Method and system for data transmission between devices and electronic device

Abstract

The invention relates to the technical field of intelligent equipment, and discloses a method and system for data transmission between equipment and electronic equipment. Each device is provided with an independent encryption unit SE, and the method comprises the following steps: determining a current transmission channel between two devices matched with current to-be-sent data; according to first key information generated by a home terminal device SE and second key information generated by an opposite terminal device SE, encrypting current to-be-sent data to obtain corresponding current encrypted data; and sending the current encrypted data to the opposite-end device through the current transmission channel, so that the opposite-end device decrypts the current encrypted data according to the first key information and the second key information to obtain corresponding received data. Therefore, since the private key can only be processed in the SE, the private key cannot be extracted even after Root processing of the equipment, the private key is ensured not to be stolen, the risk of data leakage caused by stealing of the private key is reduced, and the security of data transmission between the equipment is improved.

Description

Technical Field

[0001] The present application relates to the technical field of smart devices, for example, to a method, system and electronic device for data transmission between devices. Background Art

[0002] With the development of smart technology, many devices are smart devices, and data can be transmitted between devices. Currently, the technologies used for data transmission between many devices mainly include: NFC P2P, Bluetooth, or Wifi direct connection, etc.

[0003] Among them, NFC P2P technology corresponds to plain text transmission. When data is transmitted through Bluetooth technology, a LinkKey is generated during pairing, and then the key is used to encrypt the transmitted data. In this way, after the device is rooted, the LinkKey can be obtained from the device's storage to decrypt the transmitted data. When data is transmitted through Wifi Direct, a transmission key is also generated during the pairing association phase to encrypt the transmitted data. Similarly, after the device is rooted, the transmission key can be obtained to decrypt the transmitted data.

[0004] It can be seen that the current methods of data transmission between devices still have risks such as data tampering, data leakage due to key theft, etc. The security of data transmission between devices needs to be improved.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0007] The embodiments of the present disclosure provide a method, system and electronic device for data transmission between devices to solve the technical problem that the security of data transmission between devices needs to be improved.

[0008] In some embodiments, a method for transmitting data between devices is provided, each device having an independent encryption unit SE, the method comprising: determining a current transmission channel between two devices that match the data to be currently sent; encrypting the data to be currently sent according to first key information generated by the local device SE and second key information generated by the opposite device SE to obtain corresponding current encrypted data; sending the current encrypted data to the opposite device through the current transmission channel, so that the opposite device decrypts the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

[0009] Optionally, the method also includes: upon receiving a key generation random number sent by the peer device, obtaining key information including a private key ciphertext and a public key certificate chain from the corresponding encryption unit SE, wherein the public key certificate chain includes: a public key, and authentication extension data carrying the key generation random number; saving the private key ciphertext, and sending the public key certificate chain to the peer device through the established set communication connection.

[0010] Optionally, the method also includes: when a public key certificate chain is received, generating a random number based on the key sent to the peer device, and verifying the public key certificate chain; when it is determined that the verification is successful, saving the public key in the public key certificate chain, and sending verification success information to the peer device through the established set communication connection.

[0011] Optionally, sending a key generation random number to the peer device includes: upon receiving a user data transmission request, generating a key generation random number, and sending it to the peer device with which a set communication connection has been established; or, upon receiving a verification success message, generating a key generation random number, and sending it to the peer device with which a set communication connection has been established.

[0012] Optionally, the method further includes: establishing an NFC communication connection with a peer device, and starting a SE function.

[0013] Optionally, determining a current transmission channel that matches the data to be sent includes: determining current data characteristic information of the data to be sent, wherein the data characteristic information includes: one or more of data size, data service type, data service function, etc.; determining a current transmission channel that matches the current data characteristic information, wherein the current transmission channel includes: NFC, Bluetooth or WIFI direct connection, etc.

[0014] Optionally, encrypting the data to be sent includes: obtaining signature information corresponding to the data to be sent according to the private key ciphertext in the saved first key information through the corresponding SE; and obtaining current encrypted data corresponding to the data to be sent according to the public key and signature information in the saved second key information.

[0015] Optionally, decrypting the current encrypted data includes: decrypting the current encrypted data through the corresponding SE according to the private key ciphertext in the saved second key information to obtain the corresponding current decrypted data; verifying the current decrypted data according to the public key in the saved first private key information, and after the verification is passed, determining the current decrypted data as the received data.

[0016] In some embodiments, a system for data transmission between devices is provided, including: a first device and a second device, each device having an independent encryption unit SE, wherein the first device is configured to determine a current transmission channel between two devices that matches the data currently to be sent; encrypt the data currently to be sent according to first key information generated by the first device SE and second key information generated by the second device SE to obtain corresponding current encrypted data, and send the current encrypted data to the second device through the current transmission channel; the second device is configured to decrypt the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

[0017] In some embodiments, an electronic device is provided, comprising: a processor; and a memory storing program instructions, wherein the processor is configured to execute the method for inter-device data transmission as described in the above embodiments when running the program instructions.

