Iot data security transmission method and iot data security transmission system

Abstract

The application relates to the technical field of network security, in particular to an Internet of Things (IoT) data security transmission method and system, which comprises an IoT device and an IoT platform. The IoT device generates business plaintext data and a first symmetric key, encrypts the business plaintext data and a device serial number to obtain ciphertext, and encrypts the first symmetric key by using a platform encryption public key. Meanwhile, the IoT device signs the business plaintext data by using a device signature private key. The IoT device sends the ciphertext, the encrypted first symmetric key and signature data to the IoT platform. The platform decrypts the first symmetric key by using a platform encryption private key, further decrypts the ciphertext to obtain the business plaintext data and the device serial number, and verifies the signature data by using a device signature public key. After verification, the IoT platform processes the business plaintext data. The application ensures the security of IoT data transmission and is suitable for various IoT application scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an Internet of Things data security transmission method and an Internet of Things data security transmission system. BACKGROUND

[0002] The national requirements standards for Internet of Things devices, GB / T 36951-2018 Information Security Technology Internet of Things Perception Terminal Application Security Technology Requirements, GB / T 37024-2018 Information Security Technology Internet of Things Perception Layer Gateway Security Technology Requirements, GB / T 37025-2018 Information Security Technology Internet of Things Data Transmission Security Technology Requirements, and GB / T 37093-2018 Information Security Technology Internet of Things Perception Layer Access to Communication Network Security Requirements, clearly require that the data collected by Internet of Things devices must ensure the confidentiality, integrity, and freshness of the data.

[0003] With the popularity of Internet of Things devices, their security has attracted widespread attention. However, in the current communication between Internet of Things devices and the cloud, there are risks of forgery, data theft, and man-in-the-middle attacks for Internet of Things devices as terminal devices. However, when Internet of Things device manufacturers and application manufacturers use Internet of Things devices to transmit data, they use plaintext, weak encryption, and other methods for transmission, which cannot guarantee the security of the data, and device authentication through device serial numbers cannot ensure device access security. SUMMARY

[0004] In order to overcome the deficiencies of the prior art, the present application provides an Internet of Things data security transmission method and an Internet of Things data security transmission system to ensure the security of Internet of Things data during transmission.

[0005] The first aspect of the present application provides an Internet of Things data security transmission method applied to an Internet of Things data security transmission system, wherein the Internet of Things data security transmission system includes an Internet of Things device and an Internet of Things platform, and the method includes:

[0006] The Internet of Things device generates business plaintext data and randomly generates a first symmetric key;

[0007] The Internet of Things device encrypts the business plaintext data and a device serial number according to the first symmetric key to obtain ciphertext; the device serial number corresponds to the Internet of Things device;

[0008] The Internet of Things device encrypts the first symmetric key according to a platform encryption public key to obtain first key ciphertext data; the platform encryption public key corresponds to the Internet of Things platform and is pre-stored in the Internet of Things device;

[0009] The Internet of Things device signs the business plaintext data according to a device signature private key in a pre-generated device signature key pair, to obtain first signature data;

[0010] The Internet of Things device sends the ciphertext, the first key ciphertext data and the first signature data to the Internet of Things platform;

[0011] When the Internet of Things platform receives the ciphertext, the first key ciphertext data and the first signature data sent by the Internet of Things device, the Internet of Things platform decrypts the first key ciphertext data according to a platform encryption private key, to obtain the first symmetric key;

[0012] The Internet of Things platform decrypts the ciphertext according to the first symmetric key, to obtain the business plaintext data and the device serial number;

[0013] The Internet of Things platform queries a device signature public key according to the device serial number, and verifies the first signature data according to the device signature public key;

[0014] When the Internet of Things platform determines that the first signature data is verified successfully, the Internet of Things platform processes the business plaintext data.

[0015] In an optional implementation, the method further comprises:

[0016] The Internet of Things platform generates instruction plaintext data, and randomly generates a second symmetric key;

[0017] The Internet of Things platform encrypts the instruction plaintext data according to the second symmetric key, to obtain data ciphertext;

[0018] The Internet of Things platform queries a corresponding device encryption public key in a pre-generated device encryption key pair according to the device serial number, and encrypts the second symmetric key according to the device encryption public key, to obtain second key ciphertext data;

[0019] The Internet of Things platform signs the instruction plaintext data according to a platform signature private key, to obtain second signature data;

[0020] The Internet of Things platform sends the data ciphertext, the second key ciphertext data and the second signature data to the Internet of Things device;

[0021] When the Internet of Things device receives the data ciphertext, the second key ciphertext data and the second signature data sent by the Internet of Things platform, the Internet of Things device decrypts the second key ciphertext data according to a device encryption private key, to obtain the second symmetric key;

[0022] The Internet of Things device decrypts the data ciphertext according to the second symmetric key to obtain the instruction plaintext data;

[0023] The Internet of Things device verifies the second signature data according to the platform signature public key; the platform signature public key corresponds to the Internet of Things platform and is pre-stored in the Internet of Things device;

[0024] The Internet of Things device processes the instruction plaintext data when determining that the second signature data is verified.

