Internet of Things system, communication method thereof, communication device, storage medium, program product and computer equipment

Abstract

The application discloses an Internet of Things system and a communication method, a communication device, a storage medium, a program product and a computer device thereof. The method comprises the following steps: based on to-be-transmitted data and first identification information of the Internet of Things card, generating encrypted data, and transmitting the encrypted data to an access gateway; in response to an active acquisition identification request from the access gateway, sending a request response message to the access gateway, wherein the request response message carries the first identification information, and the request response message is used for decrypting the encrypted data, so that the communication security of the Internet of Things system can be improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an Internet of Things (IoT) system and its communication method, communication device, storage medium, program product, and computer equipment. Background Technology

[0002] During the network access authentication process of IoT devices, AI (Artificial Intelligence) technology can learn from a large number of samples to imitate IoT devices and generate information that the IoT system wants and can authenticate through the system. The generated information is then used to interact with the access gateway, causing the system to mark the imitated device as trustworthy. Ultimately, this can lead to the entire IoT system being compromised by AI, causing data transmission security and network security incidents. Summary of the Invention

[0003] To address the aforementioned technical problems, embodiments of this application propose an Internet of Things (IoT) system and its communication method, communication device, storage medium, program product, and computer equipment, which can improve the communication security of the IoT system.

[0004] In a first aspect, embodiments of this application provide a communication method for an Internet of Things (IoT) system, the IoT system including an IoT terminal and an access gateway, the IoT terminal having an IoT SIM card, and the method being executed by the IoT terminal and including:

[0005] Based on the data to be transmitted and the first identification information of the IoT card, encrypted data is generated and transmitted to the access gateway.

[0006] In response to an active request to obtain an identifier from the access gateway, a request response message is sent to the access gateway, wherein the request response message carries the first identifier information and is used to decrypt the encrypted data.

[0007] Optionally, the access gateway includes an identifier collector module, and the active identifier acquisition request is sent by the identifier collector module by transmitting electromagnetic waves.

[0008] Optionally, the power of the electromagnetic waves emitted by the identifier collector module is determined based on the wireless transmission coverage area corresponding to the access gateway.

[0009] Optionally, the active identification request is used to define the data type and / or data format of the request response message.

[0010] Optionally, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes:

[0011] Plaintext is constructed based on the data to be transmitted, and an encryption key is constructed based on the first identification information of the IoT card;

[0012] The plaintext is encrypted using the AES encryption algorithm according to the encryption key to generate ciphertext, which serves as the encrypted data.

[0013] The first identification information carried in the request-response message is used to construct a decryption key, and the request-response message is used to instruct the access gateway to decrypt the encrypted data according to the decryption key by performing the inverse operation of the AES encryption algorithm.

[0014] Optionally, the step of constructing plaintext based on the data to be transmitted and constructing an encryption key based on the first identification information of the IoT card includes:

[0015] The data to be transmitted is converted into plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted;

[0016] Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, the encryption key is constructed, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext.

[0017] The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request-response message.

[0018] Optionally, the step of encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext includes:

[0019] Based on the plaintext and the encryption key, an initial transformation is performed to obtain the transformed matrix;

[0020] The transformed matrix is ​​subjected to N rounds of iterative operations to generate the ciphertext, where N is an integer greater than 1.

[0021] Optionally, the N rounds of iterative operations consist of N-1 rounds of first iterative operations and 1 round of second iterative operations. Each round of first iterative operations includes sequential byte substitution, row shifting, column mixing, and round key addition. The second iterative operations include sequential byte substitution, row shifting, and round key addition. Performing N rounds of iterative operations on the transformed matrix to generate the ciphertext includes:

[0022] Perform N-1 rounds of the first loop operation on the transformed matrix;

[0023] The transformed matrix after N-1 rounds of the first loop operation is subjected to one round of the second loop operation to obtain the ciphertext.

[0024] Optionally, the Internet of Things system further includes a server;

[0025] The request-response message is further used to instruct the access gateway to upload the first identification information carried in the request-response message to the server when the decryption result indicates successful decryption. This allows the server to register the IoT terminal using the first identification information carried in the request-response message, enabling the server to identify the online status of the IoT terminal based on the obtained heartbeat message from the IoT terminal. The decryption result is the result of decrypting the encrypted data. The condition for successful decryption is that the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request-response message.

[0026] The server is configured to monitor each decryption result of the access gateway after confirming that the IoT terminal has successfully registered. When any decryption result indicates that decryption has failed, the server changes the online status of the IoT terminal to offline. Each decryption result corresponds to one transmission of the encrypted data.

[0027] Optionally, the IoT SIM card is adapted to be inserted into the corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT SIM card, and transmitting the encrypted data to the access gateway, the method further includes:

[0028] When the IoT card is detected to be inserted into the corresponding card slot in the IoT terminal, a binding request is sent to the base station that matches the IoT terminal. The binding request carries the first identification information and the second identification information of the IoT card.

[0029] The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether to communicate normally with the IoT terminal based on the binding relationship;

[0030] The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number.

[0031] Secondly, embodiments of this application provide a communication method for an Internet of Things (IoT) system, the IoT system including an IoT terminal and an access gateway, the IoT terminal having an IoT SIM card, and the method being executed by the access gateway and including:

[0032] Receive encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0033] Send an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card;

[0034] Receive the request response message returned by the IoT terminal in response to the active identification request;

[0035] Based on the request-response message, the encrypted data is decrypted.

[0036] Optionally, the encrypted data is generated by encrypting plaintext using the AES encryption algorithm with an encryption key, wherein the encryption key is constructed based on the first identification information of the IoT card, and the plaintext is constructed based on the data to be transmitted.

