Data secure transmission method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a data security transmission method and device, electronic equipment and a readable storage medium, and belongs to the technical field of data security. The method is applied to the Internet of Things equipment, and the Internet of Things equipment comprises a target application program. The method comprises the following steps: acquiring service encrypted data transmitted between a target application program and an application server; encrypting the service encrypted data through a first public key of the Internet of Things card to obtain first encrypted data, and encrypting the first encrypted data through a second public key of the authentication cloud platform to obtain second encrypted data; second encrypted data is sent to the authentication cloud platform, and first decrypted data returned by the authentication cloud platform based on the second encrypted data is obtained; and after determining that verification is passed based on the first decrypted data and the service encrypted data, executing service data processing corresponding to the service encrypted data. Through the mode, unauthorized access and attack can be effectively prevented, and the security of data transmission is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data security technology, and in particular, to a data security transmission method, device, electronic device, and readable storage medium. Background Art

[0002] With the development of intelligent network technology, IoT devices such as vehicle terminals and remote monitoring equipment are undergoing a transformation from traditional tools to comprehensive intelligent mobile terminals. This process covers a full range of upgrades from embedded systems to the cloud. However, IoT devices face many security risks. For example, the wide variety of devices may lead to security vulnerabilities in embedded systems; the use of multiple network protocols increases the security risks of communication data; and various usage scenarios also make the security protection of cloud platforms insufficient.

[0003] Therefore, the security of data transmission of IoT devices is still insufficient, and is prone to replay attacks, key management vulnerabilities, and key negotiation vulnerabilities. Summary of the invention

[0004] The embodiments of the present application provide a data security transmission method, device, electronic device and readable storage medium to at least solve the problem of insufficient security of data transmission of IoT devices.

[0005] In order to solve the above technical problems, this application is implemented as follows: In a first aspect, an embodiment of the present application provides a method for secure data transmission, which is applied to an Internet of Things device, wherein the Internet of Things device includes a target application, and the method includes: obtaining business encrypted data transmitted between the target application and the application server; encrypting the business encrypted data by a first public key of an Internet of Things card to obtain first encrypted data, and encrypting the first encrypted data by a second public key of an authentication cloud platform to obtain second encrypted data; obtaining first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; after determining that the verification is passed based on the first decrypted data and the business encrypted data, performing business data processing corresponding to the business encrypted data.

[0006] In the second aspect, an embodiment of the present application provides a method for secure data transmission, which is applied to an authentication cloud platform, including: obtaining second encrypted data sent by an Internet of Things device; decrypting the second encrypted data through a second private key corresponding to the Internet of Things device to obtain first decrypted data; sending the first decrypted data to the Internet of Things device, so that the Internet of Things device determines that the verification is passed based on the first decrypted data and the business encryption data, and then performs business data processing corresponding to the business encryption data; wherein the business encryption data is data transmitted between a target application included in the Internet of Things device and an application server corresponding to the target application; the second encrypted data is data obtained by encrypting the first encrypted data by the Internet of Things device through a second public key, and the first encrypted data is data obtained by encrypting the business encryption data by the Internet of Things device through the first public key of an Internet of Things card; the second public key corresponds to the second private key.

[0007] In a third aspect, an embodiment of the present application provides an Internet of Things device, which includes a target application, including: a first acquisition module, used to obtain business encrypted data transmitted between the target application and the application server; a data encryption module, used to encrypt the business encrypted data through a first public key of an Internet of Things card to obtain first encrypted data, and to encrypt the first encrypted data through a second public key of an authentication cloud platform to obtain second encrypted data; a first decryption module, used to obtain first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; a business execution module, used to perform business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data.

[0008] In the fourth aspect, an embodiment of the present application provides an authentication cloud platform, including: a second acquisition module, used to acquire second encrypted data sent by an Internet of Things device; a second decryption module, used to decrypt the second encrypted data through a second private key corresponding to the Internet of Things device to obtain first decrypted data; a data sending module, used to send the first decrypted data to the Internet of Things device, so that the Internet of Things device determines that the verification is passed based on the first decrypted data and the business encryption data, and then performs business data processing corresponding to the business encryption data; wherein the business encryption data is data transmitted between a target application included in the Internet of Things device and an application server corresponding to the target application; the second encrypted data is data obtained by encrypting the first encrypted data by the Internet of Things device using a second public key, and the first encrypted data is data obtained by encrypting the business encryption data by the Internet of Things device using the first public key of the Internet of Things card; the second public key corresponds to the second private key.

[0009] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0010] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the second aspect above are implemented.

[0011] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first or second aspect above.

[0012] In an embodiment of the present application, the IoT device obtains the business encrypted data transmitted between the target application and the application server; encrypts the business encrypted data through the first public key of the IoT card to obtain the first encrypted data, and encrypts the first encrypted data through the second public key of the authentication cloud platform to obtain the second encrypted data; obtains the first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; after determining that the verification is passed based on the first decrypted data and the business encrypted data, executes the business data processing corresponding to the business encrypted data. In this way, the secure storage, encryption engine and physical isolation characteristics of the IoT card are utilized so that the encryption and decryption operations are performed inside the IoT card, thereby providing physical level protection. At the same time, by double encrypting the business encrypted data, unauthorized access and attacks can be effectively prevented, and the security of data transmission can be improved.

