A network data security protection method and system

Abstract

This invention provides a network data security protection method and system, belonging to the field of data security technology, to improve the security of network data transmission. The method is applied to a terminal in a network and includes: the terminal receiving a command from the network, the command instructing the terminal to perform an operation involving network data transmission; in response to the command, the terminal executes the operation to perform secure network data transmission with the network. Secure network data transmission means that the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt network data to be sent.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method and system for protecting network data security. Background Technology

[0002] With the rapid development of information technology, data transmission between terminal devices (such as smartphones, tablets, and laptops) and networks (such as the Internet and local area networks) has become increasingly frequent. This data may include various sensitive information such as users' personal information, trade secrets, and government documents. Therefore, ensuring the security of this network data transmission and preventing data from being stolen, tampered with, or lost during transmission has become an important research topic in the field of information security.

[0003] Data transmission security mainly involves two aspects: data confidentiality, i.e., preventing unauthorized third parties from obtaining sensitive information; and data integrity, i.e., ensuring that data is not tampered with or damaged during transmission. To address these issues, researchers have proposed many methods for data encryption and integrity verification.

[0004] Data encryption converts raw data into ciphertext using a specific algorithm, which can only be decrypted by the person possessing the key to retrieve the original data. Common data encryption techniques include symmetric and asymmetric encryption. Symmetric encryption uses the same key for both encryption and decryption, such as DES and AES; asymmetric encryption uses a pair of keys, one for encryption and the other for decryption, such as RSA and ECC. Integrity verification checks whether data has been tampered with during transmission using a specific algorithm. Common integrity verification methods include hash functions and digital signatures. A hash function maps data of any length to a fixed-length value; if the data changes, the hash value will change significantly. Digital signatures are an effective means of preventing data tampering; they combine hash functions and asymmetric encryption techniques to verify data integrity and the sender's identity. In addition to the above techniques, other security measures can enhance the security of data transmission. For example, using a VPN (Virtual Private Network) can establish an encrypted tunnel over a public network, ensuring the security of data during transmission; using SSL / TLS (Secure Sockets Layer / Transport Layer Security) protocols can provide security for data transmission at the application layer; and using firewalls and intrusion detection systems can prevent malicious attacks and unauthorized access.

[0005] In summary, data transmission security is a complex issue that requires the comprehensive application of various technologies and strategies. With the continuous upgrading of cyberattack methods and the ongoing development of information technology, improving data transmission security remains a challenging research topic. Summary of the Invention

[0006] This invention provides a network data security protection method and system to improve the security of network data transmission.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] Firstly, a network data security protection method is provided. This method is applied to a terminal in a network. The method includes: the terminal obtaining a command from the network, the command instructing the terminal to perform an operation involving network data transmission with the network; in response to the command, the terminal performs secure network data transmission with the network by executing the operation. Secure network data transmission means that the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt network data to be sent.

[0009] Optionally, the terminal is an A-IoT terminal for environmental IoT, and the network includes a reader in the A-IoT network. The terminal performs operations to conduct secure network data transmission with the network, including: when the operation is a read operation, the A-IoT terminal reads first network data locally from the A-IoT terminal, encrypts the first network data using a first key, and sends it to the reader; or; when the operation is a write operation, the A-IoT terminal receives second network data sent by the reader, decrypts the second network data using a second key, and writes it locally to the A-IoT terminal.

[0010] Optionally, the first key and the second key are inversely related, and the first key and the second key are stored in the first storage area of ​​the A-IoT terminal in the form of superimposed data; correspondingly, when the operation is a read operation, the method further includes: the A-IoT terminal obtains the first key by reading the first storage area in forward order; or, correspondingly, when the operation is a write operation, the method further includes: the A-IoT terminal obtains the second key by reading the first storage area in reverse order.

[0011] Optionally, the first storage area includes a first sub-storage area and a second sub-storage area with non-contiguous storage addresses. The storage address segment of the first sub-storage area is from the x1st bit to the x2nd bit, and the storage address segment of the second sub-storage area is from the y1st bit to the y2nd bit. x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, and y2 is an integer greater than y1. The A-IoT terminal obtains the first key by reading the first storage area in forward order, including: the A-IoT terminal sequentially reads the x1st bit to the x2nd bit and the y1st bit to the y2nd bit, and arranges the read data in the order of sequential reading to obtain the first key; or, the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: the A-IoT terminal sequentially reads the y2nd bit to the y1st bit and the x2nd bit to the x1st bit, and arranges the read data in the order of sequential reading to obtain the second key.