[0025] In an optional embodiment, the method further comprises:

[0026] The Internet of Things device randomly generates the device signature key pair, signs the device signature public key and the device serial number according to the device signature private key in the device signature key pair to obtain third signature data, and encrypts the device signature public key and the device serial number according to the platform encryption public key to obtain ciphertext data;

[0027] The Internet of Things device sends the third signature data and the ciphertext data to the Internet of Things platform;

[0028] The Internet of Things platform decrypts the ciphertext data according to the platform encryption private key to obtain the device signature public key and the device serial number, and verifies the third signature data according to the device signature public key;

[0029] The Internet of Things platform randomly generates the device encryption key pair, encrypts the device encryption private key in the device encryption key pair according to the device signature public key to obtain encrypted private key ciphertext, and signs the device encryption public key and the encrypted private key ciphertext according to the platform signature private key to obtain fourth signature data;

[0030] The Internet of Things platform sends the encrypted private key ciphertext, the device encryption public key and the fourth signature data to the Internet of Things device;

[0031] The Internet of Things device verifies the fourth signature data according to the platform signature public key, and decrypts the encrypted private key ciphertext according to the device signature private key to obtain the device encryption private key;

[0032] The Internet of Things device stores the device encryption public key and the device encryption private key to obtain the device encryption key pair.

[0033] In an optional embodiment, the Internet of Things device is integrated with a secure chip MCU and a communication module, and the Internet of Things device sending the ciphertext, the first key ciphertext data and the first signature data to the Internet of Things platform comprises:

[0034] The security chip MCU sends the ciphertext, the first key ciphertext data and the first signature data to the communication module;

[0035] The communication module establishes a communication connection with the Internet of Things platform to send the ciphertext, the first key ciphertext data and the first signature data to the Internet of Things platform.

[0036] The second aspect of the present application provides an Internet of Things data security transmission system, the system comprises:

[0037] an Internet of Things device and an Internet of Things platform;

[0038] The Internet of Things device is configured to generate business plaintext data and randomly generate a first symmetric key, encrypt the business plaintext data and a device serial number according to the first symmetric key to obtain ciphertext, the device serial number corresponding to the Internet of Things device, encrypt the first symmetric key according to a platform encryption public key to obtain first key ciphertext data, the platform encryption public key corresponding to the Internet of Things platform and pre-stored in the Internet of Things device, sign the business plaintext data according to a device signature private key in a pre-generated device signature key pair to obtain first signature data, and send the ciphertext, the first key ciphertext data and the first signature data to the Internet of Things platform;

[0039] The Internet of Things platform is configured to, when receiving the ciphertext, the first key ciphertext data and the first signature data sent by the Internet of Things device, decrypt the first key ciphertext data according to a platform encryption private key to obtain the first symmetric key, decrypt the ciphertext according to the first symmetric key to obtain the business plaintext data and the device serial number, query a device signature public key according to the device serial number and verify the first signature data according to the device signature public key, and process the business plaintext data when determining that the first signature data is verified successfully.

[0040] In summary, the method and system for secure data transmission of the Internet of Things provided by the application, through the Internet of Things device, first generates business plaintext data and a random decryption key, and encrypts the data and its own device serial number using the key to generate ciphertext. Then, the device encrypts the key with the public key of the platform to generate key ciphertext, and uses the pre-set device signature key to digitally sign the plaintext data to generate signature data. Finally, the device sends the three information to the Internet of Things platform. After receiving the data, the platform uses its own private key to decrypt the key ciphertext to obtain the decryption key, then uses the decryption key to decrypt the ciphertext sent by the device to obtain the original data and the device serial number, and verifies the signature data of the device through the verification of the device signature public key to confirm the data integrity. Only after the verification is successful, the platform will perform subsequent business processing. In this way, the data confidentiality and identity authentication are realized in the whole transmission process, effectively preventing the data from being intercepted or tampered with by a third party in the transmission process, and ensuring the safety and reliability of the Internet of Things data in the transmission process. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is a structural schematic diagram of an Internet of Things data secure transmission system according to an embodiment of the application;

[0042] Figure 2 is a flowchart of an Internet of Things data secure transmission method according to an embodiment of the application;

[0043] Figure 3 is another flowchart of an Internet of Things data secure transmission method according to an embodiment of the application;

[0044] Figure 4 is an interaction schematic diagram of secure encryption transmission of data between an Internet of Things device and an Internet of Things platform according to an embodiment of the application;

[0045] Figure 5 is a flowchart of secure issuance of device keys by an Internet of Things platform according to an embodiment of the application;

[0046] Figure 6 is an interaction schematic diagram of secure issuance of device keys by an Internet of Things platform according to an embodiment of the application. DETAILED DESCRIPTION

[0047] The application will be further described below in conjunction with the drawings and embodiments.

[0048] The concept, specific structure and generated technical effects of the present application will be described clearly and completely in combination with the embodiments and the drawings, so as to fully understand the purpose, features and effects of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments, and other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative labor are within the protection scope of the present application. In addition, all the coupling / connection relations involved in the patent do not mean that the components are directly connected, but that a better coupling structure can be composed by adding or reducing coupling accessories according to the specific implementation. The technical features in the present application can be combined interactively without conflict.

[0049] Referring to Figure 1 Fig. 1 is a structural schematic diagram of an Internet of Things data security transmission system according to an embodiment of the present application.

[0050] The Internet of Things data security transmission system 1 comprises an Internet of Things terminal and an Internet of Things platform 10. The Internet of Things terminal comprises a plurality of Internet of Things devices 20 connected in network. The Internet of Things device 20 is provided with a security chip MCU 201 and a communication module 202. The security chip MCU 201 is responsible for security operations such as encryption, decryption, signature and signature verification of data, while the communication module 202 is responsible for data sending and receiving. The Internet of Things platform 10 and the Internet of Things device 20 perform data transmission and key exchange through the communication module 202.