[0013] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0015] Figure 1 A schematic diagram of a process flow of a data security transmission method provided in an embodiment of the present application is shown; Figure 2 Another schematic diagram of a process for secure data transmission provided by an embodiment of the present application is shown; Figure 3 A business timing diagram of the data security transmission method provided by an embodiment of the present application is shown; Figure 4 A schematic diagram of the process of the key initialization method provided in an embodiment of the present application is shown; Figure 5 The following is a business sequence diagram of the key initialization method provided by an embodiment of the present application; Figure 6 Another schematic diagram of a process for secure data transmission provided by an embodiment of the present application is shown; Figure 7 A schematic diagram of the structure of an Internet of Things device provided in an embodiment of the present application is shown; Figure 8 A schematic diagram of the structure of the authentication cloud platform provided in the embodiment of the present application is shown; Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0016] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0017] With the development of intelligent network connection technology, IoT devices such as vehicle terminals and remote monitoring equipment are undergoing a transformation from traditional tools to comprehensive intelligent mobile terminals. For example, cars are not only a means of transportation, but also become intelligent mobile terminals. This transformation has improved the safety, convenience and entertainment functions of vehicles. However, the security of data transmission of IoT devices is still insufficient, and the following problems are prone to occur during data transmission: 1) Key management vulnerabilities: If private or public keys are not managed properly, they may be leaked or tampered with. A malicious party may obtain the private key and use it to forge a digital signature, thereby deceiving the recipient.

[0018] 2) Man-in-the-middle attack: A man-in-the-middle attack is when a malicious party inserts their own node between the sender and the receiver, which can tamper with the data or forge a digital signature. In digital signatures, if the middleman is able to intercept and modify the data and signature, the receiver may not recognize the changes and accept the tampered data.

[0019] 3) Replay attack: A replay attack is when an attacker intercepts a valid digital signature and sends it again to the target system in order to deceive the system. If the system does not have proper protection measures, it may accept tampered data.

[0020] 4) Key negotiation vulnerability: If the key is not protected during transmission, it may be eavesdropped or tampered with. If a malicious party is able to obtain the key, they can use it to forge digital signatures or decrypt data.

[0021] 5) Weak encryption algorithm vulnerability: Using a weak encryption algorithm may make the signature easy to crack or forge. Although modern encryption algorithms are relatively secure in design, there is still a risk of being attacked if an unsafe or insufficiently powerful algorithm is used.

[0022] In view of the problems existing in the data transmission process of the above-mentioned IoT devices, the embodiment of the present application provides a data security transmission method, which utilizes the secure storage, encryption engine and physical isolation characteristics of the IoT card to perform encryption and decryption operations inside the IoT card, thereby providing physical level protection. At the same time, by double encrypting the business encrypted data, unauthorized access and attacks can be effectively prevented, thereby improving the security of data transmission.

[0023] Figure 1 A flow chart of a data security transmission method provided by an embodiment of the present application is shown. The execution subject of the method may be an Internet of Things device, which includes a target application, wherein the Internet of Things device may be a vehicle-mounted terminal, a remote monitoring device, etc. As shown in the figure, the data security transmission method 100 specifically includes the following steps: Step 101: Obtain encrypted business data transmitted between a target application and an application server.

[0024] Among them, the target application is an application designed specifically for IoT devices, which is usually installed in the embedded system of IoT devices to realize specific functions and services of the device. For example, an in-vehicle application (Application, App) can be pre-installed in the vehicle's on-board system to provide functions such as media playback, navigation, and smart voice assistant.

[0025] In specific implementation, IoT devices can integrate the authentication password service software development kit (SDK) on the target application, obtain the business encryption data transmitted between the target application and the application server through the authentication password service SDK, and provide subsequent authentication and encryption services. In order to ensure the security of the transmitted data, the target application can pre-encrypt the data to be transmitted using the key agreed with the application server to obtain the business encryption data, and then carry the business encryption data to request encryption from the authentication password service SDK.

[0026] Step 102: Encrypt the business encrypted data using the first public key of the Internet of Things card to obtain first encrypted data, and encrypt the first encrypted data using the second public key of the authentication cloud platform to obtain second encrypted data.

[0027] In the specific implementation, the authentication password service SDK encrypts the business encrypted data through the first public key of the IoT card to obtain the first encrypted data. The first public key is the public key of the IoT card. By utilizing the secure storage, encryption engine and physical isolation characteristics of the IoT card, the encryption and decryption operations are performed inside the IoT card, thereby ensuring that the data is protected at the physical level during the transmission process; then, the first encrypted data is re-encrypted through the second public key of the authentication cloud platform to obtain the second encrypted data. The second public key is the public key of the authentication cloud platform, which is used to further ensure the security of the business encrypted data.

[0028] Step 103: By sending the second encrypted data to the authentication cloud platform, the first decrypted data returned by the authentication cloud platform based on the second encrypted data is obtained.

[0029] In a specific implementation, the second encrypted data is sent to the authentication cloud platform to prevent the data from being accessed or tampered with by unauthorized parties during the data transmission process. After receiving the second encrypted data, the authentication cloud platform uses its private key to decrypt the second encrypted data, obtains the first decrypted data, and returns the decrypted data to the requester. Usually, after obtaining the second encrypted data, the authentication password service SDK can return the second encrypted data to the target application. The target application requests the authentication cloud platform to decrypt the second encrypted data through the application server, and then the authentication cloud platform returns the first decrypted data to the application server.

