Communication method of terminal, communication method of server, controller, terminal and server

Abstract

The invention discloses a communication method of a terminal, a communication method of a server, a controller, the terminal and the server, and is applied to the technical field of collection of data such as environment data. The method comprises the steps that a target encryption parameter stored in an accessed data read-write device is read, encryption parameters corresponding to all terminals are stored in the data read-write device, and the target encryption parameter is the encryption parameter corresponding to the current terminal; decrypting the target encryption parameter based on an initial key of the terminal to obtain a decryption parameter; on the basis of the decryption parameter, a parameter matched with the decryption parameter in the terminal is updated, and the updated parameter at least comprises the initial encryption key; acquiring original data, wherein the original data at least comprises acquisition data of the terminal, current time and a current position of the terminal; and encrypting the original data based on the initial encryption key, and transmitting the encrypted data to a server. The key configuration security of the terminal, the security of data transmission and the authenticity of the transmitted data can be ensured.

Description

Technical Field

[0001] The present application belongs to the field of information collection technology, and in particular, relates to a communication method of a terminal, a communication method of a server, a controller, a terminal, a server, a computer-readable storage medium, and a computer program product. Background Art

[0002] In the field of information collection, such as environmental monitoring, through the study of the standards "Technical Requirements for Online Automatic Monitoring (Monitoring) Data Collection and Transmission Instruments for Pollution Sources" and "Data Transmission Standards for Online Pollutant Monitoring (Monitoring) Systems" published on the official website of the Ministry of Ecology and Environment, the standards currently have relatively simple security requirements and the security of data transmission is relatively low. Summary of the invention

[0003] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a terminal communication method, a server communication method, a controller, a terminal, a server, a computer-readable storage medium and a computer program product, which can not only realize data encryption transmission, but also can detect the compliance of data through the communication time and location of the terminal, and the terminal has a higher security in data transmission.

[0004] In a first aspect, the present application provides a communication method for a terminal, the method comprising reading a target encryption parameter stored in a connected data reading and writing device, the data reading and writing device storing encryption parameters corresponding to each terminal, the target encryption parameter being the encryption parameter corresponding to the current terminal; decrypting the target encryption parameter based on an initial key of the terminal to obtain a decryption parameter, the updated parameter including at least an initial encryption key; updating parameters in the terminal that match the decryption parameter based on the decryption parameter; obtaining original data, the original data including at least the collected data of the terminal, the current time and the current location of the terminal; encrypting the original data based on the initial encryption key, and transmitting the encrypted data to a server.

[0005] In a second aspect, the present application provides a communication method of a server, the method comprising: Receiving encrypted data sent by the terminal; Decrypting the encrypted data to obtain original data, the original data at least including the collected data of the terminal, the current time and the current location of the terminal; Determining whether the collected data is compliant based on at least one of the current time and the current location; The compliance determination method for the current time includes at least one of the following: The current time is within a preset time period; Whether the uploading period of the encrypted data is equal to the preset period; and Whether the time difference between the current time and the time when the server sends the data upload request is less than a preset time difference.

[0006] In a third aspect, the present application provides a controller, which is used to execute the communication method of the terminal of the above-mentioned implementation mode.

[0007] In a fourth aspect, the present application provides a terminal, which includes the controller of the above embodiment.

[0008] In a fifth aspect, the present application provides a server, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the communication method of the server of the above-mentioned embodiment when executing the program.

[0009] In a sixth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the communication method of the terminal of the above-mentioned embodiment or the communication method of the server of the above-mentioned embodiment.

[0010] In a seventh aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the communication method of a terminal in any of the above-mentioned embodiments or the communication method of a server in any of the above-mentioned embodiments.

[0011] The communication method of the terminal, the communication method of the server, the controller, the terminal, the server, the computer-readable storage medium and the computer program product provided in the embodiment of the present application perform encrypted interaction with the terminal through a data reading and writing device to realize the configuration or update of the key of the terminal, thereby ensuring the security of the key configuration and update of the terminal, so that when the terminal and the server perform data transmission, it is performed in an encrypted manner, ensuring the security of the data transmission process and avoiding the leakage of collected data; and the transmitted data contains the current time (such as the time when the data is sent) and the current location of the terminal, so that the server can judge whether the collected data sent by the terminal is compliant based on the current time and the current location, and the judgment method of time compliance is reasonable, which can ensure the authenticity of the uploaded collected data. When the collected data is not compliant, the data security cannot be guaranteed. Therefore, by judging the compliance of the collected data, it is possible to avoid the collected data from being tampered with or the non-compliance of the collected data in non-specified scenarios, thereby ensuring the security and authenticity of the collected data.

[0012] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which: Figure 1 It is an application scenario diagram of the communication method provided in the embodiment of the present application; Figure 2 is a schematic diagram of the structure of the controller provided in an embodiment of the present application; Figure 3 is a first flow chart of a communication method of a terminal provided in an embodiment of the present application; Figure 4 is a second flow chart of the communication method of the terminal provided in an embodiment of the present application; Figure 5 is a third flow chart of the communication method of the terminal provided in an embodiment of the present application; Figure 6 is a fourth flow chart of the communication method of the terminal provided in an embodiment of the present application; Figure 7 is a fifth flow chart of the communication method of the terminal provided in an embodiment of the present application; Figure 8 is a sixth flow chart of the communication method of the terminal provided in an embodiment of the present application; Fig. 9 is a first flow chart of a communication method of a server provided in an embodiment of the present application; Fig.10 is a second flow chart of the communication method of the server provided in an embodiment of the present application; Fig.11 It is a module schematic diagram of a communication device of a terminal provided in an embodiment of the present application; Fig.12 It is a module diagram of a communication device of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0014] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0015] For ease of understanding, the technical background and application scenarios of this application are first introduced below: In the field of environmental information monitoring, the information security implementation plan of traditional collection terminals can provide data security protection for the collection terminals, but the data protection method is simple, easy to be cracked, and has low security. There are cases where the terminal avoids the designated place to collect data and then uploads the data required by the system. In actual supervision, there are endless cases of corporate violations and illegalities. The regulatory authorities hope that data transmission can be safer, and there are also control requirements for the use environment of the collection terminal to ensure the authenticity and security of the statistical data provided by the terminal.

[0016] In order to prevent problems caused by the use of terminals in different locations, this application proposes a new method for ensuring the authenticity and security of data collection by information collection terminals. This solution can be applied to various places where environmental monitoring collects environmental data. Through the implementation of multiple security methods and positioning control, this application can not only solve the reliable control of the authenticity of terminal collection, but also ensure the identity security of the access terminal and the security of data transmission through encrypted transmission during the transmission process.