[0012] Optionally, the first storage area includes a first sub-storage area, a second sub-storage area, and a third sub-storage area with non-contiguous storage addresses. The storage address segment of the first sub-storage area is from the x1th bit to the x2th bit, the storage address segment of the second sub-storage area is from the y1th bit to the y2th bit, and the storage address segment of the third sub-storage area is from the z1th bit to the z2th bit. x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, y2 is an integer greater than y1, z1 is an integer greater than y2, and z2 is an integer greater than z1. The A-IoT terminal reads the first storage area in ascending order. To obtain a first key, the A-IoT terminal sequentially reads bits x1 to x2, y1 to y2, and z1 to z2, and arranges the read data in the order they were read to obtain the first key; or, the A-IoT terminal obtains a second key by reading the first storage area in reverse order, including: the A-IoT terminal sequentially reads bits y2 to y1, x2 to x1, and z1 to z2, and arranges the read data in the order they were read to obtain the second key.

[0013] Optionally, the command is a disk read command. If the operation is a read operation, the command further indicates the address range of the area to be read. Correspondingly, the A-IoT terminal reads first network data locally from its local storage and encrypts the first network data using a first key before sending it to the reader. This includes: the A-IoT terminal reading the first network data from the storage area mapped to the address range of the area to be read in its local storage based on the address range of the area to be read; the A-IoT terminal encrypting the first network data using the first key and sending it to the reader along with the A-IoT terminal's EPC. Alternatively, the command is a disk read command. If the operation is a write operation, the command further includes second network data. Correspondingly, the A-IoT terminal receives the second network data sent by the reader and decrypts the second network data using a second key before writing it to its local storage. This includes: the A-IoT terminal obtaining the second network data from the command; the A-IoT terminal decrypting the second network data using the second key and writing it to its local storage.

[0014] Secondly, a network data security protection method is provided. This method is applied to a network and includes: the network sending a command to a terminal in the network, the command instructing the terminal to perform an operation involving network data transmission with the network; the terminal responding to the command, and the network and the terminal performing secure network data transmission. Secure network data transmission means that the key used by the network to decrypt received network data is different from the key used by the network to encrypt network data to be sent.

[0015] Optionally, the terminal is an A-IoT terminal, and the network includes a reader in the A-IoT network. The network and the terminal perform secure network data transmission, including: when the operation is a read operation, the reader receives the network data read by the A-IoT terminal and decrypts the network data read by the A-IoT terminal using a first key to obtain first network data; or; when the operation is a write operation, the reader uses a second key to encrypt the network data to be written to the A-IoT terminal to obtain second network data, and sends the second network data to the A-IoT terminal.

[0016] Optionally, the first key and the second key are inverses of each other.

[0017] Thirdly, a network data security protection system is provided, which includes a terminal for performing the method as described in the first aspect, and a network for performing the method as described in the second aspect.

[0018] Fourthly, an electronic device is provided, comprising: a processor and a memory; the memory is used to store a computer program, which, when executed by the processor, causes the electronic device to perform the method described in the first aspect.

[0019] In one possible design, the electronic device described in the fourth aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the electronic device described in the fourth aspect and other electronic devices.

[0020] In the embodiments of the present invention, the electronic device described in the fourth aspect may be a terminal, or a chip (system) or other component or assembly disposed in the terminal, or a system containing the terminal.

[0021] Fifthly, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer causes the computer to perform the method described in the first aspect.

[0022] In summary, when a terminal receives a command from the network instructing it to perform an operation involving network data transmission, the terminal can securely transmit network data in response to the command. During this secure data transmission, the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt the network device to be sent. That is, the keys used for uplink and downlink transmissions are different. Compared to existing technologies that use the same key for both uplink and downlink transmissions, even if an attacker steals either key, they cannot completely crack the uplink and downlink transmissions, thus improving the security of network data transmission. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the network system architecture provided in an embodiment of the present invention;