[0030] Step 104: After determining that the verification has passed based on the first decrypted data and the business encrypted data, execute business data processing corresponding to the business encrypted data.

[0031] In a specific implementation, data verification is performed based on the first decrypted data and the initial business encrypted data returned from the authentication cloud platform to confirm that the data has not been tampered with or lost during the transmission process. If the data verification passes, the data is complete and accurate, and corresponding business data processing can be performed based on the business encrypted data, such as page jumps, media playback, and other further business logic execution. Normally, the application server can use the key agreed with the target application to decrypt the first decrypted data and the business encrypted data to obtain the first data to be transmitted and the second data to be transmitted. By comparing the first data to be transmitted and the second data to be transmitted, a verification result is obtained, and the verification result is sent to the target application. When the target application determines that the verification has passed based on the verification result, it performs business data processing corresponding to the business encrypted data.

[0032] In this way, by utilizing the secure storage, encryption engine, and physical isolation characteristics of the IoT card, encryption and decryption operations are performed inside the IoT card, thereby providing physical level protection. At the same time, by double encrypting the business encrypted data, unauthorized access and attacks can be effectively prevented, improving the security of data transmission.

[0033] In a possible implementation, in the above step 101, obtaining the encrypted business data transmitted between the target application and the application server includes: Obtain a first encryption request sent by a target application, wherein the first encryption request includes business encryption data, and the business encryption data is data obtained by the target application by encrypting the data to be transmitted using a preset key; based on the first encryption request, determine the business encryption data transmitted between the target application and the application server.

[0034] In an embodiment of the present application, the target application can pre-encrypt the data to be transmitted using a key agreed upon with the application server to obtain business encrypted data. The IoT device obtains a first encryption request sent by the target application through an authentication cryptographic service SDK integrated on the target application, and the first encryption request includes the business encrypted data. The authentication cryptographic service SDK determines the business encrypted data transmitted between the target application and the application server based on the first encryption request.

[0035] In a possible implementation, in the above step 102, the first encrypted data is encrypted by authenticating the second public key of the cloud platform, and the obtained second encrypted data includes: Send a second encryption request to the Internet of Things card, wherein the second encryption request includes the first encrypted data; obtain second encrypted data returned by the Internet of Things card based on the second encryption request; wherein the second encrypted data is data obtained by encrypting the second decrypted data by the Internet of Things card through the second public key of the authentication cloud platform, and the Internet of Things card decrypts the first encrypted data through the first private key to obtain the second decrypted data, and the first private key corresponds to the first public key.

[0036] In the embodiment of the present application, the authentication password service SDK obtains the first encryption request sent by the target application, encrypts the business encryption data in the first encryption request through the first key of the Internet of Things card, and encrypts the encryption method of the target application for the data to be transmitted to obtain the first encrypted data, and then sends a second encryption request to the Internet of Things card to request the Internet of Things card to encrypt the first encrypted data; after the Internet of Things card receives the second encryption request, it first uses the first private key in the Internet of Things card to decrypt the first encrypted data to obtain the second decrypted data, and then uses the second public key of the authentication cloud platform to encrypt the second decrypted data to obtain the second encrypted data. Then the second encrypted data is returned to the authentication password service SDK.

[0037] The second encryption request also includes target identification information corresponding to the target application; and the method for determining the first private key includes: Acquire the first identification information bound to the Internet of Things card; and determine the first private key corresponding to the target identification information according to the corresponding relationship between the first identification information and the private key.

[0038] Among them, the target identification information includes the device identification of the Internet of Things device, the Internet of Things card identification corresponding to the Internet of Things device and the target application identification. For example, the target identification information includes the device ID, the Internet of Things card number and the target application identification APPID.

[0039] In the embodiment of the present application, the IoT card can pre-bind the correspondence between the first identification information and the private key. For example, the IoT card pre-binds the correspondence between the first private key, the second public key, the device identification of the IoT device, the IoT card identification corresponding to the IoT device, and the target application identification. The second encryption request sent by the authentication password service SDK carries information such as the device identification, the IoT card identification, and the target application identification. The IoT card determines the first private key corresponding to the target identification information based on the correspondence between the pre-bound first identification information and the private key. Similarly, the IoT card can also use the same method to determine the second public key corresponding to the target identification information.

[0040] In a possible implementation, in the above step 103, sending the second encrypted data to the authentication cloud platform to obtain the first decrypted data returned by the authentication cloud platform based on the second encrypted data includes: Send a decryption request to the authentication cloud platform, the decryption request including the second encrypted data; obtain the first decrypted data returned by the authentication cloud platform based on the decryption request, wherein the first decrypted data is the data obtained by the authentication cloud platform by decrypting the second encrypted data using a second private key, and the second private key corresponds to the second public key.

[0041] In an embodiment of the present application, after obtaining the second encrypted data, the authentication password service SDK can return the second encrypted data to the target application. The target application sends a decryption request to the authentication cloud platform through the application server, and the decryption request includes the second encrypted data. After receiving the decryption request, the authentication cloud platform decrypts the second encrypted data through the second private key to obtain the first decrypted data, and returns the first decrypted data to the application server.

[0042] The decryption request also includes target identification information corresponding to the target application; and the method for determining the second private key includes: Acquire the second identification information stored in the authentication cloud platform; and determine the second private key corresponding to the target identification information according to the corresponding relationship between the second identification information and the private key.

