Data security transmission method and device, electronic equipment and readable storage medium

Abstract

The application discloses a data security transmission method and device, electronic equipment and a readable storage medium, and belongs to the technical field of data security. The method is applied to an Internet of Things device, and the Internet of Things device comprises a target application program; the method comprises the following steps: acquiring service encrypted data transmitted between the target application program and an application server; encrypting the service encrypted data by using a first public key of an Internet of Things card to obtain first encrypted data, and encrypting the first encrypted data by using a second public key of an authentication cloud platform to obtain second encrypted data; sending the second encrypted data to the authentication cloud platform to acquire first decrypted data returned by the authentication cloud platform based on the second encrypted data; and after it is determined that the first decrypted data and the service encrypted data are verified, performing service data processing corresponding to the service encrypted data. In this way, unauthorized access and attacks can be effectively prevented, and the security of data transmission is improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data security transmission method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] With the development of intelligent connected vehicle technology, IoT devices such as in-vehicle terminals and remote monitoring equipment are undergoing a transformation from traditional tools to fully intelligent mobile terminals. This process encompasses a comprehensive upgrade from embedded systems to the cloud. However, IoT devices face numerous security risks. For example, the wide variety of devices means that embedded systems may have security vulnerabilities; the use of multiple network protocols increases the security risks of communication data; and various usage scenarios make the security protection of cloud platforms inadequate.

[0003] Therefore, the security of data transmission in IoT devices remains insufficient, and they are prone to replay attacks, key management vulnerabilities, and key negotiation vulnerabilities. Summary of the Invention

[0004] This application provides a data security transmission method, apparatus, electronic device, and readable storage medium to at least address the problem of insufficient security in data transmission of Internet of Things (IoT) devices.

[0005] To solve the above-mentioned technical problems, this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a data security transmission method applied to an Internet of Things (IoT) device, wherein the IoT device includes a target application. The method includes: acquiring encrypted business data transmitted between the target application and an application server; encrypting the encrypted business data using a first public key of an IoT card to obtain first encrypted data, and encrypting the first encrypted data using a second public key of an authentication cloud platform to obtain second encrypted data; acquiring first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; and, after determining that the verification is successful based on the first decrypted data and the encrypted business data, performing business data processing corresponding to the encrypted business data.

[0007] Secondly, embodiments of this application provide a data security transmission method applied to an authentication cloud platform, comprising: acquiring second encrypted data sent by an IoT device; decrypting the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data; sending the first decrypted data to the IoT device, so that the IoT device, based on the first decrypted data and business encrypted data, determines that the verification has passed, and then performs business data processing corresponding to the business encrypted data; wherein, the business encrypted data is data transmitted between a target application included in the IoT device and an application server corresponding to the target application; the second encrypted data is data obtained by the IoT device encrypting the first encrypted data using a second public key, and the first encrypted data is data obtained by the IoT device encrypting the business encrypted data using a first public key of an IoT card; the second public key corresponds to the second private key.

[0008] Thirdly, embodiments of this application provide an Internet of Things (IoT) device, which includes a target application and comprises: a first acquisition module, configured to acquire encrypted business data transmitted between the target application and an application server; a data encryption module, configured to encrypt the encrypted business data using a first public key of an IoT card to obtain first encrypted data, and encrypt the first encrypted data using a second public key of an authentication cloud platform to obtain second encrypted data; a first decryption module, configured to send the second encrypted data to the authentication cloud platform and acquire first decrypted data returned by the authentication cloud platform based on the second encrypted data; and a business execution module, configured to perform business data processing corresponding to the encrypted business data after determining that the verification has passed based on the first decrypted data and the encrypted business data.

[0009] Fourthly, this application provides an authentication cloud platform, comprising: a second acquisition module for acquiring second encrypted data sent by an IoT device; a second decryption module for decrypting the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data; and a data sending module for sending the first decrypted data to the IoT device, so that the IoT device, after determining that the verification is successful based on the first decrypted data and the business encrypted data, performs business data processing corresponding to the business encrypted data; wherein the business encrypted data is data transmitted between a target application included in the IoT device and an application server corresponding to the target application; the second encrypted data is data obtained by the IoT device encrypting the first encrypted data using a second public key, and the first encrypted data is data obtained by the IoT device encrypting the business encrypted data using a first public key of an IoT card; the second public key corresponds to the second private key.

[0010] Fifthly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores a program or instructions executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the method described in the first or second aspect above.

[0011] In a sixth aspect, embodiments of this application provide a computer-readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first or second aspect above.

[0012] In a seventh aspect, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, cause the computer to perform the steps of the method described in the first or second aspect above.

[0013] In this embodiment, the IoT device acquires encrypted business data transmitted between the target application and the application server; it encrypts the encrypted business data using the first public key of the IoT card to obtain first encrypted data, and then encrypts the first encrypted data using the second public key of the authentication cloud platform to obtain second encrypted data; it sends the second encrypted data to the authentication cloud platform and obtains first decrypted data returned by the authentication cloud platform based on the second encrypted data; after verifying the first decrypted data and the encrypted business data, it executes business data processing corresponding to the encrypted business data. In this way, by utilizing the secure storage, encryption engine, and physical isolation characteristics of the IoT card, encryption and decryption operations are performed internally within the IoT card, thereby providing physical-level protection. Simultaneously, by performing double encryption on the encrypted business data, unauthorized access and attacks can be effectively prevented, improving the security of data transmission.

[0014] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] Figure 1 This paper illustrates a flowchart of a data security transmission method provided in an embodiment of this application.

[0017] Figure 2 This illustration shows another flowchart of the data secure transmission method provided in an embodiment of this application;

[0018] Figure 3 This paper illustrates a service timing diagram of a data security transmission method provided in an embodiment of this application.

