Device communication methods, apparatus, computer equipment and computer-readable media

Abstract

This application relates to a device communication method, apparatus, computer equipment, and computer-readable medium. The method includes: sending a first data packet generated by the device to a server via a client, and determining whether the server has received the first data packet, the first data packet including a key; if the server receives the key, sending a second data packet from the device to the server, the second data packet including encrypted data to be encrypted; if the server does not receive the key, sending the second data packet from the device to the client, decrypting the second data packet on the client, and then sending it to the server. In the initial binding phase between the device and the server, this application temporarily establishes a path for decrypting data via the client and forwarding it to the server. Even if the key is not synchronously sent, this decouples the device and the server and completes data interaction, which is more conducive to enhancing the communication quality and data security between the device and the server during initialization.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to device communication methods, apparatus, computer equipment and computer-readable media. Background Technology

[0002] With the rapid development of technology, the Internet of Things (IoT) has been widely applied in our daily lives. IoT devices, such as smart home devices and smart security systems, connect to the internet, enabling information exchange and remote control between devices. The choice of communication method is crucial in establishing a communication connection between IoT devices and servers; common methods include wired and wireless communication. Furthermore, some IoT devices employ key encryption technology to ensure data security during communication. These unique keys are sent to the server during device initialization and used for subsequent communication encryption and decryption.

[0003] However, information security issues are becoming increasingly prominent during the initialization of IoT devices. To ensure the security of communication between devices and servers, existing technologies typically employ a client-intermediate approach. The client first undergoes user authentication with the server, and then establishes connections with both the device and the server. While this approach improves communication security to some extent, several problems remain. Specifically, before the key is successfully sent to the server, the device and server are decoupled, and the device may send data packets to the server prematurely for various reasons. Since the server has not yet received the key, it cannot correctly decrypt the received data packets, leading to data processing failures or data loss.

[0004] It is evident that existing technologies have not yet proposed a more reliable solution to the data security issues caused by key synchronization problems during the initialization of IoT devices. Summary of the Invention

[0005] This application provides a device communication method, apparatus, computer equipment, and computer-readable medium to solve the technical problem of data security caused by key synchronization during the initialization process of IoT devices in the prior art.

[0006] According to one aspect of the embodiments of this application, this application provides a device communication method, the method comprising: sending a first data packet generated by the device to a server via a client, and determining whether the server has received the first data packet, the first data packet including a key; if the server receives the key, sending a second data packet from the device to the server, the second data packet including encrypted data to be encrypted; if the server has not received the key, sending the second data packet from the device to the client, decrypting the second data packet by the client, and then sending it to the server.

[0007] Optionally, before sending the first data packet generated by the device to the server via the client, the method further includes: constructing a first transmission channel between the device and the server and a second transmission channel between the device and the client with the client as the relay platform; generating the key based on a preset encryption algorithm by a key generation center on the device; sending the key to the server via the first transmission channel; and sending the key to the client via the second transmission channel.

[0008] Optionally, the device-based key generation center generates the key according to a preset encryption algorithm, including: determining the key length based on the data type of the data to be encrypted in the device; and generating the key on the device using a symmetric encryption algorithm based on the determined key length to obtain the key.

[0009] Optionally, the first data packet further includes device information. The step of sending the first data packet generated by the device to the server from the client and determining whether the server has received the first data packet includes: extracting the device information from the device, sending the device information to the client and the server, performing device authentication on the client and the device based on the device information; if the device authentication is successful, sending the key generated by the device to the client through the second transmission channel, and forwarding the key to the server through the client; and determining whether the server has received the key based on the server's feedback information.

[0010] Optionally, determining whether the server has received the key based on the server's feedback information includes: obtaining the server's feedback information, wherein the feedback information is determined based on the server's status of receiving the key, including first feedback information and second feedback information; if the feedback information is the first feedback information, it is determined that the server has not received the key; if the feedback information is the second feedback information, it is determined that the server has received the key.

[0011] Optionally, the step of sending the second data packet from the device to the client if the server does not receive the key, and then decrypting the second data packet from the client before sending it to the server, includes: if the server does not receive the key, encrypting the data to be encrypted on the device based on the key to obtain the second data packet; sending the second data packet from the device to the client; decrypting the second data packet based on a key temporarily stored on the client to obtain decrypted data, wherein the temporarily stored key is stored when the client sends the data to the server; and forwarding the decrypted data obtained by the client to the server.