[0043] In an embodiment of the present application, the authentication cloud platform can pre-store the correspondence between the second identification information and the private key. For example, the authentication cloud platform pre-stores the correspondence between the second private key, the first public key, the device identification of the Internet of Things device, the Internet of Things card identification corresponding to the Internet of Things device, and the target application identification. The decryption request sent by the application server carries information such as the device identification, the Internet of Things card identification, the target application identification, etc. The authentication cloud platform determines the second private key corresponding to the target identification information based on the pre-stored correspondence between the second identification information and the private key.

[0044] In an exemplary embodiment, if Figure 2 and Figure 3 As shown, the above-mentioned data security transmission method is described by taking the IoT device as a vehicle terminal as an example, wherein the vehicle terminal includes a vehicle application App, and the vehicle application App is integrated with an authentication password service SDK, and subsequent authentication and encryption services are provided through the authentication password service SDK. The data security transmission method specifically includes the following steps: Step 201: the authentication password service SDK obtains a first encryption request sent by a target application, the first encryption request includes business encryption data, and the business encryption data is data obtained by encrypting the data to be transmitted by the target application using a preset key; Exemplarily, the in-vehicle application App locally uses the key agreed upon between the in-vehicle application server and the in-vehicle application server to encrypt the data to be transmitted, and then carries the encrypted data to be transmitted to request encryption from the authentication key service SDK; Step 202: The authentication password service SDK obtains the business encrypted data transmitted between the target application and the application server; encrypts the business encrypted data by using the first public key to obtain first encrypted data, and sends a second encryption request to the Internet of Things card, wherein the second encryption request includes the first encrypted data; and obtains the second encrypted data returned by the Internet of Things card based on the second encryption request; Among them, the IoT card can be a SIM card; Exemplarily, the authentication password service SDK uses the first public key of the SIM card to perform secondary encryption on the first encrypted data carried by the business party, and encrypts the encryption method of the in-vehicle application App for the data to be transmitted, and then requests the SIM card to perform encryption; Step 203: After receiving the second encryption request, the IoT card encrypts the second decrypted data using the second public key of the authentication cloud platform, and the IoT card decrypts the first encrypted data using the first private key to obtain the second decrypted data; Exemplarily, after receiving the second encryption request, the SIM card first uses the first private key in the SIM card to decrypt the first encrypted data encrypted using the first public key of the SIM card, and decrypts the encryption method, and then uses the second public key of the authentication cloud platform in the SIM card to encrypt the service encrypted data to obtain the second encrypted data, and returns the second encrypted data to the authentication password service SDK; Step 204: the authentication password service SDK returns the second encrypted data to the in-vehicle application App; Step 205: The in-vehicle application App carries the second encrypted data and requests the in-vehicle application server to perform decryption and encrypted data verification; Step 206: The application server sends the second encrypted data to the authentication cloud platform; Exemplarily, the vehicle-mounted application server carries the second encrypted data to request the unified authentication server to decrypt the data. After the unified authentication server performs relevant verification on the vehicle-mounted application server, it carries the second encrypted data to request the authentication password service platform to decrypt the data. Step 207: the authentication password service platform uses the second private key to decrypt the second encrypted data to obtain the first decrypted data, and returns the first decrypted data to the vehicle-mounted application server; Step 208: The vehicle-mounted application server compares the first decrypted data with the service encrypted data, and returns the verification result to the vehicle-mounted application App; Step 209: The in-vehicle application App performs business data processing according to the verification result of the in-vehicle application server.

[0045] The data security transmission method provided in the embodiment of the present application uses two pairs of public and private keys, namely the first public key, the first private key, the second public key, and the second private key, for encryption and decryption, which can improve the security of data transmission. The sender uses the public key of the receiver to encrypt, and only the receiver with the corresponding private key can decrypt the data, which can ensure that the data will not be accessed or tampered with by unauthorized persons during the transmission process. At the same time, the Internet of Things card is used as a secure hardware storage device, which can store sensitive information such as encryption keys and certificates, and provide physical level protection to prevent unauthorized access and attacks.

[0046] In terms of identity authentication, two pairs of public and private keys can be used to authenticate both parties in data transmission. The sender signs the data with its own private key, and the receiver verifies the validity of the signature with the sender's public key, thereby ensuring that the source of the data is credible. The IoT card has a security authentication mechanism to verify the legitimacy of the device and network. The keys in the IoT card are used for identity authentication and digital signatures to ensure the security and integrity of communications.

[0047] In terms of non-repudiation, the use of digital signatures can prevent the sender from denying the data sent. The receiver can use the sender's public key to verify the signature to prove that the data is indeed from the sender, thereby preventing the sender's denial. The IoT card has a built-in dedicated encryption engine and encryption algorithm that can perform efficient encryption and decryption operations. These algorithms are usually certified and audited, providing high security and performance.

[0048] In terms of distributed security, using two pairs of public and private keys for encryption and decryption can achieve distributed security. Even if the private key of one party is leaked, it will not affect the security of the private key of the other party, thereby reducing the risk of the overall system. The IoT card is physically isolated from the device, so that the encryption and decryption operations are performed in the IoT card and isolated from the device's operating system and application. This isolation can prevent the device from being exploited by malware and provide security protection.