[0019] Figure 4 A flowchart illustrating the key initialization method provided in an embodiment of this application is shown;

[0020] Figure 5 The following is a business timing diagram of the key initialization method provided in an embodiment of this application;

[0021] Figure 6 This illustration shows another flowchart of the data secure transmission method provided in an embodiment of this application;

[0022] Figure 7 A schematic diagram of the structure of an IoT device provided in an embodiment of this application is shown;

[0023] Figure 8 This paper shows a schematic diagram of the structure of the authentication cloud platform provided in an embodiment of this application;

[0024] Figure 9 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0025] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0026] With the development of intelligent connected vehicle technology, IoT devices such as in-vehicle terminals and remote monitoring equipment are undergoing a transformation from traditional tools to fully intelligent mobile terminals. For example, cars are no longer just means of transportation but have become intelligent mobile terminals, enhancing vehicle safety, convenience, and entertainment functions. However, the security of data transmission in IoT devices remains insufficient, and the following problems are prone to occur during data transmission:

[0027] 1) Key management vulnerabilities: Improper management of private or public keys can lead to key leaks or tampering. Malicious parties may obtain the private key and use it to forge digital signatures, thereby deceiving the recipient.

[0028] 2) Man-in-the-middle attack: A man-in-the-middle attack refers to a malicious party inserting its own node between the sender and receiver, which can tamper with data or forge digital signatures. In digital signatures, if a man in the middle can intercept and modify the data and signature, the receiver may be unable to recognize the alteration and accept the tampered data.

[0029] 3) Replay attack: A replay attack refers to an attacker intercepting a valid digital signature and resending it to the target system to deceive it. If the system does not have appropriate safeguards, it may accept the tampered data.

[0030] 4) Key negotiation vulnerability: If the key is not securely protected during transmission, it may be eavesdropped on or tampered with. If a malicious party obtains the key, they can use it to forge digital signatures or decrypt data.

[0031] 5) Weak encryption algorithm vulnerabilities: Using weak encryption algorithms can make signatures easy to crack or forge. Although modern encryption algorithms are relatively secure by design, there is still a risk of attack if insecure or insufficiently strong algorithms are used.

[0032] To address the aforementioned problems in data transmission by IoT devices, this application provides a secure data transmission method. This method utilizes the secure storage, encryption engine, and physical isolation features of the IoT card to ensure that encryption and decryption operations are performed within the IoT card, thereby providing physical-level protection. Simultaneously, by applying double encryption to encrypted business data, unauthorized access and attacks are effectively prevented, enhancing data transmission security.

[0033] Figure 1 This illustration shows a flowchart of a data security transmission method provided in an embodiment of this application. The execution subject of this method can be an Internet of Things (IoT) device, which includes a target application. The IoT device can be a vehicle-mounted terminal, a remote monitoring device, etc. As shown in the figure, the data security transmission method 100 specifically includes the following steps:

[0034] Step 101: Obtain the encrypted business data transmitted between the target application and the application server.

[0035] The target application is an application specifically designed for IoT devices. It is typically installed in the embedded system of the IoT device to implement the device's specific functions and services. For example, an in-vehicle application (App) can be pre-installed in the vehicle's infotainment system to provide functions such as media playback, navigation, and intelligent voice assistant.

[0036] In practical implementation, IoT devices can integrate an authentication and cryptography service software development kit (SDK) into the target application. The SDK allows the device to obtain encrypted business data transmitted between the target application and the application server, and provides subsequent authentication and encryption services. To ensure the security of transmitted data, the target application can pre-encrypt the data to be transmitted using a key agreed upon with the application server, obtaining encrypted business data, and then use this encrypted business data to request encryption from the authentication and cryptography service SDK.

[0037] Step 102: Encrypt the business encrypted data using the first public key of the IoT card to obtain first encrypted data, and encrypt the first encrypted data using the second public key of the authentication cloud platform to obtain second encrypted data.

[0038] In practical implementation, the authentication cryptography service SDK encrypts the business encrypted data using the first public key of the IoT card to obtain the first encrypted data. The first public key is the public key of the IoT card. Utilizing the secure storage, encryption engine, and physical isolation characteristics of the IoT card, the encryption and decryption operations are performed internally within the IoT card, thereby ensuring that the data receives physical-level protection during transmission. Then, the first encrypted data is further encrypted using the second public key of the authentication cloud platform to obtain the second encrypted data. The second public key is the public key of the authentication cloud platform, used to further ensure the security of the business encrypted data.

[0039] Step 103: By sending the second encrypted data to the authentication cloud platform, obtain the first decrypted data returned by the authentication cloud platform based on the second encrypted data.

[0040] In practice, the second encrypted data is sent to the authentication cloud platform to prevent unauthorized access or tampering during data transmission. Upon receiving the second encrypted data, the authentication cloud platform decrypts it using its private key to obtain the first decrypted data, which is then returned to the requesting party. Typically, after receiving the second encrypted data, the authentication cryptography service SDK can return it to the target application. The target application then requests the authentication cloud platform to decrypt the second encrypted data via its application server, and the authentication cloud platform subsequently returns the first decrypted data to the application server.

[0041] Step 104: After verifying that the first decrypted data and the encrypted business data have passed the verification, perform business data processing corresponding to the encrypted business data.

[0042] In practice, data verification is performed based on the first decrypted data returned from the authentication cloud platform and the initial encrypted business data to confirm that the data has not been tampered with or lost during transmission. If the data verification passes, the data is complete and accurate, and corresponding business data processing can be performed based on the encrypted business data, such as page redirection, media playback, and other further business logic execution. Typically, the application server can use a key agreed upon with the target application to decrypt the first decrypted data and the encrypted business data, obtaining the first and second data to be transmitted. By comparing the first and second data to be transmitted, a verification result is obtained and sent to the target application. If the target application determines that the verification has passed based on the verification result, it executes the business data processing corresponding to the encrypted business data.

