Internet of Things system, communication method thereof, communication apparatus, storage medium, program product, and computer device

Abstract

The invention discloses an Internet of Things system and a communication method, a communication device, a storage medium, a program product and computer equipment thereof, and the method comprises the steps: generating encrypted data based on to-be-transmitted data and first identification information of an Internet of Things card, and transmitting the encrypted data to an access gateway; and in response to an active identification obtaining request from the access gateway, sending a request response message to the access gateway, the request response message carrying the first identification information, and the request response message being used for decrypting the encrypted data, thereby improving the communication security of the Internet of Things system.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an Internet of Things system and its communication method, communication device, storage medium, program product, and computer equipment. Background Art

[0002] During the network access authentication process of IoT devices, AI (Artificial Intelligence) technology can imitate IoT devices through a large number of sample learning to generate information that the IoT system wants to obtain and can be authenticated by the system, and then use the generated information to interact with the access gateway, so that the system will mark the imitated device as trustworthy, which will eventually lead to the entire IoT system being invaded by AI, causing data transmission security and network security incidents. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present application propose an Internet of Things system and its communication method, communication device, storage medium, program product, and computer equipment, which can improve the communication security of the Internet of Things system.

[0004] In a first aspect, an embodiment of the present application provides a communication method of an Internet of Things system, wherein the Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the method is executed by the Internet of Things terminal and includes:

[0005] Generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway;

[0006] In response to the active identification request from the access gateway, a request response message is sent to the access gateway, wherein the request response message carries the first identification information, and the request response message is used to decrypt the encrypted data.

[0007] Optionally, the access gateway includes an identification collector module, and the active identification acquisition request is sent by the identification collector module by emitting electromagnetic waves.

[0008] Optionally, the power of the electromagnetic wave emitted by the identification collector module is determined according to the wireless transmission coverage corresponding to the access gateway.

[0009] Optionally, the active identification acquisition request is used to define a data type and / or data format of the request response message.

[0010] Optionally, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes:

[0011] Constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card;

[0012] Encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext as the encrypted data;

[0013] The first identification information carried in the request response message is used to construct a decryption key, and the request response message is used to instruct the access gateway to use the inverse operation of the AES encryption algorithm to decrypt the encrypted data according to the decryption key.

[0014] Optionally, constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card, includes:

[0015] Converting the data to be transmitted into the plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted;

[0016] Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, construct the encryption key, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext;

[0017] The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

[0018] Optionally, the adopting the AES encryption algorithm to encrypt the plaintext according to the encryption key to generate ciphertext includes:

[0019] Based on the plaintext and the encryption key, an initial transformation is performed to obtain a transformed matrix;

[0020] Perform N rounds of cyclic operations on the transformed matrix to generate the ciphertext, where N is an integer greater than 1.

[0021] Optionally, the N rounds of loop operations are composed of N-1 rounds of first loop operations and 1 round of second loop operations, each round of the first loop operation includes sequentially performing byte substitution processing, row shift processing, column mixing processing, and round key addition processing, the second loop operation includes sequentially performing byte substitution processing, row shift processing, and round key addition processing, and performing N rounds of loop operations on the transformed matrix to generate the ciphertext includes:

[0022] Performing N-1 rounds of first cycle operations on the transformed matrix;

[0023] The transformed matrix after N-1 rounds of first cycle operation is subjected to one round of second cycle operation to obtain the ciphertext.

[0024] Optionally, the Internet of Things system further includes a server;

[0025] The request response message is also used to instruct the access gateway to upload the first identification information carried in the request response message to the server when the decryption result indicates that the decryption is successful, so as to register the Internet of Things terminal in the server by using the first identification information carried in the request response message, so that the server can identify the online status of the Internet of Things terminal according to the acquired heartbeat message of the Internet of Things terminal, wherein the decryption result is the result of decrypting the encrypted data, and the condition that the decryption result indicates that the decryption is successful is: the first identification information of the Internet of Things card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message;

[0026] Wherein, the server is configured to monitor each decryption result of the access gateway after determining that the Internet of Things terminal is successfully registered, and when any decryption result indicates a decryption failure, change the online status of the Internet of Things terminal to offline, wherein one decryption result corresponds to transmitting the encrypted data once.

[0027] Optionally, the IoT card is suitable for being inserted into a corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmitting the encrypted data to the access gateway, the method further includes:

[0028] When it is detected that the IoT card is inserted into a corresponding card slot in the IoT terminal, a binding request is sent to a base station matched with the IoT terminal, wherein the binding request carries the first identification information and the second identification information of the IoT card;

[0029] The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether the IoT terminal can communicate normally according to the binding relationship;

[0030] The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number of the IoT card.

[0031] In a second aspect, an embodiment of the present application provides a communication method of an Internet of Things system, wherein the Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the method is executed by the access gateway and includes:

[0032] Receiving encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0033] Sending an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card;

[0034] Receiving a request response message returned by the Internet of Things terminal in response to the active request to obtain an identification;

[0035] Based on the request response message, the encrypted data is decrypted.

[0036] Optionally, the encrypted data is generated by encrypting plain text according to an encryption key using an AES encryption algorithm, the encryption key is constructed according to the first identification information of the IoT card, and the plain text is constructed according to the data to be transmitted;

[0037] The decrypting the encrypted data based on the request response message comprises:

[0038] Constructing a decryption key according to the first identification information carried in the request response message;

[0039] Decrypting the encrypted data using the inverse operation of the AES encryption algorithm according to the decryption key to obtain a decryption result;

[0040] The method further comprises:

[0041] If the decryption result indicates that the decryption is successful, the plaintext is obtained according to the decryption result; otherwise, the communication with the Internet of Things terminal is cut off.