[0049] In a possible implementation, in the above step 101, before obtaining the encrypted business data transmitted between the target application and the application server, the following is further included: In response to a touch operation on a target application, the Internet of Things device is authenticated to obtain a device identifier and an Internet of Things card identifier corresponding to the Internet of Things device; based on the device identifier and the Internet of Things card identifier, the target identifier information corresponding to the target application is determined; a first key pair generation request is sent to the Internet of Things card, wherein the first key generation request includes the target identifier information; and a first public key determined by the Internet of Things card based on the first key pair generation request is obtained.

[0050] In the embodiment of the present application, the key initialization can be performed in the following manner: the IoT device is started and connected to the network, the user performs touch operations such as clicking and touching the target application, and the IoT device responds to the touch operation on the target application, authenticates the IoT device, and obtains the device identifier and IoT card identifier corresponding to the IoT device. Specifically, the IoT device can request IoT device identity authentication from the authentication server through the authentication password service SDK, obtain IoT card identifiers such as SIM card number, and device identifiers such as device identifier (Identifier, ID), and after the authentication server performs relevant verification, it returns an access token (access Token) with the IoT card identifier and device identifier cached to the authentication password service SDK. Among them, the relevant verification performed by the authentication server refers to the server verification, which generally includes parameter verification, business service end exit IP verification, and availability verification of whether the business party APPID has the ability to call this password service. After successful verification, the authentication server carries the IoT IP address and requests the IoT gateway to obtain the IoT SIM card number and device ID. The IoT gateway returns the relevant IoT SIM card number and IoT device ID to the authentication server. The authentication server generates a temporary credential accessToken, caches the IoT card number, device ID, APPID and other information, and returns the temporary credential accessToken to the authentication password service SDK.

[0051] The authentication password service SDK determines the target identification information corresponding to the target application based on the device identification and the Internet of Things card identification; sends a first key pair generation request to the Internet of Things card, and the first key generation request includes the target identification information. In addition, the first key request may also include the target application identification APPID; the Internet of Things card triggers the generation of the first key pair, stores the first private key, and returns the first public key to the authentication password service SDK.

[0052] Wherein, in the above-mentioned determining the target identification information corresponding to the target application according to the device identification and the Internet of Things card identification, it also includes: Send a second key pair generation request to the authentication cloud platform, wherein the second key pair generation request includes the target identification information; and obtain a second public key determined by the authentication cloud platform based on the second key pair generation request.

[0053] Continuing with the above embodiment, the authentication password service SDK sends a second key pair generation request to the authentication cloud platform, and the second key pair generation request includes target identification information; wherein, the second key pair generation request may also include the first public key; after receiving the second key pair generation request, the authentication cloud platform generates a second key pair, and the second private key is stored in the authentication cloud platform. The authentication cloud platform stores the correspondence between the target identification information and the second private key. For example, the authentication cloud platform stores the correspondence between the in-vehicle application APPID, the second private key, the first public key and the device ID, and the Internet of Things card number, and the authentication cloud platform returns the second public key to the authentication password service SDK.

[0054] In an exemplary embodiment, if Figure 4 and Figure 5 As shown, the key initialization process is described by taking the IoT device as a vehicle terminal as an example. The vehicle terminal includes a vehicle application App, and the vehicle application App integrates an authentication password service SDK. Subsequent authentication and encryption services are provided through the authentication password service SDK. The key initialization process may include the following steps: Step 401: the vehicle terminal is started and connected to the network, and the target user clicks on the target application on the vehicle system, for example, to listen to music, watch videos or navigate through the target application; Step 402: Integrate the authentication password service SDK into the vehicle application App in the vehicle system and initialize the SDK; Among them, the integration of authentication password service SDK specifically introduces the SDK package into the vehicle application App to conduct joint debugging of the corresponding SDK interface. After the joint debugging is completed, it is packaged and launched together with the vehicle application App. Step 403: The authentication password service SDK requests the unified authentication server for identity authentication of the vehicle-mounted device, obtains the IoT card number and the device ID of the vehicle-mounted device, and after the unified authentication server performs relevant verification, returns the accessToken that caches the IoT card number and device ID information to the authentication password service SDK through the IoT gateway; Step 404: the authentication password service SDK requests the IoT card built into the vehicle to generate a first key pair, the IoT card internal card application triggers the generation of the first key pair and stores the first private key, and the first public key corresponding to the first private key is returned to the authentication password service SDK; Step 405: The authentication password service SDK carries the vehicle device ID, application APPID, first public key and other information to request the authentication cloud platform to generate a second key pair; It should be noted that the vehicle application App capabilities also need to be configured, including: APPID (application identifier), IP whitelist, APPKey (key), application platform, and capability availability configuration (obtaining password service capabilities); among them, capability availability configuration refers to the configuration of whether the business party APPID has the ability to call this password service capability; Step 406: The authentication cloud platform generates a second key pair, the second private key is stored in the authentication cloud platform, the authentication cloud platform binds the corresponding relationship between the vehicle application APPID, the second private key, the first public key and the device ID and the IoT card number, and the authentication cloud platform returns the second public key to the authentication password service SDK; In this way, the business party's in-vehicle application APPID must apply for this password service capability before calling the interface of the authentication password service SDK to initialize the password service; the second private key is mainly the private key in the key pair generated by the authentication cloud platform. The second private key, APPID, first public key, device ID and IoT card number correspond one to one, that is, the device security will be verified when using this device and this IoT card for encryption and decryption; the second public key is generated by requesting the interface of the IoT card through the authentication password service SDK, and the first private key is stored in the cache of the IoT card; the device ID and IoT card number are obtained through the IoT card gateway. When the device is registered and connected to the Internet, the relevant identification information is reported to the operator, so the operator can obtain the device ID and IoT card number through the exclusive operator IoT network layer, which are all unique; the authentication cloud platform generates a second key pair, using the second private key as the key, and the value is the in-vehicle application APPID, the second private key, the second public key, the device ID, and the IoT card number; the first public key is used to encrypt the second private key and the second key pair.