[0051] In some embodiments, the security chip MCU refers to a data security chip integrated with a national secret IP security core (a hardware module integrated with national secret SM2 / SM3 / SM4 / SM9 algorithms), or a data security software development kit (Software Development Kit, SDK) equipped with a HXMU305 data security chip, supporting national secret SM2 / SM3 / SM4 / SM9 algorithms. The Internet of Things platform can be connected with the Internet of Things AIoT platform + application service of Tianyi Internet of Things, and through the AIoT national secret service, zero-trust authentication based on UDP / TCP / HTTP / MQTT / LWM2M protocols is provided, national secret key management is used, and DTLS / TLS channel encryption is supported. In addition, the Internet of Things platform can also be connected with other cloud application systems to realize cross-cloud transmission and processing of data.

[0052] The present application provides security based on data security chip and cloud password service, solves the process of mutual secure transmission of data between Internet of Things device and Internet of Things platform, and realizes data security transmission, device authentication, confidentiality protection and integrity protection.

[0053] Referring to Figure 2As shown, it is a flow diagram of an Internet of Things data security transmission method according to an embodiment of the present application, which comprises the following steps.

[0054] The platform signature public key and the platform encryption public key correspond to the Internet of Things platform, and are pre-stored in the Internet of Things device, that is, the Internet of Things device pre-stores the signature public key and the encryption public key corresponding to the Internet of Things platform. It should be noted that the signature key pair includes the signature public key and the signature private key, and the encryption key pair includes the encryption public key and the encryption private key. In order to distinguish the signature key pair and the encryption key pair of the Internet of Things platform and the Internet of Things device, the signature public key of the Internet of Things platform is referred to as the platform signature public key, the signature private key of the Internet of Things platform is referred to as the platform signature private key, the encryption public key of the Internet of Things platform is referred to as the platform encryption public key, the encryption private key of the Internet of Things platform is referred to as the platform encryption private key, the signature public key of the Internet of Things device is referred to as the device signature public key, the signature private key of the Internet of Things device is referred to as the device signature private key, the encryption public key of the Internet of Things device is referred to as the device encryption public key, and the encryption private key of the Internet of Things device is referred to as the device encryption private key.

[0055] S21, the Internet of Things device generates business plaintext data and randomly generates a first symmetric key.

[0056] Referring to Figure 4 When the Internet of Things device needs to report data to the Internet of Things platform, the security chip MCU of the Internet of Things device first needs to determine the business plaintext data D to be reported. The symmetric key K at the Internet of Things device end is randomly generated and pre-generated. In order to distinguish the symmetric key at the Internet of Things platform end, the symmetric key at the Internet of Things device end is referred to as the first symmetric key.

[0057] S22, the Internet of Things device encrypts the business plaintext data and the device serial number according to the first symmetric key to obtain ciphertext.

[0058] The device serial number corresponds to the Internet of Things device, and the device serial number ID is unique. Referring to Figure 4 , the security chip MCU encrypts the business plaintext data D and the device serial number ID by using the first symmetric key K, to obtain ciphertext .

[0059] S23, the Internet of Things device encrypts the first symmetric key according to the platform encryption public key to obtain first key ciphertext data.

[0060] The Internet of Things device pre-builds the platform encryption public key corresponding to the Internet of Things platform. Referring to Figure 4 , the security chip MCU can encrypt the first symmetric key K by using the pre-stored platform encryption public key to obtain key ciphertext data (referred to as the first key ciphertext data).

[0061] S24, the Internet of Things device signs the service plaintext data according to the device signature private key in the pre-generated device signature key pair, to obtain first signature data.

[0062] In some embodiments, in order to avoid data tampering and forgery to enhance data confidentiality, the Internet of Things device randomly generates its corresponding signature key pair, including a device signature public key and a device signature private key. Referring to Figure 4 , the security chip MCU can sign the service plaintext data D using the device signature private key to obtain signature data s (referred to as the first signature data).

[0063] S25, the Internet of Things device sends the ciphertext, the first key ciphertext data, and the first signature data to the Internet of Things platform.

[0064] Referring to Figure 4 , when the ciphertext , the first key ciphertext data , and the first signature data s are generated, the security chip MCU can send the ciphertext , the first key ciphertext data , and the first signature data s to the communication module that establishes a communication connection with the Internet of Things platform, and send the ciphertext , the first key ciphertext data , and the first signature data s to the Internet of Things platform through the communication module.

[0065] S26, when the Internet of Things platform receives the ciphertext, the first key ciphertext data, and the first signature data sent by the Internet of Things device, the Internet of Things platform decrypts the first key ciphertext data according to the platform encryption private key, to obtain the first symmetric key.

[0066] Referring to Figure 4 , when the Internet of Things platform receives the ciphertext , the first key ciphertext data , and the first signature data s uploaded by the Internet of Things device, since the first key ciphertext data is encrypted by the Internet of Things device based on the platform encryption public key, the Internet of Things platform can decrypt the first key ciphertext data using the platform encryption private key corresponding to the platform encryption public key, and when the decryption is successful, the first symmetric key K can be correctly obtained.