[0042] Optionally, the encryption key is constructed based on the first identification information of the IoT card and the number of times data has been transmitted between the IoT terminal and the access gateway;

[0043] The constructing a decryption key according to the first identification information carried in the request response message includes:

[0044] The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

[0045] Optionally, the decryption result indicates that the condition for successful decryption includes: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

[0046] In a third aspect, an embodiment of the present application provides a communication device of an Internet of Things system, wherein the Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the communication device is provided in the Internet of Things terminal and includes:

[0047] An encryption transmission module, used to generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway;

[0048] An active identification request response module is used to respond to an active identification request from the access gateway and send a request response message to the access gateway, wherein the request response message carries the first identification information and is used to decrypt the encrypted data.

[0049] In a fourth aspect, an embodiment of the present application provides a communication device of an Internet of Things system, wherein the Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the communication device is provided in the access gateway and includes:

[0050] An encrypted data receiving module, used to receive encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0051] An active identification request sending module, used to send an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card;

[0052] A request response message receiving module, used to receive a request response message returned by the Internet of Things terminal in response to the active identification acquisition request;

[0053] A decryption module is used to decrypt the encrypted data based on the request response message.

[0054] In a fifth aspect, an embodiment of the present application provides an Internet of Things system, the Internet of Things system comprising an Internet of Things terminal and an access gateway, the Internet of Things terminal having an Internet of Things card;

[0055] The Internet of Things terminal is configured to execute any one of the methods in the first aspect above;

[0056] The access gateway is configured to execute any method described in the second aspect.

[0057] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the methods described above are implemented.

[0058] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of any of the methods described above.

[0059] In an eighth aspect, an embodiment of the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the steps of any one of the methods described above when executing the computer program.

[0060] In summary, the embodiments of the present application have at least the following beneficial effects:

[0061] Using the embodiment of the present application, the access gateway actively sends an active identification request for requesting the return of the first identification information, and uses the request response message returned corresponding to the active identification request to decrypt the encrypted data. In this way, because the active identification request is actively generated and sent by the access gateway, the AI ​​cannot know the relevant information of the active identification request in advance, thereby avoiding the problem of AI imitating an IoT device in advance and successfully passing the access gateway authentication, thereby improving the communication security of the IoT system. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a flow chart of a communication method of an Internet of Things system provided by an embodiment of the present application;

[0063] Figure 2 is a schematic diagram of an Internet of Things system provided by an embodiment of the present application;

[0064] Figure 3 is a schematic diagram of actively acquiring IMSI provided in an embodiment of the present application;

[0065] Figure 4 It is a schematic diagram of generating ciphertext provided by an embodiment of the present application;

[0066] Figure 5 is a schematic diagram of constructing a transformed matrix provided in an embodiment of the present application;

[0067] Figure 6 It is a schematic diagram of generating ciphertext provided by an embodiment of the present application;

[0068] Figure 7 is a schematic diagram of determining a binding relationship provided in an embodiment of the present application;

[0069] Figure 8 It is a flow chart of a communication method of an Internet of Things system provided by an embodiment of the present application;

[0070] Fig. 9 It is a schematic diagram of decrypting plain text provided by an embodiment of the present application;

[0071] Fig.10 It is a structural schematic diagram of a communication device of an Internet of Things system provided in an embodiment of the present application;

[0072] Fig.11 It is a structural schematic diagram of a communication device of an Internet of Things system provided in an embodiment of the present application;

[0073] Fig.12 It is a structural diagram of the Internet of Things system provided by an embodiment of the present application;

[0074] Fig.13 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0076] In the description of the present application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, features defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more. In the description of the present application, the term "including" and its variations are open inclusions, i.e., "including but not limited to". The term "based on" means "at least partially based on". The term "according to" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments".

[0077] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0078] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0079] The following is an explanation of some terminology concepts involved in the embodiments of the present application:

[0080] AES (Advanced Encryption Standard) encryption algorithm is a block encryption standard.

[0081] IMSI (International Mobile Subscriber Identity) is a globally unique number used to uniquely identify mobile users. IMSI plays an important role in mobile communication networks and is mainly used in processes such as identity authentication, location update and call routing.

[0082] The RRC (Radio Resource Control) protocol is used to manage radio resources between UE (User Equipment) and base stations.

[0083] In a first aspect, the present application provides a communication method for an Internet of Things system, see Figure 1 , shows a flow chart of a communication method of an Internet of Things system provided in an embodiment of the present application, the Internet of Things system includes an Internet of Things terminal and an access gateway, the Internet of Things terminal has an Internet of Things card, the method is executed by the Internet of Things terminal and includes steps S101-S102, which are as follows:

[0084] S101, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmitting the encrypted data to the access gateway;

[0085] It should be noted that the data to be transmitted in this embodiment may refer to data that the Internet of Things terminal needs to transmit to the access gateway; the first identification information may include one or more identifications corresponding to the Internet of Things card.

[0086] In one example, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card may include: encrypting the data to be transmitted using a preset encryption algorithm according to the first identification information of the IoT card to generate encrypted data.

[0087] S102: In response to the active identification request from the access gateway, send a request response message to the access gateway, wherein the request response message carries the first identification information, and the request response message is used to decrypt the encrypted data.

[0088] In some cases, due to the limited computing power of IoT terminal devices in actual use, data can only be encrypted using encryption algorithms with poor security, resulting in low encryption security. In this embodiment, since the first identification information is introduced in the encryption / decryption process to improve the encryption / decryption algorithm, the first identification information matches the IoT terminal and is usually unique, so the security of the encrypted data can be improved.

