically obtains session keys from the quantum cryptography service platform, that is, the quantum cryptography service platform randomly generates session keys for each period according to a preset period, so that the session keys and the injection keys used to protect the session keys are updated regularly and quickly, which can effectively reduce the risk of data leakage.

[0072] At the same time, during the communication between the IoT terminal and the IoT business platform, different session keys are used to encrypt or decrypt the corresponding business data in different cycles, which increases the difficulty of cracking the encrypted business data and ensures the reliability, security and integrity of the data transmission between the IoT terminal and the IoT business platform.

[0073] In summary, the embodiment of the present application provides an Internet of Things communication method. This scheme is based on a quantum cryptography service platform to distribute the session key of the current period to the Internet of Things terminal, that is, the quantum cryptography service management platform adopts a dynamic update method to periodically update the session key; then, based on the security module integrated in the Internet of Things terminal, a secure encryption technology is adopted to encrypt or decrypt the session key of the current period and the target business data, wherein the target business data is the data to be sent to the Internet of Things platform or the data issued by the Internet of Things business platform. In this way, the secure communication of the Internet of Things is ensured, and when the key is used for encryption, the key is periodically updated to avoid the problem of all business data being leaked due to key cracking, thereby ensuring the reliability, security and integrity of the data transmission process between the Internet of Things terminal and the Internet of Things business platform.

[0074] Optionally, the following embodiments will be used to explain in detail that before the IoT terminal and the IoT business platform communicate data, they also need to perform key injection and network authentication on the security module in the IoT terminal through the quantum cryptography service platform.

[0075] First, key filling, as follows: Optionally, refer to Figure 3 As shown, the Internet of Things communication system also includes: a key charging terminal 301; wherein the key charging terminal 301 and the quantum cryptography service platform 102 can be deployed on the quantum cryptography service management platform, and the Internet of Things terminal 101 can send a key charging request to the quantum cryptography service platform 102 via the key charging terminal 301, and assist the Internet of Things terminal to complete the key charging operation, so that a plurality of charging keys are stored in the security module in the Internet of Things terminal.

[0076] Optionally, refer to Figure 4 As shown, before sending the network access authentication request, it also includes: S401. The Internet of Things terminal receives an information acquisition request sent by the key charging terminal.

[0077] Among them, the security module in the IoT terminal must complete the key charging operation before leaving the factory. Specifically, the key charging terminal sends a request to obtain the public key and the identification of the IoT terminal to the IoT terminal.

[0078] It should be noted that when the security module leaves the factory, it sends a key charging request to the CSP platform with the help of a key charging terminal, and uses the security chip integrated inside the security module to save the charging key file in a secure storage space. The quantum cryptography service platform synchronously and securely stores the same charging key.

[0079] S402: The security module in the IoT terminal generates a signature key pair according to the information acquisition request.

[0080] The signature key pair includes: a signature public key PubKey1 and a signature private key PriKey1.

[0081] S403: The IoT terminal returns the signature key pair and the IoT terminal identifier to the key charging terminal.

[0082] Optionally, the security module generates a signature key pair based on the received request for obtaining the public key and the identification of the Internet of Things terminal, the signature key pair including: a signature public key PubKey1 and a signature private key PriKey1, and returns the signature public key PubKey1 and the identification of the Internet of Things terminal to the key injection terminal. After receiving the signature public key PubKey1 and the identification of the Internet of Things terminal, the key injection terminal sends a key injection request to the quantum cryptography service platform.

[0083] S404, the quantum cryptography service platform receives a key charging request for the Internet of Things terminal sent by the key charging terminal; S405: Generate a packaged charging key.

[0084] The encapsulated charging key includes: an encryption key pair, charging key ciphertext and Ka key ciphertext.