[0043] In this way, by leveraging the secure storage, encryption engine, and physical isolation features of the IoT card, encryption and decryption operations are performed internally within the IoT card, thus providing physical-level protection. Simultaneously, by applying double encryption to encrypted business data, unauthorized access and attacks can be effectively prevented, improving the security of data transmission.

[0044] In one possible implementation, step 101 above, obtaining the encrypted business data transmitted between the target application and the application server, includes:

[0045] Obtain a first encryption request sent by the target application, the first encryption request including business encryption data, the business encryption data being data obtained by the target application encrypting the data to be transmitted using a preset key; determine the business encryption data transmitted between the target application and the application server based on the first encryption request.

[0046] In this embodiment of the application, the target application can encrypt the data to be transmitted in advance using a key agreed upon with the application server to obtain encrypted business data. The IoT device obtains the first encryption request sent by the target application through the authentication cryptography service SDK integrated on the target application. The first encryption request includes the encrypted business data. The authentication cryptography service SDK determines the encrypted business data transmitted between the target application and the application server based on the first encryption request.

[0047] In one possible implementation, in step 102 above, the first encrypted data is encrypted using the second public key of the authentication cloud platform, resulting in second encrypted data including:

[0048] Send a second encryption request to the IoT card, the second encryption request including the first encrypted data; obtain the second encrypted data returned by the IoT card based on the second encryption request; wherein, the second encrypted data is data obtained by the IoT card encrypting the second decrypted data with the second public key of the authentication cloud platform, and the IoT card decrypts the first encrypted data with the first private key to obtain the second decrypted data, the first private key corresponding to the first public key.

[0049] In this embodiment, the authentication cryptography service SDK receives a first encryption request sent by the target application. Using the first key of the IoT card, it encrypts the business encryption data in the first encryption request and the encryption method used by the target application for the data to be transmitted, obtaining first encrypted data. Then, it sends a second encryption request to the IoT card, requesting the IoT card to encrypt the first encrypted data. Upon receiving the second encryption request, the IoT card first decrypts the first encrypted data using its first private key, obtaining second decrypted data. Then, it encrypts the second decrypted data using the second public key of the authentication cloud platform, obtaining second encrypted data. Finally, it returns the second encrypted data to the authentication cryptography service SDK.

[0050] The second encryption request also includes target identification information corresponding to the target application; the method for determining the first private key includes:

[0051] Obtain the first identification information bound to the IoT card; determine the first private key corresponding to the target identification information based on the correspondence between the first identification information and the private key.

[0052] The target identification information includes the device identifier of the IoT device, the IoT card identifier corresponding to the IoT device, and the target application identifier. For example, the target identification information includes the device ID, the IoT card number, and the target application identifier APPID.

[0053] In this embodiment, the IoT card can pre-bind the correspondence between the first identification information and the private key. For example, the IoT card pre-binds the correspondence between the first private key, the second public key, the device identifier of the IoT device, the IoT card identifier corresponding to the IoT device, and the target application identifier. The second encryption request sent by the authentication cryptography service SDK carries information such as the device identifier, the IoT card identifier, and the target application identifier. The IoT card determines the first private key corresponding to the target identifier information based on the pre-binded correspondence between the first identification information and the private key. Similarly, the IoT card can also use the same method to determine the second public key corresponding to the target identifier information.

[0054] In one possible implementation, step 103 above, by sending the second encrypted data to the authentication cloud platform and obtaining the first decrypted data returned by the authentication cloud platform based on the second encrypted data, includes:

[0055] Send a decryption request to the authentication cloud platform, the decryption request including the second encrypted data; obtain the first decryption data returned by the authentication cloud platform based on the decryption request, wherein the first decryption data is data obtained by the authentication cloud platform decrypting the second encrypted data using a second private key, and the second private key corresponds to the second public key.

[0056] In this embodiment of the application, after obtaining the second encrypted data, the authentication password service SDK can return the second encrypted data to the target application. The target application sends a decryption request to the authentication cloud platform through the application server. The decryption request includes the second encrypted data. After receiving the decryption request, the authentication cloud platform decrypts the second encrypted data using the second private key to obtain the first decrypted data, and returns the first decrypted data to the application server.

[0057] The decryption request also includes target identification information corresponding to the target application; the method for determining the second private key includes:

[0058] Obtain the second identification information stored in the authentication cloud platform; determine the second private key corresponding to the target identification information based on the correspondence between the second identification information and the private key.

[0059] In this embodiment of the application, the authentication cloud platform can pre-store the correspondence between the second identification information and the private key. For example, the authentication cloud platform pre-stores the correspondence between the second private key, the first public key, the device identifier of the IoT device, the IoT card identifier corresponding to the IoT device, and the target application identifier. The decryption request sent by the application server carries information such as the device identifier, the IoT card identifier, and the target application identifier. The authentication cloud platform determines the second private key corresponding to the target identification information based on the pre-stored correspondence between the second identification information and the private key.

[0060] In one exemplary embodiment, such as Figure 2 and Figure 3 As shown, taking an IoT device as an in-vehicle terminal as an example, the above-mentioned secure data transmission method is explained. The in-vehicle terminal includes an in-vehicle application (App), which integrates an authentication and password service SDK. This SDK provides subsequent authentication and encryption services. The secure data transmission method specifically includes the following steps:

[0061] Step 201: The authentication password service SDK obtains the first encryption request sent by the target application. The first encryption request includes business encryption data, which is the data obtained by the target application encrypting the data to be transmitted using a preset key.