[0089] In addition, in this embodiment, since the active identification request is actively issued by the access gateway for actively obtaining the first identification information, the access authentication process does not need to be set between the Internet of Things terminal and the access gateway of this embodiment, while fully ensuring the security of transmission and access. At this time, as long as the access gateway can actively obtain the correct first identification information for successfully completing the decryption process of the encrypted data, the Internet of Things terminal can be deemed to be safe and reliable without the need for access authentication. Therefore, a non-perceptual authentication method is essentially provided. It only requires the Internet of Things terminal device to communicate with the access gateway, and the access gateway can successfully parse the ciphertext from the Internet of Things terminal. It can be considered that the Internet of Things terminal device is securely accessed, and there is no need to set up an additional access authentication process, thereby effectively improving the working efficiency of the equipment.

[0090] In some cases, this embodiment will not publish the first identification information during the transmission of the encrypted data to the access gateway, so as to prevent the first identification information from being intercepted by other devices and thereby preventing other devices from decrypting the encrypted data. Preferably, the Internet of Things terminal can be configured to send a request response message carrying the first identification information to the access gateway only after receiving an active identification request from the access gateway.

[0091] It can be understood that since the request response message carries the first identification information, the access gateway can be instructed to use the first identification information carried in the request response message to decrypt the encrypted data. At this time, the decryption process can correspond to the encryption process that generates the encrypted data.

[0092] In one example, the first identification information may be an international mobile subscriber identity code IMSI. Here, the IoT card may be pre-inserted into a card slot corresponding to the IoT terminal (i.e., forming a complete IoT card device of "device + card", such as Figure 2 As shown), after detecting that an IoT card is inserted, the IoT terminal can obtain the IMSI of the inserted IoT card.

[0093] In one example, the active identification request may be generated by the access gateway in response to the transmitted encrypted data and sent to the IoT terminal, and / or, may be periodically sent by the access gateway to each IoT terminal within its wireless transmission coverage (in this case, the access gateway may send the active identification request by broadcasting), which is not specifically limited here.

[0094] In an optional implementation, the access gateway includes an identification collector module, and the active identification acquisition request is sent by the identification collector module by emitting electromagnetic waves.

[0095] It should be noted that in this embodiment, the identification collector module can actively obtain the IMSI of the IoT card. The identification collector module communicates with the IoT card by emitting electromagnetic waves, and can obtain the IMSI of the IoT card in the signaling interaction by configuring the base station parameters. The acquisition process is as follows: Figure 3 As shown:

[0096] 1. The identification collector module starts scanning and configures parameters such as TAC (Tracking Area Code) and PCI (Physical Cell ID);

[0097] 2. The identification collector module broadcasts MB (Master Information Block), SIB (System Information Block) and other information to the IoT terminal; here, MB and SIB can be included in the active identification request;

[0098] 3. The IoT terminal UE (User Equipment) is in IDLE state (this state indicates that the UE does not maintain a continuous connection with the network, but can still receive paging and perform cell selection and reselection) and performs measurement and reselection;

[0099] 4. The IoT terminal sends MSG1 to the identification collector module. MSG1 is the first message in the random access process, i.e., the random access preamble.

[0100] 5. The identification collector module responds to MSG1 and sends MSG2 to the IoT terminal. MSG2 is a random access response.

[0101] 6. The IoT terminal responds to MSG2 and sends MSG3 to the identification collector module. MSG3 is RRC ConnectionRequest (connection request);

[0102] 7. The identification collector module responds to MSG3 and sends MSG4 to the IoT terminal. MSG4 is RRC ContentionResolution (contention resolution);

[0103] 8. In response to MSG4, the IoT terminal sends an RRC Connection Setup Complete message to the identifier collector module to indicate that the RRC connection has been successfully established.

[0104] 9. After confirming that the RRC connection has been successfully established, the IoT terminal sends an Attach Request message to the identification collector module for requesting to register in the network and establish a connection. At the same time, the Attach Request message carries the IMSI of the IoT card possessed by the IoT terminal.

[0105] 10. The identification collector module receives the Attach Request message, thereby completing the active acquisition of the IMSI.

[0106] In this embodiment, it can be seen that the IMSI acquisition process is actively initiated by the identification collector module, and the IoT terminal can only passively provide relevant data. Therefore, AI cannot predict in advance how the identification collector module will obtain IMSI, so that AI cannot imitate in advance, which further improves communication security.

[0107] In one example, see Figure 2 , the identification collector module in this embodiment may include an IMSI collection module built into the access gateway.

[0108] In one example, the access gateway may include: a wireless communication module for receiving encrypted data transmitted by an IoT terminal, an identification collector module (such as an IMSI collection module) for sending an active identification request, an Ethernet interface module, and a memory and storage module.

[0109] In an optional implementation, the power of the electromagnetic wave emitted by the identification collector module is determined according to the wireless transmission coverage range corresponding to the access gateway.

[0110] In this embodiment, since the wireless transmission coverage corresponding to the access gateway can also be adjusted as needed, the identification collector in this embodiment can adapt to match the access gateway by adjusting the power of the transmitted electromagnetic waves.

[0111] In an optional implementation, the active identification acquisition request is used to define a data type and / or data format of the request response message.

[0112] In this embodiment, since the active identification request is initiated by the access gateway, the IoT terminal can only passively provide relevant data. When the active identification request defines the data type and / or data format of the request response message, the AI ​​cannot know in advance what data type and / or data format the message should be imitated into and sent to the access gateway for authentication by the access gateway, thereby further improving communication security.