[0085] Optionally, after receiving the key charging request, the quantum cryptography service platform performs the following operations: a. Generate SM2 encryption key pair, including: encryption public key PubKey2 and encryption private key PriKey2, and use signature public key PubKey1 to encrypt and encapsulate the encryption key pair into a digital envelope; b. Generate a symmetric key Ka; c. Generate multiple groups of injection keys K1-Kx that are uniquely bound to the identification of the IoT terminal; d. Use Ka to encrypt multiple groups of charging keys K1-Kx using the SM4 algorithm to generate multiple groups of charging key ciphertexts C1-Cx; e. Use the encryption key public key PubKey2 to encrypt the ka key and generate the Ka key ciphertext C2.

[0086] S406. The quantum cryptography service platform sends the packaged charging key to the key charging terminal.

[0087] Optionally, the quantum cryptography service platform encapsulates the encryption key pair digital envelope, multiple groups of injection key ciphertexts C1-Cx and Ka key ciphertext C2 to obtain the encapsulated injection key, and sends the encapsulated injection key to the key injection terminal.

[0088] S407. The Internet of Things terminal receives the encapsulated charging key returned from the quantum cryptography service platform via the key charging terminal.

[0089] Optionally, the key charging terminal receives the encapsulated charging key sent by the quantum cryptography service platform, and forwards the encapsulated charging key to the Internet of Things terminal. The Internet of Things terminal writes the encapsulated charging key in the form of a file into the secure storage space in the security module, and the key charging process ends here.

[0090] Furthermore, the process for the security module in the IoT terminal to obtain an unused charging key plaintext is as follows: The first step is to use the signature private key PriKey1 to decrypt the digital envelope and obtain the encryption private key PriKey2; Step 2: Use the encrypted private key PriKey2 to decrypt the Ka key ciphertext C2 to obtain the Ka key plaintext; Step 3: Use the Ka key to decrypt the charging key ciphertext C1 to obtain the charging key plaintext K1.

[0091] The following example will explain in detail how to perform network access authentication.

[0092] Second, network authentication, as follows: Optionally, refer to Figure 5 As shown, before the above step S201, it also includes: S501. The Internet of Things terminal sends a network access authentication request to the quantum cryptography service platform.

[0093] The network access authentication request includes at least: an identifier of the Internet of Things terminal, an identifier of the charging key, a first random number and a second ciphertext.

[0094] Optionally, before the IoT terminal establishes a session connection with the quantum cryptography service platform, the quantum cryptography service platform needs to perform network access authentication on the IoT terminal. Specifically, the IoT terminal initiates a network access authentication request to the IoT service platform, and the IoT service platform forwards the request to the quantum cryptography service platform.

[0095] S502. The quantum cryptography service platform determines the authentication response message of the Internet of Things terminal according to the network access authentication request.

[0096] The authentication response message includes: network access token, network access validity period, third ciphertext and identification of the charging key.

[0097] S503: Return the authentication response message to the IoT terminal.

[0098] Optionally, after receiving the network access authentication request from the Internet of Things terminal, the quantum cryptography service platform obtains the authentication response message of the Internet of Things terminal according to the network access authentication request, namely the network access token, network access validity period, third ciphertext and the identifier of the injected key, and the authentication response message is forwarded to the Internet of Things terminal via the Internet of Things business platform.

[0099] S504. The IoT terminal establishes a session connection with the quantum cryptography service platform based on the authentication response message.

[0100] Optionally, the Internet of Things terminal further performs network access identity authentication based on the received authentication response message. If the network access authentication is successful, the Internet of Things terminal establishes a session connection with the quantum cryptography service platform; if the network access authentication fails, the Internet of Things terminal continues to send a network access authentication request to the quantum cryptography service platform.

[0101] Optionally, refer to Figure 6 As shown, the above step S501 includes: S601, the IoT terminal sends the first frame request for network access to the quantum cryptography service platform.

[0102] The first frame request for network access includes: the identifier of the IoT terminal.