[0024] Figure 2 A flowchart illustrating a network data security protection method provided in an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0026] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0027] In this embodiment of the invention, "instruction" can include direct and indirect instructions, as well as explicit and implicit instructions. The information indicated by a certain piece of information is called the information to be instructed. In specific implementation, there are many ways to instruct the information to be instructed, such as, but not limited to, directly instructing the information to be instructed, such as the information to be instructed itself or its index. It can also indirectly instruct the information to be instructed by instructing other information, where there is a correlation between the other information and the information to be instructed. It can also instruct only a part of the information to be instructed, while the other parts are known or pre-agreed upon. For example, the instruction of specific information can be achieved by using a pre-agreed (e.g., protocol-defined) arrangement of various pieces of information, thereby reducing instruction overhead to some extent. Simultaneously, common parts of various pieces of information can be identified and uniformly indicated to reduce the instruction overhead caused by individually indicating the same information.

[0028] Furthermore, the specific indication method can also be any existing indication method, such as, but not limited to, the above-mentioned indication methods and their various combinations. Specific details of various indication methods can be found in existing technologies, and will not be elaborated upon here. As described above, for example, when multiple pieces of information of the same type need to be indicated, the indication methods for different pieces of information may differ. In specific implementation, the required indication method can be selected according to specific needs. This embodiment of the invention does not limit the selected indication method; therefore, the indication methods involved in this embodiment of the invention should be understood to cover various methods that enable the party to be indicated to obtain the information to be indicated.

[0029] It should be understood that the information to be indicated can be sent as a whole or divided into multiple sub-information messages sent separately, and the sending period and / or timing of these sub-information messages can be the same or different. The specific sending method is not limited in this embodiment of the invention. The sending period and / or timing of these sub-information messages can be predefined, for example, according to a protocol, or configured by the sending device by sending configuration information to the receiving device.

[0030] "Predefined" or "pre-configured" can be achieved by pre-saving corresponding codes, tables, or other means that can be used to indicate relevant information in the device. This embodiment of the invention does not limit the specific implementation method. "Saving" can refer to saving in one or more memories. These memories can be separate installations or integrated into the encoder, decoder, processor, or electronic device. Alternatively, some memories can be separately installed, while others are integrated into the decoder, processor, or electronic device. The type of memory can be any form of storage medium, and this embodiment of the invention does not limit this.

[0031] In the embodiments of this invention, "protocol" may refer to a protocol family in the field of communication, a standard protocol with a similar protocol family frame structure, or a related protocol to be applied in future systems. The embodiments of this invention do not specifically limit this.

[0032] In this embodiment of the invention, descriptions such as "when," "under the circumstances," "if," and "if" all refer to the device making corresponding processing under certain objective circumstances, and are not limited to a specific time. They do not require the device to make a judgment action during implementation, nor do they imply any other limitations.

[0033] In the description of the embodiments of the present invention, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can represent A or B. "And / or" in the embodiments of the present invention is merely a description of the relationship between the related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. Furthermore, in the description of the embodiments of the present invention, unless otherwise stated, "multiple" refers to two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or order of execution, and that "first," "second," etc., are not necessarily different. Furthermore, in the embodiments of this invention, words such as "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this invention should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0034] The network architecture and business scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0035] To facilitate understanding of the embodiments of the present invention, firstly, let's take... Figure 1 The network system shown in the figure is an example, Figure 1 This is a schematic diagram of the network system architecture to which a network data security protection method provided in an embodiment of the present invention is applicable.

[0036] like Figure 1 As shown, a network system may include: terminals and a network.

[0037] The terminal can be an Ambient IoT (AIoT) terminal, and the network can be an AIoT network, such as a reader in an AIoT network.

[0038] Specifically, A-IoT terminals can be divided into three categories: Terminal A, Terminal B, or Terminal C. Terminal A or Terminal 1a can be understood as similar to passive A-IoT terminals. Passive A-IoT terminals can be in the form of tags or any other terminal form, without restriction. Terminal B or Terminal 1b can be understood as similar to semi-passive A-IoT terminals. Semi-passive A-IoT terminals can obtain energy through solar, radio frequency, wind, hydro, or tidal power, with no restriction on the energy acquisition method. These nodes do not have their own power supply terminals such as batteries, but obtain energy from the environment to support data sensing, transmission, and distributed computing. Terminal C or Terminal 1c can be understood as similar to active A-IoT terminals. For ease of understanding, the terms "A-IoT terminal" and "tag" are interchangeable.