[0012] Optionally, after forwarding the decrypted data obtained by the client to the server, the method further includes: sending the encrypted data on the device as verification data to the server; obtaining a first verification result generated by the server based on the verification data, and obtaining a second verification result returned by the server based on the decrypted data; comparing the first verification result with the second verification result to determine whether the first verification result and the second verification result are consistent; if the first verification result and the second verification result are consistent, then it is determined that the communication of the first transmission channel between the device and the server is normal, and the second transmission channel with the client as the forwarding node is cut off; if the first verification result and the second verification result are inconsistent, then it is determined that the communication of the first transmission channel between the device and the server is abnormal, and the second transmission channel with the client as the forwarding node is maintained.

[0013] According to another aspect of the embodiments of this application, this application provides a device communication apparatus, a judging module, configured to send a first data packet generated by the device to a server via a client, and judge whether the server has received the first data packet, wherein the first data packet includes a key; a first sending module, configured to send a second data packet from the device to the server if the server receives the key, wherein the second data packet includes encrypted data to be encrypted; and a second sending module, configured to send the second data packet from the device to the client if the server has not received the key, wherein the client decrypts the second data packet and then sends it to the server.

[0014] According to another aspect of the embodiments of this application, this application provides a computer device, including a memory, a processor, a communication interface, and a communication bus. The memory stores a computer program that can run on the processor. The memory and the processor communicate through the communication bus and the communication interface. When the processor executes the computer program, it implements the steps of the device communication method described above.

[0015] According to another aspect of the embodiments of this application, this application provides a computer-readable medium having processor-executable non-volatile program code that causes the processor to perform the steps of the device communication method.

[0016] Compared with related technologies, the technical solutions provided in this application have the following advantages:

[0017] This application provides a device communication method. During device initialization, it can not only encrypt data by generating a key to ensure the security of data transmission, but also determine whether the server has received the key. If the key is not received, that is, when the device and the server are decoupled, a temporary path is established for the client to decrypt the data and forward it to the server. Even if the key has not been sent synchronously, data interaction between the device and the server can be realized, which is more conducive to enhancing the communication quality and data security between the device and the server during device initialization. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the hardware environment for an optional device communication method provided according to an embodiment of this application;

[0021] Figure 2 This is a schematic flowchart of an optional device communication method provided according to an embodiment of this application;

[0022] Figure 3 This is a schematic diagram illustrating an optional data interaction according to an embodiment of this application;

[0023] Figure 4 This is a schematic diagram of another optional device communication method provided according to an embodiment of this application;

[0024] Figure 5 This is a schematic diagram of an optional device communication apparatus structure provided according to an embodiment of this application;

[0025] Figure 6 This is a schematic diagram of an optional computer device structure provided for an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] To address the problems mentioned in the background art, an embodiment of a device communication method is provided according to one aspect of the embodiments of this application.

[0028] like Figure 1 As shown, the above-described device communication method can be applied to, for example... Figure 1 The hardware environment shown is described. The system architecture 100 of the hardware environment includes a terminal device 101 and a server 103. The server 103 is connected to the terminal 101 via a network and can be used to provide services to the terminal or clients installed on the terminal. A database 105 can be set up on the server or independently of the server to provide data storage services to the server 103. The network can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0029] It should be noted that the device provided in this embodiment can be the terminal device 101 mentioned above, and the client provided in this embodiment can be an APP installed on the terminal device 101.

[0030] Users can use terminal device 101 to interact with server 103 via a network to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, search applications, instant messaging tools, etc. Terminal device 101 can be various electronic devices with a display screen that support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc. Server 103 can be a server providing various services, such as a backend server supporting the pages displayed on terminal device 101.

[0031] It should be noted that the device communication method provided in the embodiments of this application is generally executed by a server and / or a terminal device, and correspondingly, a device communication apparatus is generally disposed in the server / terminal device. Furthermore, it should be understood that... Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0032] like Figure 2 As shown, Figure 2 A flowchart illustrating a device communication method provided in an embodiment of the present invention. Taking the device communication method being executed by a server as an example, a device communication method includes the following steps:

[0033] Step S202: The first data packet generated by the device is sent to the server from the client, and it is determined whether the server has received the first data packet. The first data packet includes a key.

[0034] In this embodiment, combined with Figure 3 As shown, a device communication system can be built using the device, client, and server. The server processes data; the client establishes communication between the device and server and forwards various data from the device to the server; the device can communicate with the server and execute related actions. After establishing the correct communication link, the device and server can directly interact with each other, the device and client can interact with each other, and the client can interact with the server.

[0035] In this embodiment, the device communication method described above can be used in the initial binding phase between the device and the server. During the initial binding phase, the client sends a key to the server. If the server has not received the key by default, the client acts as a relay platform, forwarding the device's first data packet to the server. Once the server and device establish a correct connection, the server can correctly receive the key sent by the device, at which point the backup connection using the client as a relay platform can be disconnected.

[0036] Step S204: If the server receives the key, it sends the second data packet from the device to the server. The second data packet includes the encrypted data to be encrypted.