[0103] Optionally, the IoT terminal initiates a first frame request for network access to the IoT service platform. The first frame request for network access includes an identifier of the IoT terminal. The IoT service platform forwards the first frame request for network access to the quantum cryptography service platform for processing.

[0104] S602. The quantum cryptography service platform generates a response request message according to the first frame request for network access.

[0105] The response information includes a second random number generated by the quantum cryptography service platform.

[0106] S603. The quantum cryptography service platform returns the response request message to the IoT terminal.

[0107] Optionally, after receiving the first frame request for network access, the quantum cryptography service platform verifies the Internet of Things terminal according to the identification of the Internet of Things terminal in the first frame request for network access. If the whitelist verification is passed, a second random number B is generated, and a response request is responded to, and the second random number B and the response request are returned to the Internet of Things terminal as a response request message.

[0108] S604: The Internet of Things terminal generates a first random number.

[0109] S605. The IoT terminal obtains an unused target charging key, and the security module generates a second ciphertext according to the target charging key, the first random number, and the second random number.

[0110] Optionally, after receiving the response request message, the IoT terminal generates a first random number A, and then the security module reads an unused target injection key from the secure storage space, and uses the target injection key to perform MAC encryption operation on the mixed value AB of the first random number A and the second random number B to obtain the second ciphertext MAC_AB.

[0111] S606: The Internet of Things terminal generates a second frame request for accessing the network according to the identifier of the Internet of Things terminal, the identifier of the key to be charged, the first random number and the second ciphertext.

[0112] Exemplarily, for example, the identifier of the charging key may be a serial number.

[0113] S607. The IoT terminal sends the second frame request for accessing the network to the quantum cryptography service platform.

[0114] Optionally, the IoT terminal assembles the IoT terminal identifier, the serial number of the injected key, the first random number A and the first ciphertext MAC_AB into a second frame request for network access, and sends it to the IoT service platform; the IoT service platform forwards the second frame request for network access to the quantum cryptography service platform for processing.

[0115] Optionally, refer to Figure 7 As shown, applied to the quantum cryptography service platform, the above step S502 includes: S701. Parse the second frame request for network access to obtain the identifier of the Internet of Things terminal, the identifier of the key injection, the first random number and the second ciphertext.

[0116] S702: Determine the charging key corresponding to the charging key identifier according to the identifier of the Internet of Things terminal and the identifier of the charging key.

[0117] S703. Obtain a third ciphertext according to the injection key corresponding to the injection key identifier, the first random number, and the second random number.

[0118] Optionally, the quantum cryptography service platform parses the second frame request for accessing the network to obtain the identification of the Internet of Things terminal, the identification of the charging key, the first random number and the second ciphertext, and then obtains the charging key corresponding to the identification of the charging key based on the identification of the Internet of Things terminal and the identification of the charging key, and first uses the charging key to encrypt the mixed value AB of the first random number A and the second random number B to obtain the third ciphertext.

[0119] S704: Compare the third ciphertext with the second ciphertext. If the comparison result is consistent, generate a network access token and network access validity period for the IoT terminal.

[0120] Optionally, the quantum cryptography service platform compares the calculated third ciphertext with the second ciphertext MAC_AB calculated by the IoT terminal. If the comparison result is consistent, a network access token and network access validity period are generated for the IoT terminal.

[0121] S705. Generate a fourth ciphertext according to the charging key corresponding to the charging key identifier, the first random number, and the second random number.

[0122] S706: Determine the authentication response message of the Internet of Things terminal according to the network access token, the network access validity period, the fourth ciphertext, and the identifier of the charging key.

[0123] Optionally, the quantum cryptography service platform transforms the mixed value AB of the first random number A and the second random number B into BA, and encrypts it again using the injection key corresponding to the injection key identifier to obtain a fourth ciphertext MAC_BA, and uses the network access token, the network access validity period, the fourth ciphertext MAC_BA and the injection key identifier as the authentication response message, and returns the authentication response message to the Internet of Things terminal via the Internet of Things service platform.