[0039] An AIoT terminal can be a terminal with transceiver capabilities, or a chip or chip system that can be installed on the terminal. This terminal can also be referred to as user equipment (UE), access terminal, user unit, user station, mobile station (MS), mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication equipment, user agent, or user device. The terminals in the embodiments of this application may be mobile phones, cellular phones, smartphones, tablets, wireless data cards, personal digital assistants (PDAs), wireless modems, handsets, laptop computers, machine-type communication (MTC) terminals, computers with wireless transceiver capabilities, virtual reality (VR) terminals, augmented reality (AR) terminals, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical care, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, vehicle-mounted terminals, roadside units (RSUs) with terminal functions, etc. The terminal in this application can also be an on-board module, on-board unit, on-board component, on-board chip, or on-board unit built into a vehicle as one or more components or units. Alternatively, the terminal can also be customer-premises equipment (CPE).

[0040] Readers can be radio access network (RAN) devices, such as base stations, pole stations, micro base stations, macro stations, etc., or they can be terminal devices, such as mobile phones, IoT devices, handheld readers, etc. Readers can conduct contactless two-way data communication via radio frequency (RF) to read and write tags, thereby achieving target identification and data exchange. For example, for passive tags, when they enter the effective identification range of the reader, they can receive the RF signal emitted by the reader and transmit the information stored in the chip using the energy obtained from the induced current. Alternatively, for semi-passive or active tags, they can actively transmit signals at a certain frequency. The reader receives and decodes the information and sends it to the central information system for relevant data processing.

[0041] Figure 2 This is a flowchart illustrating the method provided in an embodiment of the present invention. This network data security protection method is applicable to the aforementioned network system and involves the interaction between devices within the network system. The specific process is as follows:

[0042] S201, the network sends commands to terminals in the network, and the terminals obtain the commands from the network.

[0043] The command instructs the terminal to perform operations involving network data transmission with the network.

[0044] Taking an AIoT terminal as an example and a reader within the AIoT network as an example, in an AIoT scenario, this command can be a disk entry command. A disk entry command instructs the AIoT terminal to report its own device identifier, such as the Electronic Product Identifier (EPC) of the AIoT terminal reported subsequently. The disk entry command can contain information indicating the operation, such as information indicating a read operation (meaning the operation is read) or information indicating a write operation (meaning the operation is write). In the case of a write operation, the command (or disk entry command) also includes the data to be written to the AIoT terminal to achieve fast data reading or writing. In the case of a read operation, the command also indicates the address range of the area to be read, such as bits 41 to 88 of the AIoT terminal's storage area.

[0045] S202, in response to a command, the terminal performs an operation to conduct secure network data transmission with the network. Correspondingly, the terminal responds to the command, and the network conducts secure network data transmission with the terminal.

[0046] For a terminal, secure network data transmission means that the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt network data to be sent.

[0047] In the case of a read operation, the A-IoT terminal reads the first network data locally from the A-IoT terminal, encrypts the first network data using the first key, and sends it to the reader; or, in the case of a write operation, the A-IoT terminal receives the second network data sent by the reader, decrypts the second network data using the second key, and writes it locally to the A-IoT terminal.

[0048] In this embodiment, the first key and the second key are inversely related, and they are stored in a superimposed form in the first storage area of ​​the A-IoT terminal. That is, due to the performance limitations of the A-IoT terminal and considering energy consumption, if the A-IoT terminal maintains two keys separately, such as the first key and the second key, the A-IoT terminal's performance may not support this operation, and it will also increase overhead, which is not conducive to energy saving. Therefore, this embodiment considers designing the first key and the second key as inversely related keys, and storing them in the same area, which can be understood as using the same data to implement two keys, as described in detail below.

[0049] For example, in the case of a read operation, if the A-IoT terminal receives a command, in response to the command, the A-IoT terminal obtains the first key by reading the first storage area in ascending order.

[0050] Method 1: The first storage area includes a first sub-storage area and a second sub-storage area with non-contiguous storage addresses. The storage address segment of the first sub-storage area is from bit x1 to bit x2, and the storage address segment of the second sub-storage area is from bit y1 to bit y2. x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, and y2 is an integer greater than y1. The A-IoT terminal reads bits x1 to x2 and bits y1 to y2 sequentially, and arranges the read data in the order they were read to obtain the first key.

