Network data security protection method and system

Abstract

The invention provides a network data security protection method and system, belongs to the technical field of data security, and aims to improve the transmission security of network data. The method is applied to a terminal in a network, and comprises the following steps: the terminal obtains a command of the network, and the command indicates the terminal to perform an operation including network data transmission with the network; and in response to the command, the terminal performs secure network data transmission with the network by executing the operation, and the secure network data transmission means that a key used by the terminal for decrypting the received network data is different from a key used by the terminal for encrypting the network data to be sent.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a network data security protection method and system. Background Art

[0002] With the rapid development of information technology, data transmission between terminal devices (such as smart phones, tablets, laptops, etc.) and networks (such as the Internet, local area networks, etc.) has become more and more frequent. These data may include various sensitive information such as users' personal information, business secrets, government documents, etc. Therefore, how to ensure the transmission security of these network data and prevent the data from being stolen, tampered with or lost during the transmission process has become an important research topic in the field of information security.

[0003] Data transmission security mainly involves two aspects: one is data confidentiality, that is, preventing unauthorized third parties from obtaining sensitive information of the data; the other is data integrity, that is, ensuring that the data is not tampered with or damaged during transmission. In order to solve these problems, researchers have proposed many methods of data encryption and integrity verification.

[0004] Data encryption is to convert the original data into ciphertext through a certain algorithm. Only those who have the key can decrypt it to get the original data. Common data encryption technologies include symmetric encryption and asymmetric encryption. Symmetric encryption means that the same key is used for encryption and decryption, such as DES, AES, etc.; asymmetric encryption uses a pair of keys, one for encryption and the other for decryption, such as RSA, ECC, etc. Integrity verification is to check whether the data has been tampered with during transmission through a certain algorithm. Common integrity verification methods include hash functions and digital signatures. Hash functions can map data of any length to a value of fixed length. If any change occurs to the data, the hash value will change significantly; digital signatures are an effective means to prevent data tampering. It combines hash functions and asymmetric encryption technology to verify the integrity of data and the identity of the sender. In addition to the above technical means, there are some other security measures to enhance the security of data transmission. For example, using VPN (Virtual Private Network) can establish an encrypted channel on the public network to ensure the security of data during transmission; using SSL / TLS (Secure Sockets Layer / Transport Layer Security) protocol can provide security for data transmission at the application layer; using firewalls and intrusion detection systems can prevent malicious attacks and illegal access.

[0005] In general, data transmission security is a complex issue that requires the comprehensive use of a variety of technical means and strategies to ensure it. With the continuous upgrading of network attack methods and the continuous development of information technology, how to improve the security of data transmission remains a challenging research topic. Summary of the invention

[0006] The embodiments of the present invention provide a network data security protection method and system to improve the transmission security of network data.

[0007] In order to achieve the above object, the present invention adopts the following technical scheme:

[0008] In a first aspect, a network data security protection method is provided, which is applied to a terminal in a network, and the method includes: the terminal obtains a command from the network, and the command instructs the terminal to perform an operation including network data transmission with the network; in response to the command, the terminal performs a secure network data transmission with the network by executing the operation, and the secure network data transmission means that the key used by the terminal to decrypt the received network data is different from the key used by the terminal to encrypt the network data to be sent.

[0009] Optionally, the terminal is an A-IoT terminal, and the network includes a reader in the A-IoT network. The terminal performs secure network data transmission with the network by executing operations, including: when the operation is a read operation, the A-IoT terminal reads first network data from the A-IoT terminal locally, and uses a first key to encrypt the first network data and send it to the reader; or; when the operation is a write operation, the A-IoT terminal receives second network data sent by the reader, and uses a second key to decrypt the second network data and write it to the A-IoT terminal locally.