[0018] The method, system and electronic device for inter-device data transmission provided by the embodiments of the present disclosure can achieve the following technical effects:

[0019] In the method for data transmission between devices provided by the embodiment of the present disclosure, each device has an independent encryption unit SE. When data transmission is performed, each device generates key information in its own SE. In this way, the data to be sent is encrypted and transmitted through the mutually authenticated key information, and the corresponding data is obtained only after the data is received and decrypted through the mutually authenticated key information, so as to realize data transmission between devices. Since the private key can only be processed in the SE, the private key cannot be extracted even after the device is rooted, which ensures that the private key will not be stolen, reduces the risk of data leakage caused by the key being stolen, and improves the security of data transmission between devices. In addition, when the system is tampered with and the previously generated key pair cannot be used, the trust root in the public key certificate of the newly generated key pair in the SE will change, which ensures the security of the key pair and further improves the reliability and security of data transmission between devices.

[0020] In the embodiment of the present disclosure, when the SE generates key information, it is necessary to obtain the corresponding key generation random number, that is, user authentication is required. Only after the user is authenticated can the newly generated key information be used, ensuring that data transmission is carried out with the user's permission. When the device is stolen, data transmission cannot be carried out if the user is not authenticated, further improving the security of data transmission between devices.

[0021] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0023] Figure 1 is a schematic diagram of a system architecture for data transmission between devices provided by an embodiment of the present disclosure;

[0024] Figure 2 is a schematic diagram of a method for data transmission between devices provided by an embodiment of the present disclosure;

[0025] Figure 3 It is a schematic diagram of a method for generating and authenticating key information between devices provided by an embodiment of the present disclosure;

[0026] Figure 4 is a schematic diagram of a method for data transmission between devices provided by an embodiment of the present disclosure;

[0027] Figure 5 is a structural diagram of an apparatus for inter-device data transmission provided by an embodiment of the present disclosure;

[0028] Figure 6 is a structural schematic diagram of an apparatus for inter-device data transmission provided by another embodiment of the present disclosure;

[0029] Figure 7 is a schematic diagram of an electronic device provided by an embodiment of the present disclosure;

[0030] Figure 8 It is a schematic diagram of a device provided by an embodiment of the present disclosure.

[0031] Reference numerals:

[0032] 100 first device; 200 second device;

[0033] 500 is a device for data transmission between devices; 510 is a determination module; 520 is an encryption module; 530 is a transmission module;

[0034] 600 device for data transmission between devices; 1000 processor; 1001 memory; 1002 communication interface; 1003 bus;

[0035] 700 Electronic Equipment; SE Unit 701;

[0036] 800 equipment body. DETAILED DESCRIPTION

[0037] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0038] The terms "first", "second", etc. in the specification and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0039] Unless otherwise stated, the term "plurality" means two or more.

[0040] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0041] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A, B, A and B.

[0042] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0043] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0044] In the disclosed embodiments, the devices are configured with corresponding operating systems, such as the Android operating system. In addition, each device has an independent encryption unit SE. The encryption unit (Secure Element, SE) is a trusted unit that can independently perform key management and secure calculations, and the internal secure storage module can store keys and feature data. In this way, when transmitting data, each device generates key information in its own SE, so that the data to be sent can be encrypted and transmitted through the mutually authenticated key information, and the corresponding data can be obtained only after the data is received through the mutually authenticated key information. Data transmission between devices is realized. Since the private key can only be processed in the SE, it ensures that the private key will not be stolen, reduces the risk of data leakage caused by the theft of the key, and improves the security of data transmission between devices.

[0045] Since data is transmitted between devices, Figure 1 As shown, the system for data transmission between devices may include: a first device 100 and a second device 200, wherein the first device 100 and the second device 200 respectively correspond to SE units, and the encryption unit SE may be an independent hardware device on each device, such as a chip, wherein each device may be connected to the SE through a corresponding SPI or I2C bus, and the device and the SE may communicate through the APDU protocol. In addition, the SE may support encryption and decryption algorithms such as RSA, ECDSA, ECDH, HMAC-SHA256, signature algorithms, and random number generation algorithms. Thus, in some embodiments, each device in the system for data transmission between devices may be an Android terminal device with an independent SE, which supports the hardware key library of the SE.

[0046] In a data transmission system between devices, each device may both send and receive data. Therefore, for both ends of data transmission, the first device 100 may be a local device that sends data, and the second device 200 may be a peer device that receives data sent by the first device 100. Similarly, the second device 200 may be a local device that sends data, and the first device 100 may be a peer device that receives data sent by the second device 200.

[0047] Combination Figure 1 In the inter-device data transmission system shown in FIG. 1 , each device has an independent encryption unit SE. The embodiment of the present disclosure provides a method for inter-device data transmission, such as Figure 2 As shown, the data transmission method includes:

[0048] Step 201: Determine a current transmission channel between two devices that matches the data to be sent.