[0051] For example, taking x1=1, x2=5, y1=11, y2=15 as an example, for the first sub-storage area, the A-IoT terminal reads the data stored in the first bit of the storage area as 0, the data stored in the second bit as 1, the data stored in the third bit as 1, the data stored in the fourth bit as 0, and the data stored in the fifth bit as 1. Then, the data read in the order of reading is 01101. For the second sub-storage area, the A-IoT terminal reads the data stored in the eleventh bit as 1, the data stored in the twelfth bit as 1, the data stored in the thirteenth bit as 0, the data stored in the fourteenth bit as 0, and the data stored in the fifteenth bit as 0. Then, the data read in the order of reading is 11000. The whole sequence is 0110111000. This 0110111000 is the hashed bit string, which is also the first key.

[0052] It is understandable that discontinuous storage addresses in the first and second sub-storage areas can enable distributed storage and further improve data security.

[0053] Method 2: The first storage area includes a first sub-storage area, a second sub-storage area, and a third sub-storage area with non-contiguous storage addresses. The storage address segment of the first sub-storage area is from bit x1 to bit x2, the storage address segment of the second sub-storage area is from bit y1 to bit y2, and the storage address segment of the third sub-storage area is from bit z1 to bit z2. x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, y2 is an integer greater than y1, z1 is an integer greater than y2, and z2 is an integer greater than z1. The A-IoT terminal sequentially reads bits x1 to x2, bits y1 to y2, and bits z1 to z2, and arranges the read data in the order they were read to obtain the first key. Its implementation is similar to Method 1 above and can be understood by referring to it; it will not be elaborated here.

[0054] Alternatively, for example, in the case of a write operation, if the A-IoT terminal receives a command, in response to the command, the A-IoT terminal obtains the second key by reading the first storage area in reverse order.

[0055] Continue with method 1 above:

[0056] The A-IoT terminal reads bits y2 to y1 and bits x2 to x1 in sequence, and arranges the read data in the order they were read to obtain the second key.

[0057] For example, taking x1=1, x2=5, y1=11, y2=15 as an example, for the second sub-storage area, the A-IoT terminal reads the data stored in the 15th bit of the storage area as 0, the 14th bit as 0, the 13th bit as 0, the 12th bit as 1, and the 11th bit as 1. Then, arranging the read data in the order of reading is 00011. For the first sub-storage area, the A-IoT terminal reads the data stored in the 5th bit as 1, the 4th bit as 0, the 3rd bit as 1, the 2nd bit as 1, and the 1st bit as 0. Then, arranging the read data in the order of reading is 10110. Arranging the whole data in the order of reading is 00011110110. This 00011110110 is the hashed bit string, which is the second key.

[0058] As can be seen, 0110111000 reversed is 00011110110. In other words, by using data stored in the same area, different keys can be obtained by changing the reading order. For A-IoT terminals, this not only does not increase overhead, but also improves data transmission security.

[0059] Continue with method 2 above:

[0060] The A-IoT terminal sequentially reads bits y2 to y1, bits x2 to x1, and bits z1 to z2, and arranges the read data in the order they were read to obtain the second key. In other words, unlike the read operation in Method 2 above, the reverse order of the write operation is not a complete reverse read, but rather a majority of the reads are in reverse order and a small portion are read in order. This combined approach can further improve security. Of course, the principle of data sorting is similar to that of the read operation in Method 2 above, which can be referred to for understanding, and will not be elaborated here.

[0061] Furthermore, in the case of a read operation, the A-IoT terminal can read the first network data from the storage area mapped to the address range of the read area in its local storage (e.g., storage area) according to the address range of the read area indicated by the command. For example, the 48 bits of data contained in bits 41 to 88 mentioned above represent the first network data. The A-IoT terminal encrypts the first network data using a first key and sends it to the reader along with the A-IoT terminal's EPC. Alternatively, if the command is a write command, the A-IoT terminal can obtain the second network data from the command. The A-IoT terminal decrypts the second network data using a second key and writes it to its local storage.

[0062] For networks, secure network data transmission means that the key used by network devices to decrypt received network data is different from the key used by network devices to encrypt network data to be sent.