[0010] Optionally, the first key and the second key have an inverse relationship, and the first key and the second key are stored in a first storage area locally in the A-IoT terminal in the form of data superposition; accordingly, when the operation is a read operation, the method also includes: the A-IoT terminal reads the first storage area in positive order to obtain the first key; or, accordingly, when the operation is a write operation, the method also includes: the A-IoT terminal reads the first storage area in reverse order to obtain the second key.

[0011] Optionally, the first storage area includes a first sub-storage area and a second sub-storage area with discontinuous storage addresses, the storage address segment of the first sub-storage area is the x1th bit to the x2th bit, and the storage address segment of the second sub-storage area is the y1th bit to the y2th bit, x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, and y2 is an integer greater than y1; the A-IoT terminal obtains the first key by reading the first storage area in positive order, including: the A-IoT terminal reads the x1th bit to the x2th bit, and the y1th bit to the y2th bit in sequence, and arranges the read data in the order of reading in sequence to obtain the first key; or, the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: the A-IoT terminal reads the y2th bit to the y1th bit, and the x2th bit to the x1th bit in sequence, and arranges the read data in the order of reading in sequence to obtain the second key.

[0012] Optionally, the first storage area includes a first sub-storage area, a second sub-storage area, and a third sub-storage area with discontinuous storage addresses, the storage address segment of the first sub-storage area is from the x1th bit to the x2th bit, the storage address segment of the second sub-storage area is from the y1th bit to the y2th bit, the storage address segment of the third sub-storage area is from the z1th bit to the z2th bit, x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, y2 is an integer greater than y1, z1 is an integer greater than y2, and z2 is an integer greater than z1; the A-IoT terminal reads the first storage area in positive order The A-IoT terminal sequentially reads the x1th bit to the x2th bit, the y1th bit to the y2th bit, and the z1th bit to the z2th bit, and arranges the read data in the order of sequential reading to obtain the first key; or the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: the A-IoT terminal sequentially reads the y2th bit to the y1th bit, the x2th bit to the x1th bit, and the z1th bit to the z2th bit, and arranges the read data in the order of sequential reading to obtain the second key.

[0013] Optionally, the command is an inventory command, and when the operation is a read operation, the command also indicates the address segment of the area to be read; accordingly, the A-IoT terminal reads the first network data from the local A-IoT terminal, and uses the first key to encrypt the first network data and send it to the reader, including: the A-IoT terminal reads the first network data from the storage area mapped to the address segment of the area to be read in the local A-IoT terminal according to the address segment of the area to be read; the A-IoT terminal encrypts the first network data using the first key, and sends it to the reader together with the EPC of the A-IoT terminal; or, the command is an inventory command, and when the operation is a write operation, the command also includes second network data; accordingly, the A-IoT terminal receives the second network data sent by the reader, and uses the second key to decrypt the second network data and write it to the local A-IoT terminal, including: the A-IoT terminal obtains the second network data from the command; the A-IoT terminal uses the second key to decrypt the second network data and write it to the local A-IoT terminal.

[0014] In a second aspect, a network data security protection method is provided, which is applied to a network, and the method includes: the network sends a command to a terminal in the network, and the command instructs the terminal and the network to perform an operation including network data transmission; when the terminal responds to the command, the network and the terminal perform secure network data transmission, and secure network data transmission means that the key used by the network to decrypt received network data is different from the key used by the network end to encrypt network data to be sent.

[0015] Optionally, the terminal is an environmental Internet of Things A-IoT terminal, the network includes a reader in the A-IoT network, and the network and the terminal perform secure network data transmission, including: when the operation is a read operation, the reader receives the network data read by the A-IoT terminal, and uses a first key to decrypt the network data read by the A-IoT terminal to obtain first network data; or; when the operation is a write operation, the reader uses a second key to encrypt the network data to be written to the A-IoT terminal to obtain second network data, and sends the second network data to the A-IoT terminal.

[0016] Optionally, the first key and the second key have an inverse relationship.

[0017] In a third aspect, a network data security protection system is provided, the system comprising a terminal for executing the method as described in the first aspect, and a network for executing the method as described in the second aspect.