[0037] The process of decrypting the encrypted data based on the request-response message includes:

[0038] Construct a decryption key based on the first identification information carried in the request response message;

[0039] The encrypted data is decrypted using the inverse operation of the AES encryption algorithm and the decryption key to obtain the decryption result;

[0040] The method further includes:

[0041] If the decryption result indicates successful decryption, the plaintext is obtained based on the decryption result; otherwise, communication with the IoT terminal is cut off.

[0042] Optionally, the encryption key is constructed based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway;

[0043] The step of constructing a decryption key based on the first identification information carried in the request-response message includes:

[0044] The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request response message.

[0045] Optionally, the conditions for successful decryption include: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

[0046] Thirdly, embodiments of this application provide a communication device for an Internet of Things (IoT) system. The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card, and the communication device is located in the IoT terminal and includes:

[0047] An encrypted transmission module is used to generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and to transmit the encrypted data to the access gateway;

[0048] The active identification request response module is used to respond to an active identification request from the access gateway by sending a request response message to the access gateway, wherein the request response message carries the first identification information and is used to decrypt the encrypted data.

[0049] Fourthly, embodiments of this application provide a communication device for an Internet of Things (IoT) system. The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card, and the communication device is located on the access gateway and includes:

[0050] An encrypted data receiving module is used to receive encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0051] An active identification request sending module is used to send an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card;

[0052] The request-response message receiving module is used to receive the request-response message returned by the IoT terminal in response to the active acquisition of identifier request;

[0053] The decryption module is used to decrypt the encrypted data based on the request-response message.

[0054] Fifthly, embodiments of this application provide an Internet of Things (IoT) system, which includes an IoT terminal and an access gateway, wherein the IoT terminal has an IoT SIM card;

[0055] The IoT terminal is configured to perform the method described in any one of the first aspects above;

[0056] The access gateway is configured to perform the method described in any one of the second aspects above.

[0057] Sixthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0058] In a seventh aspect, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the preceding claims.

[0059] Eighthly, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0060] In summary, the embodiments of this application have at least the following beneficial effects:

[0061] In the embodiments of this application, the access gateway actively sends an active identification request to request the return of first identification information, and uses the request response message returned corresponding to the active identification request to decrypt the encrypted data. In this way, since the active identification request is actively generated and sent by the access gateway, the AI ​​cannot know the relevant information of the active identification request in advance, thereby avoiding the problem that the AI ​​can impersonate an IoT device in advance and successfully pass the access gateway authentication, thus improving the communication security of the IoT system. Attached Figure Description

[0062] Figure 1 This is a flowchart illustrating the communication method of the Internet of Things system provided in the embodiments of this application;

[0063] Figure 2 This is a schematic diagram of the Internet of Things system provided in the embodiments of this application;

[0064] Figure 3 This is a schematic diagram of actively obtaining IMSI provided in an embodiment of this application;

[0065] Figure 4 This is a schematic diagram illustrating the generation of ciphertext provided in an embodiment of this application;

[0066] Figure 5 This is a schematic diagram of constructing the transformed matrix provided in an embodiment of this application;

[0067] Figure 6 This is a schematic diagram illustrating the generation of ciphertext provided in an embodiment of this application;

[0068] Figure 7 This is a schematic diagram illustrating the determination of binding relationships provided in an embodiment of this application;

[0069] Figure 8 This is a flowchart illustrating the communication method of the Internet of Things system provided in the embodiments of this application;

[0070] Figure 9 This is a schematic diagram illustrating the plaintext obtained through decryption provided in an embodiment of this application;

[0071] Figure 10 This is a schematic diagram of the structure of the communication device of the Internet of Things system provided in the embodiments of this application;

[0072] Figure 11 This is a schematic diagram of the structure of the communication device of the Internet of Things system provided in the embodiments of this application;

[0073] Figure 12 This is a schematic diagram of the structure of the Internet of Things system provided in the embodiments of this application;

[0074] Figure 13 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0075] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0076] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more. In the description of this application, the term "comprising" and its variations are open-ended, meaning "including but not limited to." The term "based on" means "at least partially based on." The term "according to" means "at least partially according to." The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments."

[0077] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0078] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this application is for the purpose of describing specific embodiments only and is not intended to limit the application. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0079] The following explains some terms and concepts used in the embodiments of this application:

[0080] AES (Advanced Encryption Standard) is a block cipher standard.

[0081] IMSI (International Mobile Subscriber Identity) is a globally unique identifier used to uniquely identify mobile users. IMSI plays an important role in mobile communication networks, mainly for authentication, location updates, and call routing.

[0082] The RRC (Radio Resource Control) protocol is used to manage radio resources between the UE (User Equipment) and the base station.

[0083] Firstly, embodiments of this application provide a communication method for an Internet of Things (IoT) system, see [link to relevant documentation]. Figure 1 This diagram illustrates a flowchart of a communication method for an Internet of Things (IoT) system according to an embodiment of this application. The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card. The method is executed by the IoT terminal and includes steps S101-S102, as follows:

[0084] S101, Based on the data to be transmitted and the first identification information of the IoT card, generate encrypted data and transmit the encrypted data to the access gateway;

[0085] It should be noted that the data to be transmitted in this embodiment may refer to the data that the IoT terminal needs to transmit to the access gateway; the first identification information may include one or more identifiers corresponding to the IoT card.

[0086] In one example, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card may include: encrypting the data to be transmitted using a preset encryption algorithm according to the first identification information of the IoT card to generate encrypted data.

[0087] S102, in response to the active acquisition of identifier request from the access gateway, a request response message is sent to the access gateway, wherein the request response message carries the first identifier information and is used to decrypt the encrypted data.

[0088] In some cases, due to the limited computing power of IoT terminal devices in actual use, they often have to use encryption algorithms with poor security to encrypt data, resulting in low encryption security. However, in this embodiment, because a first identification information is introduced in both the encryption and decryption processes to improve the encryption / decryption algorithms, and this first identification information is matched with the IoT terminal and is usually unique, the security of the encrypted data can be improved.