[0113] In an optional implementation, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes:

[0114] Constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card;

[0115] Encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext as the encrypted data;

[0116] The first identification information carried in the request response message is used to construct a decryption key, and the request response message is used to instruct the access gateway to use the inverse operation of the AES encryption algorithm to decrypt the encrypted data according to the decryption key.

[0117] In one example, constructing plain text according to the data to be transmitted and constructing an encryption key according to the first identification information of the IoT card may include: directly converting the data to be transmitted into plain text and directly converting the first identification information of the IoT card into an encryption key. Accordingly, at this time, the first identification information carried in the request response message may be converted into a decryption key.

[0118] In one example, see Figure 4 The ciphertext generation process includes steps ① to ④. Step ①: the IoT terminal converts the data to be transmitted into plain text; Step ②: the IoT card provides its first identification information for constructing an encryption key; Step ③: encrypt the plain text using the encryption key; Step ④: generate the ciphertext.

[0119] In some cases, since IoT terminals generally have limited performance and weak data processing capabilities, this embodiment uses an AES encryption algorithm with lower performance requirements, and improves the encryption effect by constructing an encryption key using the first identification information of the IoT card.

[0120] In an optional implementation, constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card, includes:

[0121] Converting the data to be transmitted into the plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted;

[0122] Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, construct the encryption key, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext;

[0123] The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

[0124] In one example, the key length of the AES encryption algorithm can be 128 bits, 192 bits, or 256 bits. Figure 5 In this embodiment, 128 bits (i.e., 16 bytes) are used as an example. At this time, the plaintext is 128 bits of data (128 bits). The plaintext can be converted into a 4*4 matrix, and a 128-bit encryption key is introduced. The plaintext and encryption key with the same dimension of the indicated matrix can be constructed to facilitate the subsequent use of the AES encryption algorithm to implement encryption.

[0125] Further, see Figure 5 , based on the first identification information of the IoT card (taking IMSI as an example), and the number of data transmitted between the IoT terminal and the access gateway, constructing the encryption key may include: setting the IMSI of the IoT card as the first fifteen digits of the encryption key (IMSI consists of fifteen digits), so k1, k2, k3, ..., k15 correspond to the fifteen digits of the IMSI respectively, and setting k16 as the remainder of i (i.e., i can be determined by the number of data transmitted) in the i-th data transmitted by the IoT terminal to the access gateway divided by K (K is a positive integer, such as K=10), when K=10, the value range of k16 is [0,9]. After the above processing, taking the 15th data upload of the device with IMSI 460016911298012 (an exemplary random number, not an actual IMSI) as an example, the initial encryption key in this embodiment is [4,6,0,0,1,6,9,1,1,2,9,8,0,1,2,5]. It should be understood that the fifteen digits corresponding to the IMSI in this embodiment can be located in any fifteen element positions of the encryption key in sequence or non-sequentially. The fifteen digits of the IMSI in the above embodiment are located in the first fifteen positions of the encryption key in sequence only for the purpose of illustrative explanation to facilitate understanding and explanation, and do not limit the technical solution of the present disclosure.

[0126] In an optional implementation, the encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext includes:

[0127] Based on the plaintext and the encryption key, an initial transformation is performed to obtain a transformed matrix;

[0128] Perform N rounds of cyclic operations on the transformed matrix to generate the ciphertext, where N is an integer greater than 1.

[0129] In one example, the initial transformation can be implemented by an XOR operation, thus, see Figure 5 , taking the plaintext as 128 bits of data (128 bits) as an example, at this time, the transformed matrix is ​​still 128 bits.

[0130] In an optional implementation, the N rounds of loop operations are composed of N-1 rounds of first loop operations and 1 round of second loop operations, each round of the first loop operation includes sequentially performing byte substitution processing, row shift processing, column mixing processing, and round key addition processing, the second loop operation includes sequentially performing byte substitution processing, row shift processing, and round key addition processing, and performing N rounds of loop operations on the transformed matrix to generate the ciphertext includes:

[0131] Performing N-1 rounds of first cycle operations on the transformed matrix;

[0132] The transformed matrix after N-1 rounds of first cycle operation is subjected to one round of second cycle operation to obtain the ciphertext.

[0133] In one example, N=10, then see Figure 6 After the initial transformation of the plaintext, it will go through ten rounds of cyclic operations. The first nine rounds perform byte substitution (byte mapping is completed through a public S table), row shift (move the i-th row of the matrix to the left by the i-1th byte), column mixing (multiply the 4*4 matrix by a given 4*4 matrix on the left), and round key addition (XOR the matrix with the subkey matrix, and the subkey matrix is ​​expanded from the matrix indicated by the encryption key). The tenth round only performs byte substitution, row shift and round key addition to complete the encryption and obtain the ciphertext.

[0134] In an alternative embodiment, see Figure 2 , the Internet of Things system also includes a server;

[0135] The request response message is also used to instruct the access gateway to upload the first identification information carried in the request response message to the server when the decryption result indicates that the decryption is successful, so as to register the Internet of Things terminal in the server by using the first identification information carried in the request response message, so that the server can identify the online status of the Internet of Things terminal according to the acquired heartbeat message of the Internet of Things terminal, wherein the decryption result is the result of decrypting the encrypted data, and the condition that the decryption result indicates that the decryption is successful is: the first identification information of the Internet of Things card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message;

[0136] Wherein, the server is configured to monitor each decryption result of the access gateway after determining that the Internet of Things terminal is successfully registered, and when any decryption result indicates a decryption failure, change the online status of the Internet of Things terminal to offline, wherein one decryption result corresponds to transmitting the encrypted data once.