[0062] For example, the in-vehicle application app locally uses the key agreed upon between itself and the in-vehicle application server to encrypt the data to be transmitted, and then sends the encrypted data to the authentication key service SDK to request encryption.

[0063] Step 202: The authentication password service SDK obtains the business encrypted data transmitted between the target application and the application server; encrypts the business encrypted data using the first public key to obtain the first encrypted data; sends a second encryption request to the IoT card, the second encryption request including the first encrypted data; and obtains the second encrypted data returned by the IoT card based on the second encryption request.

[0064] Among them, the IoT card can be a SIM card;

[0065] For example, the authentication password service SDK uses the first public key of the SIM card to perform secondary encryption on the first encrypted data carried by the business party, and encrypts the encryption method of the data to be transmitted by the vehicle application App, and then requests the SIM card to encrypt it;

[0066] Step 203: After receiving the second encryption request, the IoT card encrypts the second decrypted data using the second public key of the authentication cloud platform. The IoT card then decrypts the first encrypted data using the first private key to obtain the second decrypted data.

[0067] For example, after receiving the second encryption request, the SIM card first uses the first private key in the SIM card to decrypt the first encrypted data encrypted with the first public key of the SIM card, and decrypts the encryption method. Then, it uses the second public key of the authentication cloud platform in the SIM card to encrypt the business encrypted data to obtain the second encrypted data, and returns the second encrypted data to the authentication password service SDK.

[0068] Step 204: The authentication password service SDK returns the second encrypted data to the in-vehicle application App;

[0069] Step 205: The in-vehicle application (App) sends a second encrypted data request to the in-vehicle application server for decryption and verification of the encrypted data;

[0070] Step 206: The application server sends the second encrypted data to the authentication cloud platform;

[0071] For example, the vehicle application server carries the second encrypted data and requests the unified authentication server to decrypt it. After performing relevant verification on the vehicle application server, the unified authentication server carries the second encrypted data and requests the authentication password service platform to decrypt the data.

[0072] Step 207: The authentication password service platform uses the second private key to decrypt the second encrypted data, obtains the first decrypted data, and returns the first decrypted data to the vehicle application server;

[0073] Step 208: The vehicle application server compares the first decrypted data with the encrypted business data and returns the verification result to the vehicle application App;

[0074] Step 209: The in-vehicle application (App) performs business data processing based on the verification results from the in-vehicle application server.

[0075] The data secure transmission method provided in this application improves data transmission security by using two pairs of public and private keys—a first public key, a first private key, a second public key, and a second private key—for encryption and decryption. The sender uses the receiver's public key for encryption, and only the receiver with the corresponding private key can decrypt the data. This ensures that the data is not accessed or tampered with by unauthorized individuals during transmission. Simultaneously, an IoT card is used as a secure hardware storage device, which can store sensitive information such as encryption keys and certificates, providing physical-level protection against unauthorized access and attacks.

[0076] For authentication, authentication between the two parties in data transmission can be achieved using two pairs of public and private keys. The sender uses its private key to sign the data, and the receiver uses the sender's public key to verify the validity of the signature, thus ensuring the trustworthiness of the data's origin. The IoT SIM card has a secure authentication mechanism to verify the legitimacy of the device and network. The keys in the IoT SIM card are used for authentication and digital signatures, ensuring the security and integrity of communication.

[0077] In terms of non-repudiation, digital signatures prevent the sender from denying sending data. The receiver can use the sender's public key to verify the signature, proving that the data indeed came from the sender, thus preventing the sender's repudiation. IoT cards have built-in dedicated encryption engines and algorithms capable of performing efficient encryption and decryption operations. These algorithms are typically certified and audited, providing high security and performance.

[0078] In terms of distributed security, using two pairs of public and private keys for encryption and decryption achieves distributed security. Even if one party's private key is leaked, the security of the other party's private key will not be affected, thus reducing the overall system risk. The IoT card is physically isolated from the device, allowing encryption and decryption operations to be performed on the IoT card, isolated from the device's operating system and applications. This isolation prevents the device from being exploited by malicious software, providing security protection.

[0079] In one possible implementation, step 101 above, before obtaining the encrypted business data transmitted between the target application and the application server, further includes:

[0080] In response to a touch operation on a target application, the system authenticates the IoT device and obtains the device identifier and IoT card identifier corresponding to the IoT device; based on the device identifier and IoT card identifier, it determines the target identifier information corresponding to the target application; it sends a first key pair generation request to the IoT card, the first key generation request including the target identifier information; and it obtains the first public key determined by the IoT card based on the first key pair generation request.

[0081] In this embodiment, key initialization can be performed as follows: The IoT device starts and connects to the network. The user performs touch operations such as clicking or touching on the target application. In response to the touch operation, the IoT device authenticates itself and obtains its corresponding device identifier and IoT card identifier. Specifically, the IoT device can request authentication from the authentication server through the authentication password service SDK to obtain IoT card identifiers such as the SIM card number and device identifiers such as the device identifier (ID). After relevant verification, the authentication server returns an access token cached with the IoT card identifier and device identifier to the authentication password service SDK. The relevant verifications performed by the authentication server refer to server-side verification, which generally includes parameter verification, verification of the business server's outgoing IP address, and availability verification of the business party's APPID to determine if it has the capability to call this password service. After successful verification, the authentication server, carrying the IoT IP address, requests the IoT SIM card number and device ID from the IoT gateway. The IoT gateway returns the relevant IoT SIM card number and IoT device ID to the authentication server. The authentication server generates a temporary credential accessToken, caches information such as the IoT card number, device ID, and APPID, and returns the temporary credential accessToken to the authentication password service SDK.

[0082] The authentication cryptography service SDK determines the target identification information corresponding to the target application based on the device identifier and the IoT card identifier; it sends a first key pair generation request to the IoT card, which includes the target identification information. In addition, the first key request may also include the target application identifier APPID; the IoT card triggers the generation of the first key pair, stores the first private key, and returns the first public key to the authentication cryptography service SDK.