[0017] See also Figure 1 , Figure 1 101 and 102 are examples of examples of communication methods for a terminal provided in the present application.

[0018] The terminal 101 may include but is not limited to: (1) Internet of Things devices: water quality testing equipment, air quality testing equipment, smart meters, robots, sensor devices (such as temperature sensors, humidity sensors, light sensors, etc.), etc., which are not limited to the embodiments of the present application.

[0019] (2) Other devices: smart phones (such as Android phones, IOS phones, etc.), tablet computers, laptops, desktop computers, smart speakers, smart watches, portable personal computers, mobile Internet devices (Mobile Internet Devices, MID for short), wearable devices, and other devices that can collect environmental information. This embodiment of the application does not limit this.

[0020] Please combine Figure 2 Optionally, the terminal 101 includes a controller 10, and the controller 10 is used to execute the communication method of the terminal 101 of the present application.

[0021] Optionally, the controller 10 includes a main control module 11 , a security authentication module 12 , a communication module 13 , a positioning module 14 , a data acquisition module 15 and a power supply module 16 .

[0022] The main control module 11 is connected to each functional module to coordinate the operation of multiple functional modules. The main control module 11 integrates the interfaces of each functional module to achieve connection and communication with each functional module. This module is the core of the controller 10.

[0023] Optionally, the interface connection method includes but is not limited to data interface communication methods such as SPI (Serial Peripheral Interface), serial port (usually referring to UART, Universal Asynchronous Receiver-Transmitter), IIC (Inter-Integrated Circuit, also known as I2C), etc.

[0024] The security authentication module 12 is used for identity authentication of external communication devices (such as servers, data reading and writing devices, etc.) and data encryption. The security authentication module 12 can integrate a national security chip and load a secure operating system internally to achieve identity authentication and data encryption and decryption.

[0025] Optionally, the security authentication module 12 is further used to generate a verification code for performing integrity verification on the transmitted data.

[0026] The communication module 13 is a communication interface provided by the terminal 101 to external devices, including but not limited to network ports, WiFi, cellular networks and other communication interfaces, providing a data transmission channel for the data management platform (ie, the server).

[0027] Among them, the positioning module 14 integrates different types of positioning hardware, including but not limited to Beidou positioning, base station positioning, WiFi positioning, etc., and is responsible for positioning the location information of the terminal 101.

[0028] The data acquisition module 15 may be a sensor module for direct data acquisition (such as an air quality detection sensor), or may be a data interface such as a serial port, which is connected to an external sensor to achieve data acquisition.

[0029] The power module 16 is used to supply power to the controller 10 .

[0030] Server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The embodiments of the present application are not limited to this.

[0031] The communication method of the server involved in this application can be implemented based on cloud technology.

[0032] Among them, cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data calculation, storage, processing and sharing.

[0033] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of the technical network system require a large amount of computing and storage resources, such as video websites, image websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0034] The communication method of the server of the present application can be implemented based on cloud computing. Cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The network that provides resources is called a "cloud". The resources in the "cloud" are infinitely expandable in the eyes of users, and can be obtained at any time, used on demand, expanded at any time, and paid for by use.

[0035] As a provider of basic cloud computing capabilities, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an IaaS (Infrastructure as a Service) platform) will be established, and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0036] Each terminal 101 communicates with the server 102. It should be noted that: Figure 1 The number of terminals and servers is only used as an example, and the number of terminals and servers can be more or less, which is not limited here. The terminal and the server can be directly or indirectly connected via wired (such as network port connection) or wireless communication (WiFi, cellular mobile network, etc.), which is not limited in this application.

[0037] Based on the above technical background and the introduction of its application scenarios, the embodiment of the present application provides a communication method of a terminal, and the communication method of the terminal is introduced in detail below: See also Figure 3 A terminal communication method provided in an embodiment of the present application is implemented by steps 011 and 012, which are described in detail below.

[0038] Step 011: Read the target encryption parameter stored in the connected data reading and writing device. The data reading and writing device stores encryption parameters corresponding to each terminal. The target encryption parameter is the encryption parameter corresponding to the current terminal. Step 012: decrypting the target encryption parameter based on the initial key of the terminal to obtain a decryption parameter; Step 013: Based on the decryption parameters, update the parameters in the terminal that match the decryption parameters, where the updated parameters at least include the initial encryption key; The initial key is a key preset by the terminal, and the initial key is different from the initial encryption key; or the initial key is the same as the initial encryption key.

[0039] Specifically, based on changes in data collection requirements, the terminal parameters need to be updated synchronously to meet data collection requirements. For example, the initial encryption key of the terminal needs to be updated to ensure security, and the data collection cycle changes, so the terminal data upload cycle needs to be updated; for example, if the server's identity authentication certificate changes, the server public key stored in the terminal needs to be updated synchronously.

[0040] The parameters that need to be updated can be downloaded from the server. The downloaded parameters are encrypted parameters after being encrypted by the server, ensuring the security of parameter updates.

[0041] The terminal can read the target encryption parameters stored in the data reading and writing device. The data reading and writing device stores the encryption parameters corresponding to each terminal. The target encryption parameters are the encryption parameters corresponding to the current terminal. The current terminal decrypts the target encryption parameters based on the initial key stored in the terminal to obtain the decryption parameters. Then, based on the decryption parameters, the parameters in the terminal that match the decryption parameters can be updated (such as using the decryption parameters to add or replace the corresponding parameters in the terminal).

[0042] For example, the decryption parameters at least include the initial encryption key of the terminal, so that the initial encryption key in the current terminal is added or replaced by the initial encryption key in the decryption parameters, so that the updated parameters of the terminal include the initial encryption key. When the initial key and the initial encryption key are the same, the initial key can also be updated synchronously.

[0043] Optionally, when the encryption parameters stored in the data reading and writing device are updated compared to the version of the corresponding parameters in the terminal, the parameters are updated, so that the parameters of the terminal can be guaranteed to be the latest parameters at all times.

[0044] Optionally, the data reading and writing device stores identification information of each terminal and encryption parameters corresponding to each identification information, and the terminal can read encryption parameters (ie, target encryption parameters) matching the identification information of the current terminal based on its own identification information.

[0045] It can be understood that the encryption parameters of multiple terminals can be stored in the data reading and writing device to achieve parameter updates for multiple terminals. The encryption parameters of each terminal are stored with the identification information of the corresponding terminal. After the data reading device is connected to the current terminal, the current terminal can read the corresponding target encryption parameters based on its own identification information. In this way, the data reading and writing device can be used to simultaneously achieve parameter updates for multiple terminals, and ensure that each terminal can accurately read the corresponding encryption parameters.