[0055] Step 407: The authentication password service SDK carries the second public key and synchronizes it to the IoT card. The IoT card binds the corresponding relationship between the first private key, the second public key, the device ID, the IoT card number and the vehicle application APPID, and returns the synchronization result to the authentication password service SDK to complete the SDK initialization.

[0056] Among them, the second public key encrypted by the IoT card and the second key pair encrypted by the IoT card can be used to ensure the security of the transmission of the second public key and the second key pair of the authentication cloud platform. The authentication password service SDK will return the second public key encrypted by the IoT card and the second key pair encrypted by the IoT card to the IoT card by calling the IoT card interface. The IoT card side can decrypt the second public key and the second key pair encrypted by the first public key using the first private key of the IoT card, and then put them into the cache of the IoT card for subsequent encryption and decryption.

[0057] Figure 6Another flow chart of a data security transmission method provided in an embodiment of the present application is shown. The execution subject of the method may be an authentication cloud platform. As shown in the figure, the data security transmission method 600 specifically includes the following steps: Step 601: Acquire second encrypted data sent by the IoT device; Step 602: decrypt the second encrypted data using the second private key corresponding to the IoT device to obtain first decrypted data; Step 603: Send the first decrypted data to the IoT device, so that the IoT device performs business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data; Among them, the business encrypted data is the data transmitted between the target application included in the Internet of Things device and the application server corresponding to the target application; the second encrypted data is the data obtained by the Internet of Things device encrypting the first encrypted data through the second public key, and the first encrypted data is the data obtained by the Internet of Things device encrypting the business encrypted data through the first public key of the Internet of Things card; the second public key corresponds to the second private key.

[0058] In a possible implementation, in the above step 601, before obtaining the second encrypted data sent by the IoT device, the following step is further included: Obtaining a second key pair generation request sent by the Internet of Things device, where the second key pair generation request includes target identification information corresponding to the Internet of Things device; A second key pair is determined based on the second key pair generation request, where the second key pair includes the second public key and the second private key.

[0059] The embodiment of the present application provides a data security transmission method, which is applied to the authentication cloud platform to obtain the second encrypted data sent by the IoT device; decrypt the second encrypted data through the second private key corresponding to the IoT device to obtain the first decrypted data; send the first decrypted data to the IoT device, so that the IoT device determines that the verification is passed based on the first decrypted data and the business encrypted data, and then performs the business data processing corresponding to the business encrypted data. In this way, the authentication cloud platform decrypts the second encrypted data sent by the IoT device, and sends the decrypted first decrypted data to the IoT device, which can effectively prevent unauthorized access and attacks and improve the security of data transmission.

[0060] Figure 7 The schematic diagram of the structure of the Internet of Things device provided by the embodiment of the present application is shown. The Internet of Things device can be implemented as follows: Figure 1All or part of the contents of the illustrated embodiment, as shown in the figure, the Internet of Things device 700 includes: A first acquisition module 710 is used to acquire encrypted business data transmitted between a target application and an application server; The data encryption module 720 is used to encrypt the business encrypted data by using the first public key of the Internet of Things card to obtain first encrypted data, and to encrypt the first encrypted data by using the second public key of the authentication cloud platform to obtain second encrypted data; A first decryption module 730 is used to obtain first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; The business execution module 740 is used to perform business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data.

[0061] In a possible implementation, the first acquisition module 710, when used to acquire the encrypted service data transmitted between the target application and the application server, is specifically used to: Obtaining a first encryption request sent by a target application, wherein the first encryption request includes business encryption data, where the business encryption data is data obtained by encrypting data to be transmitted by the target application using a preset key; Determine, according to the first encryption request, the business encryption data transmitted between the target application and the application server.

[0062] In a possible implementation, the data encryption module 720, when encrypting the first encrypted data by using the second public key of the authentication cloud platform to obtain the second encrypted data, is specifically used to: Sending a second encryption request to the Internet of Things card, where the second encryption request includes the first encrypted data; Obtain second encrypted data returned by the Internet of Things card based on the second encryption request; wherein the second encrypted data is data obtained by the Internet of Things card encrypting second decrypted data through the second public key of the authentication cloud platform, and the Internet of Things card decrypts the first encrypted data through the first private key to obtain the second decrypted data, and the first private key corresponds to the first public key.

[0063] The second encryption request also includes target identification information corresponding to the target application; the data encryption module 720 is used to determine the first private key in the following manner: Acquire first identification information bound to the Internet of Things card; According to the correspondence between the first identification information and the private key, a first private key corresponding to the target identification information is determined.

[0064] In a possible implementation, the first decryption module 730, when used to send the second encrypted data to the authentication cloud platform to obtain the first decrypted data returned by the authentication cloud platform based on the second encrypted data, is specifically used to: Sending a decryption request to the authentication cloud platform, wherein the decryption request includes the second encrypted data; Obtain the first decrypted data returned by the authentication cloud platform based on the decryption request, wherein the first decrypted data is data obtained by the authentication cloud platform decrypting the second encrypted data using a second private key, and the second private key corresponds to the second public key.