[0049] Data is transmitted between devices, so there needs to be a transmission channel that can be established between the devices. Generally, wireless communication channels can be established between devices, and wireless communication channels include: Near Field Communication (NFC), Bluetooth, ZigBee, Wireless Local Area Network (WIFI) and other channels.

[0050] When the local device has data to send to the opposite device, the data corresponding to the current moment is the current data to be sent. It is necessary to determine the current transmission channel that matches the current data to be sent. The current transmission channel that matches the current data to be sent can be determined based on the characteristics of the data, the distance between the devices, etc., that is, in some embodiments, it can include: determining the current data feature information of the current data to be sent, wherein the data feature information includes: one or more of the data size, data service type, data service function, etc.; determining the current transmission channel that matches the current data feature information and device information, wherein the current transmission channel includes: NFC, Bluetooth, ZigBee or WIFI direct connection and other channels.

[0051] Of course, only one transmission channel can be established between devices, and the transmission channel can be directly determined as the current transmission channel.

[0052] Step 202: Encrypt the current data to be sent according to the first key information generated by the local device SE and the second key information generated by the opposite device SE to obtain the corresponding current encrypted data.

[0053] Each device has an independent encryption unit SE, which is an independent hardware device on the device, such as a chip. Its internal secure storage module can store keys and feature data. The device can be connected to the SE through the corresponding bus and perform corresponding communication.

[0054] In the disclosed embodiment, before data transmission, both devices need to generate corresponding key information and perform mutual authentication. Data transmission can only be performed between the devices based on the two authenticated key information.

[0055] In some embodiments, the device key generation authentication process includes: upon receiving a key generation random number sent by a peer device, obtaining key information including a private key ciphertext and a public key certificate chain from a corresponding encryption unit SE, wherein the public key certificate chain includes: a public key, and authentication extension data carrying the key generation random number; saving the private key ciphertext, and sending the public key certificate chain to the peer device through an established set communication connection.

[0056] Here, the key generation random number challenge is required between devices to trigger the generation of key information. At this time, the device receiving the key generation random number can be the local device, and the device sending the key generation random number is the peer device. In some embodiments, the key generation random number challenge can be generated according to the user password.

[0057] Therefore, after receiving the random number challenge for key generation sent by the peer device, the local device can call the operating system key store function API and pass the random number challenge for key generation to SE as a parameter. For example, if the device is an Android operating system device, the Android key store function API can be called and the challenge can be passed to SE as a parameter. The correct user password can be specified to use the key information, that is, the user password verification is required. Therefore, SE generates the random number challenge according to the key, and obtains the corresponding key information through the corresponding encryption and signature algorithms. The key information includes the private key ciphertext and the public key certificate chain, and the public key certificate chain is a certificate chain authenticated by the setting server. The root certificate is issued by the setting platform, and there is also a certificate containing the public key and the authentication extension data. The authentication extension data contains the challenge, security level and trust root information, etc. Similarly, the local device can obtain the key information from the SE through the key store function API, and can save the private key ciphertext in the key information. It only needs to send the public key certificate chain in the key information to the peer device.

[0058] The platform is set as a trusted platform, which can be a trusted platform matching the SE in the related technology, and the server is set as a server corresponding to the platform. For example, the device for data transmission is an Android device, which has an independent encryption unit SE and supports the key library implemented by the SE hardware. In this way, when the Android device obtains the corresponding key information through the key library function corresponding to the SE, the public key certificate chain is the certificate chain authenticated by the Google server, and the root certificate is issued by Google.

[0059] The key information has been generated and still needs to be authenticated. Therefore, in some embodiments, the key generation authentication process also includes: when a public key certificate chain is received, a random number is generated based on the key sent to the peer device, and the public key certificate chain is verified; when it is determined that the verification is successful, the public key in the public key certificate chain is saved, and a verification success message is sent to the peer device through the established set communication connection.

[0060] Here, the device that receives the public key certificate chain is the local device, and the device that sends the public key certificate chain is the peer device. Since the public key certificate chain includes: root certificate and other certificates, one of the other certificates includes: public key, and authentication extension data, and the authentication extension data includes challenge, security level, and trust root information, etc., the local device that receives the public key certificate chain can check the validity of each certificate and whether it has expired; check whether each certificate is signed by the private key corresponding to the superior certificate; check whether the root certificate public key is the public key issued by the setting platform; check the authentication extension data, whether the challenge is the same as the challenge generated and sent by the peer device, whether the security level is SE, and judge whether the device has not been tampered with according to the device lock status, device startup status and other information in the trust root information. If the above checks are in line with expectations, it means that the key information pair generated by the peer device is generated by SE, and it can be determined that the verification is passed. At this time, the local device can save the public key in the public key certificate chain and send a verification success message to the peer device through the established setting communication connection.

[0061] It can be seen that a device can be both a local device that generates key information in the current key generation authentication process, and a peer device that verifies key information in other key generation authentication processes. Alternatively, a device can be both a local device that verifies key information in the current key generation authentication process, and a peer device that generates key information in other key generation authentication processes.