[0037] Combination Figure 4 As shown in this embodiment, the server will send feedback whether it receives the key or not, and the feedback information will differ depending on whether the key is received. The feedback information can be preset or customized. By analyzing the information fed back by the server, it can be determined whether the server has received the key.

[0038] Furthermore, when the server receives the key, it indicates that a correct communication link has been established between the device and the server, and the key can be successfully sent to the server for temporary storage. Therefore, after the server receives the key, it can send the second data packet from the device to the server. The server can decrypt the second data packet according to the received key to obtain the decrypted data.

[0039] Step S206: If the server does not receive the key, it sends the second data packet from the device to the client, and the client decrypts the second data packet before sending it to the server.

[0040] Combination Figure 4 As shown in this embodiment, when the server does not receive the key, if the device directly sends the second data packet to the server, the server cannot decrypt the second data packet. However, the device has already sent the key to the client for temporary storage. Therefore, the client can be used as a relay platform to build a temporary backup link. The second data packet that the device needs to send is first sent to the client. After decryption using the key temporarily stored on the client, the decrypted data is obtained and then forwarded to the server. Regardless of whether the server receives the key, it will not affect the acquisition of decrypted data from the server, so that the server can quickly respond based on the decrypted data and ensure the reliability of the data response.

[0041] In some examples, if there are multiple devices, different devices generate different keys, and different devices correspond to different keys. This enables point-to-point encryption between the server and the devices, thereby improving data transmission security, reducing the possibility of malicious mass attacks on data during transmission and storage, and enhancing system defense.

[0042] In this embodiment of the invention, during device initialization, not only can data be encrypted by generating a key to ensure the security of data transmission, but also, by determining whether the server has received the key, if the key has not been received, i.e., when the device and the server are decoupled, a temporary path is established for the client to decrypt the data and forward it to the server. Even if the key has not been sent synchronously, data interaction between the device and the server can be realized, which is more conducive to enhancing the communication quality and data security between the device and the server during device initialization.

[0043] In an optional embodiment, prior to step S202 above, the method further includes:

[0044] Establish a first transmission channel between the device and the server, and a second transmission channel between the device and the client, with the client as the relay platform.

[0045] The key is generated by the device-side key generation center according to a preset encryption algorithm.

[0046] In this embodiment, to enable data transmission between the device, client, and server, a network connection needs to be established between them. Common network connection methods include wired and wireless connections. Wired connections include, but are not limited to, Ethernet, USB, and HDMI connections; wireless connections include, but are not limited to, Wi-Fi, Bluetooth, Zigbee, and 4G / 5G. Furthermore, establishing a communication protocol is fundamental for data exchange between the device, client, and server. Communication protocols include, but are not limited to, HTTP / HTTPS, SSL, TLS, MQTT, and WebSocket protocols. On the device side, hardware configuration is required to enable network communication, including configuring Wi-Fi modules, GPRS modules, and 3G / 4G / 5G modules. These modules can connect to the device via serial ports, SPI, I2C, or other interfaces.

[0047] In this embodiment, the server also needs to have high-performance server hardware to ensure it can handle data transmission requests from a large number of devices, including selecting stable network connections and configuring appropriate network addresses and ports so that devices can establish connections. The server can be configured with a cloud platform, such as an MQTT server or an HTTP server, to handle data and instructions sent by devices and provide services such as data storage, device management, and data analysis. Furthermore, the server needs to provide communication interfaces and APIs for communication with devices, facilitating data exchange and communication between the devices and the server.

[0048] In this embodiment, a key can be generated by a key generation center on the device side according to a preset encryption algorithm. This preset encryption algorithm can be either a symmetric or asymmetric encryption algorithm. Symmetric encryption algorithms typically have faster encryption speeds, are suitable for processing large amounts of data, and, with the same key length, are generally more efficient than asymmetric encryption algorithms. Common symmetric encryption algorithms include AES (Advanced Encryption Standard), DES (Data Encryption Standard), and 3DES (Triple Data Encryption Standard), which can be used in network transmission, file encryption, database encryption, etc. For example, symmetric encryption algorithms can be used to protect the transmission of second data packets in network communication based on HTTPS and SSL / TLS protocols. Asymmetric encryption algorithms include RSA (Rivest-Shamir-Adleman algorithm) and ECC (Elliptic Curve Cryptography), which can be applied to digital signatures, key exchange, encrypted communication, etc. Because asymmetric encryption algorithms are slower in encryption and decryption, they are typically used for encrypting small amounts of data or for digital signatures.