[0046] Step 014: Acquire original data, which at least includes the collected data of the terminal, the current time and the current location of the terminal.

[0047] Among them, raw data refers to the unencrypted data collected by the terminal.

[0048] Optionally, the original data includes data collected by a data collection module of the terminal, the current time of the terminal (such as the time when the terminal uploads data) and the current location information of the terminal collected by a positioning module.

[0049] Taking the terminal as an air quality collection terminal as an example, the collected data of the terminal is the air quality data of the scene where the terminal is located at each moment.

[0050] Before transmitting the original data, the main control module can read the original data from each functional module.

[0051] Step 015: Encrypt the original data based on the initial encryption key and transmit the encrypted data to the server.

[0052] Before transmitting the original data, in order to avoid being stolen and leaked during the data transmission process, which would affect the data security, the original data needs to be encrypted. For example, the original data can be encrypted using an encryption algorithm and a preset key to obtain encrypted data, and then the encrypted data can be transmitted. In this way, only servers that deploy the same encryption algorithm and corresponding keys can decrypt the encrypted data to obtain the original data after receiving it. Even if the data is stolen during the transmission process, the original data cannot be obtained, thus ensuring the data transmission security of the original data.

[0053] Optionally, the encryption algorithm may be a symmetric encryption algorithm or an asymmetric encryption algorithm. For example, the encryption algorithm may be a block cipher algorithm SM4.

[0054] Among them, SM4 is a block cipher algorithm and one of the commercial encryption standards issued by the China National Cryptography Administration. It is designed to protect the security of data, especially in government and financial institutions, with high security.

[0055] The encryption process of SM4 is mainly divided into the following steps: (1) Key expansion: 32 subkeys are generated from the 128-bit original key, each of which is also 128 bits. The generation of the subkeys is completed through a series of complex operations to ensure that the relationship between the subkeys and the original key is complex enough to be difficult to predict.

[0056] (2) Initial transformation: Perform an initial transformation on the input 128-bit plaintext, usually an XOR operation.

[0057] (3) Round function: 32 rounds of iterations, each round includes a nonlinear transformation S-box, a linear transformation L-box, and an XOR operation with the subkey. The specific operations of each round are as follows: S-box transformation: divide the input data into multiple parts, and each part is transformed nonlinearly through the S-box. L-box transformation: linearly transform the result after the S-box transformation. XOR operation: XOR the transformed result with the subkey of the current round. Final transformation: after the completion of 32 rounds of iterations, the result is finally transformed, usually an XOR operation.

[0058] The decryption process of SM4 is mainly divided into the following steps: The decryption process is similar to the encryption process, but the subkeys are used in the opposite order and some steps are different. The specific steps are as follows: (1) Inverse initial transformation: Perform the inverse initial transformation on the input 128-bit ciphertext.

[0059] (2) Inverse wheel function: 32 rounds of iterations, each round includes an inverse S-box transformation, an inverse L-box transformation, and an XOR operation with the inverse subkey.

[0060] The specific operations of each round are as follows: Inverse S-box transformation: divide the input data into multiple parts, and each part is transformed nonlinearly through the inverse S-box. Inverse L-box transformation: linearly transform the result after the inverse S-box transformation. XOR operation: XOR the transformed result with the inverse subkey of the current round.

[0061] (3) Inverse final transformation: After 32 iterations are completed, the result is subjected to an inverse final transformation, usually an XOR operation.

[0062] In this way, the encryption and decryption design of SM4 takes into account multiple attack methods, such as differential attacks, linear attacks, etc., and takes corresponding protection measures, which has a high security.

[0063] Optionally, the SM4 algorithm is deployed in the national secret security chip integrated in the security authentication module. After the main control module obtains the original data, it sends the original data to the security authentication module to encrypt the original data. After that, the main control module obtains the encrypted data and sends it to the server through the communication module.

[0064] After the server decrypts and obtains the original data, it can determine whether the collected data is compliant based on at least one of the current time and the current location.

[0065] Optionally, when either the current time or the current location is not compliant, the collected data is determined to be not compliant; and when both the current time and the current location are compliant, the collected data is determined to be compliant.

[0066] Optionally, the compliance determination method for the current time includes at least one of the following: (1) The current time is within the preset time period. In other words, data needs to be uploaded within the specified time. Data uploaded outside the specified time period may be false data and non-compliant data.

[0067] (2) Whether the upload cycle of encrypted data is equal to the preset cycle. In other words, there is a preset upload cycle for data upload, such as uploading once every other day. If there is a deviation in the upload cycle of encrypted data (i.e., not equal to the preset cycle, or the cycle difference is greater than the preset value), it can be considered that the upload cycle of encrypted data is not equal to the preset cycle, which may be false data and non-compliant data.

[0068] (3) Is the time difference between the current time and the time when the server sends the data upload request less than the preset time difference? In other words, the server can also request the terminal to upload data at any time. The terminal can only upload data within the preset time after the server request. If the terminal uploads data earlier than the request time, or the time difference from the request time is too large, it may be false data and non-compliant data.

[0069] Optionally, the current location compliance includes at least one of the following situations: (1) The current location is within the preset geographical area. The area where the terminal performs environmental monitoring is generally fixed. When the terminal is not within the preset geographical area, the data collected by the terminal is distorted, that is, non-compliant data.

[0070] (2) Matching the current location with the historical location. The area where the terminal performs environmental monitoring is generally fixed. Therefore, when uploading data multiple times, the location change of the terminal should be very small. Therefore, when the current location matches the historical location, it can be determined that the data collected by the terminal is compliant, otherwise it is non-compliant.

[0071] In this way, compliance detection of the collected data of the terminal can be implemented through the current time and current location uploaded by the terminal, thereby ensuring the authenticity of the data collected by the terminal.

[0072] The communication method of the terminal provided in the embodiment of the present application performs data transmission between the terminal and the server in an encrypted manner, thereby ensuring the security of the data transmission process and avoiding leakage of collected data; and the transmitted data includes the current time (such as the time when the data is sent) and the current location of the terminal, so that the server can judge whether the collected data sent by the terminal is compliant based on the current time and the current location. When the collected data is not compliant, the data security cannot be guaranteed. Therefore, by judging the compliance of the collected data, it is possible to avoid tampering with the collected data or non-compliance of the collected data in non-specified scenarios, thereby further ensuring the security and authenticity of the collected data.

[0073] See also Figure 4 In some embodiments, step 015: encrypting the original data based on the initial encryption key and transmitting the encrypted data to the server includes: Step 0151: Generate a first random code; Step 0152: Generate an encryption process key based on the current time, the first random code and the initial encryption key of the terminal; Step 0153: Encrypt the original data based on the encryption process key and transmit the encrypted data to the server.