[0018] In a fourth aspect, an electronic device is provided, comprising: a processor and a memory; the memory is used to store a computer program, and when the processor executes the computer program, the electronic device executes the method described in the first aspect.

[0019] In a possible design solution, the electronic device described in the fourth aspect may further include a transceiver. The transceiver may be a transceiver circuit or an interface circuit. The transceiver may be used for the electronic device described in the fourth aspect to communicate with other electronic devices.

[0020] In an embodiment of the present invention, the electronic device described in the fourth aspect may be a terminal, or a chip (system) or other parts or components that may be arranged in the terminal, or a system including the terminal.

[0021] In a fifth aspect, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer executes the method described in the first aspect.

[0022] In summary, when the terminal obtains a command from the network, and the command instructs the terminal to perform an operation including network data transmission with the network, in response to the command, the terminal can perform secure network data transmission with the network by executing the operation. At this time, in this secure network data transmission, the key used by the terminal to decrypt the received network data is different from the key used by the terminal to encrypt the network device to be sent, that is, the keys used for uplink transmission and downlink transmission are different. Compared with the scheme in the prior art that uses the same key for uplink transmission and downlink transmission, even if an attacker steals any one of the keys, the uplink and downlink cannot be completely cracked, which can improve the transmission security of network data. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of the architecture of a network system provided by an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a flow chart of a network data security protection method provided by an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The technical solution of the present invention will be described below in conjunction with the accompanying drawings.

[0027] In the embodiment of the present invention, "indication" may include direct indication and indirect indication, and may also include explicit indication and implicit indication. The information indicated by a certain information is called information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association relationship between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, the indication of specific information can also be achieved by means of the arrangement order of each information agreed in advance (for example, specified by the protocol), thereby reducing the indication overhead to a certain extent. At the same time, the common parts of each information can also be identified and indicated uniformly to reduce the indication overhead caused by indicating the same information separately.

[0028] In addition, the specific indication method may also be various existing indication methods, such as but not limited to the above-mentioned indication methods and various combinations thereof. The specific details of the various indication methods can refer to the prior art and will not be repeated herein. As can be seen from the above, for example, when it is necessary to indicate multiple information of the same type, different indication methods may be used for different information. In the specific implementation process, the desired indication method can be selected according to specific needs. The embodiment of the present invention does not limit the selected indication method. In this way, the indication method involved in the embodiment of the present invention should be understood to cover various methods that can enable the party to be indicated to obtain the information to be indicated.

[0029] It should be understood that the information to be indicated can be sent as a whole or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The specific sending method is not limited in the embodiment of the present invention. Among them, the sending period and / or sending time of these sub-information can be pre-defined, for example, pre-defined according to a protocol, or can be configured by the sending end device by sending configuration information to the receiving end device.

[0030] "Pre-definition" or "pre-configuration" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and the embodiments of the present invention do not limit the specific implementation method. Among them, "saving" can mean saving in one or more memories. The one or more memories can be set separately or integrated in an encoder or decoder, a processor, or an electronic device. The one or more memories can also be partially set separately and partially integrated in a decoder, a processor, or an electronic device. The type of memory can be any form of storage medium, which is not limited by the embodiments of the present invention.

[0031] The "protocol" involved in the embodiments of the present invention may refer to a protocol family in the communication field, a standard protocol with a similar protocol family frame structure, or a related protocol applied in future systems, and the embodiments of the present invention do not specifically limit this.

[0032] In the embodiments of the present invention, descriptions such as "when...", "in the case of...", "if" and "if" all mean that the device will perform corresponding processing under certain objective circumstances, but do not limit the time, nor do they require the device to perform judgment actions when implementing, nor do they mean the existence of other limitations.