[0065] The decryption request also includes target identification information corresponding to the target application; the first decryption module 730 is used to determine the second private key in the following manner: Acquire second identification information stored in the authentication cloud platform; According to the correspondence between the second identification information and the private key, the second private key corresponding to the target identification information is determined.

[0066] In a possible implementation, the Internet of Things device 700 further includes: A first generating module is used to perform identity authentication on the IoT device in response to a touch operation on a target application, and obtain a device identifier and an IoT card identifier corresponding to the IoT device; Determine the target identification information corresponding to the target application according to the device identification and the IoT card identification; Sending a first key pair generation request to the authentication cloud platform, wherein the first key pair generation request includes the target identification information; Obtain a second public key determined by the authentication cloud platform based on the first key pair generation request.

[0067] In a possible implementation, the first generating module is further configured to: Sending a second key pair generation request to the Internet of Things card, wherein the second key generation request includes the target identification information; Obtain a first public key determined by the Internet of Things card based on the second key pair generation request.

[0068] The embodiment of the present application provides an Internet of Things device, which includes a target application, including a first acquisition module, a data encryption module, a first decryption module and a business execution module: the first acquisition module acquires the business encrypted data transmitted between the target application and the application server; the data encryption module encrypts the business encrypted data through the first public key of the Internet of Things card to obtain the first encrypted data, and encrypts the first encrypted data through the second public key of the authentication cloud platform to obtain the second encrypted data; the first decryption module sends the second encrypted data to the authentication cloud platform to obtain the first decrypted data returned by the authentication cloud platform based on the second encrypted data; the business execution module determines that the verification is passed based on the first decrypted data and the business encrypted data, and then performs business data processing corresponding to the business encrypted data. In this way, the secure storage, encryption engine and physical isolation characteristics of the Internet of Things card are utilized to enable the encryption and decryption operations to be performed inside the Internet of Things card, thereby providing physical level protection. At the same time, by double encrypting the business encrypted data, unauthorized access and attacks can be effectively prevented, and the security of data transmission can be improved.

[0069] Figure 8 The schematic diagram of the structure of the authentication cloud platform provided in the embodiment of the present application is shown. The authentication cloud platform can implement the following Figure 6 All or part of the contents of the illustrated embodiment, as shown in the figure, the authentication cloud platform 800 includes: The second acquisition module 810 is used to acquire the second encrypted data sent by the IoT device; A second decryption module 820, configured to decrypt the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data; A data sending module 830 is used to send the first decrypted data to the IoT device, so that the IoT device performs business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data; Among them, the business encrypted data is the data transmitted between the target application included in the Internet of Things device and the application server corresponding to the target application; the second encrypted data is the data obtained by the Internet of Things device encrypting the first encrypted data through the second public key, and the first encrypted data is the data obtained by the Internet of Things device encrypting the business encrypted data through the first public key of the Internet of Things card; the second public key corresponds to the second private key.

[0070] In a possible implementation, the Internet of Things device 700 further includes: A second generation module is used to obtain a second key pair generation request sent by the Internet of Things device, wherein the second key pair generation request includes target identification information corresponding to the Internet of Things device; and a second key pair is determined based on the second key pair generation request, wherein the second key pair includes the second public key and the second private key.

[0071] The embodiment of the present application provides an authentication cloud platform, including a second acquisition module, a second decryption module and a data sending module; the second acquisition module acquires the second encrypted data sent by the IoT device; the second decryption module decrypts the second encrypted data through the second private key corresponding to the IoT device to obtain the first decrypted data; the data sending module sends the first decrypted data to the IoT device, so that the IoT device determines that the verification is passed based on the first decrypted data and the business encrypted data, and then performs the business data processing corresponding to the business encrypted data. In this way, the authentication cloud platform decrypts the second encrypted data sent by the IoT device, and sends the decrypted first decrypted data to the IoT device, which can effectively prevent unauthorized access and attacks and improve the security of data transmission.

[0072] Fig. 9 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 900 includes a processor 910, and optionally, includes an internal bus 920, a network interface 930, and a memory 940. Among them, the memory 940 may include a memory 941, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 942 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 900 may also include hardware required for other services.

[0073] The processor 910, the network interface 930 and the memory may be connected to each other via an internal bus 920, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0074] The memory 940 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 940 may include a memory 941 and a non-volatile memory 942 , and provide instructions and data to the processor 910 .

[0075] The processor 910 reads the corresponding computer program from the non-volatile memory 942 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 910 executes the program stored in the memory and specifically performs: Figure 1 or Figure 6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0076] The above application Figure 1 or Figure 6 The method disclosed in the illustrated embodiment can be applied to the processor 910 or implemented by the processor 910. The processor 910 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 910. The above processor 910 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0077] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0078] Of course, in addition to software implementation, the electronic device 900 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0079] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 1 or Figure 6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0080] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0081] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 1 or Figure 6 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0082] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.

