Data transmission method and system based on SM series cryptographic algorithm

Abstract

The invention is suitable for the technical field of data transmission, and provides a data transmission method and system based on an SM series national secret algorithm, and the method comprises the steps: carrying out the key negotiation between an equipment end and an Internet of Things security gateway based on an SM2 algorithm and an SM3 algorithm; the equipment end encrypts data needing to be transmitted by adopting an SM4 algorithm to obtain encrypted data, and obtains a check code of the encrypted data; the equipment end sends the encrypted data and the check code to a data platform; the data platform sends the received encrypted data and the check code to a security gateway of the Internet of Things; the security gateway of the internet of things verifies the check code, and decrypts the encrypted data by using the session key when the check code passes the verification; and the security gateway of the internet of things sends the decrypted data to the data platform. The whole data transmission process is realized based on the SM series national cryptographic algorithm, and the data security can be improved at the same time.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data transmission, and particularly relates to a data transmission method and system based on SM series national secret algorithms. BACKGROUND

[0002] The existing encryption algorithm mainly includes symmetric encryption and asymmetric encryption, wherein the symmetric encryption is represented by the advanced encryption standard (AES), and the asymmetric encryption is mainly represented by the asymmetric encryption algorithm (RSA) and the elliptic curve encryption (ECC).

[0003] Among them, the symmetric encryption uses the same key for encryption and decryption, the representative algorithm is AES, which provides three key length options of 128 bits, 192 bits and 256 bits, has the characteristics of high efficiency and flexibility, and is widely used in network communication and data storage fields.

[0004] The asymmetric encryption uses a public key and a private key in pairs, has higher security but slower operation. The RSA is based on the large number decomposition principle, and the ECC uses the elliptic curve mathematical structure to achieve the same security level with a shorter key length.

[0005] The existing data transmission system mainly uses the combination of RSA and AES for encryption, which does not meet the mandatory requirement of using national secret algorithms for core data in relevant laws, and the existing scheme mainly depends on a single SM3 digest, lacks a strengthened verification mechanism against quantum computing attacks, and causes low data security. SUMMARY

[0006] The embodiments of the application provide a data transmission method and system based on SM series national secret algorithms, which can solve the problems that data cannot be completely encrypted by using national secret algorithms and data security is low.

[0007] In a first aspect, the embodiments of the application provide a data transmission method based on SM series national secret algorithms, which comprises the following steps:

[0008] Step 1, a device end and an Internet of Things security gateway perform key negotiation based on an SM2 algorithm and an SM3 algorithm;

[0009] Step 2, the device end uses an SM4 algorithm to encrypt the data to be transmitted to obtain encrypted data and obtain a check code of the encrypted data; an encryption key of the data to be transmitted is a session key after the key negotiation, the encrypted data carries a security parameter index after the key negotiation, and the security parameter index is used to uniquely identify the device end in a data transmission system;

[0010] Step 3, the device end sends the encrypted data and the check code to a data platform;

[0011] Step 4, the data platform sends the received encrypted data and check code to the Internet of Things security gateway;

[0012] Step 5, the Internet of Things security gateway checks the verification code, and when the verification code passes the verification, the encrypted data is decrypted using the session key;

[0013] Step 6, the Internet of Things security gateway sends the decrypted data to the data platform.

[0014] Optionally, step 1 comprises:

[0015] Step 1.1, the device end sends its own device identification code to the Internet of Things security gateway;

[0016] Step 1.2, the device end generates a first SM2 key pair based on the SM2 algorithm, the SM3 algorithm and the device identification code, which is used for SM2 decryption and signature verification;

[0017] Step 1.3, the Internet of Things security gateway generates a second SM2 key pair based on the SM2 algorithm, the SM3 algorithm and the device identification code, which is used for SM2 encryption and signature;

[0018] Step 1.4, the Internet of Things security gateway sends exchange data to the device end; the exchange data includes a security parameter index SPI used to uniquely identify the device end in the data transmission system, a ciphertext of the session key, and a signature value of the session key; the SPI and the session key are random data randomly generated by a random number generator in the Internet of Things security gateway, the ciphertext of the session key is obtained by encrypting the session key using the SM2 public key in the second SM2 key pair, and the signature value of the session key is obtained by signing the session key using the SM2 private key in the second SM2 key pair;

[0019] Step 1.5, the device end parses the received exchange data to obtain the SPI, the ciphertext of the session key, and the signature value of the session key;

[0020] Step 1.6, the device end verifies the signature value of the session key using the SM2 private key in the first SM2 key pair, and sends a notification message to the Internet of Things security gateway when the signature value of the session key passes the verification; the notification message is a ciphertext obtained by encrypting the SPI using the SM4 algorithm, and the encryption key of the SPI is the session key.