[0067] S27, the Internet of Things platform decrypts the ciphertext according to the first symmetric key, to obtain the service plaintext data and the device serial number.

[0068] When the first symmetric key K is decrypted, the Internet of Things platform can decrypt the ciphertext using the first symmetric key K When the decryption is successful, the service plaintext data D and the device serial number ID can be correctly obtained.

[0069] S28, the Internet of Things platform queries the device signature public key according to the device serial number, and verifies the first signature data according to the device signature public key.

[0070] Since the device serial number ID of each Internet of Things device is unique, the device signature key and the device encryption key corresponding to each Internet of Things device are different. Before accessing the Internet of Things platform, the Internet of Things device needs to be registered. During the registration process, the Internet of Things device generates a pair of signature keys, i.e. a device signature public key and a device signature private key. When registering, the Internet of Things device uploads the device signature public key to the Internet of Things platform, and the device signature public key will be used by the Internet of Things platform for subsequent encryption of the device encryption private key and verification of the integrity of the data sent by the Internet of Things device. The device signature private key is stored in the security chip MCU of the Internet of Things device, and is used to decrypt the encrypted private key ciphertext sent by the Internet of Things platform and verify the signature of the data sent by the Internet of Things platform. After the device serial number ID is decrypted, the Internet of Things platform can query the corresponding device signature public key in the database. The device signature public key is generated by the Internet of Things device during registration and stored on the Internet of Things platform, and is used to verify the signature data of the Internet of Things device. When the device signature public key is queried, the Internet of Things platform can verify the first signature data s based on the device signature public key. Specifically, since the first signature data s is signed by the security chip MCU based on the device signature private key on the service plaintext data D, and the device signature private key and the device signature public key are one-to-one corresponding, the Internet of Things platform verifies the first signature data s by using the correct device signature public key.

[0071] S29, when the Internet of Things platform determines that the first signature data verification is successful, the service processes the service plaintext data.

[0072] Further, when the verification is successful, i.e. the first signature data s is indeed sent by the corresponding Internet of Things device and has not been tampered with, the Internet of Things platform can process the service plaintext data D according to the business logic, including updating the device state, recording the log, executing the instruction and other operations.

[0073] Through the optional implementation manner, the service plaintext data is encrypted by the randomly generated first symmetric key, thereby effectively preventing the data from being leaked in the transmission process. Meanwhile, the symmetric key is encrypted by the platform encryption public key, and the service plaintext data is signed by the device signature private key, thereby further enhancing the confidentiality and integrity of the data. The Internet of Things platform can confirm the source and integrity of the data by verifying the signature and decrypting the data, thereby making correct service processing, ensuring the security of the data transmission between the Internet of Things device and the platform, improving the security and credibility of the Internet of Things system, and providing strong security guarantee for the Internet of Things application.

[0074] With reference to Figure 3 Another flowchart of an embodiment of the application is shown, which is a method for secure data transmission in the Internet of Things. The method comprises the following steps.

[0075] S31, the Internet of Things platform generates instruction plaintext data and randomly generates a second symmetric key.

[0076] With reference to Figure 4 When the Internet of Things platform needs to issue data to the Internet of Things device, the Internet of Things platform first determines the instruction plaintext data d to be issued. Similarly, the symmetric key k of the Internet of Things platform is also randomly generated and pre-generated. In order to distinguish the symmetric key of the Internet of Things device, the symmetric key of the Internet of Things platform is referred to as the second symmetric key.

[0077] S32, the Internet of Things platform encrypts the instruction plaintext data according to the second symmetric key, to obtain data ciphertext.

[0078] With reference to Figure 4 The Internet of Things platform can encrypt the instruction plaintext data d by using the second symmetric key k, to obtain data ciphertext .

[0079] S33, the Internet of Things platform queries the corresponding device encryption public key in the pre-generated device encryption key pair according to the device serial number, and encrypts the second symmetric key according to the device encryption public key, to obtain second key ciphertext data.

[0080] The device encryption public key is generated by the Internet of Things device when registering and stored on the Internet of Things platform. The Internet of Things platform queries the device encryption public key corresponding to the device serial number ID of the Internet of Things device from the database. With reference to Figure 4 After the device encryption public key is queried, the Internet of Things platform can encrypt the second symmetric key k by using the device encryption public key, to obtain key ciphertext data (referred to as second key ciphertext data).

[0081] S34, the Internet of Things platform signs the instruction plaintext data according to a platform signature private key to obtain second signature data.

[0082] With reference to Figure 4 , the Internet of Things platform can sign the instruction plaintext data d using a platform signature private key to obtain signature data (referred to as second signature data).

[0083] S35, the data ciphertext, the second key ciphertext data and the second signature data are sent to the Internet of Things device.

[0084] With reference to Figure 4 , after the data ciphertext , the second key ciphertext data and the fourth signature data are generated, the Internet of Things platform can send the generated data ciphertext , the second key ciphertext data and the fourth signature data to the communication model of the Internet of Things device, and send the generated data ciphertext , the second key ciphertext data and the fourth signature data to the security chip MCU of the Internet of Things device through the communication module.

[0085] S36, when the Internet of Things device receives the data ciphertext, the second key ciphertext data and the second signature data sent by the Internet of Things platform, the second key ciphertext data is decrypted according to a device encryption private key to obtain the second symmetric key.