[0137] In this embodiment, after completing the decryption process of the encrypted data, the access gateway needs to further determine whether the decrypted first identification information is the same as the first identification information carried in the request response message to confirm that the decryption is successful, thereby further improving communication security without the need for access authentication.

[0138] It should be noted that the IoT terminal in this embodiment is also configured to: after determining that the IoT terminal is successfully registered in the server, periodically send a heartbeat message to the server, and the heartbeat information can be uploaded to the server via the access gateway.

[0139] It can be understood that when any of the decryption results indicates that the decryption fails, the online status of the IoT terminal is changed to offline. At this time, it can be confirmed based on the offline IoT terminal that the IoT card has been attacked or the IoT terminal has been shut down. At this time, the server can issue an instruction to announce and handle the situation, so that this embodiment can efficiently monitor the IoT card status.

[0140] In an optional embodiment, the IoT card is suitable for being inserted into a corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT card and transmitting the encrypted data to the access gateway, the method further includes:

[0141] When it is detected that the IoT card is inserted into a corresponding card slot in the IoT terminal, a binding request is sent to a base station matched with the IoT terminal, wherein the binding request carries the first identification information and the second identification information of the IoT card;

[0142] The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether communication with the IoT terminal is normal according to the binding relationship.

[0143] For specific implementation, see Figure 2 and Figure 7 When the IoT terminal (i.e., the collection terminal) detects that the IoT card has been inserted, the IoT terminal device will interact with the base station (which can be understood as the first network access stage). At this time, the IoT terminal can send a binding request to the base station (for example, sent in the form of the first call list) to instruct the base station to bind the first identification information of the IoT card possessed by the IoT terminal with the second identification information to determine the binding relationship between the two. If it is a binding relationship, the IoT terminal is allowed to communicate normally with the base station. Otherwise, the normal communication between the IoT terminal and the base station is stopped.

[0144] The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number of the IoT card.

[0145] In this embodiment, authentication is performed by actively acquiring device information. Since IMSI is the unique identity identifier of the IoT card, it is difficult to obtain and forge with existing AI technology. Therefore, this embodiment can effectively prevent AI identity fraud and thus cause AI security incidents.

[0146] Second, see Figure 8 , shows a flow chart of a communication method of an Internet of Things system provided by an embodiment of the present application, the Internet of Things system includes an Internet of Things terminal and an access gateway, the Internet of Things terminal has an Internet of Things card, the method is executed by the access gateway and includes steps S801-S804, which are as follows:

[0147] S801, receiving encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0148] S802, sending an active identification request to the IoT terminal, wherein the active identification request is used to request to return the first identification information of the IoT card;

[0149] S803, receiving a request response message returned by the IoT terminal in response to the active request for obtaining an identification;

[0150] S804: Decrypt the encrypted data based on the request response message.

[0151] In an optional implementation, the encrypted data is generated by encrypting plain text according to an encryption key using an AES encryption algorithm, the encryption key is constructed according to the first identification information of the IoT card, and the plain text is constructed according to the data to be transmitted;

[0152] The decrypting the encrypted data based on the request response message comprises:

[0153] Constructing a decryption key according to the first identification information carried in the request response message;

[0154] Decrypting the encrypted data using the inverse operation of the AES encryption algorithm according to the decryption key to obtain a decryption result;

[0155] The method further comprises:

[0156] If the decryption result indicates that the decryption is successful, the plaintext is obtained according to the decryption result; otherwise, the communication with the Internet of Things terminal is cut off.

[0157] In one example, see Fig. 9 The process of decrypting encrypted data to obtain a decryption result includes steps ① to ③. Step ①: the access gateway constructs a decryption key according to the first identification information carried in the request response message; Step ②: decrypts the transmitted ciphertext (i.e., encrypted data) using the decryption key; Step ③: obtains the decrypted plaintext.

[0158] It should be noted that the inverse operation of the AES encryption algorithm used in this embodiment may be the inverse operation corresponding to any embodiment of the AES encryption algorithm in the present disclosure.

[0159] In an optional implementation, the encryption key is constructed based on the first identification information of the IoT card and the number of times data has been transmitted between the IoT terminal and the access gateway;

[0160] The constructing a decryption key according to the first identification information carried in the request response message includes:

[0161] The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

[0162] As mentioned above Figure 5Similar to the embodiment for constructing the encryption key shown, in one example, the first identification information (taking IMSI as an example) carried in the request response message can be set as the first fifteen digits of the decryption key (IMSI consists of fifteen digits), and the remainder obtained after dividing i (i.e., i can be determined by the number of transmitted data) in the i-th data transmitted by the IoT terminal to the access gateway by K (K is a positive integer, for example, K=10) is used as the sixteenth digit of the decryption key, thereby constructing the decryption key. It should be understood that the fifteen digits corresponding to the IMSI in this embodiment can be located in any fifteen element positions of the decryption key in sequence or not in sequence. The fifteen digits of the IMSI in the above embodiment are located in the first fifteen digits of the decryption key in sequence only for the sake of easy understanding and explanation of the example, and do not limit the technical solution of the present disclosure.

[0163] In an optional embodiment, the decryption result indicates that the condition for successful decryption includes: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

[0164] In an optional implementation, the access gateway includes an identification collector module, and the active identification acquisition request is sent by the identification collector module by emitting electromagnetic waves.

[0165] In an optional implementation, the power of the electromagnetic wave emitted by the identification collector module is determined according to the wireless transmission coverage range corresponding to the access gateway.

[0166] In an optional implementation, the active identification acquisition request is used to define a data type and / or data format of the request response message.