[0021] Optionally, generating an SM2 key pair based on the SM2 algorithm, the SM3 algorithm and the device identification code comprises:

[0022] using the SM3 algorithm to operate the device identification code, and taking the HASH result obtained by the operation as the SM2 private key of the SM2 key pair;

[0023] The SM2 public key of the SM2 key pair is generated based on the SM2 private key by using the SM2 algorithm; the SM2 key pair is a first SM2 key pair or a second SM2 key pair.

[0024] Optionally, the SPI is 4 bytes of random data randomly generated by a random number generator in the Internet of Things security gateway.

[0025] Optionally, the session key is 16 bytes of random data randomly generated by a random number generator in the Internet of Things security gateway.

[0026] Optionally, the data transmission method further comprises:

[0027] Step 7, the data platform sends the to-be-transmitted data to be sent to the device end to the Internet of Things security gateway;

[0028] Step 8, the Internet of Things security gateway encrypts the received to-be-transmitted data by using the SM4 algorithm, obtains a check code of the encrypted to-be-transmitted data, and sends the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the data platform; the encryption key of the to-be-transmitted data is the session key, and the encrypted to-be-transmitted data carries a security parameter index;

[0029] Step 9, the data platform sends the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the device end;

[0030] Step 10, the device end checks the check code of the encrypted to-be-transmitted data, and when the check code of the encrypted to-be-transmitted data passes the check, decrypts the encrypted to-be-transmitted data by using the session key to obtain decrypted data.

[0031] Optionally, the check code of the encrypted data and the check code of the encrypted to-be-transmitted data are checked by using the SM3-HMAC algorithm.

[0032] In a second aspect, the embodiments of the present application provide a data transmission system based on SM series national secret algorithms, comprising a device end, a data platform and an Internet of Things security gateway;

[0033] The device end is configured to perform: key negotiation with the Internet of Things security gateway based on SM2 algorithm and SM3 algorithm, encryption of to-be-transmitted data by using SM4 algorithm to obtain encrypted data, and obtaining a check code of the encrypted data, and sending the encrypted data and the check code to the data platform; the encryption key of the to-be-transmitted data is a session key after key negotiation, and the encrypted data carries a security parameter index after key negotiation, and the security parameter index is used for uniquely identifying the device end in the data transmission system.

[0034] The data platform is configured to perform: sending the received encrypted data and the check code to the Internet of Things security gateway;

[0035] The Internet of Things security gateway is configured to perform the following: checking the check code, and when the check code passes the check, using the session key to decrypt the encrypted data, and sending the decrypted data to the data platform.

[0036] The above-mentioned solutions of the present application have the following advantages:

[0037] In the embodiments of the present application, before transmitting data between the device end and the data platform, the device end first performs key negotiation with the Internet of Things security gateway based on the SM2 algorithm and the SM3 algorithm to determine the session key for data encryption, and then uses the SM4 algorithm to encrypt the data using the session key and generates a check code for the encrypted data when transmitting the data, so that when the Internet of Things security gateway receives the encrypted data and the check code, it first checks the check code, and only when the check passes, it uses the session key to decrypt the encrypted data and sends the decrypted data to the data platform, completing the data transmission. The entire data transmission process is based on the SM series national secret algorithm, and a check mechanism is provided before decryption, thereby greatly improving the data security.