[0033] In the description of the embodiments of the present invention, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the embodiments of the present invention is only a kind of association relationship describing the associated objects, indicating that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In addition, in the description of the embodiments of the present invention, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present invention, in the embodiments of the present invention, the words "first" and "second" are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art will appreciate that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. At the same time, in the embodiments of the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0034] The network architecture and business scenarios described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.

[0035] To facilitate understanding of the embodiments of the present invention, first Figure 1 The network system shown in is taken as an example, illustrative, Figure 1 A schematic diagram of the architecture of a network system applicable to a network data security protection method provided in an embodiment of the present invention.

[0036] like Figure 1 As shown, the network system may include: a terminal and a network.

[0037] The terminal may be an ambient IoT (AIoT) terminal, and the network may be an AIoT network, such as a reader in the AIoT network.

[0038] Specifically, A-IoT terminals can be divided into three categories: terminal A, terminal B or terminal C. Terminal A or terminal 1a can be understood as similar to a passive A-IoT terminal. Passive A-IoT terminals can be in the form of tags or any other terminal form without restriction. Terminal B or terminal 1b can be understood as similar to a semi-passive A-IoT terminal. Semi-passive A-IoT terminals can obtain energy through solar energy, radio frequency, wind energy, hydropower or tidal energy, and there is no restriction on the way of obtaining energy. These nodes themselves are not equipped with or rely on power terminals such as batteries, but obtain energy from the environment to support data perception, transmission and distributed computing. Terminal C or terminal 1c can be understood as similar to an active A-IoT terminal. For ease of understanding, A-IoT terminals and tags can be interchanged in expression.

[0039] AIoT terminal can be a terminal with transceiver function, or a chip or chip system that can be set in the terminal. The terminal can also be called user equipment (UE), access terminal, subscriber unit, user station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The terminal in the embodiments of the present application can be a mobile phone, a cellular phone, a smart phone, a tablet computer, a wireless data card, a personal digital assistant (PDA), a wireless modem, a handset, a laptop computer, a machine type communication (MTC) terminal, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, a vehicle-mounted terminal, a road side unit (RSU) with terminal function, etc. The terminal of the present application may also be a vehicle-mounted module, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into a vehicle as one or more components or units. Alternatively, the terminal may also be customer-premises equipment (CPE).

[0040] The reader can be a radio access network (RAN) device, such as a base station, pole station, micro base station, macro station, etc., or the reader can also be a terminal device, such as a mobile phone, IoT device, handheld reader and other devices. The reader can perform non-contact two-way data communication through wireless radio frequency, and read and write tags using wireless radio frequency, so as to achieve the purpose of identifying targets and exchanging data. For example, for passive tags, when they enter the effective identification range of the reader, they can receive the radio frequency signal emitted by the reader, and use the energy obtained by the induced current to emit the information stored in the chip, or, for semi-passive tags or active tags, they can actively send a signal of a certain frequency, and the reader receives and decodes the information and sends it to the central information system for relevant data processing.

[0041] Figure 2 A flowchart of a method provided by an embodiment of the present invention. This network data security protection method is applicable to the above network system and involves the interaction between devices in the above network system. The specific process is as follows:

[0042] S201, the network sends a command to a terminal in the network, and the terminal obtains the command from the network.

[0043] The command instructs the terminal to perform operations with the network including network data transmission.

[0044] Taking the terminal as an AIoT terminal and the network as a reader in the AIoT network as an example, in the AIoT scenario, the command can be an inventory command, which is used to instruct the AIoT terminal to report its own device identification, such as the electronic product identifier (EPC) of the AIoT terminal reported subsequently. The inventory command may include information indicating the operation, such as information indicating a read operation, indicating that the above operation is a read operation, or information indicating a write operation, indicating that the above operation is a write operation. In the case of a write operation, the command (or inventory command) also includes data that needs to be written to the AIoT terminal to achieve fast reading or writing of data. In the case of a read operation, the command also indicates the address segment of the area to be read, such as the 41st bit to the 88th bit of the storage area of ​​the AIoT terminal.