[0083] The method for determining the target identification information corresponding to the target application based on the device identifier and the IoT card identifier further includes:

[0084] Send a second key pair generation request to the authentication cloud platform, the second key pair generation request including the target identification information; obtain the second public key determined by the authentication cloud platform based on the second key pair generation request.

[0085] Continuing with the above embodiments, the authentication cryptography service SDK sends a second key pair generation request to the authentication cloud platform. The second key pair generation request includes target identification information; the second key pair generation request may also include a first public key. After receiving the second key pair generation request, the authentication cloud platform generates a second key pair, stores the second private key on the authentication cloud platform, and stores the correspondence between the target identification information and the second private key. For example, the authentication cloud platform stores the correspondence between the vehicle application APPID, the second private key, the first public key, the device ID, and the IoT card number. At the same time, the authentication cloud platform returns the second public key to the authentication cryptography service SDK.

[0086] In one exemplary embodiment, such as Figure 4 and Figure 5 As shown, taking an IoT device as an in-vehicle terminal as an example, the key initialization process described above is explained. The in-vehicle terminal includes an in-vehicle application (App), which integrates an authentication password service SDK. This SDK provides subsequent authentication and encryption services. The key initialization process described above may include the following steps:

[0087] Step 401: The in-vehicle terminal starts up and connects to the network. The target user clicks on the target application on the in-vehicle system, for example, to listen to music, watch videos or navigate through the target application.

[0088] Step 402: Integrate the authentication password service SDK into the in-vehicle application App in the vehicle system and initialize the SDK;

[0089] Specifically, the integrated authentication password service SDK involves importing the SDK package into the vehicle application App to perform joint debugging of the corresponding SDK interface. After the joint debugging is completed, the SDK package is launched together with the vehicle application App.

[0090] Step 403: The authentication password service SDK requests the identity authentication of the vehicle device from the unified authentication server to obtain the IoT card number and the device ID of the vehicle device. After the unified authentication server performs relevant verification, it returns an accessToken containing the cached IoT card number and device ID information to the authentication password service SDK through the IoT gateway.

[0091] Step 404: The authentication password service SDK requests the generation of the first key pair from the IoT card built into the vehicle system. The internal card application of the IoT card triggers the generation of the first key pair and stores the first private key. The first public key corresponding to the first private key is returned to the authentication password service SDK.

[0092] Step 405: The authentication password service SDK sends the vehicle device ID, application APPID, first public key and other information to the authentication cloud platform to request the generation of a second key pair;

[0093] It should be noted that the vehicle application's capabilities also need to be configured, including: APPID (application identifier), IP whitelist, APPKey (key), application platform, and capability availability configuration (capability to obtain password service); among which, capability availability configuration refers to the operation and management configuration of whether this business party's APPID has the ability to call this password service.

[0094] Step 406: The authentication cloud platform generates a second key pair. The second private key is stored on the authentication cloud platform. The authentication cloud platform binds the correspondence between the vehicle application APPID, the second private key, the first public key, the device ID, and the IoT card number. The authentication cloud platform returns the second public key to the authentication password service SDK.

[0095] In this way, the business party's vehicle application APPID needs to apply for this password service capability in order to call the authentication password service SDK interface to initialize the password service; the second private key is mainly the private key in the key pair generated by the authentication cloud platform. The second private key, APPID, first public key, device ID, and IoT card number correspond one-to-one, that is, when using this device and this IoT card for encryption and decryption, device security will be verified; the second public key is generated by the authentication password service SDK requesting the IoT card interface, and the first private key is stored in the IoT card's cache; the device ID and IoT card number are obtained through the IoT card gateway. When the device registers and connects to the network, the relevant identification information is reported to the operator, so the operator can obtain the device ID and IoT card number through the dedicated operator IoT network layer. These are unique; the authentication cloud platform generates the second key pair, using the second private key as the key, and the value is the vehicle application APPID, second private key, second public key, device ID, and IoT card number; the first public key is used to encrypt the second private key and the second key pair.

[0096] Step 407: The authentication password service SDK synchronizes the second public key to the IoT card. The IoT card binds the mapping relationship between the first private key, the second public key, the device ID, the IoT card number, and the vehicle application APPID. The synchronization result is returned to the authentication password service SDK to complete the SDK initialization.

[0097] The second public key and the second key pair encrypted using the IoT card can ensure the security of the transmission between the second public key and the second key pair of the authentication cloud platform. The authentication password service SDK will return the second public key and the second key pair encrypted using the IoT card to the IoT card by calling the IoT card interface. The IoT card can decrypt the second public key and the second key pair encrypted using the first public key using the first private key, and then put them into the IoT card's cache for subsequent encryption and decryption.

[0098] Figure 6 The figure shows another flowchart of the data security transmission method provided in this application embodiment. The execution subject of this method can be an authentication cloud platform. As shown in the figure, the data security transmission method 600 specifically includes the following steps:

[0099] Step 601: Obtain the second encrypted data sent by the IoT device;

[0100] Step 602: Decrypt the second encrypted data using the second private key corresponding to the IoT device to obtain the first decrypted data;

[0101] Step 603: Send the first decrypted data to the IoT device, so that the IoT device, after determining that the verification is passed based on the first decrypted data and the business encryption data, performs business data processing corresponding to the business encryption data;

[0102] Wherein, the business encrypted data is the data transmitted between the target application included in the IoT device and the application server corresponding to the target application; the second encrypted data is the data obtained by the IoT device encrypting the first encrypted data with the second public key, and the first encrypted data is the data obtained by the IoT device encrypting the business encrypted data with the first public key of the IoT card; the second public key corresponds to the second private key.