[0086] With reference to Figure 4 , when the security chip MCU of the Internet of Things device receives the data ciphertext , the second key ciphertext data and the fourth signature data issued by the Internet of Things platform, the second key ciphertext data is first decrypted using a device encryption private key, and when the decryption is successful, the second symmetric key k can be correctly obtained.

[0087] S37, the Internet of Things device decrypts the data ciphertext according to the second symmetric key to obtain the instruction plaintext data.

[0088] With reference to Figure 4 , since the data ciphertext is encrypted by the Internet of Things platform based on the second symmetric key k to the instruction plaintext data d, after the second symmetric key k is decrypted, the security chip MCU can use the second symmetric key k to decrypt the data ciphertext The decryption is performed, and when the decryption is successful, the instruction plaintext data d can be correctly obtained.

[0089] S38, the Internet of Things device verifies the second signature data according to the platform signature public key.

[0090] Since the second signature data is obtained by signing the instruction plaintext data d by the platform signature private key by the Internet of Things platform, when the second signature data is received, the Internet of Things device can verify the second signature data by using the pre-stored platform signature public key corresponding to the Internet of Things platform.

[0091] S39, when it is determined that the second signature data is verified, the Internet of Things device processes the instruction plaintext data.

[0092] When the verification is successful, that is, the second signature data is indeed issued by the corresponding Internet of Things platform and is not tampered with, the Internet of Things device can process the instruction plaintext data d verified according to the service logic, including updating the device state, recording the log, executing the instruction, and the like.

[0093] Through the above optional implementation, the instruction plaintext data is encrypted by the second symmetric key randomly generated, the data confidentiality is ensured, the symmetric key and the platform signature private key are used to sign the instruction data by using the device encryption public key, the data integrity and the source credibility are enhanced, and the received instruction is ensured to be real and effective by the Internet of Things device through the verification of the signature and the decryption of the data, so that the operation is accurately executed, the data leakage and tampering are effectively prevented, and the security is provided for the stable operation of the Internet of Things system.

[0094] Referring to Figure 5 , a flowchart of a process of issuing a device key by an Internet of Things platform is shown.

[0095] S51, the Internet of Things device randomly generates the device signature key pair, signs the device signature public key and the device serial number according to the device signature private key in the device signature key pair to obtain third signature data, and encrypts the device signature public key and the device serial number according to the platform encryption public key to obtain ciphertext data.

[0096] In some embodiments, based on the PKI public key infrastructure, each IoT device is assigned a unique identity authentication information (such as a device encryption key) for identity recognition and security verification when the IoT device accesses the network or communicates with other devices and servers. The device encryption key is like an "identity card" of the IoT device, and only through the verification of the device encryption key, the IoT device can perform legal operations such as data transmission and receiving instructions. For a further description of the PKI public key infrastructure, please refer to the following description. Figure 6 When the IoT device needs to upload data to the IoT platform, the device serial number ID of the IoT device is determined, and the platform signature public key PubK and the device serial number ID are signed by using the device signature private key to obtain signature data S (referred to as third signature data). Then, the platform signature public key PubK and the device serial number ID are encrypted by using the platform encryption public key to obtain ciphertext data E. Specifically, the platform signature public key PubK and the platform encryption public key corresponding to the IoT platform are pre-stored in the security chip MCU built-in in the IoT device, and a pair of signature key pairs are randomly generated by the security chip MCU, that is, a device signature public key and a device signature private key. In the security chip MCU, the platform signature public key PubK and the device serial number ID are signed by using the device signature private key to obtain the third signature data S, and the platform signature public key PubK and the device serial number ID can also be encrypted by using the platform encryption public key to obtain the ciphertext data E.

[0097] S52, the IoT device sends the third signature data and the ciphertext data to the IoT platform.

[0098] When the third signature data S and the ciphertext data E are generated, the security chip MCU of the Internet of Things device can send the third signature data S and the ciphertext data E to a communication module that establishes a communication connection with the Internet of Things platform, and send the third signature data S and the ciphertext data E to the Internet of Things platform through the communication module. In some embodiments, in the initialization phase, a unique asymmetric key (including a public key and a private key) can be generated when the Internet of Things device is manufactured or first configured. In the identity verification phase, the Internet of Things device can use its own private key to sign the authentication information, and the Internet of Things platform uses the corresponding public key to verify, wherein the public key can be public, but only the Internet of Things device that has the corresponding private key can correctly sign, thereby ensuring the authenticity of the Internet of Things device. In the data transmission phase, the Internet of Things device can use the public key of the receiver (for example, the Internet of Things platform) to encrypt the data to be transmitted, and only the receiver that has the corresponding private key can correctly decrypt the data, thereby ensuring that the data can only be read by the authorized receiver. It should be noted that the key pair (including the signature key pair and the encryption key pair) is unique in the life cycle of the Internet of Things device, and the private key is securely stored inside the Internet of Things device, that is, stored in the internal security chip MCU and not accessed externally. In order to enhance security, the system should support regular or on-demand updating of the key pair. When the key pair needs to be updated, the Internet of Things platform can generate a new key pair and issue it to the Internet of Things device through a secure channel. After receiving the new key pair, the Internet of Things device replaces the old key pair and continues to use the new key pair for subsequent data transmission and authentication operations.

[0099] Through the above optional implementation, through "one machine one secret", each Internet of Things device has an independent key, so that even if the key of one device is cracked, the security of other devices is still not affected, compared with "one machine multiple secrets" or shared key mode, greatly reducing the propagation range of security risk. And the key of each device is unique, so that in the security management process, a single device can be conveniently monitored, audited and troubleshooting. If a security problem occurs, the specific device can be accurately located to trace the source of the security event.