[0045] S202, in response to the command, the terminal performs secure network data transmission with the network by executing an operation, and correspondingly, when the terminal responds to the command, the network and the terminal perform secure network data transmission.

[0046] For a terminal, secure network data transmission means that the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt the network device to be sent.

[0047] When the operation is a read operation, the A-IoT terminal reads the first network data from the local A-IoT terminal, encrypts the first network data using the first key and sends it to the reader; or; when the operation is a write operation, the A-IoT terminal receives the second network data sent by the reader, decrypts the second network data using the second key and writes it to the local A-IoT terminal.

[0048] Among them, there is an inverse relationship between the first key and the second key, and the first key and the second key are stored in the first storage area of ​​the A-IoT terminal in the form of data superposition. In other words, due to the limited performance of the A-IoT terminal and considering the energy consumption problem, if the A-IoT terminal maintains two keys separately, such as the first key and the second key, on the one hand, the performance of the A-IoT terminal may not support this operation, and on the other hand, it will increase the overhead, which is not conducive to energy saving. Therefore, the embodiment of the present application considers designing the first key and the second key as keys with a mutually inverse relationship, and both are stored in the same area, that is, it can be understood as using the same data to realize two keys, which is described in detail below.

[0049] For example, when the operation is a read operation, if the A-IoT terminal receives a command, in response to the command, the A-IoT terminal reads the first storage area in a positive sequence to obtain the first key.

[0050] Mode 1: The first storage area includes a first sub-storage area and a second sub-storage area with discontinuous storage addresses, the storage address segment of the first sub-storage area is from the x1th bit to the x2th bit, the storage address segment of the second sub-storage area is from the y1th bit to the y2th bit, x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, and y2 is an integer greater than y1. The A-IoT terminal reads from the x1th bit to the x2th bit, and from the y1th bit to the y2th bit in sequence, and arranges the read data in the order in which they are read in sequence to obtain the first key.

[0051] For example, taking x1=1, x2=5, y1=11, y2=15 as an example, for the first sub-storage area, the A-IoT terminal reads the data stored in the first bit of the storage area as 0, the data stored in the second bit as 1, the data stored in the third bit as 1, the data stored in the fourth bit as 0, and the data stored in the fifth bit as 1, then the read data is arranged in the order of reading, that is, 01101, for the second sub-storage area, the A-IoT terminal reads the data stored in the 11th bit of the storage area as 1, the data stored in the 12th bit as 1, the data stored in the 13th bit as 0, the data stored in the 14th bit as 0, and the data stored in the 15th bit as 0, then the read data is arranged in the order of reading, that is, 11000, and the overall arrangement in order is 0110111000, and 0110111000 is the hashed bit string, that is, the first key.

[0052] It can be understood that the discontinuous storage addresses of the first sub-storage area and the second sub-storage area can also realize distributed storage, further improving data security.

[0053] Method 2: The first storage area includes a first sub-storage area, a second sub-storage area, and a third sub-storage area with discontinuous storage addresses. The storage address segment of the first sub-storage area is from the x1th bit to the x2th bit, the storage address segment of the second sub-storage area is from the y1th bit to the y2th bit, and the storage address segment of the third sub-storage area is from the z1th bit to the z2th bit, x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, y2 is an integer greater than y1, z1 is an integer greater than y2, and z2 is an integer greater than z1. The A-IoT terminal reads the x1th bit to the x2th bit, the y1th bit to the y2th bit, and the z1th bit to the z2th bit in sequence, and arranges the read data in the order of sequential reading to obtain the first key. Its implementation is similar to the above-mentioned method 1, which can be referred to for understanding and will not be repeated here.

[0054] Or, for another example, in the case where the operation is a write operation, if the A-IoT terminal receives a command, in response to the command, the A-IoT terminal obtains the second key by reading the first storage area in reverse order.