[0049] In this embodiment, the corresponding encryption algorithm can be selected according to the specific usage scenario of the device communication method. For scenarios involving the encryption of large amounts of data, a symmetric encryption algorithm can be used to generate a symmetric key. For scenarios involving the encryption of small amounts of data with high data security requirements, an asymmetric encryption algorithm can be selected to generate a private key and a public key. For example, some publicly available news information can be encrypted using the DES encryption algorithm, while personal privacy information can be encrypted using the RSA encryption algorithm.

[0050] Furthermore, based on the aforementioned communication infrastructure, a first data transmission channel can be constructed for direct data interaction between the device and the server, as well as a second transmission channel between the device, client, and server. The device can directly send first data packets, second data packets, etc., to the server through the first transmission channel, or send the first data packets, second data packets, etc., to the client through the second transmission channel, and then relay them to the server through the client.

[0051] In this embodiment, by establishing a first transmission channel between the device and the server, secure data interaction between the client and the server can be ensured. By establishing a second transmission channel between the device, the client, and the server, in the event of an anomaly in the first transmission channel or the server failing to receive the key, the client can act as a relay platform to achieve temporary data interaction between the device and the server based on the second transmission channel, maintaining secure data and key transmission, ensuring data security while improving system stability and reliability. Data encryption and key distribution can be achieved by generating keys using a preset encryption algorithm.

[0052] In an optional embodiment, the key is generated by a device-side key generation center according to a preset encryption algorithm, including:

[0053] The key length is determined based on the data type of the data to be encrypted in the device.

[0054] Based on the determined key length, the key is generated on the device side using a symmetric encryption algorithm.

[0055] In some examples, the data to be encrypted can be text, image, audio, or other format files, with file extensions such as dump, bak, csv, xls, or xlsx. This invention does not impose specific restrictions on the file type or file extension of the data to be encrypted; these can be selected according to actual needs.

[0056] In this embodiment, different data types have different security level requirements for the data to be encrypted. Therefore, the key length can be determined based on the data type to ensure that different types of data meet the same security requirements. Data types with higher security requirements can be classified as sensitive data, including personal identification information, financial information, chat messages, and medical records. Data types with lower security requirements can be classified as non-sensitive data, including publicly available news, announcements, and ordinary documents.

[0057] Furthermore, data types with higher security requirements require longer key lengths. If the amount of data transmitted in the applicable system is small, a symmetric key can be generated using a symmetric encryption algorithm based on the determined key length. Conversely, if the amount of data transmitted in the applicable system is large, a key pair, including a public and private key, can be generated using an asymmetric encryption algorithm. The public key is then distributed to the client and server; for example, the `genrsa` command in OpenSSL can be used to generate a key pair on the device side.

[0058] In some examples, for data types with higher security requirements, a key length of 2048 bits or longer can be used, providing greater security and reducing the risk of data breaches. For data types with lower security requirements, a key length of less than 2048 bits can be used, reducing the computational complexity of encryption and decryption operations and improving performance. For example, if the data to be encrypted is a user's personal financial information, the RSA algorithm can be chosen for encryption, using a 2048-bit key length.

[0059] In this embodiment, by determining the key length according to the data type of the data to be encrypted, it is possible to meet the protection requirements of different security levels for different data types, which is more conducive to improving the security of data encryption and data transmission; by generating the key through a symmetric encryption algorithm, it is possible to ensure data encryption efficiency and data processing efficiency.

[0060] In an optional embodiment, step S202 specifically includes:

[0061] Extract the device information from the device and send the device information to the client and server. Perform device authentication on the client and device based on the device information.

[0062] If the device authentication is successful, the key generated on the device is sent to the client through the second transmission channel, and the client forwards the key to the server.

[0063] Determine whether the server has received the key based on the feedback information from the server.

[0064] In this embodiment, the first data packet may include device information. When multiple devices exist, the client and server can analyze the device information to achieve device authentication. The device information includes: device name, device ID, device type, brand / model, serial number, production date, manufacturer information, status information, timestamp, etc.

[0065] Furthermore, when establishing a temporary communication link, device information can be extracted from the device's static data repository. The client needs to obtain this device information for device authentication. After successful authentication, the generated key can be sent to the client. The client then forwards the device information to the server for further authentication, and subsequently forwards the key to the server as well. If authentication fails, it indicates a device anomaly, and key distribution will not proceed to ensure data security. The feedback information can be determined based on the server's key reception status. The feedback information differs depending on whether a key has been received.

[0066] In this embodiment, by obtaining device information and performing device verification first, point-to-point data transmission between the device, client, and server can be guaranteed. By using the client as a relay platform and implementing temporary data interaction between the device and server based on the second transmission channel, the device and server can be decoupled during the initial binding phase at each end. This prevents resource congestion caused by the device having to maintain a long connection during key transmission and confirmation, thereby ensuring the reliability of system operation.