[0089] Furthermore, in this embodiment, since the active identification request is initiated by the access gateway to actively obtain the first identification information, no access authentication process needs to be set between the IoT terminal and the access gateway. At the same time, transmission and access security are fully guaranteed. In this case, as long as the access gateway can actively obtain the correct first identification information to successfully complete the decryption process of the encrypted data, the IoT terminal can be considered secure and trustworthy without access authentication. Therefore, a seamless authentication method is essentially provided. As long as the IoT terminal device communicates with the access gateway and the access gateway can successfully parse the ciphertext from the IoT terminal, the IoT terminal device can be considered securely connected without the need to set up an additional access authentication process, thereby effectively improving the device's working efficiency.

[0090] In some cases, this embodiment will not publish the first identification information during the transmission of encrypted data to the access gateway, so as to prevent other devices from intercepting the first identification information and thus preventing other devices from decrypting the encrypted data. Preferably, the IoT terminal can be configured to send a request response message carrying the first identification information to the access gateway only after receiving the access gateway's active request to obtain the identification.

[0091] It is understandable that, since the request-response message carries first identification information, the access gateway can be instructed to use the first identification information carried in the request-response message to decrypt the encrypted data. In this case, the decryption process can correspond to the encryption process that generated the encrypted data.

[0092] In one example, the first identification information can be the International Mobile Subscriber Identity (IMSI). Here, the IoT SIM card can be pre-inserted into the corresponding card slot of the IoT terminal (i.e., forming a complete IoT SIM card device consisting of "device + card"), such as... Figure 2 As shown, after detecting the insertion of an IoT SIM card, the IoT terminal can obtain the IMSI of the inserted IoT SIM card.

[0093] In one example, the active identification request may be generated and sent to the IoT terminal by the access gateway in response to the transmitted encrypted data, and / or it may be sent periodically by the access gateway to each IoT terminal within its wireless transmission coverage area (in which case the access gateway may send the active identification request by broadcasting), without specific limitations.

[0094] In one optional implementation, the access gateway includes an identifier collector module, and the active identifier acquisition request is sent by the identifier collector module by transmitting electromagnetic waves.

[0095] It should be noted that in this embodiment, the identifier collector module can actively acquire the IMSI of the IoT SIM card. The identifier collector module communicates with the IoT SIM card by emitting electromagnetic waves, and can acquire the IMSI of the IoT SIM card during signaling interaction by configuring base station parameters. The acquisition process is as follows: Figure 3 As shown:

[0096] 1. The identifier acquisition module starts frequency scanning and configures parameters such as TAC (Tracking Area Code) and PCI (Physical Cell ID);

[0097] 2. The identifier acquisition module broadcasts information such as MB (Master Information Block) and SIB (System Information Block) to the IoT terminal; here, MB and SIB can be included in the active identifier acquisition request;

[0098] 3. The IoT terminal UE (User Equipment) is in IDLE state (this state indicates that the UE does not maintain a continuous connection with the network, but can still receive paging and perform cell selection and reselection) and performs measurement and reselection;

[0099] 4. The IoT terminal sends MSG1 to the identifier collector module. MSG1 is the first message in the random access process, i.e., the random access preamble.

[0100] 5. The identifier collector module responds to MSG1 and sends MSG2 to the IoT terminal. MSG2 is a random access response.

[0101] 6. In response to MSG2, the IoT terminal sends MSG3 to the identifier collector module. MSG3 is an RRC Connection Request.

[0102] 7. The identifier collector module responds to MSG3 and sends MSG4 to the IoT terminal. MSG4 is RRC Contention Resolution.

[0103] 8. The IoT terminal responds to MSG4 by sending an RRC Connection Setup Complete message to the identifier collector module to indicate that the RRC connection has been successfully established.

[0104] 9. After confirming that the RRC connection has been successfully established, the IoT terminal sends an Attach Request message to the identifier collector module to request registration and connection in the network. The Attach Request message also carries the IMSI of the IoT card of the IoT terminal.

[0105] 10. The identifier collector module receives the Attach Request message, thereby completing the active acquisition of the IMSI.

[0106] In this embodiment, it can be seen that the process of acquiring the IMSI is initiated by the identifier collector module. The IoT terminal can only passively provide relevant data. Therefore, the AI ​​cannot predict in advance how the identifier collector module will acquire the IMSI, thus preventing the AI ​​from imitating it in advance and further improving communication security.

[0107] In one example, see Figure 2 In this embodiment, the identifier collector module may include an IMSI collection module built into the access gateway.

[0108] In one example, the access gateway may include: a wireless communication module for receiving encrypted data transmitted by IoT terminals, an identifier collector module (e.g., an IMSI acquisition module) for sending active identifier acquisition requests, an Ethernet interface module, and a memory and storage module.

[0109] In one optional implementation, the power of the electromagnetic waves emitted by the identifier collector module is determined based on the wireless transmission coverage area corresponding to the access gateway.

[0110] In this embodiment, since the wireless transmission coverage area corresponding to the access gateway can also be adjusted as needed, the identifier collector in this embodiment can adjust the power of the transmitted electromagnetic waves to adapt to and match the access gateway.

[0111] In an optional implementation, the proactive identification request is used to define the data type and / or data format of the request response message.

[0112] In this embodiment, since the active identification request is initiated by the access gateway, the IoT terminal can only passively provide relevant data. When the active identification request defines the data type and / or data format of the request response message, the AI ​​is even less able to know in advance what data type and / or data format the message should be imitated to send to the access gateway for authentication through the access gateway, thereby further improving communication security.

[0113] In an optional implementation, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes:

[0114] Plaintext is constructed based on the data to be transmitted, and an encryption key is constructed based on the first identification information of the IoT card;

[0115] The plaintext is encrypted using the AES encryption algorithm according to the encryption key to generate ciphertext, which serves as the encrypted data.