[0055] Continue with method 1 above:

[0056] The A-IoT terminal reads the y2th bit to the y1th bit and the x2th bit to the x1th bit in sequence, and arranges the read data in the order in which they are read in sequence to obtain a second key.

[0057] For example, still taking x1=1, x2=5, y1=11, y2=15 as an example, for the second sub-storage area, the A-IoT terminal reads the data stored in the 15th bit of the storage area as 0, the data stored in the 14th bit as 0, the data stored in the 13th bit as 0, the data stored in the 12th bit as 1, and the data stored in the 11th bit as 1. Then the read data is arranged in the order of reading, which is 00011. For the first sub-storage area, the A-IoT terminal reads the data stored in the 5th bit of the storage area as 1, the data stored in the 4th bit as 0, the data stored in the 3rd bit as 1, the data stored in the 2nd bit as 1, and the data stored in the 1st bit as 0. Then the read data is arranged in the order of reading, which is 10110. The overall arrangement in order is 00011110110, and 00011110110 is the hashed bit string, that is, the second key.

[0058] It can be seen that 0110111000 is represented by 00011110110 in reverse. In other words, by utilizing the data stored in the same area, different keys can be obtained by changing the reading order. For A-IoT terminals, not only does it basically not increase the overhead, but it also improves the security of data transmission.

[0059] Continue with method 2 above:

[0060] The A-IoT terminal reads the y2th bit to the y1th bit, the x2th bit to the x1th bit, and the z1th bit to the z2th bit in sequence, and arranges the read data in the order of sequential reading to obtain the second key. That is to say, unlike the read operation in the above method 2, the reverse order of the write operation is not a complete reverse read, but a mostly reverse read and a small part sequential read. This combination method can further improve security. Of course, the principle of data sorting is similar to the read operation in the above method 2, which can be used as a reference for understanding and will not be repeated here.

[0061] Furthermore, in the case where the operation is a read operation, the A-IoT terminal can read the first network data from the storage area mapped by the address segment of the read area in the local A-IoT terminal (such as the storage area) according to the address segment of the read area indicated by the command, such as the 48 bits of data contained in the 41st to 88th bits mentioned above are the first network device; the A-IoT terminal encrypts the first network data with the first key and sends it to the reader along with the EPC of the A-IoT terminal. Alternatively, the command is an inventory command, and in the case where the operation is a write operation, the A-IoT terminal can obtain the second network data from the command; the A-IoT terminal decrypts the second network data with the second key and writes it to the local A-IoT terminal.

[0062] For a network, secure network data transmission means that the key used by the network device to decrypt the received network data is different from the key used by the network device to encrypt the network data to be sent.

[0063] Specifically, the reader is also pre-configured with the above-mentioned first key and second key, that is, the first key and the second key have an inverse relationship, and the understanding of the first key and the second key is consistent with that of the A-IoT terminal. Accordingly, in the case of a read operation, the reader receives the network data read by the A-IoT terminal, and uses the first key to decrypt the network data read by the A-IoT terminal to obtain the first network data. Or; in the case of a write operation, the reader uses the second key to encrypt the network data to be written to the A-IoT terminal, obtain the second network data, and send the second network data to the A-IoT terminal.

[0064] In summary, when the terminal obtains a command from the network, and the command instructs the terminal to perform an operation including network data transmission with the network, in response to the command, the terminal can perform secure network data transmission with the network by executing the operation. At this time, in this secure network data transmission, the key used by the terminal to decrypt the received network data is different from the key used by the terminal to encrypt the network device to be sent, that is, the keys used for uplink transmission and downlink transmission are different. Compared with the scheme in the prior art that uses the same key for uplink transmission and downlink transmission, even if an attacker steals any one of the keys, the uplink and downlink cannot be completely cracked, which can improve the transmission security of network data.