[0074] Specifically, when encrypting the original data, the terminal (such as a security authentication module) may first generate a first random code, which may be a hardware random number. The first random code serves as a random factor for subsequent calculation of the key, which may increase the randomness of the key.

[0075] Afterwards, an encryption process key can be generated based on the current time, the first random code and the initial encryption key of the terminal (the key preset in the terminal). The random encryption process key can be used to dynamically encrypt the original data, thereby improving encryption security.

[0076] Optionally, when transmitting encrypted data, the first random code and the current time may also be transmitted to the server, so that the server can obtain the random factor for generating the encryption process key, thereby ensuring that the server can accurately perform decryption.

[0077] Optionally, in order to further ensure the accuracy of the encryption process key, the terminal (such as the security authentication module) can generate a first verification code based on the current time, the first random code, the encrypted data and the encryption process key, and send it to the server together with the encrypted data. The first verification code is used to verify the integrity of the transmitted data, such as the integrity of the encrypted data and the encryption process key.

[0078] After the server generates an encryption process key based on the received data (such as the current time, the first random code and the initial encryption key of the terminal; or the current time, the first random code, the second random code and the initial encryption key of the terminal), the data integrity can be verified through the first verification code.

[0079] The initial encryption key of the terminal may be a key stored by the server for each terminal, or the server may store the original key and identification information of each terminal, and the initial encryption key of the terminal may be quickly calculated through the original key and identification information of the terminal.

[0080] Optionally, the first verification code may be a message authentication code.

[0081] Among them, MAC (Message Authentication Code) is a security technology used to verify data integrity and source authenticity. It uses a key and an encryption algorithm to generate a fixed-length data, which is the MAC check code. The receiver can recalculate the MAC using the same key and algorithm and compare it with the received MAC to confirm that the data has not been tampered with during transmission and is indeed from the expected sender.

[0082] Optionally, when performing identity authentication, the server sends a second random code for data encryption to the terminal. Therefore, an encryption process key can be generated based on the current time, the first random code, the second random code and the initial encryption key of the terminal.

[0083] In this way, the second random code is used as a random factor for subsequent calculation of the key, which can not only further increase the randomness of the key, but also increase the uniqueness of the data link between the terminal and the server.

[0084] See also Figure 5 In some embodiments, the method further comprises: Step 018: Authenticate the server to obtain a first authentication result, where the first authentication result includes pass or fail; When the identity authentication is passed, the process proceeds to the step of obtaining the original data (ie, step 011 ).

[0085] Specifically, in order to ensure the security of data transmission, the identities of both communicating parties may be authenticated before data transmission.

[0086] Identity authentication can be actively triggered by the terminal, or it can be triggered when receiving a server request for the terminal to upload data.

[0087] Identity authentication is bidirectional. The terminal can authenticate the server, and the server also needs to authenticate the terminal, so as to ensure the communication security between the terminal and the server. Through identity authentication, a first authentication result can be obtained. When the identity authentication of the server and the terminal is passed, the terminal can start preparing for data transmission, that is, perform the operation of obtaining the original data in step 012.

[0088] The identity authentication process is as follows: (1) The terminal sends an identity authentication request to the server; (2) Receive the server certificate sent by the server; (3) Verify whether the server certificate is valid based on the server public key (the public key pre-stored in the terminal to implement certificate authentication); (4) If yes (i.e. certificate authentication is successful), the terminal certificate is sent to the server so that the server can verify whether the terminal certificate is valid based on the terminal public key. At this time, the server needs to authenticate the terminal.

[0089] (5) If not (i.e., the certificate authentication fails), the first authentication result is determined to be identity authentication failure; (6) If the terminal certificate is valid (i.e., the server successfully authenticates the terminal identity), determining that the first authentication result is successful identity authentication; (7) When the terminal certificate is invalid (i.e., the server fails to authenticate the terminal identity), the first authentication result is determined to be identity authentication failure.

[0090] In this way, two-way authentication can be used to achieve identity authentication of the terminal and the server, thus ensuring the security of subsequent data transmission.

[0091] Optionally, identity authentication can be implemented based on the SM2 algorithm (public key cryptography algorithm). The SM2 algorithm is a public key cryptography algorithm based on elliptic curve cryptography (ECC) released by the Office of State Commercial Cryptography Administration (OSCCA) of China. It is mainly used for security applications such as digital signatures, key exchange and data encryption.

[0092] See also Figure 6 In some embodiments, the communication method further comprises: Step 019: Perform compliance detection on the current location to obtain a compliance detection result, where the compliance detection result includes whether the location is compliant or not compliant; Step 015: Transmit encrypted data to the server, including: Step 0154: Transmit the encrypted data and compliance detection results to the server.

[0093] Specifically, the terminal itself can also perform compliance detection. The terminal stores preset geographical areas (or geographical fences) internally. By judging whether the current location is in the preset geographical area, it can be determined whether the current location is compliant.

[0094] When the current location is in the preset geographical area, it can be determined that the current location is compliant. When the current location is not in the preset geographical area, it can be determined that the current location is not compliant.

[0095] When transmitting encrypted data, the compliance test results (which can also be encrypted together with the original data) can be sent to the server together. In this way, the server does not need to perform location compliance testing, reducing the amount of resources required for the server to perform compliance testing.

[0096] See also Figure 7 In some embodiments, the communication method further comprises: Step 020: When the data reading and writing device is detected to be connected, the data reading and writing device is authenticated to obtain a second authentication result, where the second authentication result includes a pass or a fail; Step 021: When the identity authentication is passed, communicate with the data reading and writing device to update the terminal parameters and / or send the collected data to the data reading and writing device.

[0097] Specifically, the terminal may need to update initialization parameters (such as upload policies, geo-fences, initial encryption keys, public keys required for server authentication, etc.), or the terminal may be unable to upload data to the server due to network anomalies, communication module damage, etc. Since the terminal's storage capacity is limited, in order to avoid data loss due to overflow, employees need to use data reading and writing devices to implement terminal parameter updates or data storage.

[0098] When the terminal detects that the data reading and writing device is connected, it will also authenticate the data reading and writing device to obtain a second authentication result, which includes pass or fail. Only when the identity authentication is passed will it communicate with the data reading and writing device to update the terminal parameters and / or send the collected data to the data reading and writing device.

[0099] In this way, the communication security between the terminal and the data reading and writing device can be guaranteed, and the terminal parameter update and data storage can be realized. The data reading and writing device can be subsequently inserted into a computer or other device to upload it to the server to ensure the integrity of the data collected by the terminal (i.e. avoid the lack of collected data in a specific period of time).