[0038] Other advantages of the present application will be described in detail in the subsequent specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0040] Figure 1 The flowchart of the data transmission method based on the SM series national secret algorithm provided by an embodiment of the present application;

[0041] Figure 2 The flowchart of the key negotiation provided by an embodiment of the present application;

[0042] Figure 3 The structural schematic diagram of the data transmission system based on the SM series national secret algorithm provided by an embodiment of the present application. DETAILED DESCRIPTION

[0043] In the following description, for purposes of explanation and not limitation, specific details are set forth such as particular architectures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application can be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, circuits, and

[0044] It will be understood that the term "includes," "including," "has," "having," "comprises," "comprising," "contains" or "containing," when used in this specification and in the following claims, specifies the presence of the stated features, integers, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0045] It will also be understood that the term "and / or," when used in this specification and in the following claims, can connote any conjunctive or disjunctive sense, in any combination, and can include any of the possible combinations of the items linked by the term.

[0046] As used in this specification and claims, the terms "if' can be construed to mean "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [a described condition or event] is detected" can be construed to mean "upon determining" or "in response to determining" or "upon detecting [the described condition or event]" or "in response to detecting [the described condition or event]," depending on the context.

[0047] In addition, the terms "first," "second," "third," etc. are used herein only to describe different instances of an element, and do not imply relative importance of the elements.

[0048] The terms "one embodiment," "some embodiments," "an embodiment," "some embodiments," etc. as may be used herein, mean "one or more embodiments," "some or all embodiments," etc. and do not necessarily refer to the same embodiment(s), unless otherwise indicated. The terms "including," "containing," "comprising," "having," etc. are meant to be broad and encompass the terms "consisting of," "consisting essentially of," and "consisting of," unless otherwise indicated. The terms "a," "an," and "the" are meant to be broad and encompass the terms "one or more," unless otherwise indicated.

[0049] In view of the problem that data cannot be completely encrypted by using the national secret algorithm and the data security is low, the embodiment of the present application provides a data transmission method and system based on SM series national secret algorithm. In the transmission method, before data is transmitted between the device end and the data platform, the device end first performs key negotiation with the Internet of Things security gateway based on SM2 algorithm and SM3 algorithm, determines the session key for data encryption, and then uses the SM4 algorithm to encrypt the data using the session key and generates the check code of the encrypted data when the data is transmitted. When the Internet of Things security gateway receives the encrypted data and the check code, the check code is first checked, and only when the check is passed, the encrypted data is decrypted using the session key, and the decrypted data is sent to the data platform, and the data transmission is completed. The entire data transmission process is implemented based on the SM series national secret algorithm, and a check mechanism is provided before decryption, so that the data security is greatly improved.

[0050] The data transmission method and system based on SM series national secret algorithm provided by the present application will be exemplarily described in combination with specific embodiments.

[0051] As shown in Figure 1 , the data transmission method based on SM series national secret algorithm provided by the embodiment of the present application comprises the following steps:

[0052] Step 1, the device end and the Internet of Things security gateway perform key negotiation based on SM2 algorithm and SM3 algorithm.

[0053] The above-mentioned device end is a terminal in the Internet of Things, such as a smart sensor, a smart monitoring camera, etc. The Internet of Things security gateway is mainly used to establish a protected intermediate layer between the device end and the data platform (generally the management platform of the Internet of Things), to ensure that the data is securely, reliably and efficiently transmitted.

[0054] In some embodiments of the present application, the purpose of the key negotiation between the device end and the Internet of Things security gateway is to determine the session key for subsequent data encryption and the security parameter index (SPI) for uniquely identifying the device end in the data transmission system (i.e. the Internet of Things system where the device end is located).

[0055] In some embodiments of the present application, as shown in Figure 2 , the above-mentioned step 1 comprises:

[0056] Step 1.1, the device end sends its own device identification code to the Internet of Things security gateway.

[0057] The above-mentioned device identification code is the identity information of the device end, which is a unique code usually composed of letters and numbers.

[0058] Step 1.2, the device end generates a first SM2 key pair for SM2 decryption and signature verification based on the SM2 algorithm, the SM3 algorithm and the device identification code.

[0059] Step 1.3, the Internet of Things security gateway generates a second SM2 key pair for SM2 encryption and signature based on the SM2 algorithm, the SM3 algorithm and the device identification code.

[0060] That is, after receiving the device identification code, the Internet of Things security gateway generates a second SM2 key pair for SM2 encryption and signature based on the SM2 algorithm, the SM3 algorithm and the device identification code.