[0062] During the key generation and authentication process, the local device and the peer device need to send challenges, public key certificate chains, or verification success information, etc., that is, a communication connection is also required between the local device and the peer device.

[0063] NFC technology can achieve very fast device connection. It is intuitive and simple to use. You only need to bring two devices close to each other to activate the NFC connection between the devices. Therefore, during the key generation authentication process, the devices can communicate through the NFC connection, that is, the communication connection can be set to an NFC connection. Therefore, the local device can receive the key generation random number challenge sent by the peer device through the established NFC connection, and can also send the public key certificate chain in the key information to the peer device through the established NFC connection. Or, the local device can send the key generation random number challenge to the peer device through the established NFC connection, and can also receive the public key certificate chain sent by the peer device through the established NFC connection, and send verification success information to the peer device through the established NFC connection.

[0064] Of course, the implementation of the present disclosure is not limited to this, and other communication connections can also be applied here, that is, the communication connection can also be set to be a Bluetooth connection, a WIFI connection, etc., which are specifically explained in detail one by one.

[0065] In some embodiments, when a communication connection is established between devices, each device may also start the SE function, which may be responsible for generating a key pair in the SE, performing key authentication, signing and encrypting and decrypting data, etc. based on the hardware key library framework of the setting operating system. Therefore, in some embodiments, the local device may establish an NFC communication connection with the peer device and start the SE function, that is, establish an NFC communication connection with the peer device and start the SE function.

[0066] The key generation random number challenge is required between devices to trigger the generation of key information. Therefore, the process of sending the key generation random number between devices to the peer device may include: upon receiving a user data transmission request, generating a key generation random number and sending it to the peer device with which a set communication connection has been established; or, upon receiving verification success information, generating a key generation random number and sending it to the peer device with which a set communication connection has been established.

[0067] When a user has a need for data transmission, the local device can generate a corresponding key-generated random number challenge after receiving the corresponding request, and send it to the peer device. The SE of the peer device can generate the corresponding key information based on the key-generated random number challenge, so that the correct user password is required to use the key information, that is, user password verification is required.

[0068] Since both parties of data transmission need to generate key information and perform authentication, when the local device receives the verification success information sent by the other device, that is, the key information generated by the local device has been successfully authenticated, at this time, it is also necessary to generate a key generation random number challenge to trigger the other device to generate key information and perform corresponding authentication. The specific authentication process is consistent with the above and will not be repeated.

[0069] It can be seen that before the devices transmit data, the key information generation authentication process has been completed between the two devices. Therefore, the SE in the local device that needs to send the current data to be sent has generated the first key information, and the SE in the opposite device that receives the current data to be sent has generated the second key information, and the local device saves the private key ciphertext in the first key information and the public key in the second key information, while the opposite device saves the private key ciphertext in the second key information and the public key in the first key information. In this way, according to the first key information generated by the local device SE and the second key information generated by the opposite device SE, the current data to be sent is encrypted, and the corresponding current encrypted data may include: according to the private key ciphertext in the saved first key information, through the corresponding SE, the signature information corresponding to the current data to be sent is obtained; according to the public key and signature information in the saved second key information, the current encrypted data corresponding to the current data to be sent is obtained.

[0070] The local device can send the private key ciphertext in the saved first key information and the current data to be sent to SE for signing through the key library function API, obtain the corresponding signature information from SE, and then encrypt the signature information according to the public key in the saved second key information to obtain the corresponding current encrypted data.

[0071] Step 203: Send the current encrypted data to the peer device through the current transmission channel, so that the peer device decrypts the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

[0072] According to the current transmission channel determined in step 201, the local device sends the current encrypted data to the opposite device, so that the opposite device decrypts the current encrypted data to obtain corresponding received data.

[0073] Since the private key ciphertext in the second key information and the public key in the first key information are stored in the peer device, in some embodiments, decrypting the current encrypted data includes: decrypting the current encrypted data through the corresponding SE according to the private key ciphertext in the stored second key information to obtain the corresponding current decrypted data; verifying the current decrypted data according to the public key in the stored first private key information, and determining the current decrypted data as received data after the verification is passed.

[0074] The peer device can use the key store function API to send the private key ciphertext in the saved second key information and the current encrypted data to the SE for decryption, and obtain the corresponding current decrypted data from the SE. Then, the current decrypted data is verified based on the public key in the saved first private key information. In this way, if it is determined that the data has not been tampered with, it can be determined that the verification has passed, and the current decrypted data can be determined as the received data, thereby realizing the transmission of data between devices.