[0100] Optionally, the collected data includes at least one of uploaded data and non-uploaded data, and the terminal may send the non-uploaded data to the data reading and writing device, thereby reducing the amount of data transmission.

[0101] Optionally, the terminal may mark the data, and mark the uploaded data as uploaded data, and mark the unuploaded data as unuploaded data.

[0102] Optionally, the data reading and writing device may upload the collected data to the server through the electronic device, and the server may distinguish the uploaded data and the non-uploaded data in the received collected data, thereby storing the non-uploaded data.

[0103] It can be understood that when the data reading and writing device wants to update the parameters of the terminal, it needs to download the corresponding encryption parameters from the server. After the data reading and writing device stores the collected data of the terminal, it also needs to upload the stored data to the server.

[0104] In some embodiments, when the server detects that a data reading and writing device has been connected, it performs identity authentication on the data reading and writing device to obtain a third authentication result, which includes pass or fail; when the identity authentication passes, the encryption parameters of the terminal are sent down or the collected data of the terminal stored in the data reading and writing device is read.

[0105] In this way, after the data reading and writing device and the server are authenticated, the security of sending the encryption parameters of the terminal or reading the collected data of the terminal stored in the data reading and writing device can be guaranteed.

[0106] Optionally, the data sent by the server includes encryption parameters of each terminal and corresponding identification information; a plurality of groups of collected data are stored in the data reading and writing device, and each group of collected data corresponds to one terminal.

[0107] In this way, the server can send encryption parameters and corresponding identification information of multiple terminals, so that the data reading and writing device can update parameters of multiple terminals and ensure that each terminal can accurately read the corresponding encryption parameters. And the data reading and writing device can store the collected data of multiple terminals.

[0108] Optionally, the data reading and writing device transmits the collected data and the fourth check code to the server, and the fourth check code is generated based on a preset algorithm and the collected data. When the server receives the data uploaded by the data reading and writing device, it will generate a fifth check code based on the preset algorithm and the received data, and determine whether the received data is valid based on the fourth check code and the fifth check code. In this way, the integrity of the data transmission between the data reading device and the server can be guaranteed.

[0109] See also Figure 8 Optionally, step 021: sending the collected data to a data reading and writing device includes: Step 0211: Transmit the collected data and the second check code to the data reading and writing device, the second check code is generated based on a preset algorithm and the collected data, the data reading and writing device generates a third check code based on the preset algorithm and the received data, and determines whether the received data is valid based on the second check code and the third check code.

[0110] Optionally, the data reading and writing device may be a device that can be connected and communicated with the terminal and can be used by the terminal to read and write data. For example, the data reading and writing device may include a hardware security token.

[0111] Among them, USBKey, also known as USB token or hardware security token, is a small, portable USB device mainly used to store digital certificates and private keys and perform encryption operations.

[0112] Specifically, the terminal's collected data is stored in the data reading and writing device. Generally, the server detects that the terminal is disconnected from the network and arranges maintenance personnel to do it manually in real time. It can be understood that since the terminal disconnection is random, the probability of someone stealing the terminal's collected data after the terminal disconnection is extremely low. Therefore, when storing the terminal's collected data, the security of the collected data is relatively high, and it only needs to ensure the integrity of the collected data.

[0113] Therefore, the terminal can transmit the collected data and the second check code to the data reading and writing device, and the second check code is generated based on the preset algorithm and the collected data. After that, the data reading and writing device generates a third check code based on the preset algorithm and the received data, and determines whether the received data is valid based on the second check code and the third check code. When the second check code and the third check code match (if they are the same), it can be determined that the received data is complete and valid. Otherwise, it can be determined that the received data is incomplete and invalid, and an abnormality occurred during the transmission process and needs to be retransmitted.

[0114] Optionally, in the case where the received data is invalid, the terminal may issue a prompt message to prompt the maintenance personnel to retransmit.

[0115] Optionally, the preset algorithm may be an SM3 algorithm. SM3 is a cryptographic hash function standard issued by the Office of State Commercial Cryptography Administration (OSCCA) of China, which is mainly used for security applications such as data integrity verification and digital signatures. It is part of the national secret standard and together with SM2 (public key encryption algorithm) and SM4 (block cipher algorithm) constitutes China's commercial cryptographic system.

[0116] The communication method of the present application has the following technical effects: (1) Before the data is transmitted from the collection terminal, it is necessary to pass the background identity authentication. The identity authentication process involves the random codes of both parties to increase the randomness of the verification data. The random code RNG2 of the data management platform is still used as a factor in the subsequent data protection calculation to increase the uniqueness of the data link. The algorithm includes but is not limited to symmetric and asymmetric algorithms.

[0117] (2) The data transmitted by the acquisition terminal is encrypted and the verification code is calculated using the proprietary key in the security authentication module. The security authentication module uses a national secret chip. Time and random factors are involved in the encryption process to strengthen the protection of the ciphertext and verification code. The algorithm process is customized so that attackers cannot crack it. The ciphertext and verification code of the collected data are protected by random factors such as time and random code. The 4-byte time information YYMMDDHH+4-byte terminal random code (i.e., the first random code)+8-byte data management platform random code (i.e., the second random code) is used as the random factor. The initial encryption key and 16-byte random factor are encrypted by SM4 through the security authentication module, and the encryption process key is calculated and generated. The encryption process key is used to encrypt the collected data by SM4 to ensure data security. The MAC verification code is calculated by the security authentication module to ensure data integrity.

[0118] (3) The data collection equipment has a location positioning function, which provides data basis for the location warning of the equipment. The location information is protected as part of the collected data and cannot be stolen or changed. The location information positioning methods include but are not limited to Beidou positioning, base station positioning, GPS positioning, and WiFi positioning. When the location information exceeds the specified range or the collection is abnormal, the data management platform can analyze the data and prompt the alarm information in time.

[0119] (4) Data collection is real-time, and the equipment must collect and upload data regularly within the time range required by the system. In order to increase the randomness of the collected data calculation, time information is used as one of the algorithm factors of data security protection to participate in the calculation of data encryption protection, and also as the basis for real-time judgment of background management.

[0120] (5) Terminal configuration and debugging are based on USBKey and security authentication module for security authentication. USBKey not only has the function of security authentication, but also has storage space for configuration information and collected information. Configuration information storage is encrypted storage, and reading and writing require permission authentication before they can be performed. Collection information storage supports multiple storages, and reading and writing require permission authentication before they can be performed. It also has a compression checksum value calculated based on the SM3 algorithm to ensure the correctness of the data.