[0100] S53, the Internet of Things platform decrypts the ciphertext data according to the platform encryption private key to obtain the device signature public key and the device serial number, and verifies the third signature data according to the device signature public key.

[0101] Referring to Figure 6When the IoT platform receives the third signature data S and the ciphertext data E sent by the IoT device, since the ciphertext data E is encrypted by the platform encryption public key, which contains the platform signature public key PubK and the device serial number ID, the IoT platform can decrypt the ciphertext data E based on its own platform encryption private key. Since encryption and decryption are corresponding, using the correct private key can successfully decrypt the data encrypted by the corresponding public key. When the decryption is successful, the IoT platform can correctly obtain the platform signature public key PubK and the device serial number ID in plaintext form. Further, after decrypting the platform signature public key PubK, the IoT platform can verify the third signature data S based on the platform signature public key PubK. Since the third signature data S is signed by the device signature private key based on the platform signature public key PubK and the device serial number ID, it is used to verify the integrity of the information and the identity of the sender. Therefore, when verifying the third signature data S, the IoT platform can recalculate the hash value of the device serial number ID, and then perform a certain mathematical operation (such as the verification algorithm in RSA or ECDSA) on the third signature data S using the platform signature public key PubK. Compare the output result with the calculated hash value. When they match, it means that the signature is valid, that is, the third signature data S is indeed generated by the IoT device that owns the corresponding private key, and the data has not been tampered with in the transmission process. If they do not match, the signature is invalid, and there may be a security problem or data error.

[0102] Through the above optional implementation, encryption ensures the confidentiality of data in the transmission process, and signature ensures the integrity of data and the identity authentication of the sender. Through the encryption and signature mechanism, the security and integrity of data are jointly ensured.

[0103] S54, the IoT platform randomly generates the device encryption key pair, encrypts the device encryption private key in the device encryption key pair according to the device signature public key, obtains the encrypted private key ciphertext, and signs the device encryption public key and the encrypted private key ciphertext according to the platform signature private key, obtains the fourth signature data.

[0104] S55, the IoT platform sends the encrypted private key ciphertext, the device encryption public key and the fourth signature data to the IoT device.

[0105] Referring to Figure 6 Figure 6, the IoT platform randomly generates a pair of encryption keys, including an encryption public key EPubK (referred to as a device encryption public key) and an encryption private key EPriK (referred to as a device encryption private key), and encrypts the device encryption private key EPriK based on the device signature public key to obtain an encryption private key ciphertext Enc (EPriK), and signs the device encryption public key EPubK and the encryption private key ciphertext Enc (EPriK) using the platform signature private key to obtain a signature data Sign (referred to as fourth signature data). When the encryption private key ciphertext Enc (EPriK) and the fourth signature data Sign are generated, the IoT platform can send the encryption private key ciphertext Enc (EPriK), the fourth signature data Sign, and the device encryption public key EPubK to the IoT device. Specifically, the IoT platform first sends the encryption private key ciphertext Enc (EPriK), the fourth signature data Sign, and the device encryption public key EPubK to the communication module of the IoT device, and sends the encryption private key ciphertext Enc (EPriK), the fourth signature data Sign, and the device encryption public key EPubK to the security chip MCU of the IoT device through the communication module.

[0106] Through the above optional implementation, the IoT platform randomly generates a pair of encryption keys, and encrypts the device encryption private key using the device signature public key, ensuring the security of the device encryption private key during transmission. The IoT platform signs the device encryption public key and the encryption private key ciphertext using the platform signature private key to generate second signature data to verify the integrity and authenticity of the data, effectively preventing tampering and leakage of data during transmission, and ensuring the security of communication between the IoT device and the IoT platform.

[0107] S56, the IoT device verifies the fourth signature data according to the platform signature public key, and decrypts the encryption private key ciphertext according to the device signature private key to obtain the device encryption private key.

[0108] When the security chip MCU of the IoT device receives the encryption private key ciphertext Enc (EPriK), the fourth signature data Sign, and the device encryption public key EPubK, it can verify the fourth signature data Sign based on the platform signature public key according to the same embodiment of step S23. If the verification is successful, it can be determined that the encryption private key ciphertext Enc (EPriK) and the device encryption public key EPubK have not been tampered with during transmission, and are indeed sent by the IoT platform. After successfully verifying the second signature data, the IoT device can decrypt the encryption private key ciphertext Enc (EPriK) using the platform signature private key, and obtain the device encryption private key EPriK when the decryption is successful.

[0109] S57, the Internet of Things device stores the device encryption public key and the device encryption private key to obtain the device encryption key pair.

[0110] When the Internet of Things platform generates the device encryption key pair (device encryption public key EPubK and device encryption private key EPriK), the Internet of Things platform synchronously sends the device encryption public key EPubK when sending the fourth signature data Sign to the Internet of Things device, and then the Internet of Things device can store the device encryption public key EPubK and the device encryption private key EPriK in the secure storage area of the device, that is, in the secure chip MCU, to obtain the complete encryption key pair after decryption.