[0103] In one possible implementation, step 601 above, before obtaining the second encrypted data sent by the IoT device, further includes:

[0104] Obtain a second key pair generation request sent by the IoT device, wherein the second key pair generation request includes target identification information corresponding to the IoT device;

[0105] The second key pair is generated based on the second key pair request, and the second key pair includes the second public key and the second private key.

[0106] This application provides a data security transmission method applied to an authentication cloud platform. The method involves acquiring second encrypted data sent by an IoT device; decrypting the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data; and sending the first decrypted data to the IoT device. This allows the IoT device to perform business data processing corresponding to the encrypted business data after verifying that the verification has passed based on the first decrypted data and the encrypted business data. In this way, the authentication cloud platform decrypts the second encrypted data sent by the IoT device and sends the decrypted first decrypted data to the IoT device, effectively preventing unauthorized access and attacks and improving data transmission security.

[0107] Figure 7 This illustration shows a schematic diagram of the structure of an IoT device provided in an embodiment of this application. This IoT device can achieve the following: Figure 1 As shown in the figure, the IoT device 700 includes all or part of the components in the illustrated embodiment, including:

[0108] The first acquisition module 710 is used to acquire encrypted business data transmitted between the target application and the application server.

[0109] The data encryption module 720 is used to encrypt the business encryption data using the first public key of the IoT card to obtain first encrypted data, and to encrypt the first encrypted data using the second public key of the authentication cloud platform to obtain second encrypted data.

[0110] The first decryption module 730 is used to obtain the first decryption data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform;

[0111] The business execution module 740 is used to perform business data processing corresponding to the business encrypted data after determining that the verification has passed based on the first decrypted data and the business encrypted data.

[0112] In one possible implementation, the first acquisition module 710, when acquiring encrypted business data transmitted between the target application and the application server, is specifically used for:

[0113] Obtain a first encryption request sent by the target application, wherein the first encryption request includes business encryption data, and the business encryption data is data obtained by the target application encrypting the data to be transmitted using a preset key;

[0114] Based on the first encryption request, the encrypted business data transmitted between the target application and the application server is determined.

[0115] In one possible implementation, the data encryption module 720, when used to encrypt the first encrypted data using the second public key of the authentication cloud platform to obtain the second encrypted data, specifically performs the following:

[0116] Send a second encryption request to the IoT card, the second encryption request including the first encrypted data;

[0117] The second encrypted data returned by the IoT card based on the second encryption request is obtained; wherein, the second encrypted data is data obtained by the IoT card encrypting the second decrypted data with the second public key of the authentication cloud platform, and the IoT card decrypts the first encrypted data with the first private key to obtain the second decrypted data, and the first private key corresponds to the first public key.

[0118] The second encryption request also includes target identification information corresponding to the target application; the data encryption module 720 is used to determine the first private key in the following way:

[0119] Obtain the first identification information bound to the IoT card;

[0120] Based on the correspondence between the first identification information and the private key, the first private key corresponding to the target identification information is determined.

[0121] In one possible implementation, the first decryption module 730, when used to obtain first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform, is specifically used for:

[0122] A decryption request is sent to the authentication cloud platform, the decryption request including the second encrypted data;

[0123] Obtain the first decrypted data returned by the authentication cloud platform based on the decryption request, wherein the first decrypted data is the data obtained by the authentication cloud platform decrypting the second encrypted data using the second private key, and the second private key corresponds to the second public key.

[0124] The decryption request also includes target identification information corresponding to the target application; the first decryption module 730 is used to determine the second private key in the following way:

[0125] Obtain the second identification information stored in the authentication cloud platform;

[0126] Based on the correspondence between the second identification information and the private key, the second private key corresponding to the target identification information is determined.

[0127] In one possible implementation, the IoT device 700 also includes:

[0128] The first generation module is used to perform identity authentication on the IoT device in response to a touch operation on the target application, and obtain the device identifier and IoT card identifier corresponding to the IoT device.

[0129] Based on the device identifier and the IoT card identifier, the target identifier information corresponding to the target application is determined;

[0130] Send a first key pair generation request to the authentication cloud platform, wherein the first key pair generation request includes the target identification information;

[0131] Obtain the second public key determined by the authentication cloud platform based on the first key pair in the generation request.

[0132] In one possible implementation, the first generation module is also used for:

[0133] Send a second key pair generation request to the IoT card, the second key generation request including the target identification information;

[0134] Obtain the first public key determined by the IoT card based on the second key pair generation request.

[0135] This application provides an Internet of Things (IoT) device, which includes a target application and comprises a first acquisition module, a data encryption module, a first decryption module, and a business execution module. The first acquisition module acquires encrypted business data transmitted between the target application and an application server. The data encryption module encrypts the encrypted business data using a first public key of the IoT card to obtain first encrypted data, and then encrypts the first encrypted data using a second public key of an authentication cloud platform to obtain second encrypted data. The first decryption module sends the second encrypted data to the authentication cloud platform and obtains first decrypted data returned by the authentication cloud platform based on the second encrypted data. The business execution module, after verifying that the verification is successful based on the first decrypted data and the encrypted business data, executes business data processing corresponding to the encrypted business data. Thus, by utilizing the secure storage, encryption engine, and physical isolation characteristics of the IoT card, encryption and decryption operations are performed internally within the IoT card, providing physical-level protection. Simultaneously, by performing double encryption on the encrypted business data, unauthorized access and attacks can be effectively prevented, improving the security of data transmission.