[0124] Optionally, refer to Figure 8 As shown, applied to an IoT terminal, the above step S504 includes: S801. Generate a fifth ciphertext according to the injection key corresponding to the injection key identifier, the first random number, and the second random number.

[0125] S802. Compare the fourth ciphertext with the fifth ciphertext. If the comparison result is consistent, establish a session connection with the quantum cryptography service platform.

[0126] In one feasible method, for example, after receiving the authentication response message returned by the quantum cryptography service platform, the IoT terminal reads the injection key corresponding to the injection key identifier from the secure storage space of the security chip integrated in the security module according to the injection key identifier, and then uses the injection key corresponding to the injection key identifier to encrypt the mixed value BA of the first random number A and the second random number B once, generating the fifth ciphertext, and compares the fourth ciphertext with the fifth ciphertext. If the comparison is consistent, the network access identity authentication is completed, and the network access token is effective within the network access validity period. At this point, the IoT terminal establishes a session connection with the quantum cryptography service platform, realizing the scenario of cross-domain data collection of the IoT terminal integrated security module to ensure the confidentiality and integrity of the data.

[0127] The interactive process of the Internet of Things communication method provided by this application will be introduced through the following interactive schematic diagram.

[0128] Among them, the quantum cryptography service platform is abbreviated as CPS platform.

[0129] Optionally, refer to Fig. 9 FIG. 1 is a schematic diagram of an interactive process of key charging, and the method includes: The first step is that the IoT terminal receives the information acquisition request sent by the key charging terminal; Step 2: The security module in the IoT terminal generates a signature key pair based on the information acquisition request. The signature key pair includes: signature public key PubKey1 and signature private key PriKey1. Step 3: The IoT terminal returns the signature key pair and the IoT terminal identifier to the key charging terminal; Step 4: After receiving the signature public key PubKey1 and the IoT terminal's identifier, the key charging terminal sends a key charging request to the CPS platform; Step 5: After receiving the key charging request, the CSP platform performs the following operations: a. Generate an encryption key pair, including the encryption public key PubKey2 and the encryption private key PriKey2, and use the signature public key PubKey1 to encrypt and encapsulate the encryption key pair into a digital envelope; b. Generate a symmetric key Ka; c. Generate multiple groups of injection keys K1-Kx that are uniquely bound to the terminal ID; d. Use Ka to encrypt the charging key and generate multiple sets of charging key ciphertexts C1-Cx; e. Use the encryption key public key PubKey2 to encrypt the ka key to generate the Ka key ciphertext C2.

[0130] Step 6: The CSP platform encapsulates the encryption key pair digital envelope, charging key ciphertext C1-Cx, and Ka key ciphertext C2 and sends them to the key charging terminal; Step 7. The IoT terminal receives the encapsulated charging key returned from the quantum cryptography service platform via the key charging terminal.

[0131] Optionally, refer to Fig.10 FIG. 1 is a schematic diagram of an interactive process for authentication of an IoT terminal accessing the network, and the method includes: The first step is that the IoT terminal initiates an authentication request to the IoT service platform, that is, sends the first frame request for network access, which contains the IoT terminal's identifier; Step 2: The IoT service platform forwards the first frame request for network access to the CSP platform for processing; Step 3: The CSP platform first confirms the identifier of the IoT terminal according to the received first frame request for network access, and then generates a response request message, wherein the response request message includes: a second random number B; Step 4: forward the response request message to the IoT terminal via the IoT service platform; Step 5: After receiving the response request message, the IoT terminal generates a first random number A, and then uses an unused charging key to perform MAC encryption operation on the mixed value AB of the two time-varying parameters to obtain the ciphertext MAC_AB. Step 6: The IoT terminal assembles the IoT terminal identifier, the injection key serial number FID, the first random number A and the ciphertext MAC_AB into a second frame request for accessing the network, and sends it to the IoT service platform; Step 7: The IoT service platform forwards the second frame request to the CSP platform for processing; Step 8. The CSP platform reads the corresponding charging key according to the identification of the IoT terminal and the charging key serial number FID, and first uses the charging key to encrypt the mixed value AB of the two random numbers, and compares the ciphertext result with the MAC_AB calculated by the terminal. If the comparison is consistent, a network access token and network access validity period for the IoT terminal are generated; at the same time, the CSP platform transforms the mixed value into BA, and encrypts it again with the charging key to obtain the ciphertext result MAC_BA, and uses the network access token, network access validity period, ciphertext result MAC_BA and the charging key serial number FID as the authentication response message, and returns the authentication response message to the IoT terminal.