[0167] In an optional implementation, the Internet of Things system further includes a server;

[0168] The request response message is also used to instruct the access gateway to upload the first identification information carried in the request response message to the server when the decryption result indicates that the decryption is successful, so as to register the Internet of Things terminal in the server by using the first identification information carried in the request response message, so that the server can identify the online status of the Internet of Things terminal according to the acquired heartbeat message of the Internet of Things terminal, wherein the decryption result is the result of decrypting the encrypted data, and the condition that the decryption result indicates that the decryption is successful is: the first identification information of the Internet of Things card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message;

[0169] Wherein, the server is configured to monitor each decryption result of the access gateway after determining that the Internet of Things terminal is successfully registered, and when any decryption result indicates a decryption failure, change the online status of the Internet of Things terminal to offline, wherein one decryption result corresponds to transmitting the encrypted data once.

[0170] In the third aspect, accordingly, an embodiment of the present application also provides a communication device of an Internet of Things system, which can implement all processes of the communication method of the Internet of Things system provided by any embodiment of the first aspect above.

[0171] See also Fig.10 , shows a schematic diagram of the structure of a communication device of an Internet of Things system provided in an embodiment of the present application, wherein the Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the communication device is provided in the Internet of Things terminal and includes:

[0172] The encryption transmission module 1001 is used to generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway;

[0173] The active identification request response module 1002 is used to send a request response message to the access gateway in response to the active identification request from the access gateway, wherein the request response message carries the first identification information and is used to decrypt the encrypted data.

[0174] In an optional implementation, the access gateway includes an identification collector module, and the active identification acquisition request is sent by the identification collector module by emitting electromagnetic waves.

[0175] In an optional implementation, the power of the electromagnetic wave emitted by the identification collector module is determined according to the wireless transmission coverage corresponding to the access gateway.

[0176] In an optional implementation, the active identification acquisition request is used to define a data type and / or data format of the request response message.

[0177] In an optional implementation, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes:

[0178] Constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card;

[0179] Encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext as the encrypted data;

[0180] The first identification information carried in the request response message is used to construct a decryption key, and the request response message is used to instruct the access gateway to use the inverse operation of the AES encryption algorithm to decrypt the encrypted data according to the decryption key.

[0181] In an optional implementation, constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card, includes:

[0182] Converting the data to be transmitted into the plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted;

[0183] Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, construct the encryption key, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext;

[0184] The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

[0185] In an optional implementation, encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext includes:

[0186] Based on the plaintext and the encryption key, an initial transformation is performed to obtain a transformed matrix;

[0187] Perform N rounds of cyclic operations on the transformed matrix to generate the ciphertext, where N is an integer greater than 1.

[0188] In an optional implementation, the N rounds of loop operations are composed of N-1 rounds of first loop operations and 1 round of second loop operations, each round of the first loop operation includes sequentially performing byte substitution processing, row shift processing, column mixing processing, and round key addition processing, the second loop operation includes sequentially performing byte substitution processing, row shift processing, and round key addition processing, and performing N rounds of loop operations on the transformed matrix to generate the ciphertext includes:

[0189] Performing N-1 rounds of first cycle operations on the transformed matrix;

[0190] The transformed matrix after N-1 rounds of first cycle operation is subjected to one round of second cycle operation to obtain the ciphertext.

[0191] In an optional implementation, the Internet of Things system further includes a server;

[0192] The request response message is also used to instruct the access gateway to upload the first identification information carried in the request response message to the server when the decryption result indicates that the decryption is successful, so as to register the Internet of Things terminal in the server by using the first identification information carried in the request response message, so that the server can identify the online status of the Internet of Things terminal according to the acquired heartbeat message of the Internet of Things terminal, wherein the decryption result is the result of decrypting the encrypted data, and the condition that the decryption result indicates that the decryption is successful is: the first identification information of the Internet of Things card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message;

[0193] Wherein, the server is configured to monitor each decryption result of the access gateway after determining that the Internet of Things terminal is successfully registered, and when any decryption result indicates a decryption failure, change the online status of the Internet of Things terminal to offline, wherein one decryption result corresponds to transmitting the encrypted data once.

[0194] In an optional embodiment, the IoT card is suitable for being inserted into a corresponding card slot in the IoT terminal, and before generating encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmitting the encrypted data to the access gateway, the communication device of the IoT system further includes:

[0195] A binding module, configured to send a binding request to a base station matching the IoT terminal when detecting that the IoT card is inserted into a corresponding card slot in the IoT terminal, wherein the binding request carries the first identification information and the second identification information of the IoT card;

[0196] The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether the IoT terminal can communicate normally according to the binding relationship;

[0197] The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number of the IoT card.

[0198] In the fourth aspect, accordingly, an embodiment of the present application also provides a communication device of an Internet of Things system, which can implement all processes of the communication method of the Internet of Things system provided in any embodiment of the second aspect above.

[0199] See also Fig.11, shows a schematic diagram of the structure of a communication device of an Internet of Things system provided in an embodiment of the present application, wherein the Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the communication device is provided in the access gateway and includes:

[0200] The encrypted data receiving module 1101 is used to receive the encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0201] An active identification request sending module 1102 is used to send an active identification request to the IoT terminal, wherein the active identification request is used to request to return the first identification information of the IoT card;

[0202] The request response message receiving module 1103 is used to receive the request response message returned by the IoT terminal in response to the active identification acquisition request;

[0203] The decryption module 1104 is used to decrypt the encrypted data based on the request response message.