[0136] Figure 8This illustration shows a schematic diagram of the structure of an authentication cloud platform provided in an embodiment of this application. This authentication cloud platform can achieve the following: Figure 6 As shown in the figure, the authentication cloud platform 800 includes all or part of the contents of the illustrated embodiment, including:

[0137] The second acquisition module 810 is used to acquire the second encrypted data sent by the IoT device;

[0138] The second decryption module 820 is used to decrypt the second encrypted data using the second private key corresponding to the IoT device to obtain the first decrypted data;

[0139] The data sending module 830 is used to send the first decrypted data to the IoT device, so that the IoT device, after determining that the verification is passed based on the first decrypted data and the business encrypted data, performs business data processing corresponding to the business encrypted data.

[0140] Wherein, the business encrypted data is the data transmitted between the target application included in the IoT device and the application server corresponding to the target application; the second encrypted data is the data obtained by the IoT device encrypting the first encrypted data with the second public key, and the first encrypted data is the data obtained by the IoT device encrypting the business encrypted data with the first public key of the IoT card; the second public key corresponds to the second private key.

[0141] In one possible implementation, the IoT device 700 also includes:

[0142] The second generation module is used to obtain a second key pair generation request sent by the IoT device, the second key pair generation request including target identification information corresponding to the IoT device; and to determine a second key pair based on the second key pair generation request, the second key pair including the second public key and the second private key.

[0143] This application provides an authentication cloud platform, including a second acquisition module, a second decryption module, and a data sending module. The second acquisition module acquires second encrypted data sent by an IoT device. The second decryption module decrypts the second encrypted data using a second private key corresponding to the IoT device to obtain first decrypted data. The data sending module sends the first decrypted data to the IoT device, so that the IoT device, after confirming that the verification is successful based on the first decrypted data and the encrypted business data, executes business data processing corresponding to the encrypted business data. In this way, the authentication cloud platform decrypts the second encrypted data sent by the IoT device and sends the decrypted first decrypted data to the IoT device, effectively preventing unauthorized access and attacks and improving the security of data transmission.

[0144] Figure 9 The diagram illustrates the hardware structure of an electronic device implementing the embodiments of this application. Referring to the diagram, at the hardware level, the electronic device 900 includes a processor 910, and optionally includes an internal bus 920, a network interface 930, and a memory 940. The memory 940 may include main memory 941, such as high-speed random-access memory (RAM), and may also include non-volatile memory 942, such as at least one disk storage device. Of course, the electronic device 900 may also include other hardware required for other services.

[0145] The processor 910, network interface 930, and memory can be interconnected via an internal bus 920. This internal bus 920 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be categorized as an address bus, data bus, control bus, etc. For ease of illustration, only a single bidirectional arrow is used in this diagram, but this does not imply that there is only one bus or one type of bus.

[0146] Memory 940 stores programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 940 may include main memory 941 and non-volatile memory 942, and provides instructions and data to processor 910.

[0147] The processor 910 reads the corresponding computer program from the non-volatile memory 942 into memory and then runs it, forming a device for locating the target user at the logical level. The processor 910 executes the program stored in memory and specifically performs the following: Figure 1 or Figure 6 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0148] The above is as stated in this application. Figure 1 or Figure 6The methods disclosed in the illustrated embodiments can be applied to or implemented by processor 910. Processor 910 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware or by instructions in software form within processor 910. Processor 910 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0149] The computer device can also execute the methods described in the preceding method embodiments and achieve the functions and beneficial effects of the methods described in the preceding method embodiments, which will not be repeated here.

[0150] Of course, in addition to software implementation, the electronic device 900 of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0151] This application also proposes a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform... Figure 1 or Figure 6 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0152] The computer-readable storage medium mentioned above includes read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0153] Furthermore, embodiments of this application also provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the following process: Figure 1 or Figure 6 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0154] The embodiments of this application can be applied to various scenarios of electronic device collaboration or interconnection, including: collaboration and interconnection between mobile phones and laptops / tablets; collaboration and interconnection between mobile terminals and smart TVs / monitors; collaboration and interconnection between mobile phones or tablets and in-vehicle entertainment systems; collaboration and interconnection between mobile terminals and smart conferencing systems, etc. This satisfies users' diverse needs in smart home, smart office, and smart travel scenarios.

[0155] In summary, the above description is merely a preferred embodiment of this application and does not limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0156] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can store information accessible to a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0158] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0159] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A method for secure data transmission, characterized in that, Applied to Internet of Things (IoT) devices, wherein the IoT devices include a target application, the method includes: Obtain encrypted business data transmitted between the target application and the application server; The first public key of the IoT card is used to encrypt the business encrypted data to obtain the first encrypted data, and the second public key of the authentication cloud platform is used to encrypt the first encrypted data to obtain the second encrypted data. By sending the second encrypted data to the authentication cloud platform, the first decrypted data returned by the authentication cloud platform based on the second encrypted data is obtained; After verifying that the first decrypted data and the encrypted business data have passed the verification, the business data processing corresponding to the encrypted business data is executed. The second encrypted data obtained by encrypting the first encrypted data using the second public key of the authentication cloud platform includes: Send a second encryption request to the IoT card, the second encryption request including the first encrypted data; The second encrypted data returned by the IoT card based on the second encryption request is obtained; wherein, the second encrypted data is data obtained by the IoT card encrypting the second decrypted data with the second public key of the authentication cloud platform, and the IoT card decrypts the first encrypted data with the first private key to obtain the second decrypted data, and the first private key corresponds to the first public key.

2. The method according to claim 1, characterized in that, The acquisition of encrypted business data transmitted between the target application and the application server includes: Obtain a first encryption request sent by the target application, wherein the first encryption request includes business encryption data, and the business encryption data is data obtained by the target application encrypting the data to be transmitted using a preset key; Based on the first encryption request, the encrypted business data transmitted between the target application and the application server is determined.