[0067] In an optional embodiment, the above-mentioned determination of whether the server has received the key based on the server's feedback information specifically includes:

[0068] Obtain the feedback information from the server, which is determined based on the server's status in receiving the key, and includes first feedback information and second feedback information;

[0069] If the feedback information is the first feedback information, then it is determined that the server has not received the key;

[0070] If the feedback information is the second feedback information, then it is determined that the server has received the key.

[0071] In this embodiment, during the initial binding phase between the device and the server, it is assumed that the server has not received the key, and data is relayed through the client. Key reception is a continuous process. If the server has not received the key at a preset time interval, it returns a first feedback message. This first feedback message can be empty or a pre-agreed message between the server and the device regarding the failure to receive the key. The second feedback message can be a confirmation message indicating that the key has been received.

[0072] In some examples, after receiving the key from the device, the server verifies the key according to preset verification rules, such as checking the key's format, length, and expiration status. If the key verification passes, the server considers it successfully received; if verification fails, the server considers the received key invalid. Based on the key verification result, the server generates corresponding feedback information. If the key verification passes, the returned second feedback information may contain phrases such as "Key successfully received"; if verification fails, the returned first feedback information may contain phrases such as "Key invalid, please resend". Since key forwarding is based on the client as an intermediary platform before the server receives the key, the server sends the feedback information to the client through the established second transmission channel, which then forwards it to the device.

[0073] In some examples, the server, client, and device can also encrypt the feedback information using predetermined encryption methods to ensure the security of the feedback information, such as encrypting it with a fixed string.

[0074] Furthermore, after receiving the feedback information from the server, the device parses the feedback content. If the feedback information indicates that the key has been successfully received, the device can perform subsequent operations, such as continuing to send the encrypted second data packet. If the feedback information indicates that the key is invalid, the device may need to regenerate the key and send it to the server again to ensure the uniqueness of the key and maintain the connection with the server.

[0075] In this embodiment, when the client sends a key to the server, the server's feedback information is verified to determine whether the key has been received. If the key has been received, the device can directly send the second data packet to the server through the first transmission channel. Alternatively, if the key has not been received, the client can act as an intermediary platform to send the second data packet to the server through the second transmission channel. This not only completes the data transmission between the device and the server but also decouples them, preventing resource congestion caused by the device having to maintain a long connection during key transmission and confirmation, thereby ensuring the reliability of the system operation.

[0076] In an optional embodiment, step S206 specifically includes:

[0077] S2061, If ​​the server does not receive the key, the device encrypts the data to be encrypted based on the key to obtain the second data packet;

[0078] S2062, the second data packet from the device is sent to the client;

[0079] S2063, decrypt the second data packet based on the key temporarily stored by the client to obtain decrypted data, wherein the key temporarily stored is based on the key sent by the client to the server;

[0080] S2064, forward the decrypted data obtained by the client to the server.

[0081] In this embodiment, if the server does not receive the key, the transmission of the data to be encrypted will first be encrypted on the device side using the public key in the generated key pair or the generated symmetric key to obtain a second data packet. The second data packet may include the data to be encrypted, an encryption timestamp, and other information.

[0082] In some examples, data preprocessing can be performed before encryption, including handling missing values, outlier handling, data transformation, format conversion, and standardization. For instance, if the data to be encrypted is text, the text format can be converted to a file format that the server can receive and recognize. Another example is if the data to be encrypted is a table, the table content can be extracted and converted into text or other file formats to facilitate server reception and recognition.

[0083] Furthermore, combined Figure 4 As shown, after data encryption on the device side, the second data packet can be sent to the client via the second transmission channel. The client temporarily stores the key sent by the device, allowing it to decrypt the second data packet, extract the decrypted data, and then forward it to the server via the second transmission channel for a response. Upon receiving the decrypted data from the client, the server can send a confirmation message to the client, which then sends the confirmation message back to the device.

[0084] In other examples, after the second data packet is successfully uploaded to the server, a corresponding log file can be generated on the server to record the completion status of the decrypted data transmission. If no log file for decrypted data is recorded on the server, it indicates that the upload was unsuccessful. Thus, by recording log files on the server, the server can detect whether the decrypted data was uploaded successfully based on the log files. If the upload was unsuccessful, the server can promptly send feedback to the device to re-upload.

[0085] In this embodiment, by preprocessing the data to be encrypted, the data can be converted into a form that the server can receive and process, ensuring efficient and consistent data transmission. By encrypting the data to be encrypted with a key on the device side to generate a second data packet, data security can be guaranteed. By using the client as a relay platform to decrypt the second data packet and forward it to the server, not only can data transmission between the device and the server be completed, but the device and the server can also be decoupled, preventing resource congestion caused by the device having to maintain a long connection during key transmission and confirmation, thereby ensuring the reliability of system operation.