[0063] Specifically, the reader is also pre-configured with the aforementioned first key and second key, meaning that the first key and second key are inversely related, and the understanding of the first key and second key is consistent with that of the A-IoT terminal. Accordingly, in the case of a read operation, the reader receives network data read by the A-IoT terminal and uses the first key to decrypt the network data read by the A-IoT terminal to obtain the first network data. Alternatively, in the case of a write operation, the reader uses the second key to encrypt the network data to be written to the A-IoT terminal to obtain the second network data, and then sends the second network data to the A-IoT terminal.

[0064] In summary, when a terminal receives a command from the network instructing it to perform an operation involving network data transmission, the terminal can securely transmit network data in response to the command. During this secure data transmission, the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt the network device to be sent. That is, the keys used for uplink and downlink transmissions are different. Compared to existing technologies that use the same key for both uplink and downlink transmissions, even if an attacker steals either key, they cannot completely crack the uplink and downlink transmissions, thus improving the security of network data transmission.

[0065] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Exemplarily, the electronic device may be a network device, or a chip (system) or other component or assembly that can be disposed in a network device. Figure 3 As shown, the electronic device 400 may include a processor 401. Optionally, the electronic device 400 may also include a memory 402 and / or a transceiver 403. The processor 401 is coupled to the memory 402 and the transceiver 403, for example, via a communication bus.

[0066] The following is combined Figure 3 A detailed description of each component of the electronic device 400 is provided below:

[0067] The processor 401 is the control center of the electronic device 400. It can be a single processor or a collective term for multiple processing elements. For example, the processor 401 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0068] Optionally, the processor 401 can perform various functions of the electronic device 400 by running or executing software programs stored in the memory 402 and calling data stored in the memory 402, such as performing the aforementioned functions. Figure 2 This illustrates a method for protecting network data security.

[0069] In a specific implementation, as one example, processor 401 may include one or more CPUs, for example... Figure 3 CPU0 and CPU1 are shown in the diagram.

[0070] In a specific implementation, as one example, the electronic device 400 may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0071] The memory 402 is used to store the software program that executes the solution of the present invention, and is controlled by the processor 401 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0072] Optionally, the memory 402 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 402 may be integrated with the processor 401 or may exist independently and be accessible through the interface circuit of the electronic device 400. Figure 3 (Not shown in the image) is coupled to processor 401, and this embodiment of the invention does not specifically limit this.

[0073] Transceiver 403 is used for communication with other electronic devices. For example, if electronic device 400 is a terminal, transceiver 403 can be used to communicate with a network device or with another terminal device. As another example, if electronic device 400 is a network device, transceiver 403 can be used to communicate with a terminal or with another network device.

[0074] Alternatively, transceiver 403 may include a receiver and a transmitter. Figure 3 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0075] Alternatively, the transceiver 403 can be integrated with the processor 401, or it can exist independently and be connected via the interface circuit of the electronic device 400. Figure 3 (Not shown in the image) is coupled to processor 401, and this embodiment of the invention does not specifically limit this.

[0076] Understandable, Figure 3 The structure of the electronic device 400 shown does not constitute a limitation on the electronic device. Actual electronic devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0077] Furthermore, the technical effects of the electronic device 400 can be referred to the technical effects of the methods described in the above method embodiments, and will not be repeated here.

[0078] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0079] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DRRAM).

[0080] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0081] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0082] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0083] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0084] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0085] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0086] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0087] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0088] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0089] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0090] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A network data security protection method, characterized in that, The method is applied to a terminal in a network, and the method includes: The terminal obtains a command from the network, the command instructing the terminal to perform an operation involving network data transmission with the network; In response to the command, the terminal performs the operation to conduct secure network data transmission with the network. The secure network data transmission means that the key used by the terminal to decrypt received network data is different from the key used by the terminal to encrypt network data to be sent. The terminal is an A-IoT (Artificial Intelligence of Things) terminal, and the network includes readers in the A-IoT network. The terminal performs the operation to conduct secure network data transmission with the network, including: When the operation is a read operation, the A-IoT terminal reads the first network data locally from the A-IoT terminal, encrypts the first network data using the first key, and sends it to the reader; or; When the operation is a write operation, the A-IoT terminal receives the second network data sent by the reader, and uses the second key to decrypt the second network data and write it to the local machine of the A-IoT terminal; The first key and the second key are inversely related, and the first key and the second key are stored in the first storage area of ​​the A-IoT terminal in the form of superimposed data; Accordingly, when the operation is a read operation, the method further includes: The A-IoT terminal obtains the first key by reading the first storage area in ascending order; Alternatively, correspondingly, when the operation is a write operation, the method further includes: The A-IoT terminal obtains the second key by reading the first storage area in reverse order.