[0065] Figure 3 The electronic device provided in the embodiment of the present invention is a schematic diagram of the structure of the electronic device. For example, the electronic device may be a network device, or a chip (system) or other components or assemblies that can be set in the network device. Figure 3 As shown, the electronic device 400 may include a processor 401. Optionally, the electronic device 400 may further include a memory 402 and / or a transceiver 403. The processor 401 is coupled with the memory 402 and the transceiver 403, such as being connected via a communication bus.

[0066] Combine the following Figure 3 The components of the electronic device 400 are described in detail:

[0067] The processor 401 is the control center of the electronic device 400, and may be a processor or a general term for multiple processing elements. For example, the processor 401 is one or more central processing units (CPUs), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (FPGAs).

[0068] Optionally, the processor 401 can execute various functions of the electronic device 400 by running or executing the software program stored in the memory 402 and calling the data stored in the memory 402, such as executing the above Figure 2 A network data security protection method is shown.

[0069] In a specific implementation, as an embodiment, the processor 401 may include one or more CPUs, such as Figure 3 CPU0 and CPU1 are shown in FIG.

[0070] In a specific implementation, as an embodiment, the electronic device 400 may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0071] The memory 402 is used to store the software program for executing the solution of the present invention, and the execution is controlled by the processor 401. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0072] Optionally, the memory 402 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 402 may be integrated with the processor 401, or may exist independently and access the computer through the interface circuit ( Figure 3 (not shown) is coupled to the processor 401, which is not specifically limited in this embodiment of the present invention.

[0073] The transceiver 403 is used for communication with other electronic devices. For example, if the electronic device 400 is a terminal, the transceiver 403 can be used to communicate with a network device, or with another terminal device. For another example, if the electronic device 400 is a network device, the transceiver 403 can be used to communicate with a terminal, or with another network device.

[0074] Optionally, the transceiver 403 may include a receiver and a transmitter ( Figure 3 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0075] Optionally, the transceiver 403 may be integrated with the processor 401, or may exist independently and communicate with the electronic device 400 through an interface circuit ( Figure 3 (not shown) is coupled to the processor 401, which is not specifically limited in this embodiment of the present invention.

[0076] Understandably, Figure 3 The structure of the electronic device 400 shown in the figure does not constitute a limitation on the electronic device, and the actual electronic device may include more or fewer components than those shown in the figure, or combine certain components, or arrange the components differently.

[0077] In addition, the technical effects of the electronic device 400 can refer to the technical effects of the methods described in the above method embodiments, which will not be repeated here.

[0078] It should be understood that the processor in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0079] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DRRAM).

[0080] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0081] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0082] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0083] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0084] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0085] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0086] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0087] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0088] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0089] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0090] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A network data security protection method, characterized in that: The method is applied to a terminal in a network, and the method comprises: The terminal obtains a command from the network, the command instructing the terminal to perform an operation including network data transmission with the network; In response to the command, the terminal performs secure network data transmission with the network by executing the operation, wherein the secure network data transmission means that the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt network data to be sent.

2. The method according to claim 1, characterized in that The terminal is an A-IoT terminal, the network includes a reader in the A-IoT network, and the terminal performs secure network data transmission with the network by performing the operation, including: In the case where the operation is a read operation, the A-IoT terminal reads the first network data locally from the A-IoT terminal, encrypts the first network data using a first key, and sends the encrypted data to the reader; or; When the operation is a write operation, the A-IoT terminal receives the second network data sent by the reader, and uses the second key to decrypt the second network data and write it locally to the A-IoT terminal.

3. The method according to claim 2, characterized in that There is an inverse relationship between the first key and the second key, and the first key and the second key are stored in a first storage area of ​​the A-IoT terminal in the form of data superposition; Accordingly, when the operation is a read operation, the method further includes: The A-IoT terminal obtains the first key by reading the first storage area in positive order; Alternatively, correspondingly, when the operation is a write operation, the method further includes: The A-IoT terminal obtains the second key by reading the first storage area in reverse order.