[0121] In summary, the present application belongs to the field of information security technology, and specifically is a method for implementing security protection and control of information collection terminals, which performs security authentication and data reading and writing on terminal management and debugging work through a dedicated USB interface authorization device (such as USBkey). In the process of uploading terminal collection data to the server, identity authentication and data encryption and decryption protection are required. Random factors are used in encryption and decryption, so that the generated encryption process key has randomness, which improves the reliability of encryption. At the same time, the management platform (such as the server) verifies and warns the real-time (i.e., current time) of the device location data and the collection data, and eliminates all possible attacks and tampering behaviors, which helps to improve the security of special information collection terminals.

[0122] See also Fig. 9 , the communication method of the server of the present application includes: Step 031: receiving encrypted data sent by the terminal; Step 032: decrypt the encrypted data to obtain the original data, which at least includes the collected data of the terminal, the current time and the current location of the terminal; Step 033: Based on at least one of the current time and the current location, determine whether the collected data is compliant.

[0123] Among them, the specific description of steps 031 to 033 can be found in the communication method of the terminal, which will not be repeated here.

[0124] See also Fig.10 In some embodiments, the communication method of the server further includes: Step 034: receiving a first random code, current time and a first check code sent by the terminal; Step 035: Generate an encryption process key based on the current time, the first random code and the initial encryption key of the terminal; Alternatively, an encryption process key is generated based on the current time, the first random code, the second random code and the initial encryption key of the terminal; the initial encryption key of the terminal is determined based on the identification information of the terminal and a preset key; Step 032: Decrypt the encrypted data to obtain the original data, including: Step 0321: Based on the encryption process key, decrypt the encrypted data to obtain the original data.

[0125] Among them, the specific description of step 034, step 035 and step 0321 can be found in the communication method of the terminal, which will not be repeated here.

[0126] In some embodiments, the communication method of the server further includes: When the data reading and writing device is detected to be connected, the data reading and writing device is authenticated to obtain a third authentication result, where the third authentication result includes a pass or a fail; When the identity authentication is passed, the encryption parameters of the terminal are issued or the collected data of the terminal stored in the data reading and writing device is read.

[0127] In some embodiments, the data sent by the server includes encryption parameters of each terminal and corresponding identification information; a plurality of groups of collected data are stored in the data reading and writing device, and each group of collected data corresponds to one terminal.

[0128] In some embodiments, the data reading and writing device transmits the collected data and the fourth verification code to the server, the fourth verification code is generated based on a preset algorithm and the collected data, and the communication method of the server further includes: A fifth check code is generated based on a preset algorithm and the received data, and whether the received data is valid is determined based on the fourth check code and the fifth check code.

[0129] According to the method described in the above embodiment, the present application embodiment also provides a terminal communication device 300, which is used to execute the steps in the above terminal communication method. Fig.11 , Fig.11 3 is a schematic diagram of the structure of a communication device 300 of a terminal provided in an embodiment of the present application. The communication device 300 of the terminal includes: The communication module 307 is used to read the target encryption parameter stored in the connected data reading and writing device, where the encryption parameters corresponding to each terminal are stored, and the target encryption parameter is the encryption parameter corresponding to the current terminal; decrypt the target encryption parameter based on the initial key of the terminal to obtain the decryption parameter, where the decryption parameter at least includes the initial encryption key of the terminal; based on the decryption parameter, update the parameter in the terminal that matches the decryption parameter; The acquisition module 301 is used to acquire original data, which at least includes the collected data of the terminal, the current time and the current location of the terminal; The transmission module 302 is used to encrypt the original data based on the initial encryption key and transmit the encrypted data to the server.

[0130] In some embodiments, the communication device 300 of the terminal further includes: A first generating module 303, configured to generate a first random code, and generate an encryption process key based on the current time, the first random code and an initial encryption key of the terminal; The transmission module 302 is specifically used to encrypt the original data based on the encryption process key and transmit the encrypted data to the server.

[0131] In some embodiments, the communication device 300 of the terminal further includes: The first identity authentication module 304 is used to perform identity authentication on the server to obtain a first authentication result, where the first authentication result includes pass or fail; if the identity authentication passes, the original data is obtained.

[0132] In some embodiments, the first identity authentication module 304 is specifically used to: Send an authentication request to the server; Receive the server certificate sent by the server; Verify that the server certificate is valid based on the server public key; If yes, the terminal certificate is sent to the server so that the server verifies whether the terminal certificate is valid based on the terminal public key; If not, the first authentication result is determined to be identity authentication failure; If the terminal certificate is valid, determining the first authentication result is that the identity authentication is passed; When the terminal certificate is invalid, the first authentication result is determined to be identity authentication failure.

[0133] In some embodiments, the first generation module 303 is also used to generate a first random code; generate an encryption process key based on the current time, the first random code, the second random code and the initial encryption key of the terminal; the transmission module 302 is specifically used to encrypt the original data based on the encryption process key and transmit the encrypted data to the server.

[0134] In some embodiments, the first generating module 303 is further used to generate a first verification code based on the current time, the first random code, the encrypted data and the encryption process key; The transmission module 302 is further specifically used to transmit the encrypted data, the first random code, the current time and the first verification code to the server.

[0135] In some embodiments, the communication device 300 of the terminal also includes a first compliance detection module 305, which is used to perform compliance detection on the current location to obtain a compliance detection result, and the compliance detection result includes whether the location is compliant or non-compliant; the transmission module 302 is specifically used to transmit encrypted data and compliance detection results to the server.

[0136] In some embodiments, the communication device 300 of the terminal also includes an access detection module 306 and a communication module 307. The access detection module 306 is used to perform identity authentication on the data reading and writing device when it detects that the data reading and writing device has accessed, so as to obtain a second authentication result, and the second authentication result includes pass or fail; the communication module 307 is used to communicate with the data reading and writing device when the identity authentication passes, so as to update the terminal parameters and / or send the collected data to the data reading and writing device.

[0137] In some embodiments, the communication module 307 is specifically used to send the unuploaded data to the data reading and writing device.

[0138] In some embodiments, the communication module 307 is specifically used to read encryption parameters that match the identification information of the current terminal.

[0139] In some embodiments, the communication module 307 is specifically used to transmit the collected data and the second verification code to the data reading and writing device, the second verification code is generated based on a preset algorithm and the collected data, the data reading and writing device generates a third verification code based on the preset algorithm and the received data, and determines whether the received data is valid based on the second verification code and the third verification code.