[0075] It can be seen that in the disclosed embodiment, each device has an independent encryption unit SE. Before data transmission, each device generates key information in its own SE, and the key information at both ends of the data transmission needs to be mutually authenticated. In this way, during the data transmission process, the data to be sent is encrypted by the mutually authenticated key information and then transmitted, and the corresponding data is obtained only after the data is received and decrypted by the mutually authenticated key information, so as to realize data transmission between devices. Since the private key can only be processed in the SE, the private key cannot be extracted even after the device Root is processed, which ensures that the private key will not be stolen, reduces the risk of data leakage caused by the key being stolen, and improves the security of data transmission between devices. In addition, when the system is tampered with and the previously generated key pair cannot be used, the trust root in the public key certificate of the newly generated key pair in the SE will change, which ensures the security of the key pair and further improves the reliability and security of data transmission between devices. In addition, when SE generates key information, it needs to obtain the corresponding key generation random number, that is, user authentication is required. Only after user authentication can the newly generated key information be used, ensuring that data transmission is carried out with user permission. When the device is stolen, data transmission cannot be carried out if the user is not authenticated, further improving the security of data transmission between devices.

[0076] The operation flow is summarized into a specific embodiment below to illustrate the process of data transmission between devices provided by the embodiment of the present invention.

[0077] In one embodiment of the present disclosure, Figure 1 As shown, the first device 100 and the second device 200 can be devices using the Android operating system, and each device has a corresponding SE unit, that is, the first device 100 and the second device 200 can be Android devices that support the hardware key library of SE, and can use the Android hardware key library framework to generate key information for data transmission in their respective SEs and perform mutual authentication, such as Figure 3 As shown, the process of generating and authenticating key information between devices includes:

[0078] Step 301: The first device and the second device are brought close to each other and corresponding NFC connections are activated respectively.

[0079] In this way, both devices can be in the RFST_POLL_ACTIVE state of the NCI specification, and data transmission can begin between the two devices.

[0080] Step 302: The first device and the second device respectively start the SE function.

[0081] In this embodiment, the SE function may be responsible for using the Android hardware keystore framework to generate key pairs in the SE, perform key authentication, sign and encrypt and decrypt data, etc.

[0082] Step 303: The first device receives a data transmission request sent by a user.

[0083] The first device transmits the data transmission request to the SE, and the SE may perform key information generation authentication preparation.

[0084] Step 304: The first device generates a first key to generate a random number challenge, and sends it to the second device via the NFC communication connection.

[0085] Step 305: After receiving the first challenge, the second device sends the first challenge to the corresponding SE and obtains second key information from the SE, where the second key information includes: a private key ciphertext and a public key certificate chain.

[0086] The public key certificate chain is a certificate chain that has been authenticated by the set server. The root certificate is issued by the set platform and contains a public key and authentication extension data. The authentication extension data includes challenge, security level, and trust root information, etc.

[0087] Step 306: The second device saves the private key ciphertext in the second key information, and sends the public key certificate chain in the second key information to the first device via the NFC communication connection.

[0088] Step 307: The first device verifies the public key certificate chain in the received second key information according to the first challenge.

[0089] Step 308: When it is determined that the verification is successful, the first device saves the public key in the public key certificate chain.

[0090] The first device can check the validity of each certificate in the public key certificate chain and whether it has expired; check whether each certificate is signed by the private key corresponding to the superior certificate; check whether the root certificate public key is the public key issued by the setting platform; check the authentication extension data, whether the challenge is the same as the first challenge generated and sent by the first device, whether the security level is SE, and determine whether the device has not been tampered with based on the device lock status, device startup status and other information in the trusted root information. If all the above checks are in line with expectations, it means that the key information pair generated by the peer device is generated by SE, and it can be determined that the verification is passed, and the first device can save the public key in the second key information.

[0091] Step 309: The first device sends verification success information to the second device via NFC communication connection.

[0092] Step 310: After receiving the verification success information, the second device generates a second key to generate a random number challenge, and sends it to the first device via the NFC communication connection.

[0093] Step 311: The first device sends the received second challenge to the corresponding SE, and obtains first key information from the SE, where the first key information includes: a private key ciphertext and a public key certificate chain.

[0094] Step 312: The first device saves the private key ciphertext in the first key information, and sends the public key certificate chain in the first key information to the second device via the NFC communication connection.

[0095] Step 313: The second device verifies the public key certificate chain in the received first key information according to the second challenge.

[0096] Step 314: When it is determined that the verification is successful, the second device saves the public key in the public key certificate chain.

[0097] Step 315: The second device sends verification success information to the first device via NFC communication connection.

[0098] In this way, each device has an independent encryption unit SE. When data is transmitted, each device generates key information in its own SE, and the key information generation authentication process between the first device and the second device is completed, wherein the first device stores the private key ciphertext in the first key information and the public key in the second key information, and the second device stores the private key ciphertext in the second key information and the public key in the first key information. Figure 1 , Figure 3 , Figure 4 , the process of data transmission between devices is as follows:

[0099] Step 401: The first device determines current data characteristic information of data to be sent, wherein the data characteristic information includes: one or more of data size, data service type, data service function, etc.

[0100] Step 402: The first device determines a current transmission channel that matches current data feature information and device information.

[0101] That is, during the data transmission process, the first device may be in contact with the second device, or may not be in contact with the second device, and there is a certain distance between them. In this way, the corresponding current transmission channel can be determined based on the current data feature information, the distance between the devices, and other information. The current transmission channel includes: NFC, Bluetooth, ZigBee, or WIFI direct connection and other channels.