[0132] Step 9: forward the authentication response message to the IoT terminal via the IoT service platform; Step 10. The IoT terminal uses the charging key corresponding to the charging key serial number FID to encrypt the time-varying parameter mixed value BA again to obtain the fifth ciphertext, and compares the fifth ciphertext with MAC_BA. If the comparison is consistent, a session connection is established with the CSP platform, that is, the network access identity authentication is completed, and the token is effective within the network access validity period.

[0133] Optionally, refer to Fig.11 FIG. 1 is a schematic diagram of a negotiation interaction process of a session key, and the method includes: Step 1: After the IoT terminal passes the network authentication, it establishes a session connection with the CSP platform and obtains the session identifier SID and the injection key serial number FID; Step 2: The IoT terminal obtains the current charging key according to the charging key serial number FID; Step 3: The IoT terminal sends a session key request for the current period to the CSP platform; The session key request of the current cycle includes: the current session identifier, the current recharge key and the identifier of the Internet of Things terminal.

[0134] Step 4: The IoT service platform forwards the session key request for the current period to the CSP platform; Step 5: After receiving the session key request for the current period, the CSP platform generates the session key for the IoT terminal in the current period.

[0135] Step 6: The CSP platform uses the current charging key to encrypt the session key of the current period to obtain the first ciphertext, and returns the first ciphertext to the IoT terminal; Step 7: The IoT terminal uses the current charging key to decrypt the first ciphertext to obtain the plaintext of the current session key.

[0136] The specific structure of the above-mentioned Internet of Things terminal and quantum cryptography service platform will be introduced through the following embodiments.

[0137] Optionally, refer to Fig.12 As shown, a security module is integrated in the IoT terminal, and the IoT terminal performs data processing based on the IoT communication method provided in the above embodiment.

[0138] Among them, the IoT terminal integrates a security module, which is used for the IoT terminal to communicate with the IoT business platform to complete data interaction; the security chip integrated in the security module is a hardware product with a security algorithm and a certain amount of secure storage space; the security module communicates with the IoT terminal main control chip, and the IoT device main control chip calls the security module to achieve session key acquisition, uplink data encryption and downlink data decryption, etc. Specifically, Fig.12 As shown, the security module interacts with the main control chip on the IoT terminal through AT commands, and the MCU / CPU in the security module interacts with the security chip through APDU commands; the main control chip on the IoT terminal makes function calls to the security module to implement key charging, terminal network authentication, session key acquisition, uplink data encryption, and downlink data decryption; The security module communicates with the main control chip on the IoT terminal through communication interfaces such as I2C, SPI, and UART. At the same time, the embedded SDK interface program that matches the security module needs to be called in the embedded program of the main control chip on the IoT terminal to complete the call of the specific functions of the security module; the embedded SDK includes: key injection, terminal network authentication, session key acquisition, uplink data encryption, downlink data decryption and other functions. Among them, the embedded SDK is part of the main control program in the main control chip on the IoT terminal, provided by the security module manufacturer, and can be customized and compiled according to the development environment used by the main control chip of the IoT terminal, generally the Keil or Linux development environment. The IoT terminal calls the embedded SDK to complete the encryption and packaging of the data, and then uploads it to the IoT service platform.