[0140] According to the method described in the above embodiment, the present application embodiment also provides a communication device 400 of a server, which is used to execute the steps in the communication method of the server. Fig.12 , Fig.12 4 is a schematic diagram of the structure of a communication device 400 of a server provided in an embodiment of the present application. The communication device 400 of the server includes: Receiving module 401, used for receiving encrypted data sent by the terminal; The decryption module 402 is used to decrypt the encrypted data to obtain the original data, which at least includes the collected data of the terminal, the current time and the current location of the terminal; The second compliance detection module 403 is used to determine whether the collected data is compliant based on at least one of the current time and the current location; the compliance judgment method for the current time includes at least one of the following: the current time is within a preset time period; whether the upload period of the encrypted data is equal to the preset period; and whether the time difference between the current time and the time when the server sends the data upload request is less than the preset time difference.

[0141] In some embodiments, the receiving module 401 is also used to receive a first random code, current time and first verification code sent by the terminal; the server's communication device 400 also includes a second generation module 404, and the second generation module 404 is used to generate an encryption process key based on the current time, the first random code and the initial encryption key of the terminal; or, to generate an encryption process key based on the current time, the first random code, the second random code and the initial encryption key of the terminal; the initial encryption key of the terminal is determined based on the terminal's identification information and a preset key; the decryption module 402 is specifically used to decrypt the encrypted data based on the encryption process key to obtain the original data.

[0142] In some embodiments, the second compliance detection module 403 is specifically used to determine that the collected data is non-compliant when either the current time or the current location is non-compliant; and to determine that the collected data is compliant when both the current time and the current location are compliant.

[0143] In some embodiments, the communication device 400 of the server further includes a second identity authentication module 405, and the second identity authentication module 405 is used to: When the data reading and writing device is detected to be connected, the data reading and writing device is authenticated to obtain a third authentication result, where the third authentication result includes a pass or a fail; When the identity authentication is passed, the encryption parameters of the terminal are issued or the collected data of the terminal stored in the data reading and writing device is read.

[0144] In some embodiments, the communication device 400 of the server further includes a verification module 406. The data reading and writing device transmits the collected data and the fourth verification code to the server. The fourth verification code is generated based on a preset algorithm and the collected data. The verification module 406 is used to: A fifth check code is generated based on a preset algorithm and the received data, and whether the received data is valid is determined based on the fourth check code and the fifth check code.

[0145] It should be noted that the specific details of each module unit in the above communication device have been described in detail in the embodiment of the communication method of the above terminal, and will not be repeated here.

[0146] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0147] In some embodiments, the communication device in the embodiments of the present application can be implemented in hardware, such as an electronic device, or a component in an electronic device, such as an integrated circuit or a chip; the communication device can also be implemented in software, such as as an application installed in an electronic device.

[0148] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the embodiment of the communication method of the above-mentioned terminal are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0149] The processor may be a processor in the electronic device in the above embodiment. The computer readable storage medium may be a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0150] Computer readable media may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other solid-state memory technology, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, cassettes, tapes, disk storage or other magnetic storage devices. Of course, those skilled in the art will know that computer storage media are not limited to the above. The above-mentioned system memory 504 and mass storage device 507 can be collectively referred to as memory.

[0151] The embodiment of the present application also provides a computer program product, including a computer program, which implements the communication method of the above-mentioned terminal when executed by a processor. The processor may be a processor in the electronic device in the above-mentioned embodiment. When the computer program is executed by the processor, each process of the embodiment of the communication method of the above-mentioned terminal is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0152] It is understandable that in the specific implementation of this application, data related to user identity or characteristics is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0153] In the description of this specification, the descriptions with reference to the terms "certain embodiments", "in an example", "exemplarily", etc., mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0154] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0155] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. A communication method for a terminal, characterized in that: include: Reading a target encryption parameter stored in a connected data reading and writing device, wherein the data reading and writing device stores encryption parameters corresponding to each terminal, and the target encryption parameter is the encryption parameter corresponding to the current terminal; Decrypting the target encryption parameter based on the initial key of the terminal to obtain a decryption parameter; Based on the decryption parameter, updating the parameters in the terminal that match the decryption parameter, the updated parameters at least including an initial encryption key; Acquire original data, the original data including at least the collected data of the terminal, the current time and the current location of the terminal; The original data is encrypted based on the initial encryption key, and the encrypted data is transmitted to the server.

2. The communication method according to claim 1, characterized in that: The terminal transmits the encrypted data to the server, so that the server decrypts the encrypted data to obtain the original data, and determines whether the collected data is compliant based on at least one of the current time and the current location; wherein the compliance determination method of the current time includes at least one of the following: The current time is within a preset time period; Whether the uploading period of the encrypted data is equal to the preset period; and Whether the time difference between the current time and the time when the server sends the data upload request is less than a preset time difference.

3. The communication method according to claim 1, characterized in that: The encrypting the original data based on the initial encryption key and transmitting the encrypted data to the server includes: Generate a first random code; Generate an encryption process key based on the current time, the first random code and the initial encryption key of the terminal; The original data is encrypted based on the encryption process key, and the encrypted data is transmitted to the server.

4. The communication method according to claim 1, characterized in that: The method further comprises: Performing identity authentication on the server to obtain a first authentication result, wherein the first authentication result includes a pass or a fail; When the identity authentication is passed, the step of obtaining the original data is entered.

5. The communication method according to claim 4, characterized in that: The performing identity authentication on the server to obtain a first authentication result includes: Sending an identity authentication request to the server; Receiving a server certificate sent by the server; Verifying whether the server certificate is valid based on the server public key; If yes, sending the terminal certificate to the server so that the server verifies whether the terminal certificate is valid based on the terminal public key; If not, the first authentication result is determined to be identity authentication failure; If the terminal certificate is valid, determining that the first authentication result is identity authentication passed; When the terminal certificate is invalid, the first authentication result is determined to be identity authentication failure.

6. The communication method according to claim 1, characterized in that: The terminal receives a second random code sent by the server, where the second random code is used in a data encryption process of the terminal.

7. The communication method according to claim 6, characterized in that: The encrypting the original data based on the initial encryption key and transmitting the encrypted data to the server includes: Generate a first random code; Generate an encryption process key based on the current time, the first random code, the second random code, and an initial encryption key of the terminal; The original data is encrypted based on the encryption process key, and the encrypted data is transmitted to the server.

8. The communication method according to claim 3 or 7, characterized in that: Also includes: Generate a first verification code based on the current time, the first random code, the encrypted data and the encryption process key; The transmitting of encrypted data to the server comprises: The encrypted data, the first random code, the current time and the first verification code are transmitted to the server.

9. The communication method according to claim 3 or 7, characterized in that: The terminal transmits the encrypted data to the server, so that the server generates the encryption process key based on the current time, the first random code and the initial encryption key of the terminal; Alternatively, the encryption process key is generated based on the current time, the first random code, the second random code generated by the server, and the initial encryption key of the terminal; The initial encryption key of the terminal is determined based on the identification information of the terminal and the preset key of the server; the server also decrypts the encrypted data based on the encryption process key to obtain the original data, and determines whether the collected data is compliant based on at least one of the current time and the current location.