[0102] Step 403: The first device obtains signature information corresponding to the current data to be sent through the corresponding SE according to the private key ciphertext in the stored first key information.

[0103] The first device can call the Android key store function API with the private key ciphertext in the saved first key information and the current data to be sent, send them to the SE for signing, and then obtain the corresponding signature information from the SE.

[0104] Step 404: The first device obtains current encrypted data corresponding to the data to be sent according to the public key and signature information in the stored second key information.

[0105] The first device may encrypt the signature information according to the public key in the stored second key information to obtain the corresponding current encrypted data.

[0106] Step 405: The first device sends the current encrypted data to the second device through the current transmission channel.

[0107] Step 406: The second device decrypts the current encrypted data through the corresponding SE according to the private key ciphertext in the stored second key information to obtain the corresponding current decrypted data.

[0108] The second standby can call the Android key store function API, send the private key ciphertext in the stored second key information and the current encrypted data to the SE for decryption, and obtain the corresponding current decrypted data from the SE.

[0109] Step 407: The second device verifies the current decrypted data according to the public key in the stored first private key information, and after the verification is passed, determines the current decrypted data as received data.

[0110] It can be seen that in this embodiment, after the key information between the first device and the second device is successfully authenticated, during the data transmission process, the data to be sent is encrypted and transmitted through the mutually authenticated key information, and the corresponding data is obtained only after the data is received and decrypted through the mutually authenticated key information, so as to realize the data transmission between the devices. Since the private key can only be processed in the SE, the private key cannot be extracted even after the device Root is processed, which ensures that the private key will not be stolen, reduces the risk of data leakage caused by the key being stolen, and improves the security of data transmission between devices. In addition, when the system is tampered with, the previously generated key pair cannot be used, and the trust root in the public key certificate of the newly generated key pair in the SE will change, which ensures the security of the key pair, and further improves the reliability and security of data transmission between devices. In addition, when the SE generates the key information, it needs to obtain the corresponding key generation random number, that is, user authentication is required. Only after the user authentication, the newly generated key information can be used, which ensures that the data transmission is carried out with the user's permission. When the device is stolen, if the user does not authenticate, the data transmission cannot be carried out, which further improves the security of data transmission between devices.

[0111] According to the above process for data transmission between devices, an apparatus for data transmission between devices can be constructed.

[0112] Combination Figure 1 , Figure 5 , the embodiment of the present disclosure provides an apparatus for data transmission between devices. It can be applied to a first device or a second device, such as Figure 5 As shown, the device includes: a determination module 510, an encryption module 520, and a transmission module 530.

[0113] The determination module 510 is configured to determine a current transmission channel between two devices that matches the data to be sent.

[0114] The encryption module 520 is configured to encrypt the current data to be sent according to the first key information generated by the local device SE and the second key information generated by the opposite device SE to obtain the corresponding current encrypted data.

[0115] The transmission module 530 is configured to send the current encrypted data to the opposite device through the current transmission channel, so that the opposite device decrypts the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

[0116] In some embodiments, the apparatus further comprises:

[0117] The key acquisition module is configured to obtain key information including private key ciphertext and public key certificate chain from the corresponding encryption unit SE when receiving the key generation random number sent by the opposite device, wherein the public key certificate chain includes: public key and authentication extension data carrying the key generation random number.

[0118] The first key storage module is configured to store the private key ciphertext in the key information generated by the SE.

[0119] The first sending module is configured to send the public key certificate chain to the peer device through the established set communication connection.

[0120] In some embodiments, the apparatus further comprises:

[0121] The key authentication module is configured to generate a random number based on the key sent to the peer device when receiving the public key certificate chain, and verify the public key certificate chain.

[0122] The second key storage module is configured to store the public key in the received public key certificate chain when it is determined that the verification is successful.

[0123] The second sending module is configured to send verification success information to the opposite device through the established set communication connection when it is determined that the verification is successful.

[0124] In some embodiments, it also includes:

[0125] The generation and sending module is configured to generate a key generation random number upon receiving a user data transmission request and send it to the opposite device with which a set communication connection has been established; or, upon receiving a verification success message, generate a key generation random number and send it to the opposite device with which a set communication connection has been established.

[0126] In some embodiments, it also includes:

[0127] The pairing start module is configured to establish an NFC communication connection with the peer device and start the SE function.

[0128] In some embodiments, the determination module 510 is specifically configured to determine current data characteristic information of the data to be sent, wherein the data characteristic information includes: one or more of: data size, data service type, data service function, etc.; determine the current transmission channel that matches the current data characteristic information and device information, wherein the current transmission channel includes: NFC, Bluetooth or WIFI direct connection and other channels.

[0129] In some embodiments, the encryption module 510 is specifically configured to obtain signature information corresponding to the data to be sent according to the private key ciphertext in the saved first key information through the corresponding SE; and to obtain current encrypted data corresponding to the data to be sent according to the public key and signature information in the saved second key information.