3. The method according to claim 1, characterized in that, The second encryption request also includes target identification information corresponding to the target application; The method for determining the first private key includes: Obtain the first identification information bound to the IoT card; Based on the correspondence between the first identification information and the private key, the first private key corresponding to the target identification information is determined.

4. The method according to claim 1, characterized in that, The step of sending the second encrypted data to the authentication cloud platform and obtaining the first decrypted data returned by the authentication cloud platform based on the second encrypted data includes: A decryption request is sent to the authentication cloud platform, the decryption request including the second encrypted data; Obtain the first decrypted data returned by the authentication cloud platform based on the decryption request, wherein the first decrypted data is the data obtained by the authentication cloud platform decrypting the second encrypted data using the second private key, and the second private key corresponds to the second public key.

5. The method according to claim 4, characterized in that, The decryption request also includes target identification information corresponding to the target application; The methods for determining the second private key include: Obtain the second identification information stored in the authentication cloud platform; Based on the correspondence between the second identification information and the private key, the second private key corresponding to the target identification information is determined.

6. The method according to claim 1, characterized in that, Before obtaining the encrypted business data transmitted between the target application and the application server, the method further includes: In response to a touch operation on the target application, the IoT device is authenticated to obtain the device identifier and IoT card identifier corresponding to the IoT device; Based on the device identifier and the IoT card identifier, the target identifier information corresponding to the target application is determined; Send a first key pair generation request to the IoT card, wherein the first key generation request includes the target identification information; Obtain the first public key determined by the IoT card based on the first key pair generation request.

7. The method according to claim 6, characterized in that, After determining the target identification information corresponding to the target application based on the device identifier and the IoT card identifier, the method further includes: Send a second key pair generation request to the authentication cloud platform, the second key pair generation request including the target identification information; Obtain the second public key determined by the authentication cloud platform based on the second key pair in the generation request.

8. A method for secure data transmission, characterized in that, Applied to authentication cloud platforms, including: Obtain the second encrypted data sent by the IoT device; The second encrypted data is decrypted using the second private key corresponding to the IoT device to obtain the first decrypted data; The first decrypted data is sent to the IoT device so that the IoT device, after determining that the verification is successful based on the first decrypted data and the business encryption data, performs business data processing corresponding to the business encryption data. Wherein, the business encrypted data is the data transmitted between the target application included in the IoT device and the application server corresponding to the target application; the second encrypted data is the data obtained by the IoT device encrypting the first encrypted data with a second public key, and the first encrypted data is the data obtained by the IoT device encrypting the business encrypted data with a first public key of the IoT card; the second public key corresponds to the second private key; The methods for obtaining the second encrypted data include: The IoT device sends a second encryption request to the IoT card, the second encryption request including the first encrypted data; the IoT card returns second encrypted data based on the second encryption request; wherein the second encrypted data is data obtained by the IoT card encrypting second decrypted data using the second public key, and the IoT card decrypts the first encrypted data using the first private key to obtain the second decrypted data, the first private key corresponding to the first public key.

9. The method according to claim 8, characterized in that, Before obtaining the second encrypted data sent by the IoT device, the method further includes: Obtain a second key pair generation request sent by the IoT device, wherein the second key pair generation request includes target identification information corresponding to the IoT device; The second key pair is generated based on the second key pair generation request, and the second key pair includes the second public key and the second private key; The system stores the correspondence between the second key pair and the target identification information, and sends the second public key to the IoT device.

10. An Internet of Things (IoT) device, characterized in that, The IoT device includes a target application, comprising: The first acquisition module is used to acquire encrypted business data transmitted between the target application and the application server. The data encryption module is used to encrypt the business encryption data using the first public key of the IoT card to obtain first encrypted data, and to encrypt the first encrypted data using the second public key of the authentication cloud platform to obtain second encrypted data. The first decryption module is used to obtain the first decrypted data returned by the authentication cloud platform based on the second encrypted data by sending the second encrypted data to the authentication cloud platform; The business execution module is used to perform business data processing corresponding to the business encrypted data after determining that the verification has passed based on the first decrypted data and the business encrypted data. Specifically, when the data encryption module is used to encrypt the first encrypted data using the second public key of the authentication cloud platform to obtain the second encrypted data, it is used for: Send a second encryption request to the IoT card, the second encryption request including the first encrypted data; The second encrypted data returned by the IoT card based on the second encryption request is obtained; wherein, the second encrypted data is data obtained by the IoT card encrypting the second decrypted data with the second public key of the authentication cloud platform, and the IoT card decrypts the first encrypted data with the first private key to obtain the second decrypted data, and the first private key corresponds to the first public key.

11. An authentication cloud platform, characterized in that, include: The second acquisition module is used to acquire the second encrypted data sent by the IoT device; The second decryption module is used to decrypt the second encrypted data using the second private key corresponding to the IoT device to obtain the first decrypted data; The data sending module is used to send the first decrypted data to the IoT device, so that the IoT device, after determining that the verification is passed based on the first decrypted data and the business encrypted data, performs business data processing corresponding to the business encrypted data; Wherein, the business encrypted data is the data transmitted between the target application included in the IoT device and the application server corresponding to the target application; the second encrypted data is the data obtained by the IoT device encrypting the first encrypted data with a second public key, and the first encrypted data is the data obtained by the IoT device encrypting the business encrypted data with a first public key of the IoT card; the second public key corresponds to the second private key; The methods for obtaining the second encrypted data include: The IoT device sends a second encryption request to the IoT card, the second encryption request including the first encrypted data; the IoT card returns second encrypted data based on the second encryption request; wherein the second encrypted data is data obtained by the IoT card encrypting second decrypted data using the second public key, and the IoT card decrypts the first encrypted data using the first private key to obtain the second decrypted data, the first private key corresponding to the first public key.

12. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the method as claimed in any one of claims 1 to 9.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1 to 9.

Images