[0204] In an optional implementation, the encrypted data is generated by encrypting plain text according to an encryption key using an AES encryption algorithm, the encryption key is constructed according to the first identification information of the IoT card, and the plain text is constructed according to the data to be transmitted;

[0205] The decrypting the encrypted data based on the request response message comprises:

[0206] Constructing a decryption key according to the first identification information carried in the request response message;

[0207] Decrypting the encrypted data using the inverse operation of the AES encryption algorithm according to the decryption key to obtain a decryption result;

[0208] The communication device further comprises:

[0209] The decryption result response module is used to obtain the plaintext according to the decryption result if the decryption result indicates that the decryption is successful, otherwise, cut off the communication with the Internet of Things terminal.

[0210] In an optional implementation, the encryption key is constructed based on the first identification information of the IoT card and the number of times data has been transmitted between the IoT terminal and the access gateway;

[0211] The constructing a decryption key according to the first identification information carried in the request response message includes:

[0212] The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

[0213] In an optional embodiment, the decryption result indicates that the condition for successful decryption includes: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

[0214] In an optional implementation, the access gateway includes an identification collector module, and the active identification acquisition request is sent by the identification collector module by emitting electromagnetic waves.

[0215] In an optional implementation, the power of the electromagnetic wave emitted by the identification collector module is determined according to the wireless transmission coverage range corresponding to the access gateway.

[0216] In an optional implementation, the active identification acquisition request is used to define a data type and / or data format of the request response message.

[0217] In an optional implementation, the Internet of Things system further includes a server;

[0218] The request response message is also used to instruct the access gateway to upload the first identification information carried in the request response message to the server when the decryption result indicates that the decryption is successful, so as to register the Internet of Things terminal in the server by using the first identification information carried in the request response message, so that the server can identify the online status of the Internet of Things terminal according to the acquired heartbeat message of the Internet of Things terminal, wherein the decryption result is the result of decrypting the encrypted data, and the condition that the decryption result indicates that the decryption is successful is: the first identification information of the Internet of Things card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message;

[0219] Wherein, the server is configured to monitor each decryption result of the access gateway after determining that the Internet of Things terminal is successfully registered, and when any decryption result indicates a decryption failure, change the online status of the Internet of Things terminal to offline, wherein one decryption result corresponds to transmitting the encrypted data once.

[0220] Fifth, see Fig.12 , shows a schematic diagram of the structure of an Internet of Things system provided in an embodiment of the present application, wherein the Internet of Things system includes an Internet of Things terminal 1201 and an access gateway 1202, wherein the Internet of Things terminal 1201 has an Internet of Things card 12011;

[0221] The Internet of Things terminal 1201 is configured to execute any one of the methods in the first aspect above;

[0222] The access gateway 1202 is configured to execute any one of the methods described in the second aspect.

[0223] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the methods described above are implemented.

[0224] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of any of the methods described above.

[0225] In an eighth aspect, an embodiment of the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the steps of any one of the methods described above when executing the computer program.

[0226] See also Fig.13 The computer device of this embodiment includes: a processor 1301, a memory 1302, and a computer program stored in the memory 1302 and executable on the processor 1301, such as a communication program of an Internet of Things system. When the processor 1301 executes the computer program, the steps in the above-mentioned communication method embodiments of each Internet of Things system are implemented.

[0227] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 1302 and executed by the processor 1301 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the computer device.

[0228] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may include, but not limited to, a processor 1301 and a memory 1302. Those skilled in the art may understand that the schematic diagram is only an example of a computer device and does not constitute a limitation on the computer device. The computer device may include more or fewer components than shown in the figure, or may combine certain components, or different components. For example, the computer device may also include input and output devices, network access devices, buses, etc.

[0229] The processor 1301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor 1301 may also be any conventional processor, etc. The processor 1301 is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

[0230] The memory 1302 can be used to store the computer program and / or module. The processor 1301 implements various functions of the computer device by running or executing the computer program and / or module stored in the memory 1302 and calling the data stored in the memory 1302. The memory 1302 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 1302 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0231] Wherein, if the module / unit integrated in the computer device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor 1301. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0232] In summary, the embodiments of the present application have at least the following beneficial effects:

[0233] Using the embodiment of the present application, the access gateway actively sends an active identification request for requesting the return of the first identification information, and uses the request response message returned corresponding to the active identification request to decrypt the encrypted data. In this way, because the active identification request is actively generated and sent by the access gateway, the AI ​​cannot know the relevant information of the active identification request in advance, thereby avoiding the problem of AI imitating an IoT device in advance and successfully passing the access gateway authentication, thereby improving the communication security of the IoT system.

[0234] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus the necessary hardware platform, and of course, it can also be implemented entirely by hardware. Based on such an understanding, all or part of the contribution of the technical solution of the present application to the background technology can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0235] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A communication method for an Internet of Things system, characterized in that: The Internet of Things system includes an Internet of Things terminal and an access gateway, the Internet of Things terminal has an Internet of Things card, and the method is executed by the Internet of Things terminal and includes: Generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway; In response to the active identification request from the access gateway, a request response message is sent to the access gateway, wherein the request response message carries the first identification information, and the request response message is used to decrypt the encrypted data.

2. The method according to claim 1, characterized in that The access gateway includes an identification collector module, and the active identification acquisition request is sent by the identification collector module in a manner of emitting electromagnetic waves.

3. The method according to claim 2, characterized in that The power of the electromagnetic wave emitted by the identification collector module is determined according to the wireless transmission coverage corresponding to the access gateway.

4. The method according to claim 1, characterized in that The active identification acquisition request is used to define the data type and / or data format of the request response message.