[0139] Fig.13 This is a schematic diagram of the structure of a quantum cryptography service platform provided in an embodiment of the present application. The quantum cryptography service platform may be deployed on a computing device with data processing capabilities.

[0140] The quantum cryptography service platform includes: a processor 1301 and a memory 1302 .

[0141] The memory 1302 is used to store programs, and the processor 1301 calls the programs stored in the memory 1302 to execute the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0142] Optionally, the present invention also provides a program product, such as a computer-readable storage medium, comprising a program, which is used to execute the above method embodiment when executed by a processor.

[0143] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0144] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0145] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0146] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, referred to as: ROM), random access memory (English: Random Access Memory, referred to as: RAM), disk or optical disk and other media that can store program codes.

Claims

1. An Internet of Things communication method, characterized in that: An Internet of Things terminal applied to an Internet of Things communication system, wherein the Internet of Things terminal is integrated with a security module, and the method comprises: Sending a session key request of the current period to the quantum cryptographic service platform, wherein the session key request includes: the current session identifier, the current charging key, and the identifier of the IoT terminal; Receiving a first ciphertext returned by the quantum cryptography service platform, where the first ciphertext is obtained by encrypting the session key of the current period by the quantum cryptography service platform based on the current injection key, wherein the quantum cryptography service platform updates the session key according to a preset period; The security module decrypts the first ciphertext according to the current injection key to obtain the session key of the current period; The security module encrypts or decrypts the target business data based on the session key of the current period.

2. The method according to claim 1, characterized in that Before sending the session key request of the current cycle to the quantum cryptographic service platform, the method further includes: Sending a network access authentication request to the quantum cryptography service platform; the network access authentication request at least includes: an identifier of the Internet of Things terminal, an identifier of the charging key, a first random number, and a second ciphertext; Receiving an authentication response message returned by the quantum cryptography service platform, wherein the authentication response message includes: a network access token, a network access validity period, a third ciphertext, and an identifier of the charging key; A session connection is established with the quantum cryptography service platform according to the authentication response message.

3. The method according to claim 2, characterized in that The system also includes: a key charging terminal; Before sending the network access authentication request, the method further includes: Receiving an information acquisition request issued by the key charging terminal; The security module generates a signature key pair according to the information acquisition request, wherein the signature key pair includes: a signature public key and a signature private key; Returning the signature key pair and the identification information of the Internet of Things terminal to the key charging terminal; Receive the encapsulated charging key returned from the quantum cryptography service platform and forwarded via the key charging terminal, wherein the encapsulated charging key includes: an encryption key pair, a charging key ciphertext and a Ka key ciphertext.

4. The method according to claim 2, characterized in that: The sending the network access authentication request to the quantum cryptography service platform includes: Sending a first frame request for network access to the quantum cryptography service platform, wherein the first frame request for network access includes: an identifier of the Internet of Things terminal; Receiving a response message sent by the quantum cryptography service platform, and generating a first random number, wherein the response message includes a second random number generated by the quantum cryptography service platform; Obtaining an unused target charging key, and generating a second ciphertext by the security module according to the target charging key, the first random number, and the second random number; Generate a second frame request for network access according to the identifier of the Internet of Things terminal, the identifier of the key injection, the first random number and the second ciphertext, and send the second frame request for network access to the quantum cryptography service platform; Wherein, establishing a session connection with the quantum cryptography service platform according to the authentication response message includes: Generate a fifth ciphertext according to the charging key corresponding to the identification of the charging key, the first random number, and the second random number; The fourth ciphertext is compared with the fifth ciphertext, and if the comparison result is consistent, a session connection is established with the quantum cryptography service platform.