10. The communication method according to claim 1, characterized in that: The method further comprises: Performing a compliance check on the current location to obtain a compliance check result, wherein the compliance check result includes whether the location is compliant or not compliant; The transmitting of encrypted data to the server comprises: The encrypted data and the compliance detection result are transmitted to the server.

11. The communication method according to claim 1, characterized in that: The method further comprises: When the data reading and writing device is detected to be connected, the data reading and writing device is authenticated to obtain a second authentication result, wherein the second authentication result includes a pass or a fail; When the identity authentication is passed, communication is performed with the data reading and writing device to update the parameters of the terminal and / or send the collected data to the data reading and writing device.

12. The communication method according to claim 11, characterized in that: The collected data includes at least one of uploaded data and non-uploaded data, and the sending of the collected data to the data reading and writing device includes: The unuploaded data is sent to the data reading and writing device.

13. The communication method according to claim 12, characterized in that: The sending the collected data to the data reading and writing device comprises: The collected data and the second check code are transmitted to the data reading and writing device, wherein the second check code is generated based on a preset algorithm and the collected data, and the data reading and writing device generates a third check code based on the preset algorithm and the received data, and determines whether the received data is valid based on the second check code and the third check code.

14. The communication method according to claim 1, characterized in that: The data reading and writing device stores identification information of each terminal and the encryption parameters corresponding to each identification information, and the target encryption parameters stored in the accessed data reading and writing device are read, including: The target encryption parameter matching the identification information of the current terminal is read.

15. A communication method for a server, characterized in that: include: Receiving encrypted data sent by the terminal; Decrypting the encrypted data to obtain original data, the original data at least including the collected data of the terminal, the current time and the current location of the terminal; Determining whether the collected data is compliant based on at least one of the current time and the current location; The compliance determination method for the current time includes at least one of the following: The current time is within a preset time period; Whether the uploading period of the encrypted data is equal to the preset period; and Whether the time difference between the current time and the time when the server sends the data upload request is less than a preset time difference.

16. The communication method according to claim 15, characterized in that: The method further comprises: Receiving a first random code, current time and a first check code sent by the terminal; Generate an encryption process key based on the current time, the first random code and the initial encryption key of the terminal; Alternatively, the encryption process key is generated based on the current time, the first random code, the second random code generated by the server, and the initial encryption key of the terminal; the initial encryption key of the terminal is determined based on the identification information of the terminal and the preset key of the server; Decrypting the encrypted data to obtain the original data includes: Based on the encryption process key, the encrypted data is decrypted to obtain the original data.

17. The communication method according to claim 15, characterized in that: The determining whether the collected data is compliant based on at least one of the current time and the current location includes: In the case that any one of the current time and the current location is not in compliance, determining that the collected data is not in compliance; In a case where both the current time and the current location are compliant, it is determined that the collected data is compliant.

18. The communication method according to claim 17, characterized in that: The compliance determination method of the current location includes at least one of the following: The current location is within a preset geographical area; The current location is matched with the historical location.

19. The communication method according to claim 15, characterized in that: Also includes: When the data reading and writing device is detected to be connected, the data reading and writing device is authenticated to obtain a third authentication result, wherein the third authentication result includes a pass or a fail; When the identity authentication is passed, the encryption parameters of the terminal are issued or the collected data of the terminal stored in the data reading and writing device is read.

20. The communication method according to claim 19, characterized in that: The data sent by the server includes encryption parameters of each terminal and corresponding identification information; The data reading and writing device stores multiple groups of collected data, and each group of collected data corresponds to a terminal.

21. The communication method according to claim 19, characterized in that: The data reading and writing device transmits the collected data and the fourth verification code to the server, the fourth verification code is generated based on a preset algorithm and the collected data, and the method further includes: A fifth check code is generated based on the preset algorithm and the received data, and whether the received data is valid is determined based on the fourth check code and the fifth check code.

22. A controller, characterized in that: The controller is used to execute the communication method of the terminal according to any one of claims 1-14.

23. The controller according to claim 22, comprising: A positioning module, used to collect the current location of the terminal; A security authentication module is used to read a target encryption parameter stored in a connected data reading and writing device, wherein the data reading and writing device stores encryption parameters corresponding to each terminal, and the target encryption parameter is the encryption parameter corresponding to the current terminal; Decrypting the target encryption parameter based on the initial key of the terminal to obtain a decryption parameter; Based on the decryption parameter, updating the parameters in the terminal that match the decryption parameter, the updated parameters at least including an initial encryption key; and Encrypting the transmitted data based on the initial encryption key; The main control module is used to obtain original data, transmit the original data to the security authentication module for encryption, and transmit the encrypted data to the server, wherein the original data at least includes the collected data of the terminal, the current time, and the current location of the terminal.

24. The controller according to claim 23, characterized in that The security authentication module is also used to generate a first random code, generate an encryption process key based on the current time, the first random code and the initial encryption key of the terminal; or, generate the encryption process key based on the current time, the first random code, the second random code generated by the server and the initial encryption key of the terminal, and encrypt the original data based on the encryption process key.

25. The controller according to claim 23, characterized in that The security authentication module is also used to generate a check code for performing integrity check on the transmitted data.

26. The controller according to claim 23, characterized in that The security authentication module is also used for: Authenticate the server or connected data reading and writing device; When the server identity authentication is passed, encrypting the transmission data; When the data reading and writing device passes the identity authentication, decrypting the encryption parameters stored in the data reading and writing device to obtain the decryption parameters; The main control module data is also used to update the parameters in the terminal that match the decryption parameters based on the decryption parameters; and / or, when the identity authentication of the data reading and writing device is passed, send the collected data to the data reading and writing device.

27. The controller according to claim 26, characterized in that The data reading and writing device includes a hardware security token.

28. The controller according to claim 23, characterized in that The controller further comprises: A data acquisition module, wherein the data acquisition module is used to acquire the acquired data; A communication module is used to communicate with the server.

29. The controller according to claim 23, characterized in that The main control module includes a plurality of data interfaces, and the main control module communicates with the functional modules of the terminal respectively through the plurality of data interfaces.

30. A terminal, characterized in that: A controller comprising any one of claims 22-29.

31. A server, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the communication method of the server as described in any one of claims 15 to 21 is implemented.

32. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the communication method of the terminal as described in any one of claims 1 to 14 or the communication method of the server as described in any one of claims 15 to 21 is implemented.

33. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the communication method of the terminal according to any one of claims 1 to 14, or the communication method of the server according to any one of claims 15 to 21.

Images