[0116] The first identification information carried in the request-response message is used to construct a decryption key, and the request-response message is used to instruct the access gateway to decrypt the encrypted data according to the decryption key by performing the inverse operation of the AES encryption algorithm.

[0117] In one example, constructing plaintext based on the data to be transmitted and constructing an encryption key based on the first identification information of the IoT card can include: directly converting the data to be transmitted into plaintext and directly converting the first identification information of the IoT card into an encryption key. Correspondingly, the first identification information carried in the request-response message can then be converted into a decryption key.

[0118] In one example, see Figure 4 The ciphertext generation process includes steps ① to ④. Step ①: The IoT terminal converts the data to be transmitted into plaintext; Step ②: The IoT card provides its first identification information for constructing an encryption key; Step ③: The plaintext is encrypted using the encryption key; Step ④: Ciphertext is generated.

[0119] In some cases, due to the generally limited performance and weak data processing capabilities of IoT terminals, this embodiment adopts the AES encryption algorithm with lower performance requirements and improves the encryption effect by using the first identification information of the IoT card to construct the encryption key.

[0120] In an optional implementation, the step of constructing plaintext based on the data to be transmitted and constructing an encryption key based on the first identification information of the IoT card includes:

[0121] The data to be transmitted is converted into plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted;

[0122] Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, the encryption key is constructed, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext.

[0123] The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request-response message.

[0124] In one example, the key length for the AES encryption algorithm can be 128 bits, 192 bits, or 256 bits, see [link / reference]. Figure 5 This embodiment uses 128 bits (i.e. 16 bytes) as an example. In this case, the plaintext is 128 bits of data (128 bits). The plaintext can be converted into a 4*4 matrix, and a 128-bit encryption key can be introduced and converted into a 4*4 matrix. This allows the plaintext and encryption key to be constructed with the same dimensions as the indicated matrix, so that the AES encryption algorithm can be used for subsequent encryption.

[0125] Further, see Figure 5 Based on the first identification information of the IoT SIM card (taking IMSI as an example) and the number of data transmissions between the IoT terminal and the access gateway, the encryption key is constructed. This can include: setting the first fifteen digits of the encryption key using the IMSI of the IoT SIM card (the IMSI consists of fifteen digits), so k1, k2, k3, ..., k15 correspond to the fifteen digits of the IMSI, and setting k16 as the remainder of the i-th data transmitted by the IoT terminal to the access gateway (i.e., i can be determined by the number of data transmissions) divided by K (K is a positive integer, for example, K = 10). When K = 10, the value range of k16 is [0, 9]. After the above processing, taking the 15th data upload of a device with IMSI 460016911298012 (an exemplary random number, not a real IMSI) as an example, the initial encryption key in this embodiment is [4, 6, 0, 0, 1, 6, 9, 1, 1, 2, 9, 8, 0, 1, 2, 5]. It should be understood that in this embodiment, the fifteen digits corresponding to the IMSI can be located in any fifteen elements of the encryption key, either sequentially or out of order. The fact that the fifteen digits of the IMSI are located in the first fifteen bits of the encryption key in the above embodiment is only for illustrative purposes to facilitate understanding and explanation, and is not intended to limit the technical solution of this disclosure.

[0126] In an optional implementation, encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext includes:

[0127] Based on the plaintext and the encryption key, an initial transformation is performed to obtain the transformed matrix;

[0128] The transformed matrix is ​​subjected to N rounds of iterative operations to generate the ciphertext, where N is an integer greater than 1.

[0129] In one example, this initial transformation can be achieved using an XOR operation, as shown in [reference needed]. Figure 5 To illustrate, if the plaintext is 128 bits, the transformed matrix will still be 128 bits.

[0130] In an optional implementation, the N rounds of iterative operations consist of N-1 rounds of first iterative operations and 1 round of second iterative operations. Each round of first iterative operations includes sequential byte substitution, row shifting, column mixing, and round key addition. The second iterative operations include sequential byte substitution, row shifting, and round key addition. Performing N rounds of iterative operations on the transformed matrix to generate the ciphertext includes:

[0131] Perform N-1 rounds of the first loop operation on the transformed matrix;

[0132] The transformed matrix after N-1 rounds of the first loop operation is subjected to one round of the second loop operation to obtain the ciphertext.

[0133] In one example, N = 10; in this case, see [link to relevant documentation]. Figure 6 After the plaintext undergoes an initial transformation, it goes through ten rounds of cyclic operations. The first nine rounds sequentially perform byte substitution (by mapping bytes using a public S-table), row shift (shifting the i-th row of the matrix to the left by the (i-1)-th byte), column mixing (multiplying the 4x4 matrix on the left by a given 4x4 matrix), and round key addition (XORing the matrix with the subkey matrix, which is derived from the matrix indicated by the encryption key). The tenth round only performs byte substitution, row shift, and round key addition, thus completing the encryption and obtaining the ciphertext.

[0134] In one alternative implementation, see Figure 2 The IoT system also includes a server.

[0135] The request-response message is further used to instruct the access gateway to upload the first identification information carried in the request-response message to the server when the decryption result indicates successful decryption. This allows the server to register the IoT terminal using the first identification information carried in the request-response message, enabling the server to identify the online status of the IoT terminal based on the obtained heartbeat message from the IoT terminal. The decryption result is the result of decrypting the encrypted data. The condition for successful decryption is that the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request-response message.

[0136] The server is configured to monitor each decryption result of the access gateway after confirming that the IoT terminal has successfully registered. When any decryption result indicates that decryption has failed, the server changes the online status of the IoT terminal to offline. Each decryption result corresponds to one transmission of the encrypted data.

[0137] In this embodiment, after the access gateway completes the decryption process of the encrypted data, it also needs to further determine that the decrypted first identification information is the same as the first identification information carried in the request response message to confirm that the decryption is successful, thereby further improving communication security without the need for access authentication.