[0111] Through the above-mentioned optional implementation, through the mutual authentication and data encryption transmission between the Internet of Things device and the Internet of Things platform, the security and integrity of data transmission are ensured. The Internet of Things device signs by using the signature key pair, and the Internet of Things platform verifies by using the corresponding public key, which ensures the authenticity of the identity of the Internet of Things device. At the same time, the encryption key pair generated by the Internet of Things platform ensures the security of the encryption key in the transmission process. After receiving the encryption key, the Internet of Things device verifies and decrypts to obtain the device encryption private key, and then the device encryption private key and the device encryption public key form an encryption key pair, which is used for subsequent secure communication, effectively preventing data leakage and tampering, and improving the overall security of the Internet of Things system.

[0112] In an optional implementation, the method further comprises:

[0113] The Internet of Things device determines the corresponding device serial number and verifies the device serial number;

[0114] The Internet of Things device uploads the device serial number to the Internet of Things platform through device registration when the device serial number verification is successful;

[0115] The Internet of Things platform generates a device encryption key corresponding to the Internet of Things device based on the device serial number;

[0116] The Internet of Things platform sends the device encryption key to the Internet of Things device, so that the Internet of Things device stores the device encryption key to the secure storage area.

[0117] In some embodiments, the IoT device reads the device serial number stored in the device internally, such as in the secure chip MCU, through the hardware interface at startup or a specific time, verifies the read device serial number through the secure chip MCU to ensure that it is in the correct format, has not been tampered with, and meets the specifications of the device manufacturer. When the device serial number verification is successful, the IoT device starts the device registration process, in which the IoT device can listen to the communication module to establish a connection with the IoT platform based on a secure communication protocol (such as HTTPS, TLS, etc.), and the IoT device uploads the device serial number as part of the registration information to the IoT platform. The IoT platform receives the device serial number uploaded by the IoT device and also needs to verify the received device serial number to ensure its uniqueness, non-repetition registration, and compliance with the platform's registration specifications. When the device serial number verification is successful, the IoT platform generates a device encryption key based on the device serial number, which can use a secure encryption algorithm (such as AES, RSA, etc.) and combine the device serial number as input to ensure the uniqueness and security of the key. In addition, the IoT platform can also store the device serial number and the device encryption key in association to facilitate subsequent management and query. Further, the IoT platform sends the generated device encryption key back to the IoT device through a secure communication protocol. During transmission, the IoT platform takes measures such as encryption and signature to ensure the security and integrity of the device encryption key during transmission. After receiving the device encryption key, the IoT device stores it in the secure storage area of the device, such as the secure chip MCU.

[0118] In an optional implementation, the method further comprises:

[0119] The IoT platform updates the device encryption key according to a preset time period to obtain a new device encryption key, and sends the new device encryption key to the IoT device;

[0120] The IoT device matches the new device encryption key with the currently used device encryption key after receiving the new device encryption key;

[0121] The IoT device replaces the device encryption key with the new device encryption key when the matching result is a match.

[0122] In some embodiments, the IoT platform can generate a new device encryption key based on the device serial number of the IoT device at a regular time interval, and distribute the new device encryption key to the corresponding IoT device through a secure channel (such as a TLS / SSL protocol). The IoT device receiving the new device encryption key can match the new device encryption key with the device encryption key being used to determine whether they are the same, and when they are not the same, the matching result is determined to be a matching success. When the matching result is a matching success, the IoT device can replace the old device encryption key with the new device encryption key, and ensure that the current data transmission and authentication operation is not interrupted during the replacement. Further, the IoT device can update its configuration (for example, update the firmware, software or related configuration file of the device) to use the new device encryption key for subsequent data transmission and authentication operation. In some embodiments, after replacing the device encryption key, the IoT device can perform a series of tests to ensure that the new device encryption key is working properly and that the data transmission and authentication operation is not affected.

[0123] Through the above optional implementation, the IoT platform generates a device encryption key based on the device serial number, enhances the uniqueness and security of the key, and periodically updates the device encryption key, effectively preventing the risk of key leakage. When the IoT device receives the new key, it can smoothly replace the old key to ensure the continuity of data transmission and authentication operation, and improve the security of the IoT device and the flexibility of key management.

[0124] It should be noted that, for the foregoing method embodiments, in order to facilitate description, they are all described as a combination of a series of actions, but those skilled in the art should know that the present application is not limited by the order of the described actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions and modules involved are not necessarily essential to the present application.

[0125] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0126] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the described embodiments. Those skilled in the art can make various equivalent modifications or replacements without departing from the spirit of the present application, and these equivalent modifications or replacements are all included in the scope defined by the claims of the present application.