[0086] In an optional embodiment, after step S2064 above, the method further includes:

[0087] The encrypted data on the device is sent to the server as verification data.

[0088] Obtain the first verification result generated by the server based on the verification data, and obtain the second verification result returned by the server based on the decrypted data;

[0089] Compare the first verification result with the second verification result to determine whether the first verification result and the second verification result are consistent.

[0090] If the first verification result is consistent with the second verification result, it is determined that the communication of the first transmission channel between the device and the server is normal, and the second transmission channel with the client as the forwarding node is cut off.

[0091] If the first verification result is inconsistent with the second verification result, it is determined that the communication of the first transmission channel between the device and the server is abnormal, and the second transmission channel with the client as the forwarding node is maintained.

[0092] In this embodiment, the reason why the server does not receive the key may include communication link disconnection, network delay, etc. In fact, establishing a connection between the server and the device is a continuous process. In the initial binding phase, the server may not receive the key, but in the subsequent process, the communication between the server and the device will gradually return to normal. Therefore, after the recovery, the server can directly interact with the device based on the first transmission channel. At this time, the temporary backup connection that uses the client as a relay platform and interacts with data based on the second transmission channel will be disconnected.

[0093] In this embodiment, if the server can receive the key, it indicates that the device can directly interact with the server via the first transmission channel. To continuously monitor whether the server can receive the key, encrypted data from the device can be sent to the server as verification data. If the server receives the key, it will decrypt the verification data, obtain the decrypted data, and generate a first verification result. Additionally, after receiving the decrypted data sent by the client, the server will also return a second verification result. If the server has already received the key, the generated first and second verification results should be the same.

[0094] Furthermore, by comparing the first and second verification results, it can be determined whether the server can receive the key. If they match, it is determined that the first transmission channel between the device and the server is communicating normally, and the second transmission channel with the client as the forwarding node (relay platform) is cut off, that is, the backup channel is disconnected, and data interaction between the device and the server is restored based on the first transmission channel. Otherwise, data interaction will continue to be carried out using the second transmission channel.

[0095] In this embodiment, the verification data is directly sent to the server through the result verification method. The first verification result generated based on the verification data is compared with the second verification result generated based on the temporarily constructed client-decrypted data sent to the server to determine whether the server has received the key. After the first transmission channel between the device and the server is normal, the backup channel can be cut off in time to restore direct data interaction between the device and the server. This reduces the impact of the relay platform forwarding method on data transmission and processing efficiency, reduces the coupling between the server and the device, and avoids resource congestion caused by long-term connections.

[0096] In some examples, the communication status between clients, devices, and servers can also be monitored. If the communication status between the server and devices, or clients, changes—for example, due to a weak communication terminal or signal—technical personnel can be notified via alerts to troubleshoot the problem. Alert methods include audible and visual prompts, SMS messages, and emails. Once an anomaly is detected, timely measures can be taken to investigate and repair it, ensuring system stability.

[0097] In this embodiment, key management and updates can also be performed to ensure the freshness and security of the keys. A key management system can be established to manage the entire lifecycle of keys, including generation, distribution, storage, and destruction. Specifically, the system can detect whether the current key status meets the key update conditions and initiate an update. These conditions include update cycle, key usage count, key risk assessment value, and event-driven updates. The update cycle refers to periodic key updates; the key usage count refers to the number of times the key is invoked during data transmission and retrieval; the key risk assessment value refers to the level of risk determined based on the system's risk assessment results; and event-driven updates refer to user-driven or specific condition-driven key updates. Detecting whether the current key status meets the key update conditions can be performed on the device, server, or client. If any end triggers a key update, other ends can be synchronized for a system-wide key update, ensuring the consistency of the key and the encryption method used for encrypted data.

[0098] In this embodiment, key updates can be triggered by any one of the following: update cycle, key usage count, key risk assessment value, or event-driven update. This enables personalized management, and by managing and updating the key, the freshness and security of the key can be ensured, thus achieving full lifecycle management of the key.

[0099] According to another aspect of the embodiments of this application, such as Figure 5 As shown, corresponding to the device communication method in the above embodiments, this embodiment provides a device communication apparatus, the apparatus comprising:

[0100] The judgment module 501 is used to send the first data packet generated by the device to the server based on the client, and to determine whether the server has received the first data packet, wherein the first data packet includes a key;

[0101] The first sending module 503 is used to send a second data packet from the device to the server if the server receives the key, wherein the second data packet includes encrypted data to be encrypted;

[0102] The second sending module 505 is used to send the second data packet from the device to the client if the server does not receive the key, and then send the second data packet to the server after the client decrypts the second data packet.