[0138] It should be noted that the IoT terminal in this embodiment is also configured to periodically send heartbeat messages to the server after it is determined that the IoT terminal has successfully registered with the server. The heartbeat information can be uploaded to the server via the access gateway.

[0139] It is understood that when any of the decryption results indicates decryption failure, the online status of the IoT terminal is changed to offline. At this time, it can be confirmed that the IoT card has been attacked or the IoT terminal is out of service based on the offline IoT terminal. At this time, the server can issue instructions to announce and handle the situation, so that this embodiment can efficiently monitor the IoT card status.

[0140] In an optional implementation, the IoT SIM card is adapted to be inserted into a corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT SIM card, and transmitting the encrypted data to the access gateway, the method further includes:

[0141] When the IoT card is detected to be inserted into the corresponding card slot in the IoT terminal, a binding request is sent to the base station that matches the IoT terminal. The binding request carries the first identification information and the second identification information of the IoT card.

[0142] The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether to communicate normally with the IoT terminal based on the binding relationship.

[0143] For specific implementation, please refer to Figure 2 and Figure 7 When an IoT terminal (i.e., a data acquisition terminal) detects the insertion of an IoT SIM card, the IoT terminal device will interact with the base station (which can be understood as the first network connection phase). At this time, the IoT terminal can send a binding request to the base station (for example, by sending the first call detail record) to instruct the base station to bind the first identification information and the second identification information of the IoT SIM card possessed by the IoT terminal to determine the binding relationship between the two. If the binding relationship is established, the IoT terminal is allowed to communicate and work normally with the base station; otherwise, the normal communication between the IoT terminal and the base station is stopped.

[0144] The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number.

[0145] In this embodiment, authentication is performed by actively acquiring device information. Since the IMSI is the unique identifier of the IoT card, it is difficult for existing AI technology to obtain and forge. Therefore, this embodiment can effectively prevent AI identity fraud and thus prevent AI security incidents.

[0146] Secondly, see Figure 8 This diagram illustrates a flowchart of a communication method for an Internet of Things (IoT) system according to an embodiment of this application. The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card. The method is executed by the access gateway and includes steps S801-S804, as follows:

[0147] S801, receiving encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0148] S802, send an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card;

[0149] S803, Receive the request response message returned by the IoT terminal in response to the active acquisition of identifier request;

[0150] S804, based on the request response message, decrypt the encrypted data.

[0151] In one optional implementation, the encrypted data is generated by encrypting plaintext using the AES encryption algorithm with an encryption key, wherein the encryption key is constructed based on the first identification information of the IoT card, and the plaintext is constructed based on the data to be transmitted.

[0152] The process of decrypting the encrypted data based on the request-response message includes:

[0153] Construct a decryption key based on the first identification information carried in the request response message;

[0154] The encrypted data is decrypted using the inverse operation of the AES encryption algorithm and the decryption key to obtain the decryption result;

[0155] The method further includes:

[0156] If the decryption result indicates successful decryption, the plaintext is obtained based on the decryption result; otherwise, communication with the IoT terminal is cut off.

[0157] In one example, see Figure 9 The process of decrypting encrypted data to obtain the decryption result includes steps ① to ③. Step ①: The access gateway constructs a decryption key based on the first identification information carried in the request response message; Step ②: The transmitted ciphertext (i.e., encrypted data) is decrypted using the decryption key; Step ③: The decrypted plaintext is obtained.

[0158] It should be noted that the inverse operation of the AES encryption algorithm used in this embodiment can be the inverse operation corresponding to any embodiment of the AES encryption algorithm in this disclosure.

[0159] In one optional implementation, the encryption key is constructed based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway;

[0160] The step of constructing a decryption key based on the first identification information carried in the request-response message includes:

[0161] The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request response message.

[0162] As mentioned above Figure 5Similar to the embodiment shown for constructing the encryption key, in one example, the first identification information (using IMSI as an example) carried in the request-response message can be set as the first fifteen bits of the decryption key (IMSI consists of fifteen digits). The remainder obtained by dividing the i-th data transmitted by the IoT terminal to the access gateway (i.e., i can be determined by the number of data transmissions) by K (K is a positive integer, e.g., K = 10) is used as the sixteenth bit of the decryption key, thereby constructing the decryption key. It should be understood that in this embodiment, the fifteen digits corresponding to the IMSI can be located sequentially or unsequentially in any fifteen elements of the decryption key. The sequential placement of the fifteen digits of the IMSI in the first fifteen bits of the decryption key in the above embodiment is merely an illustrative example for ease of understanding and explanation, and not a limitation on the technical solution of this disclosure.

[0163] In an optional implementation, the conditions for successful decryption include: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

[0164] In one optional implementation, the access gateway includes an identifier collector module, and the active identifier acquisition request is sent by the identifier collector module by transmitting electromagnetic waves.

[0165] In one optional implementation, the power of the electromagnetic waves emitted by the identifier collector module is determined based on the wireless transmission coverage area corresponding to the access gateway.

[0166] In an optional implementation, the proactive identification request is used to define the data type and / or data format of the request response message.

[0167] In one optional implementation, the IoT system further includes a server.

[0168] The request-response message is further used to instruct the access gateway to upload the first identification information carried in the request-response message to the server when the decryption result indicates successful decryption. This allows the server to register the IoT terminal using the first identification information carried in the request-response message, enabling the server to identify the online status of the IoT terminal based on the obtained heartbeat message from the IoT terminal. The decryption result is the result of decrypting the encrypted data. The condition for successful decryption is that the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request-response message.

[0169] The server is configured to monitor each decryption result of the access gateway after confirming that the IoT terminal has successfully registered. When any decryption result indicates that decryption has failed, the server changes the online status of the IoT terminal to offline. Each decryption result corresponds to one transmission of the encrypted data.