5. The method according to claim 1, characterized in that The step of generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes: Constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card; Encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext as the encrypted data; The first identification information carried in the request response message is used to construct a decryption key, and the request response message is used to instruct the access gateway to use the inverse operation of the AES encryption algorithm to decrypt the encrypted data according to the decryption key.

6. The method according to claim 5, characterized in that The step of constructing a plain text according to the data to be transmitted, and constructing an encryption key according to the first identification information of the IoT card, includes: Converting the data to be transmitted into the plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted; Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, construct the encryption key, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext; The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

7. The method according to claim 5, characterized in that The adopting the AES encryption algorithm to encrypt the plaintext according to the encryption key to generate ciphertext includes: Based on the plaintext and the encryption key, an initial transformation is performed to obtain a transformed matrix; Perform N rounds of cyclic operations on the transformed matrix to generate the ciphertext, where N is an integer greater than 1.

8. The method according to claim 7, characterized in that The N rounds of cyclic operations are composed of N-1 rounds of first cyclic operations and 1 round of second cyclic operations, each round of first cyclic operations includes sequentially performed byte substitution processing, row shift processing, column mixing processing, and round key addition processing, the second cyclic operation includes sequentially performed byte substitution processing, row shift processing, and round key addition processing, and the N rounds of cyclic operations are performed on the transformed matrix to generate the ciphertext, including: Performing N-1 rounds of first cycle operations on the transformed matrix; The transformed matrix after N-1 rounds of first cycle operation is subjected to one round of second cycle operation to obtain the ciphertext.

9. The method according to any one of claims 1 to 8, characterized in that: The Internet of Things system also includes a server; The request response message is also used to instruct the access gateway to upload the first identification information carried in the request response message to the server when the decryption result indicates that the decryption is successful, so as to register the Internet of Things terminal in the server by using the first identification information carried in the request response message, so that the server can identify the online status of the Internet of Things terminal according to the acquired heartbeat message of the Internet of Things terminal, wherein the decryption result is the result of decrypting the encrypted data, and the condition that the decryption result indicates that the decryption is successful is: the first identification information of the Internet of Things card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message; Wherein, the server is configured to monitor each decryption result of the access gateway after determining that the Internet of Things terminal is successfully registered, and when any decryption result indicates a decryption failure, change the online status of the Internet of Things terminal to offline, wherein one decryption result corresponds to transmitting the encrypted data once.

10. The method according to any one of claims 1 to 8, characterized in that The IoT card is suitable for being inserted into a corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT card and transmitting the encrypted data to the access gateway, the method further includes: When it is detected that the IoT card is inserted into a corresponding card slot in the IoT terminal, a binding request is sent to a base station matched with the IoT terminal, wherein the binding request carries the first identification information and the second identification information of the IoT card; The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether the IoT terminal can communicate normally according to the binding relationship; The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number of the IoT card.

11. A communication method for an Internet of Things system, characterized in that: The Internet of Things system includes an Internet of Things terminal and an access gateway, the Internet of Things terminal has an Internet of Things card, and the method is executed by the access gateway and includes: Receiving encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card; Sending an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card; Receiving a request response message returned by the Internet of Things terminal in response to the active request to obtain an identification; Based on the request response message, the encrypted data is decrypted.

12. The method according to claim 11, characterized in that The encrypted data is generated by encrypting plain text according to an encryption key using an AES encryption algorithm, the encryption key is constructed according to the first identification information of the IoT card, and the plain text is constructed according to the data to be transmitted; The decrypting the encrypted data based on the request response message comprises: Constructing a decryption key according to the first identification information carried in the request response message; Decrypting the encrypted data using the inverse operation of the AES encryption algorithm according to the decryption key to obtain a decryption result; The method further comprises: If the decryption result indicates that the decryption is successful, the plaintext is obtained according to the decryption result; otherwise, the communication with the Internet of Things terminal is cut off.

13. The method according to claim 12, characterized in that The encryption key is constructed based on the first identification information of the IoT card and the number of times data has been transmitted between the IoT terminal and the access gateway; The constructing a decryption key according to the first identification information carried in the request response message includes: The decryption key is constructed based on the number of times data has been transmitted between the Internet of Things terminal and the access gateway, and the first identification information carried in the request response message.

14. The method according to claim 12, characterized in that The decryption result indicates that the decryption is successful, and the condition includes: the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

15. A communication device for an Internet of Things system, characterized in that: The Internet of Things system includes an Internet of Things terminal and an access gateway, the Internet of Things terminal has an Internet of Things card, and the communication device is arranged in the Internet of Things terminal and includes: An encryption transmission module, used to generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway; An active identification request response module is used to respond to an active identification request from the access gateway and send a request response message to the access gateway, wherein the request response message carries the first identification information and is used to decrypt the encrypted data.

16. A communication device for an Internet of Things system, characterized in that: The Internet of Things system includes an Internet of Things terminal and an access gateway, wherein the Internet of Things terminal has an Internet of Things card, and the communication device is arranged in the access gateway and includes: An encrypted data receiving module, used to receive encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card; An active identification request sending module, used to send an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card; A request response message receiving module, used to receive a request response message returned by the Internet of Things terminal in response to the active identification acquisition request; A decryption module is used to decrypt the encrypted data based on the request response message.

17. An Internet of Things system, characterized in that: The Internet of Things system includes an Internet of Things terminal and an access gateway, and the Internet of Things terminal has an Internet of Things card; The Internet of Things terminal is configured to execute the method according to any one of claims 1 to 10; The access gateway is configured to execute the method according to any one of claims 11 to 14.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 14 is implemented.

19. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the method according to any one of claims 1 to 14 is implemented.

20. A computer device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the method according to any one of claims 1 to 14 when executing the computer program.

Images