Claims

1. A method for secure data transmission in the Internet of Things (IoT), characterized in that, Applied to an IoT data security transmission system, the IoT data security transmission system including IoT devices and an IoT platform, the method includes: The IoT device generates plaintext business data and randomly generates a first symmetric key; The IoT device encrypts the plaintext business data and the device serial number using the first symmetric key to obtain ciphertext; the device serial number corresponds to the IoT device. The IoT device encrypts the first symmetric key using the platform's encryption public key to obtain the first key ciphertext data; the platform's encryption public key corresponds to the IoT platform and is pre-installed in the IoT device. The IoT device signs the plaintext data of the service according to the device signature private key in the pre-generated device signature key pair to obtain the first signature data; The IoT device sends the ciphertext, the first key ciphertext data, and the first signature data to the IoT platform; When the IoT platform receives the ciphertext, the first key ciphertext data, and the first signature data sent by the IoT device, it decrypts the first key ciphertext data according to the platform's encryption private key to obtain the first symmetric key. The IoT platform decrypts the ciphertext using the first symmetric key to obtain the plaintext business data and the device serial number; The IoT platform queries the device signature public key based on the device serial number, and verifies the first signature data based on the device signature public key; Once the IoT platform determines that the first signature data has been successfully verified, it processes the plaintext data. The IoT device randomly generates the device signature key pair, and signs the device signature public key and the device serial number according to the device signature private key in the device signature key pair to obtain third signature data. Then, it encrypts the device signature public key and the device serial number according to the platform encryption public key to obtain ciphertext data. The third signature data and the ciphertext data are sent to the IoT platform. The IoT platform decrypts the ciphertext data using its platform encryption private key to obtain the device signature public key and the device serial number, and verifies the third signature data using the device signature public key; it randomly generates a device encryption key pair, encrypts the device encryption private key in the device encryption key pair using the device signature public key to obtain encrypted private key ciphertext, and signs the corresponding device encryption public key and the encrypted private key ciphertext in the device encryption key pair using the platform signature private key to obtain fourth signature data; it then sends the encrypted private key ciphertext, the device encryption public key, and the fourth signature data to the IoT device. The IoT device verifies the fourth signature data based on the platform's signature public key, and decrypts the encrypted private key ciphertext based on the device's signature private key to obtain the device's encrypted private key; it then stores the device's encrypted public key and the device's encrypted private key to obtain the device's encrypted key pair.

2. The IoT data secure transmission method according to claim 1, characterized in that, The method further includes: The IoT platform generates plaintext instruction data and randomly generates a second symmetric key; The IoT platform encrypts the plaintext instruction data using the second symmetric key to obtain ciphertext data. The IoT platform queries the pre-generated device encryption key pair corresponding to the device encryption public key based on the device serial number, and encrypts the second symmetric key based on the device encryption public key to obtain the second key ciphertext data; The IoT platform signs the plaintext data of the instruction according to the platform's signature private key to obtain second signature data; The encrypted data, the second key encrypted data, and the second signature data are sent to the IoT device; When the IoT device receives the encrypted data, the encrypted second key data, and the second signature data sent by the IoT platform, it decrypts the encrypted second key data according to the device's encryption private key to obtain the second symmetric key. The IoT device decrypts the ciphertext data using the second symmetric key to obtain the plaintext instruction data; The IoT device verifies the second signature data based on the platform's signature public key; the platform's signature public key corresponds to the IoT platform and is pre-installed in the IoT device. When the IoT device determines that the second signature data has been verified, it processes the plaintext instruction data.

3. The IoT data secure transmission method according to claim 1, characterized in that, The IoT device integrates a security chip MCU and a communication module. The IoT device sends the ciphertext, the first key ciphertext data, and the first signature data to the IoT platform, including: The security chip MCU sends the ciphertext, the first key ciphertext data, and the first signature data to the communication module; The communication module establishes a communication connection with the IoT platform to send the ciphertext, the first key ciphertext data, and the first signature data to the IoT platform.

4. An Internet of Things (IoT) data security transmission system, characterized in that, The system for executing the IoT data security transmission method according to any one of claims 1 to 3, the system comprising: Internet of Things (IoT) devices and IoT platforms; The IoT device is used to generate plaintext business data and randomly generate a first symmetric key; encrypt the plaintext business data and the device serial number according to the first symmetric key to obtain ciphertext; the device serial number corresponds to the IoT device; encrypt the first symmetric key according to the platform encryption public key to obtain first key ciphertext data; the platform encryption public key corresponds to the IoT platform and is pre-installed in the IoT device; sign the plaintext business data according to the device signature private key in the pre-generated device signature key pair to obtain first signature data; and send the ciphertext, the first key ciphertext data, and the first signature data to the IoT platform. The IoT platform is configured to, upon receiving the ciphertext, the first key ciphertext data, and the first signature data sent by the IoT device, decrypt the first key ciphertext data using the platform's encryption private key to obtain the first symmetric key; decrypt the ciphertext using the first symmetric key to obtain the service plaintext data and the device serial number; query the device signature public key using the device serial number and verify the first signature data using the device signature public key; and, upon confirming that the first signature data has been successfully verified, process the service plaintext data. The IoT device is further configured to randomly generate the device signature key pair, and sign the device signature public key and the device serial number according to the device signature private key in the device signature key pair to obtain third signature data, and encrypt the device signature public key and the device serial number according to the platform encryption public key to obtain ciphertext data; and send the third signature data and the ciphertext data to the IoT platform; The IoT platform is further configured to: decrypt the ciphertext data using the platform's private encryption key to obtain the device signature public key and the device serial number; verify the third signature data using the device signature public key; randomly generate a device encryption key pair; encrypt the device encryption private key in the device encryption key pair using the device signature public key to obtain encrypted private key ciphertext; and sign the corresponding device encryption public key and the encrypted private key ciphertext in the device encryption key pair using the platform's private signature key to obtain fourth signature data; and send the encrypted private key ciphertext, the device encryption public key, and the fourth signature data to the IoT device. The IoT device is also used to verify the fourth signature data according to the platform signature public key, and to decrypt the encrypted private key ciphertext according to the device signature private key to obtain the device encrypted private key; and to store the device encrypted public key and the device encrypted private key to obtain the device encrypted key pair.

Images