[0061] It should be noted that, in order to ensure encrypted communication between the device end and the Internet of Things security gateway, the first SM2 key pair and the second SM2 key pair are actually the same SM2 key pair. Therefore, the device end and the Internet of Things security gateway generate the SM2 key pair based on the SM2 algorithm, the SM3 algorithm and the device identification code in the same way.

[0062] Specifically, in some embodiments of the present application, the specific implementation of generating the SM2 key pair based on the SM2 algorithm, the SM3 algorithm and the device identification code is as follows:

[0063] First, the device identification code is operated by using the SM3 algorithm, and the HASH result obtained by the operation is used as the SM2 private key of the SM2 key pair; then, the SM2 public key of the SM2 key pair is generated based on the SM2 private key by using the SM2 algorithm.

[0064] The SM2 key pair in the above specific implementation is the first SM2 key pair or the second SM2 key pair.

[0065] Step 1.4, the Internet of Things security gateway sends exchange data to the device end.

[0066] The exchange data includes a security parameter index SPI for uniquely identifying the device end in the data transmission system, a ciphertext of a session key, and a signature value of the session key.

[0067] The SPI and the session key are both random data randomly generated by a random number generator in the Internet of Things security gateway. In order to facilitate identification and improve data security, the SPI can be 4 bytes of random data randomly generated by the random number generator in the Internet of Things security gateway, ensuring uniqueness in the entire interactive system (i.e. the Internet of Things system). The session key can be 16 bytes of random data randomly generated by the random number generator in the Internet of Things security gateway. It can be understood that the Internet of Things security gateway also stores the session key.

[0068] The ciphertext of the session key is the ciphertext obtained by encrypting the session key using the SM2 public key in the second SM2 key pair, and the signature value of the session key is the signature value obtained by signing the session key using the SM2 private key in the second SM2 key pair.

[0069] Step 1.5, the device side parses the received exchange data to obtain the SPI, the ciphertext of the session key, and the signature value of the session key.

[0070] It can be understood that when the Internet of Things security gateway sends the exchange data to the device side, the exchange data needs to be processed according to the communication mode (such as network communication mode) between the two to be transmitted. Based on this, after the device side receives the exchange data, it needs to take corresponding parsing processing according to the communication mode, and then the SPI, the ciphertext of the session key, and the signature value of the session key can be obtained.

[0071] Step 1.6, the device side verifies the signature value of the session key using the SM2 private key in the first SM2 key pair, and sends a notification message to the Internet of Things security gateway when the signature value of the session key is verified.

[0072] The above notification message is the ciphertext obtained by encrypting the SPI using the SM4 algorithm, and the encryption key of the SPI is the session key. Specifically, the notification message can be the ciphertext obtained by encrypting the SPI according to the session key using the SM4-CBC algorithm, to inform the Internet of Things security gateway that the key agreement is completed.

[0073] It can be understood that after the Internet of Things security gateway receives the notification message, it will decrypt it using the session key to obtain and store the corresponding SPI of the device side. After receiving the notification message, the Internet of Things security gateway knows that the key agreement is completed. The Internet of Things security gateway stores the correspondence between the device side and the SPI, which can facilitate subsequent identification of related communication data of the device side.

[0074] Step 2, the device side encrypts the data to be transmitted using the SM4 algorithm to obtain encrypted data and obtain a check code of the encrypted data.

[0075] The encryption key of the above data to be transmitted is the session key after the key agreement, and the encrypted data carries the security parameter index after the key agreement, which is used to uniquely identify the device side in the data transmission system.

[0076] The encrypted data carries the security parameter index after the key agreement mainly to facilitate the identification of the device side to complete the data transmission of the device side. It is worth mentioning that the above encrypted data only carries the security parameter index (SPI) and does not carry other data related to the key, so it can effectively prevent the key from being captured and greatly improve the data security.

[0077] In some embodiments of the present application, the SM4-CBC algorithm can be used to encrypt the data to be transmitted according to the session key, and encrypted data is obtained.

[0078] In some embodiments of the present application, the check code of the encrypted data is mainly used for subsequent verification by the Internet of Things security gateway, thereby improving data security.

[0079] The check code of the encrypted data can be verified by the SM3-HMAC algorithm. Based on this, the check code of the encrypted data can be a result obtained by calculating the encrypted data using the SM3-HMAC algorithm.