5. An Internet of Things communication method, characterized in that: A quantum cryptography service platform applied to an Internet of Things communication system, the method comprising: Receive a session key request sent by an Internet of Things terminal, wherein the session key request includes: a current session identifier, a current charging key, and an identifier of the Internet of Things terminal; Obtaining the session key of the IoT terminal in the current period; According to the current charging key in the session key request, the session key of the Internet of Things terminal in the current period is encrypted to obtain a first ciphertext, and a mapping relationship between the session key of the Internet of Things terminal in the current period and the identifier of the Internet of Things terminal and the current session identifier is established and stored, wherein the quantum cryptography service platform updates the session key according to a preset period; Returning the first ciphertext to the Internet of Things terminal; According to the mapping relationship between the session key of the Internet of Things terminal in the current cycle, the identifier of the Internet of Things terminal and the identifier of this session, the business data to be sent to the Internet of Things terminal and the business data from the Internet of Things terminal are encrypted or decrypted.

6. The method according to claim 5, characterized in that Before receiving the session key request sent by the Internet of Things terminal, the method further includes: Receiving a network access authentication request sent by the Internet of Things terminal, wherein the network access authentication request includes: the network access authentication request at least includes: an identifier of the Internet of Things terminal, an identifier of a charging key, a first random number, and a second ciphertext; Determine an authentication response message of the Internet of Things terminal according to the network access authentication request, wherein the authentication response message includes: a network access token, a network access validity period, a third ciphertext and an identifier of the charging key; The authentication response message is returned to the Internet of Things terminal.

7. The method according to claim 6, characterized in that The system also includes: a key charging terminal; The receiving the network access authentication request sent by the Internet of Things terminal also includes: Receiving a key charging request for the Internet of Things terminal sent by the key charging terminal; Generate an encapsulated charging key, wherein the encapsulated charging key includes: an encryption key pair, a charging key ciphertext and a Ka key ciphertext; The packaged charging key is sent to the key charging terminal.

8. The method according to claim 6, characterized in that The receiving the network access authentication request sent by the Internet of Things terminal includes: Receive a first frame request for network access sent by the Internet of Things terminal, where the first frame request for network access includes: an identifier of the Internet of Things terminal; Generate a response request message according to the first frame request for network access, wherein the response message includes a second random number generated by the quantum cryptography service platform; Returning the response request message to the Internet of Things terminal; Receive a second frame request for network access sent by the Internet of Things terminal.

9. The method according to claim 8, characterized in that The step of determining the authentication response message of the Internet of Things terminal according to the network access authentication request includes: Parsing the second frame request for network access to obtain the identifier of the Internet of Things terminal, the identifier of the key injection, the first random number and the second ciphertext; Determine, according to the identifier of the Internet of Things terminal and the identifier of the charging key, the charging key corresponding to the identifier of the charging key; Obtaining a third ciphertext according to the charging key corresponding to the charging key identifier, the first random number, and the second random number; Comparing the third ciphertext with the second ciphertext, if the comparison result is consistent, generating a network access token and network access validity period for the Internet of Things terminal; Generate a fourth ciphertext according to the charging key corresponding to the identification of the charging key, the first random number, and the second random number; An authentication response message of the Internet of Things terminal is determined according to the network access token, the network access validity period, the fourth ciphertext and the identifier of the charging key.

10. An Internet of Things terminal, characterized in that: A security module is integrated in the IoT terminal, and the IoT terminal performs data processing based on the IoT communication method according to any one of claims 1 to 4.

11. A quantum cryptography service platform, characterized in that: The quantum cryptography service platform includes: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor. When the quantum cryptography service platform is running, the processor executes the machine-readable instructions to perform the steps of the Internet of Things communication method as described in any one of claims 5 to 9.

12. An Internet of Things communication system, characterized in that: include: The Internet of Things terminal described in claim 10, the quantum cryptography service platform and the Internet of Things business platform described in claim 11, wherein the quantum cryptography service platform is communicatively connected to the Internet of Things terminal and the Internet of Things business platform respectively.

Images