[0170] Thirdly, correspondingly, embodiments of this application also provide a communication device for an Internet of Things (IoT) system, capable of implementing all processes of the communication method for an IoT system provided in any embodiment of the first aspect above.

[0171] See Figure 10 This illustration shows a schematic diagram of the structure of a communication device for an Internet of Things (IoT) system provided in an embodiment of this application. The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card, and the communication device is located in the IoT terminal and includes:

[0172] The encrypted transmission module 1001 is used to generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway;

[0173] The active identification request response module 1002 is used to send a request response message to the access gateway in response to an active identification request from the access gateway, wherein the request response message carries the first identification information and is used to decrypt the encrypted data.

[0174] In one optional implementation, the access gateway includes an identifier collector module, and the active identifier acquisition request is sent by the identifier collector module by transmitting electromagnetic waves.

[0175] In one optional implementation, the power of the electromagnetic waves emitted by the identifier collector module is determined based on the wireless transmission coverage area corresponding to the access gateway.

[0176] In one optional implementation, the proactive identification request is used to define the data type and / or data format of the request response message.

[0177] In one optional implementation, generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes:

[0178] Plaintext is constructed based on the data to be transmitted, and an encryption key is constructed based on the first identification information of the IoT card;

[0179] The plaintext is encrypted using the AES encryption algorithm according to the encryption key to generate ciphertext, which serves as the encrypted data.

[0180] The first identification information carried in the request-response message is used to construct a decryption key, and the request-response message is used to instruct the access gateway to decrypt the encrypted data according to the decryption key by performing the inverse operation of the AES encryption algorithm.

[0181] In one optional implementation, the step of constructing plaintext based on the data to be transmitted and constructing an encryption key based on the first identification information of the IoT card includes:

[0182] The data to be transmitted is converted into plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted;

[0183] Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, the encryption key is constructed, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext.

[0184] The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request-response message.

[0185] In one optional implementation, the step of encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext includes:

[0186] Based on the plaintext and the encryption key, an initial transformation is performed to obtain the transformed matrix;

[0187] The transformed matrix is ​​subjected to N rounds of iterative operations to generate the ciphertext, where N is an integer greater than 1.

[0188] In one optional implementation, the N rounds of iterative operations consist of N-1 rounds of first iterative operations and 1 round of second iterative operations. Each round of first iterative operations includes sequential byte substitution, row shifting, column mixing, and round key addition. The second iterative operations include sequential byte substitution, row shifting, and round key addition. Performing N rounds of iterative operations on the transformed matrix to generate the ciphertext includes:

[0189] Perform N-1 rounds of the first loop operation on the transformed matrix;

[0190] The transformed matrix after N-1 rounds of the first loop operation is subjected to one round of the second loop operation to obtain the ciphertext.

[0191] In one alternative implementation, the IoT system further includes a server.

[0192] The request-response message is further used to instruct the access gateway to upload the first identification information carried in the request-response message to the server when the decryption result indicates successful decryption. This allows the server to register the IoT terminal using the first identification information carried in the request-response message, enabling the server to identify the online status of the IoT terminal based on the obtained heartbeat message from the IoT terminal. The decryption result is the result of decrypting the encrypted data. The condition for successful decryption is that the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request-response message.

[0193] The server is configured to monitor each decryption result of the access gateway after confirming that the IoT terminal has successfully registered. When any decryption result indicates that decryption has failed, the server changes the online status of the IoT terminal to offline. Each decryption result corresponds to one transmission of the encrypted data.

[0194] In one optional implementation, the IoT SIM card is adapted to be inserted into a corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT SIM card, and transmitting the encrypted data to the access gateway, the communication device of the IoT system further includes:

[0195] The binding module is used to send a binding request to a base station that matches the IoT terminal when the IoT card is detected to be inserted into the corresponding card slot in the IoT terminal. The binding request carries the first identification information and the second identification information of the IoT card.

[0196] The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether to communicate normally with the IoT terminal based on the binding relationship;

[0197] The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number.

[0198] Fourthly, correspondingly, embodiments of this application also provide a communication device for an Internet of Things (IoT) system, capable of implementing all processes of the communication method for an IoT system provided in any of the embodiments of the second aspect above.

[0199] See Figure 11This illustration shows a schematic diagram of the structure of a communication device for an Internet of Things (IoT) system provided in an embodiment of this application. The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card, and the communication device is located on the access gateway and includes:

[0200] The encrypted data receiving module 1101 is used to receive encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card;

[0201] Active identification request sending module 1102 is used to send an active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card;

[0202] The request response message receiving module 1103 is used to receive the request response message returned by the Internet of Things terminal in response to the active acquisition of identifier request;

[0203] The decryption module 1104 is used to decrypt the encrypted data based on the request response message.

[0204] In one optional implementation, the encrypted data is generated by encrypting plaintext using the AES encryption algorithm with an encryption key, wherein the encryption key is constructed based on the first identification information of the IoT card, and the plaintext is constructed based on the data to be transmitted.

[0205] The process of decrypting the encrypted data based on the request-response message includes:

[0206] Construct a decryption key based on the first identification information carried in the request response message;

[0207] The encrypted data is decrypted using the inverse operation of the AES encryption algorithm and the decryption key to obtain the decryption result;

[0208] The communication device further includes:

[0209] The decryption result response module is used to obtain the plaintext based on the decryption result if the decryption result indicates successful decryption; otherwise, it cuts off communication with the IoT terminal.

[0210] In one optional implementation, the encryption key is constructed based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway;

[0211] The step of constructing a decryption key based on the first identification information carried in the request-response message includes:

[0212] The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request response message.

[0213] In an optional implementation, the conditions for successful decryption include: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

[0214] In one optional implementation, the access gateway includes an identifier collector module, and the active identifier acquisition request is sent by the identifier collector module by transmitting electromagnetic waves.