[0080] Step 3: The device end sends the encrypted data and the check code to the data platform.

[0081] Step 4: The data platform sends the received encrypted data and the check code to the Internet of Things security gateway.

[0082] That is, after receiving the encrypted data and the check code, the data platform sends them to the Internet of Things security gateway.

[0083] Step 5: The Internet of Things security gateway verifies the check code, and when the check code passes the verification, the encrypted data is decrypted using the session key.

[0084] In some embodiments of the present application, after receiving the encrypted data and the check code, the Internet of Things security gateway calculates the received encrypted data using the SM3-HMAC algorithm to obtain a result, and compares whether the result is consistent with the received check code. If they are consistent, it is considered that the check code passes the verification, otherwise, it is considered that the check code fails the verification.

[0085] Step 6: The Internet of Things security gateway sends the decrypted data to the data platform.

[0086] In some embodiments of the present application, after obtaining the decrypted data, the Internet of Things security gateway sends the decrypted data to the data platform.

[0087] The process of the data platform sending data to the device end will be described below in conjunction with specific embodiments.

[0088] Specifically, the data transmission method provided by the embodiments of the present application further includes the following steps:

[0089] Step 7: The data platform sends the to-be-transmitted data to be sent to the device end to the Internet of Things security gateway.

[0090] In some embodiments of the present application, the data platform can perform data transmission with the Internet of Things security gateway through a network.

[0091] Step 8, the Internet of Things security gateway uses the SM4 algorithm to encrypt the received to-be-transmitted data, obtains a check code of the encrypted to-be-transmitted data, and sends the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the data platform.

[0092] The encryption key of the to-be-transmitted data is a session key, and the encrypted to-be-transmitted data carries a security parameter index, so as to complete data transmission at the device end.

[0093] The Internet of Things security gateway encrypts the to-be-transmitted data after receiving the to-be-transmitted data. In some embodiments of the present application, the SM4-CBC algorithm can be used to encrypt the to-be-transmitted data according to the session key, to obtain the encrypted to-be-transmitted data.

[0094] The check code of the encrypted to-be-transmitted data can be checked by the SM3-HMAC algorithm. Based on this, the check code of the encrypted to-be-transmitted data can be a result obtained by using the SM3-HMAC algorithm to calculate the encrypted to-be-transmitted data.

[0095] Step 9, the data platform sends the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the device end.

[0096] In some embodiments of the present application, the data platform can perform data transmission with the device end through a network. After receiving the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data, the data platform sends them to the device end.

[0097] Step 10, the device end checks the check code of the encrypted to-be-transmitted data, and when the check code of the encrypted to-be-transmitted data passes the check, the device end uses the session key to decrypt the encrypted to-be-transmitted data, to obtain decrypted data.

[0098] In some embodiments of the present application, after receiving the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data, the device end uses the SM3-HMAC algorithm to calculate the received encrypted to-be-transmitted data, and compares the result with the received check code. If they are consistent, it is considered that the check code passes the check, otherwise, it is considered that the check code fails the check.

[0099] It should be noted that the Internet of Things security gateway binds the MAC address of the data platform to prevent illegal data transmission.

[0100] It is worth mentioning that the data transmission method of the application is based on SM2 negotiation, SM4 encryption, dynamic key derivation, device identification code, and SM3 to realize data encryption transmission. The entire data transmission process is realized based on SM series national secret algorithm, which meets the "Basic Requirements for Information Security Technology Information System Cryptography", and has a verification mechanism before decryption, thereby greatly improving the data security.

[0101] The data transmission system based on the SM series national secret algorithm provided by the application will be exemplarily described below in combination with specific embodiments.

[0102] In some embodiments of the application, as shown in Figure 3 It can be understood that in the embodiments of the application, the number of device ends and data platforms is not limited, and only one device and two data platforms (i.e., data platform 1 and data platform 2 in the figure) are shown in the figure. Among them, the device end and the data platform, the data platform and the Internet of Things security gateway, and the device end and the Internet of Things security gateway can perform data transmission / key negotiation through the network.