[0130] In some embodiments, it also includes: a decryption module, which is configured to decrypt the current encrypted data through the corresponding SE according to the private key ciphertext in the saved second key information to obtain the corresponding current decrypted data; verify the current decrypted data according to the public key in the saved first private key information, and after the verification is passed, determine the current decrypted data as the received data.

[0131] It can be seen that in this embodiment, each device has an independent encryption unit SE. Before data transmission, the device used for data transmission between devices can generate key information through the corresponding SE and mutually authenticate with the key information of the opposite device. In this way, during the data transmission process, the device used for data transmission between devices encrypts the data to be sent through the mutually authenticated key information and then transmits it. Moreover, the corresponding data is obtained only after the data received through the mutually authenticated key information is decrypted, thereby realizing data transmission between devices. Since the private key can only be processed in the SE, the private key cannot be extracted even after the device Root is processed, ensuring that the private key will not be stolen, reducing the risk of data leakage caused by the key being stolen, and improving the security of data transmission between devices. In addition, when the system is tampered with and the previously generated key pair cannot be used, the trust root in the public key certificate of the newly generated key pair in the SE will change, ensuring the security of the key pair, and further improving the reliability and security of data transmission between devices.

[0132] According to the above process for data transmission between devices, a system for data transmission between devices can be constructed, combined with Figure 3 , Figure 4 ,like Figure 1 As shown, the system for data transmission between devices includes: a first device 100 and a second device 200, and each device has a corresponding SE unit.

[0133] The first device 100 is configured to determine the current transmission channel between two devices that match the data to be currently sent; encrypt the data to be currently sent according to the first key information generated by the first device SE and the second key information generated by the second device SE to obtain the corresponding current encrypted data, and send the current encrypted data to the second device through the current transmission channel.

[0134] The second device 200 is configured to decrypt the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

[0135] In some embodiments, the first device 100 or the second device 200 is also configured to obtain key information including a private key ciphertext and a public key certificate chain from the corresponding encryption unit SE when receiving a key generation random number sent by the peer device, wherein the public key certificate chain includes: a public key, authentication extension data carrying the key generation random number; save the private key ciphertext, and send the public key certificate chain to the peer device through an established set communication connection.

[0136] In some embodiments, the first device 100 or the second device 200 is also configured to, upon receiving the public key certificate chain, generate a random number based on the key sent to the peer device and verify the public key certificate chain; when it is determined that the verification is successful, save the public key in the public key certificate chain and send verification success information to the peer device through the established set communication connection.

[0137] In some embodiments, the first device 100 or the second device 200 is also configured to generate a key generation random number upon receiving a user data transmission request, and send it to a peer device with which a set communication connection has been established; or, upon receiving a verification success message, generate a key generation random number, and send it to a peer device with which a set communication connection has been established.

[0138] In some embodiments, the first device 100 or the second device 200 is further configured to establish an NFC communication connection with the counterpart device and activate the SE function.

[0139] In some embodiments, the first device 100 is specifically configured to determine current data characteristic information of the data to be sent, wherein the data characteristic information includes: one or more of: data size, data service type, data service function, etc.; determine the current transmission channel that matches the current data characteristic information and device information, wherein the current transmission channel includes: NFC, Bluetooth or WIFI direct connection and other channels.

[0140] In some embodiments, the first device 100 is specifically configured to obtain signature information corresponding to the data to be sent through the corresponding SE based on the private key ciphertext in the saved first key information; and to obtain current encrypted data corresponding to the data to be sent based on the public key and signature information in the saved second key information.

[0141] In some embodiments, the second device 200 is specifically configured to decrypt the current encrypted data through the corresponding SE according to the private key ciphertext in the saved second key information to obtain the corresponding current decrypted data; verify the current decrypted data according to the public key in the saved first private key information, and after the verification is passed, determine the current decrypted data as the received data.

[0142] It can be seen that in this embodiment, in the system for data transmission between devices, the first device and the second device can generate key information through the corresponding SE and authenticate each other with the key information. In this way, during the data transmission process, the first device can encrypt the data to be sent with the mutually authenticated key information and then transmit it, and the second device receives the data through the mutually authenticated key information and decrypts it before obtaining the corresponding data, thereby realizing data transmission between devices. Since the private key can only be processed in the SE, the private key cannot be extracted even after the device Root processes it, ensuring that the private key will not be stolen, reducing the risk of data leakage caused by the key being stolen, and improving the security of data transmission between devices. In addition, when the system is tampered with and the previously generated key pair cannot be used, the trust root in the public key certificate of the newly generated key pair in the SE will change, ensuring the security of the key pair, and further improving the reliability and security of data transmission between devices.

[0143] Combination Figure 6 As shown, the embodiment of the present disclosure provides an apparatus 600 for inter-device data transmission, including:

[0144] The processor 1000 and the memory 1001 may also include a communication interface 1002 and a bus 1003. The processor 1000, the communication interface 1002, and the memory 1001 may communicate with each other through the bus 1003. The communication interface 1002 may be used for information transmission. The processor 1000 may call the logic instructions in the memory 1001 to execute the method for device data storage of the above embodiment.