[0215] In one optional implementation, the power of the electromagnetic waves emitted by the identifier collector module is determined based on the wireless transmission coverage area corresponding to the access gateway.

[0216] In an optional implementation, the proactive identification request is used to define the data type and / or data format of the request response message.

[0217] In one optional implementation, the IoT system further includes a server.

[0218] The request-response message is further used to instruct the access gateway to upload the first identification information carried in the request-response message to the server when the decryption result indicates successful decryption. This allows the server to register the IoT terminal using the first identification information carried in the request-response message, enabling the server to identify the online status of the IoT terminal based on the obtained heartbeat message from the IoT terminal. The decryption result is the result of decrypting the encrypted data. The condition for successful decryption is that the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request-response message.

[0219] The server is configured to monitor each decryption result of the access gateway after confirming that the IoT terminal has successfully registered. When any decryption result indicates that decryption has failed, the server changes the online status of the IoT terminal to offline. Each decryption result corresponds to one transmission of the encrypted data.

[0220] Fifthly, see Figure 12 The diagram shows a schematic of the structure of an Internet of Things (IoT) system provided in an embodiment of this application. The IoT system includes an IoT terminal 1201 and an access gateway 1202. The IoT terminal 1201 has an IoT card 12011.

[0221] The Internet of Things terminal 1201 is configured to perform the method described in any one of the first aspects above;

[0222] The access gateway 1202 is configured to perform the method described in any one of the second aspects above.

[0223] Sixthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0224] In a seventh aspect, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the method described in any of the preceding claims.

[0225] Eighthly, embodiments of this application provide a computer device including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the preceding claims.

[0226] See Figure 13 The computer device in this embodiment includes a processor 1301, a memory 1302, and a computer program stored in the memory 1302 and executable on the processor 1301, such as a communication program for an Internet of Things (IoT) system. When the processor 1301 executes the computer program, it implements the steps described in the communication method embodiments of the various IoT systems above.

[0227] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 1302 and executed by the processor 1301 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the computer device.

[0228] The computer device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor 1301 and a memory 1302. Those skilled in the art will understand that the schematic diagram is merely an example of a computer device and does not constitute a limitation on the computer device. It may include more or fewer components than shown, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0229] The processor 1301 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor 1301 can be any conventional processor. The processor 1301 is the control center of the computer device, connecting various parts of the entire computer device through various interfaces and lines.

[0230] The memory 1302 can be used to store the computer programs and / or modules. The processor 1301 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 1302 and calling the data stored in the memory 1302. The memory 1302 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 1302 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0231] Wherein, if the modules / units integrated into the computer device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 1301, it can implement the steps of the various method embodiments described above. Wherein, the computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0232] In summary, the embodiments of this application have at least the following beneficial effects:

[0233] In the embodiments of this application, the access gateway actively sends an active identification request to request the return of first identification information, and uses the request response message returned corresponding to the active identification request to decrypt the encrypted data. In this way, since the active identification request is actively generated and sent by the access gateway, the AI ​​cannot know the relevant information of the active identification request in advance, thereby avoiding the problem that the AI ​​can impersonate an IoT device in advance and successfully pass the access gateway authentication, thus improving the communication security of the IoT system.

[0234] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary hardware platforms, or it can be implemented entirely by hardware. Based on this understanding, all or part of the technical solutions of this application that contribute to the background technology can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0235] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.

Claims

1. A communication method for an Internet of Things (IoT) system, characterized in that, The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card. The method is executed by the IoT terminal and includes: Based on the data to be transmitted and the first identification information of the IoT card, encrypted data is generated and transmitted to the access gateway. The first identification information is matched with the IoT terminal and is unique. The data to be transmitted refers to the data that the IoT terminal needs to transmit to the access gateway. In response to an active identification request from the access gateway, a request response message is sent to the access gateway, wherein the request response message carries the first identification information, the request response message is used to decrypt the encrypted data, the active identification request is used to define the data type and / or data format of the request response message, and the active identification request is generated by the access gateway in response to the encrypted data.

2. The method as described in claim 1, characterized in that, The access gateway includes an identifier collector module, and the active identifier acquisition request is sent by the identifier collector module by emitting electromagnetic waves.

3. The method as described in claim 2, characterized in that, The power of the electromagnetic waves emitted by the identifier collector module is determined based on the wireless transmission coverage area corresponding to the access gateway.

4. The method as described in claim 1, characterized in that, The process of generating encrypted data based on the data to be transmitted and the first identification information of the IoT card includes: Plaintext is constructed based on the data to be transmitted, and an encryption key is constructed based on the first identification information of the IoT card; The plaintext is encrypted using the AES encryption algorithm according to the encryption key to generate ciphertext, which serves as the encrypted data. The first identification information carried in the request-response message is used to construct a decryption key, and the request-response message is used to instruct the access gateway to decrypt the encrypted data according to the decryption key by performing the inverse operation of the AES encryption algorithm.

5. The method as described in claim 4, characterized in that, The step of constructing plaintext based on the data to be transmitted and constructing an encryption key based on the first identification information of the IoT card includes: The data to be transmitted is converted into plaintext, wherein the dimension of the matrix indicated by the plaintext is determined by the data length corresponding to the data to be transmitted; Based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway, the encryption key is constructed, wherein the dimension of the matrix indicated by the encryption key is equal to the dimension of the matrix indicated by the plaintext. The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request-response message.

6. The method as described in claim 4, characterized in that, The step of encrypting the plaintext using the AES encryption algorithm according to the encryption key to generate ciphertext includes: Based on the plaintext and the encryption key, an initial transformation is performed to obtain the transformed matrix; The transformed matrix is ​​subjected to N rounds of iterative operations to generate the ciphertext, where N is an integer greater than 1.