[0103] It should be noted that in this embodiment, the judgment module 501 can be used to execute step S202 in this application embodiment, the first sending module 503 in this embodiment can be used to execute step S204 in this application embodiment, and the second sending module 505 in this embodiment can be used to execute step S206 in this application embodiment.

[0104] Optionally, the device further includes: a construction module for constructing a first transmission channel between the device and the server and a second transmission channel between the device and the client, with the client as the relay platform; and a key generation module for generating the key based on a preset encryption algorithm using a key generation center on the device.

[0105] Optionally, the key generation module includes: a key length determination submodule, used to determine the key length based on the data type of the data to be encrypted in the device; and a key generation submodule, used to generate the key on the device using a symmetric encryption algorithm based on the determined key length, thereby obtaining the key.

[0106] Optionally, the judgment module 501 includes: a first sending submodule, configured to extract the device information from the device end, send the device information to the client and the server, and perform device authentication on the client and the device end based on the device information; a second sending submodule, configured to send the key generated by the device end to the client through the second transmission channel if the device authentication is successful, and forward the key to the server through the client; and a judgment submodule, configured to determine whether the server has received the key based on the feedback information from the server.

[0107] Optionally, the judgment submodule includes: an acquisition unit, configured to acquire the feedback information from the server, the feedback information being determined based on the server's status in receiving the key, including first feedback information and second feedback information; a first judgment unit, configured to determine that the server has not received the key if the feedback information is the first feedback information; and a second judgment unit, configured to determine that the server has received the key if the feedback information is the second feedback information.

[0108] Optionally, the second sending module 505 includes: a data encryption submodule, used to encrypt the data to be encrypted on the device side based on the key if the server does not receive the key, to obtain the second data packet; a third sending submodule, used to send the second data packet from the device side to the client; a decryption submodule, used to decrypt the second data packet based on a key temporarily stored on the client side to obtain decrypted data, wherein the temporarily stored key is temporarily stored when the client sends the data to the server; and a fourth sending submodule, used to forward the decrypted data obtained by the client to the server.

[0109] Optionally, the device further includes: a verification data sending module, used to send encrypted data from the device to the server as verification data; a verification result acquisition module, used to acquire a first verification result generated by the server based on the verification data, and to acquire a second verification result returned by the server based on the decrypted data; a comparison module, used to compare the first verification result with the second verification result, and determine whether the first verification result and the second verification result are consistent; a first channel control module, used to determine that the communication of the first transmission channel between the device and the server is normal if the first verification result and the second verification result are consistent, and to disconnect the second transmission channel with the client as the forwarding node; and a second channel control module, used to determine that the communication of the first transmission channel between the device and the server is abnormal if the first verification result and the second verification result are inconsistent, and to maintain the second transmission channel with the client as the forwarding node.

[0110] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented either through software or through hardware.

[0111] It should be noted that the suffixes such as module, component, unit, submodule, and subunit used to represent elements in the above-described device are only for the purpose of illustrative purposes and have no specific meaning in themselves. Therefore, they can be used in combination.

[0112] According to another aspect of the embodiments of this application, this application provides a computer device, such as... Figure 6 As shown, the device includes a memory 601, a processor 603, a communication interface 605, and a communication bus 607. The memory 601 stores a computer program that can run on the processor 603. The memory 601 and the processor 603 communicate through the communication interface 605 and the communication bus 607. When the processor 603 executes the computer program, it implements the steps of the above-mentioned device communication method.

[0113] The memory and processor in the aforementioned computer equipment communicate with each other via a communication bus and a communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0114] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0115] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0116] According to another aspect of the embodiments of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the device communication method in any of the above embodiments.

[0117] Optionally, in this embodiment, the computer-readable medium is configured to store program code for the processor to execute the steps of the device communication method described in the above embodiments, the device communication method including:

[0118] Step S202: The first data packet generated by the device is sent to the server based on the client, and it is determined whether the server has received the first data packet. The first data packet includes a key.

[0119] Step S204: If the server receives the key, it sends the second data packet from the device to the server. The second data packet includes the encrypted data to be encrypted.

[0120] Step S206: If the server does not receive the key, it sends the second data packet from the device to the client, and the client decrypts the second data packet before sending it to the server.

[0121] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here. Furthermore, in the specific implementation of this application embodiment, the above embodiments can be consulted, and corresponding technical effects can be achieved.