[0145] In addition, the logic instructions in the above-mentioned memory 1001 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0146] The memory 1001 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the methods in the embodiments of the present disclosure. The processor 1000 executes functional applications and data processing by running the program instructions / modules stored in the memory 1001, that is, implements the method for data transmission between devices in the above method embodiments.

[0147] The memory 1001 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 1001 may include a high-speed random access memory and may also include a non-volatile memory.

[0148] Therefore, combined with Figure 7 The embodiment of the present disclosure provides an electronic device 700, including: a processor 1000, a memory 1001 storing program instructions, and also including: an SE unit 701; the processor 1000 can be connected to the memory 1001 and the SE unit 701 respectively through a bus, and the processor is configured to execute the above-mentioned method for data transmission between devices when running the program instructions.

[0149] An embodiment of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to execute the above-mentioned method for data transmission between devices.

[0150] The above-mentioned storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0151] An embodiment of the present disclosure provides a computer program product, which includes a computer program stored on a storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned method for data transmission between devices.

[0152] Combination Figure 8 The embodiment of the present disclosure provides a device, including: a device body 800 including an SE unit, a device 500 (600) for data transmission between devices is installed on the device body, wherein the installation relationship described here is not limited to placement inside the product, but also includes installation connection with other components of the product, including but not limited to physical connection, electrical connection or signal transmission connection, etc. It can be understood by those skilled in the art that the device 500 (600) for data transmission between devices can be adapted to a feasible device body, thereby realizing other feasible embodiments.

[0153] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes.

[0154] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of listings containing one or more associated ones. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0155] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0156] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0157] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A method for data transmission between devices, characterized in that: Each device is provided with an independent encryption unit SE, and the method comprises: Determine the current transmission channel between two devices that matches the data currently to be sent; Encrypt the current data to be sent according to the first key information generated by the local device SE and the second key information generated by the opposite device SE to obtain the corresponding current encrypted data; The current encrypted data is sent to the opposite device through the current transmission channel, so that the opposite device decrypts the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

2. The method according to claim 1, characterized in that Also includes: When receiving the random number for key generation sent by the peer device, obtain key information including private key ciphertext and public key certificate chain from the corresponding encryption unit SE, wherein the public key certificate chain includes: a public key and authentication extension data carrying the random number for key generation; Save the private key ciphertext and send the public key certificate chain to the peer device through the established communication connection.

3. The method according to claim 2, characterized in that Also includes: When a public key certificate chain is received, a random number is generated based on the key sent to the peer device to verify the public key certificate chain; When the verification is confirmed to be successful, the public key in the public key certificate chain is saved, and a verification success message is sent to the peer device through the established communication connection.

4. The method according to claim 3, characterized in that The sending of a random number for key generation to a peer device includes: Upon receiving a user data transmission request, generating a key generating random number and sending it to the peer device with which the communication connection has been established; or, When the verification success message is received, a key is generated to generate a random number, and the random number is sent to the peer device with which the communication connection has been established.

5. The method according to any one of claims 2 to 4, characterized in that: Also includes: Establish an NFC communication connection with the peer device and start the SE function.

6. The method according to claim 1, characterized in that Determining the current transmission channel that matches the current data to be sent includes: Determine current data characteristic information of the data to be sent, wherein the data characteristic information includes: one or more of data size, data service type, data service function, etc.; Determine a current transmission channel that matches the current data feature information and device information, where the current transmission channel includes: NFC, Bluetooth, or WIFI direct connection and other channels.

7. The method according to claim 1, characterized in that The encrypting of the current data to be sent includes: According to the private key ciphertext in the saved first key information, the signature information corresponding to the current data to be sent is obtained through the corresponding SE; According to the public key and signature information in the saved second key information, the current encrypted data corresponding to the current data to be sent is obtained.

8. The method according to claim 1, characterized in that Decrypting the current encrypted data includes: According to the private key ciphertext in the stored second key information, the current encrypted data is decrypted through the corresponding SE to obtain the corresponding current decrypted data; The current decrypted data is verified according to the public key in the stored first private key information, and after the verification is passed, the current decrypted data is determined as the received data.

9. A system for data transmission between devices, characterized in that: include: The first device and the second device each have an independent encryption unit SE, wherein: The first device is configured to determine a current transmission channel between two devices that matches the data to be currently sent; encrypt the data to be currently sent according to the first key information generated by the first device SE and the second key information generated by the second device SE to obtain corresponding current encrypted data, and send the current encrypted data to the second device through the current transmission channel; The second device is configured to decrypt the current encrypted data according to the first key information and the second key information to obtain corresponding received data.

10. An electronic device, characterized in that: include: A processor, a memory storing program instructions, and an SE unit; The processor is configured to execute the method for inter-device data transmission according to any one of claims 1 to 8 when running the program instructions.

Images