7. The method as described in claim 6, characterized in that, The N rounds of iterative operations consist of N-1 rounds of first iterative operations and 1 round of second iterative operations. Each round of first iterative operations includes sequential byte substitution, row shifting, column mixing, and round key addition. The second iterative operations also include sequential byte substitution, row shifting, and round key addition. Performing N rounds of iterative operations on the transformed matrix to generate the ciphertext includes: Perform N-1 rounds of the first loop operation on the transformed matrix; The transformed matrix after N-1 rounds of the first loop operation is subjected to one round of the second loop operation to obtain the ciphertext.

8. The method according to any one of claims 1-7, characterized in that, The IoT system also includes a server; The request-response message is further used to instruct the access gateway to upload the first identification information carried in the request-response message to the server when the decryption result indicates successful decryption. This allows the server to register the IoT terminal using the first identification information carried in the request-response message, enabling the server to identify the online status of the IoT terminal based on the obtained heartbeat message from the IoT terminal. The decryption result is the result of decrypting the encrypted data. The condition for successful decryption is that the first identification information of the IoT card is decrypted from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request-response message. The server is configured to monitor each decryption result of the access gateway after confirming that the IoT terminal has successfully registered. When any decryption result indicates that decryption has failed, the server changes the online status of the IoT terminal to offline. Each decryption result corresponds to one transmission of the encrypted data.

9. The method according to any one of claims 1-7, characterized in that, The IoT SIM card is adapted to be inserted into the corresponding card slot in the IoT terminal. Before generating encrypted data based on the data to be transmitted and the first identification information of the IoT SIM card, and transmitting the encrypted data to the access gateway, the method further includes: When the IoT card is detected to be inserted into the corresponding card slot in the IoT terminal, a binding request is sent to the base station that matches the IoT terminal. The binding request carries the first identification information and the second identification information of the IoT card. The binding request is used to instruct the base station to determine the binding relationship between the first identification information and the second identification information of the IoT card, so as to determine whether to communicate normally with the IoT terminal based on the binding relationship; The first identification information of the IoT card is the International Mobile Subscriber Identity (IMSI) of the IoT card, and the second identification information of the IoT card is the IoT card number.

10. A communication method for an Internet of Things (IoT) system, characterized in that, The IoT system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card. The method is executed by the access gateway and includes: The device receives encrypted data transmitted by the IoT terminal, wherein the encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card, the first identification information being unique and matching the IoT terminal, and the data to be transmitted referring to the data that the IoT terminal needs to transmit to the access gateway. In response to the encrypted data, an active identification request is generated and sent to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card; The system receives a request response message returned by the IoT terminal in response to the active identification request, wherein the active identification request is used to define the data type and / or data format of the request response message; Based on the request-response message, the encrypted data is decrypted.

11. The method as described in claim 10, characterized in that, The encrypted data is generated by encrypting plaintext using the AES encryption algorithm and an encryption key. The encryption key is constructed based on the first identification information of the IoT card, and the plaintext is constructed based on the data to be transmitted. The process of decrypting the encrypted data based on the request-response message includes: Construct a decryption key based on the first identification information carried in the request response message; The encrypted data is decrypted using the inverse operation of the AES encryption algorithm and the decryption key to obtain the decryption result; The method further includes: If the decryption result indicates successful decryption, the plaintext is obtained based on the decryption result; otherwise, communication with the IoT terminal is cut off.

12. The method as described in claim 11, characterized in that, The encryption key is constructed based on the first identification information of the IoT card and the number of data transmitted between the IoT terminal and the access gateway; The step of constructing a decryption key based on the first identification information carried in the request-response message includes: The decryption key is constructed based on the number of data transmitted between the IoT terminal and the access gateway, and the first identification information carried in the request response message.

13. The method as described in claim 11, characterized in that, The conditions for successful decryption include: decrypting the first identification information of the IoT card from the encrypted data, and the decrypted first identification information is the same as the first identification information carried in the request response message.

14. A communication device for an Internet of Things (IoT) system, characterized in that, The Internet of Things (IoT) system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card. The communication device is located in the IoT terminal and includes: An encrypted transmission module is used to generate encrypted data based on the data to be transmitted and the first identification information of the IoT card, and transmit the encrypted data to the access gateway. The first identification information is matched with the IoT terminal and is unique. The data to be transmitted refers to the data that the IoT terminal needs to transmit to the access gateway. An active identification request response module is used to send a request response message to the access gateway in response to an active identification request from the access gateway. The request response message carries the first identification information and is used to decrypt the encrypted data. The active identification request is used to define the data type and / or data format of the request response message. The active identification request is generated by the access gateway in response to the encrypted data.

15. A communication device for an Internet of Things (IoT) system, characterized in that, The Internet of Things (IoT) system includes an IoT terminal and an access gateway. The IoT terminal has an IoT SIM card. The communication device is located in the access gateway and includes: An encrypted data receiving module is used to receive encrypted data transmitted by the IoT terminal. The encrypted data is generated based on the data to be transmitted and the first identification information of the IoT card. The first identification information matches the IoT terminal and is unique. The data to be transmitted refers to the data that the IoT terminal needs to transmit to the access gateway. An active identification request sending module is used to generate an active identification request in response to the encrypted data and send the active identification request to the IoT terminal, wherein the active identification request is used to request the return of the first identification information of the IoT card; The request-response message receiving module is used to receive the request-response message returned by the IoT terminal in response to the active acquisition of identifier request, wherein the active acquisition of identifier request is used to define the data type and / or data format of the request-response message; The decryption module is used to decrypt the encrypted data based on the request-response message.

16. An Internet of Things (IoT) system, characterized in that, The Internet of Things (IoT) system includes IoT terminals and access gateways, and the IoT terminals have IoT cards. The IoT terminal is configured to perform the method according to any one of claims 1-9; The access gateway is configured to perform the method according to any one of claims 10-13.

17. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-13.

18. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the method described in any one of claims 1-13.

19. A computer device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-13.

Images