4. The method according to claim 3, characterized in that The first storage area includes a first sub-storage area and a second sub-storage area with discontinuous storage addresses, the storage address segment of the first sub-storage area is from the x1th bit to the x2th bit, the storage address segment of the second sub-storage area is from the y1th bit to the y2th bit, x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, and y2 is an integer greater than y1; The A-IoT terminal reads the first storage area in positive order to obtain the first key, including: The A-IoT terminal sequentially reads the x1th bit to the x2th bit, and the y1th bit to the y2th bit, and arranges the read data in the order of sequential reading to obtain the first key; Alternatively, the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: The A-IoT terminal sequentially reads the y2th bit to the y1th bit, and the x2th bit to the x1th bit, and arranges the read data in the order of sequential reading to obtain the second key.

5. The method according to claim 3, characterized in that: The first storage area includes a first sub-storage area, a second sub-storage area, and a third sub-storage area with discontinuous storage addresses, the storage address segment of the first sub-storage area is from the x1th bit to the x2th bit, the storage address segment of the second sub-storage area is from the y1th bit to the y2th bit, the storage address segment of the third sub-storage area is from the z1th bit to the z2th bit, x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, y2 is an integer greater than y1, z1 is an integer greater than y2, and z2 is an integer greater than z1; The A-IoT terminal reads the first storage area in positive order to obtain the first key, including: The A-IoT terminal sequentially reads the x1th bit to the x2th bit, the y1th bit to the y2th bit, and the z1th bit to the z2th bit, and arranges the read data in the order of sequential reading to obtain the first key; Alternatively, the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: The A-IoT terminal sequentially reads the y2th bit to the y1th bit, the x2th bit to the x1th bit, and the z1th bit to the z2th bit, and arranges the read data in the order of sequential reading to obtain the second key.

6. The method according to any one of claims 2 to 4, characterized in that: The command is an inventory command, and when the operation is a read operation, the command further indicates an address segment of the read area; accordingly, the A-IoT terminal reads the first network data locally from the A-IoT terminal, and encrypts the first network data using a first key and sends the encrypted data to the reader, including: The A-IoT terminal reads the first network data from a storage area mapped to the address segment of the read area in the local A-IoT terminal according to the address segment of the read area; The A-IoT terminal encrypts the first network data using the first key and sends the encrypted data to the reader together with the EPC of the A-IoT terminal; Alternatively, the command is an inventory command, and when the operation is a write operation, the command also includes the second network data; accordingly, the A-IoT terminal receives the second network data sent by the reader, and uses the second key to decrypt the second network data and write it to the A-IoT terminal locally, including: The A-IoT terminal obtains the second network data from the command; The A-IoT terminal uses the second key to decrypt the second network data and writes the decrypted data to the A-IoT terminal locally.

7. A network data security protection method, characterized in that: The method is applied to a network, and the method comprises: The network sends a command to a terminal in the network, the command instructing the terminal to perform an operation including network data transmission with the network; When the terminal responds to the command, the network and the terminal perform secure network data transmission, wherein the secure network data transmission means that a key used by the network to decrypt received network data is different from a key used by the network to encrypt network data to be sent.

8. The method according to claim 7, characterized in that The terminal is an A-IoT terminal, the network includes a reader in the A-IoT network, and the network performs secure network data transmission with the terminal, including: In the case where the operation is a read operation, the reader receives the network data read by the A-IoT terminal, and decrypts the network data read by the A-IoT terminal using the first key to obtain the first network data; or; When the operation is a write operation, the reader uses the second key to encrypt the network data to be written to the A-IoT terminal, obtains second network data, and sends the second network data to the A-IoT terminal.

9. The method according to claim 8, characterized in that The first key and the second key have an inverse relationship.

10. A network data security protection system, characterized in that: The system comprises a terminal for executing the method according to any one of claims 1 to 6, and a network for executing the method according to any one of claims 7 to 9.

Images