2. The method of claim 1, wherein, The first storage area includes a first sub-storage area and a second sub-storage area with non-contiguous storage addresses. The storage address segment of the first sub-storage area is from the x1st bit to the x2nd bit, and the storage address segment of the second sub-storage area is from the y1st bit to the y2nd bit. x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, and y2 is an integer greater than y1. The A-IoT terminal obtains the first key by reading the first storage area in ascending order, including: The A-IoT terminal sequentially reads bits x1 to x2 and bits y1 to y2, and arranges the read data in the order they were read to obtain the first key; Alternatively, the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: The A-IoT terminal sequentially reads bits y2 to y1 and bits x2 to x1, and arranges the read data in the order they were read to obtain the second key.

3. The method of claim 1, wherein, The first storage area includes a first sub-storage area, a second sub-storage area, and a third sub-storage area with non-contiguous storage addresses. The storage address segment of the first sub-storage area is from the x1st bit to the x2nd bit, the storage address segment of the second sub-storage area is from the y1st bit to the y2nd bit, and the storage address segment of the third sub-storage area is from the z1st bit to the z2nd bit. x1 is an integer greater than or equal to 1, x2 is an integer greater than x1, y1 is an integer greater than x2, y2 is an integer greater than y1, z1 is an integer greater than y2, and z2 is an integer greater than z1. The A-IoT terminal obtains the first key by reading the first storage area in ascending order, including: The A-IoT terminal sequentially reads bits x1 to x2, bits y1 to y2, and bits z1 to z2, and arranges the read data in the order they were read to obtain the first key; Alternatively, the A-IoT terminal obtains the second key by reading the first storage area in reverse order, including: The A-IoT terminal sequentially reads bits y2 to y1, bits x2 to x1, and bits z1 to z2, and arranges the read data in the order they were read to obtain the second key.

4. The method of claim 1, wherein, The command is a disk entry command. When the operation is a read operation, the command also indicates the address range of the area to be read. Correspondingly, the A-IoT terminal reads first network data locally from its own data and encrypts the first network data using a first key before sending it to the reader, including: The A-IoT terminal reads the first network data from the storage area mapped to the address segment of the read region in the local storage area of ​​the A-IoT terminal according to the address segment of the read region; After the A-IoT terminal encrypts the first network data using the first key, it sends the data to the reader along with the EPC of the A-IoT terminal. Alternatively, if the command is a write command, and the operation is a write operation, the command further includes the second network data; correspondingly, the A-IoT terminal receives the second network data sent by the reader, and decrypts the second network data using the second key before writing it locally to the A-IoT terminal, including: The A-IoT terminal obtains the second network data from the command; The A-IoT terminal uses the second key to decrypt the second network data and then writes it locally to the A-IoT terminal.

5. A method for protecting network data security, characterized in that, The method is applied to a network, and the method includes: The network sends a command to a terminal in the network, the command instructing the terminal to perform an operation involving network data transmission with the network. When the terminal responds to the command, the network and the terminal perform secure network data transmission. The secure network data transmission means that the key used by the network to decrypt received network data is different from the key used by the network to encrypt network data to be sent. The terminal is an A-IoT (Artificial Intelligence of Things) terminal, the network includes a reader in the A-IoT network, and the network and the terminal perform secure network data transmission, including: When the operation is a read operation, the reader receives the network data read by the A-IoT terminal and uses the first key to decrypt the network data read by the A-IoT terminal to obtain the first network data; or; When the operation is a write operation, the reader uses a second key to encrypt the network data to be written to the A-IoT terminal, obtains second network data, and sends the second network data to the A-IoT terminal; The reciprocal relationship between the first key and the second key means that the A-IoT terminal obtains the first key by reading the first storage area in forward order, and the A-IoT terminal obtains the second key by reading the first storage area in reverse order.

6. A network data security protection system, characterized in that, The system includes a terminal for performing the method as described in any one of claims 1-4, and a network for performing the method as described in claim 5.

Images