[0083] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0084] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0085] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0086] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0087] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A data security transmission method, characterized in that: Applied to an Internet of Things device, the Internet of Things device includes a target application program, and the method includes: Obtaining encrypted business data transmitted between the target application and the application server; The business encrypted data is encrypted by using a first public key of the Internet of Things card to obtain first encrypted data, and the first encrypted data is encrypted by using a second public key of the authentication cloud platform to obtain second encrypted data; By sending the second encrypted data to the authentication cloud platform, obtaining the first decrypted data returned by the authentication cloud platform based on the second encrypted data; After determining that the verification has passed based on the first decrypted data and the business encrypted data, business data processing corresponding to the business encrypted data is performed.

2. The method according to claim 1, characterized in that The step of obtaining encrypted business data transmitted between the target application and the application server includes: Obtaining a first encryption request sent by a target application, wherein the first encryption request includes business encryption data, where the business encryption data is data obtained by encrypting data to be transmitted by the target application using a preset key; Determine, according to the first encryption request, the business encryption data transmitted between the target application and the application server.

3. The method according to claim 1, characterized in that: The second encrypted data obtained by encrypting the first encrypted data with the second public key of the authentication cloud platform includes: Sending a second encryption request to the Internet of Things card, where the second encryption request includes the first encrypted data; Obtain second encrypted data returned by the Internet of Things card based on the second encryption request; wherein the second encrypted data is data obtained by the Internet of Things card encrypting second decrypted data through the second public key of the authentication cloud platform, and the Internet of Things card decrypts the first encrypted data through the first private key to obtain the second decrypted data, and the first private key corresponds to the first public key.

4. The method according to claim 3, characterized in that The second encryption request also includes target identification information corresponding to the target application; The method for determining the first private key includes: Acquire first identification information bound to the Internet of Things card; According to the correspondence between the first identification information and the private key, a first private key corresponding to the target identification information is determined.

5. The method according to claim 1, characterized in that The step of sending the second encrypted data to the authentication cloud platform to obtain the first decrypted data returned by the authentication cloud platform based on the second encrypted data includes: Sending a decryption request to the authentication cloud platform, wherein the decryption request includes the second encrypted data; Obtain the first decrypted data returned by the authentication cloud platform based on the decryption request, wherein the first decrypted data is data obtained by the authentication cloud platform decrypting the second encrypted data using a second private key, and the second private key corresponds to the second public key.

6. The method according to claim 5, characterized in that The decryption request also includes target identification information corresponding to the target application; The method for determining the second private key includes: Acquire second identification information stored in the authentication cloud platform; According to the correspondence between the second identification information and the private key, the second private key corresponding to the target identification information is determined.

7. The method according to claim 1, characterized in that Before obtaining the encrypted business data transmitted between the target application and the application server, the method further includes: In response to a touch operation on a target application, the IoT device is authenticated to obtain a device identifier and an IoT card identifier corresponding to the IoT device; Determine the target identification information corresponding to the target application according to the device identification and the IoT card identification; Sending a first key pair generation request to the Internet of Things card, wherein the first key generation request includes the target identification information; Obtain a first public key determined by the Internet of Things card based on the first key pair generation request.

8. The method according to claim 7, characterized in that After determining the target identification information corresponding to the target application according to the device identification and the Internet of Things card identification, the method further includes: Sending a second key pair generation request to the authentication cloud platform, wherein the second key pair generation request includes the target identification information; Obtain a second public key determined by the authentication cloud platform based on the second key pair generation request.

9. A data security transmission method, characterized in that: Applied to the authentication cloud platform, including: Obtain the second encrypted data sent by the IoT device; Decrypting the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data; Sending the first decrypted data to the IoT device, so that the IoT device performs business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data; Among them, the business encrypted data is the data transmitted between the target application included in the Internet of Things device and the application server corresponding to the target application; the second encrypted data is the data obtained by the Internet of Things device encrypting the first encrypted data through the second public key, and the first encrypted data is the data obtained by the Internet of Things device encrypting the business encrypted data through the first public key of the Internet of Things card; the second public key corresponds to the second private key.

10. The method according to claim 9, characterized in that: Before obtaining the second encrypted data sent by the IoT device, the method further includes: Obtaining a second key pair generation request sent by the Internet of Things device, where the second key pair generation request includes target identification information corresponding to the Internet of Things device; A second key pair determined based on the second key pair generation request, wherein the second key pair includes the second public key and the second private key; The corresponding relationship between the second key pair and the target identification information is stored, and the second public key is sent to the Internet of Things device.

11. An Internet of Things device, characterized in that: The IoT device includes target applications, including: A first acquisition module, used to acquire encrypted business data transmitted between a target application and an application server; A data encryption module, used to encrypt the business encrypted data by using a first public key of the Internet of Things card to obtain first encrypted data, and to encrypt the first encrypted data by using a second public key of the authentication cloud platform to obtain second encrypted data; A first decryption module, configured to obtain first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; The business execution module is used to perform business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data.

12. An authentication cloud platform, characterized in that: include: A second acquisition module, used to acquire second encrypted data sent by the IoT device; A second decryption module, used to decrypt the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data; A data sending module, used for sending the first decrypted data to the IoT device, so that the IoT device performs business data processing corresponding to the business encrypted data after determining that the verification is passed based on the first decrypted data and the business encrypted data; The business encrypted data is data transmitted between the target application included in the IoT device and the application server corresponding to the target application; the second encrypted data is data obtained by encrypting the first encrypted data by the IoT device using the second public key, and the first encrypted data is data obtained by encrypting the business encrypted data by the IoT device using the first public key of the IoT card; The second public key corresponds to the second private key.

13. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images