[0122] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0123] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0124] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0126] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0127] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, the functional units in the various embodiments of this application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0128] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0129] It should be noted that, in this document, relational terms such as "first," "second," etc., are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprises a…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0130] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A device communication method, characterized in that, The method includes: The first data packet generated by the device is sent from the client to the server, and it is determined whether the server has received the first data packet. The first data packet includes a key. If the server receives the key, it will send the second data packet from the device to the server. The second data packet includes the encrypted data to be encrypted. If the server does not receive the key, it sends the second data packet from the device to the client, and the client decrypts the second data packet before sending it to the server. The method further includes, prior to sending the first data packet generated by the device to the server based on the client: Establish a first transmission channel between the device and the server, and a second transmission channel between the device and the server with the client as the relay platform; The key is generated by the device-side key generation center according to a preset encryption algorithm; The first data packet further includes device information. The step of sending the first data packet generated by the device to the server from the client and determining whether the server has received the first data packet includes: Extract the device information from the device and send the device information to the client and server. Perform device authentication on the client and server based on the device information. If the device authentication is successful, the key generated on the device is sent to the client through the second transmission channel, and the client forwards the key to the server. The server determines whether it has received the key based on the server's feedback information. The feedback information is determined based on the server's status of receiving the key, and the feedback information corresponding to not receiving the key and receiving the key is different. Wherein, if the server does not receive the key, it sends the second data packet from the device to the client, and the client decrypts the second data packet before sending it to the server, including: If the server does not receive the key, the device will encrypt the data to be encrypted based on the key to obtain the second data packet. Send the second data packet from the device to the client; The second data packet is decrypted based on the key temporarily stored by the client to obtain the decrypted data. The key temporarily stored is based on the key that the client sends to the server. The decrypted data obtained by the client is forwarded to the server.

2. The device communication method according to claim 1, characterized in that, The device-based key generation center generates the key according to a preset encryption algorithm, including: The key length is determined based on the data type of the data to be encrypted in the device. Based on the determined key length, the key is generated on the device side using a symmetric encryption algorithm.

3. The device communication method according to claim 1, characterized in that, The step of determining whether the server has received the key based on the server's feedback information includes: Obtain the feedback information from the server, which is determined based on the server's status in receiving the key, and includes first feedback information and second feedback information; If the feedback information is the first feedback information, then it is determined that the server has not received the key; If the feedback information is the second feedback information, then it is determined that the server has received the key.

4. The device communication method according to claim 1, characterized in that, After forwarding the decrypted data obtained by the client to the server, the method further includes: The encrypted data on the device is sent to the server as verification data; Obtain the first verification result generated by the server based on the verification data, and obtain the second verification result returned by the server based on the decrypted data; Compare the first verification result with the second verification result to determine whether the first verification result and the second verification result are consistent. If the first verification result is consistent with the second verification result, it is determined that the communication of the first transmission channel between the device and the server is normal, and the second transmission channel with the client as the forwarding node is cut off. If the first verification result is inconsistent with the second verification result, it is determined that the communication of the first transmission channel between the device and the server is abnormal, and the second transmission channel with the client as the forwarding node is maintained.

5. A device communication apparatus, characterized in that, The device includes: The judgment module is used to send the first data packet generated by the device to the server based on the client, and to determine whether the server has received the first data packet, wherein the first data packet includes a key; The first sending module is configured to send a second data packet from the device to the server if the server receives the key, wherein the second data packet includes encrypted data to be encrypted; The second sending module is used to send the second data packet from the device to the client if the server does not receive the key, and then send the second data packet to the server after the client decrypts the second data packet. The device further includes: The building module is used to build the first transmission channel between the device and the server, and the second transmission channel between the device and the server with the client as the relay platform. A key generation module is used to generate the key based on a preset encryption algorithm from a key generation center on the device side; The first data packet further includes device information, and the determination module includes: The first sending submodule is used to extract the device information from the device end, send the device information to the client and the server, and perform device authentication on the client and the server based on the device information; The second sending submodule is used to send the key generated by the device to the client through the second transmission channel if the device authentication is successful, and then forward the key to the server through the client. The judgment submodule is used to determine whether the server has received the key based on the feedback information from the server. The second sending module includes: The data encryption submodule is used to encrypt the data to be encrypted on the device side based on the key if the server does not receive the key, so as to obtain the second data packet; The third sending submodule is used to send the second data packet from the device to the client; The decryption submodule is used to decrypt the second data packet based on the key temporarily stored by the client to obtain the decrypted data. The key temporarily stored is based on the key sent by the client to the server. The fourth sending submodule is used to forward the decrypted data obtained by the client to the server.

6. A computer device, comprising a memory, a processor, a communication interface, and a communication bus, wherein the memory stores a computer program executable on the processor, and the memory and the processor communicate via the communication bus and the communication interface, characterized in that... When the processor executes the computer program, it implements the steps of the device communication method according to any one of claims 1 to 4.

7. A computer-readable medium having processor-executable non-volatile program code, characterized in that, The program code causes the processor to perform the steps of the device communication method according to any one of claims 1 to 4.

Images