[0103] As a preferred example, the device end includes an encryption / decryption module for encrypting / decrypting data, a data processing module for processing (such as parsing) data, and an Ethernet module (i.e., Ethernet in Figure 3 ) for communicating with the data platform / Internet of Things security gateway. The device end can communicate with the data platform / Internet of Things security gateway through 4G / 5G / wired, etc.

[0104] When the device end transmits data to the data platform, the device end is mainly used to perform: key negotiation with the Internet of Things security gateway based on SM2 algorithm and SM3 algorithm, encrypting the data to be transmitted using SM4 algorithm to obtain encrypted data, and obtaining a check code of the encrypted data, and sending the encrypted data and the check code to the data platform. The encryption key of the data to be transmitted is the session key after key negotiation, and the encrypted data carries a security parameter index after key negotiation, which is used to uniquely identify the device end in the data transmission system.

[0105] The data platform is mainly used to perform: sending the received encrypted data and the check code to the Internet of Things security gateway.

[0106] The Internet of Things security gateway is mainly used to perform: verifying the check code, and when the check code passes the verification, decrypting the encrypted data using the session key, and sending the decrypted data to the data platform.

[0107] When the data platform transmits data to the device end, the data platform is mainly used for executing: sending the to-be-transmitted data to be sent to the device end to the Internet of Things security gateway.

[0108] The Internet of Things security gateway is mainly used for executing: encrypting the received to-be-transmitted data by using an SM4 algorithm, and obtaining a check code of the encrypted to-be-transmitted data, and sending the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the data platform. The encryption key of the to-be-transmitted data is a session key, and the encrypted to-be-transmitted data carries a security parameter index.

[0109] The data platform is mainly also used for executing: sending the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the device end.

[0110] The device end is mainly used for executing: checking the check code of the encrypted to-be-transmitted data, and when the check code of the encrypted to-be-transmitted data passes the check, decrypting the encrypted to-be-transmitted data by using the session key to obtain decrypted data.

[0111] It should be noted that, since the data transmission process between the device end and the data platform has been described in detail in the foregoing, to avoid excessive repetition, it will not be repeated here.

[0112] It is worth mentioning that, in the transmission system, the device end and the Internet of Things security gateway perform key negotiation, the device end and the data platform perform encrypted data transmission, the data platform and the Internet of Things security gateway perform data encryption and decryption communication, and these processes are all completely realized based on the SM series national secret algorithm, and a check mechanism is provided before decryption, so that the data security can be greatly improved.

[0113] The above is the preferred embodiment of the application. It should be noted that, for those skilled in the art, without departing from the principles described in the application, a number of improvements and refinements can be made, which should also be considered as the protection scope of the application.

Claims

1. A data transmission method based on SM series national secret algorithm, characterized in that, The method comprises the following steps: Step 1, the device end and the Internet of Things security gateway perform key negotiation based on SM2 algorithm and SM3 algorithm; Step 2, the device end uses SM4 algorithm to encrypt the data to be transmitted, obtains encrypted data, and obtains a check code of the encrypted data; the encryption key of the data to be transmitted is the session key after key negotiation, the encrypted data carries a security parameter index after key negotiation, and the security parameter index is used to uniquely identify the device end in a data transmission system; Step 3, the device end sends the encrypted data and the check code to a data platform; Step 4, the data platform sends the received encrypted data and check code to the Internet of Things security gateway; Step 5, the Internet of Things security gateway checks the check code, and when the check code passes the check, uses the session key to decrypt the encrypted data; Step 6, the Internet of Things security gateway sends the decrypted data to the data platform.

2. The data transmission method of claim 1, wherein, The step 1 comprises the following steps: Step 1.1, the device end sends a device identification code of itself to the Internet of Things security gateway; Step 1.2, the device end generates a first SM2 key pair used for SM2 decryption and signature verification based on SM2 algorithm, SM3 algorithm and the device identification code; Step 1.3, the Internet of Things security gateway generates a second SM2 key pair used for SM2 encryption and signature based on SM2 algorithm, SM3 algorithm and the device identification code; Step 1.4, the Internet of Things security gateway sends exchange data to the device end; the exchange data comprises a security parameter index SPI used to uniquely identify the device end in a data transmission system, a ciphertext of a session key, and a signature value of the session key; the SPI and the session key are random data randomly generated by a random number generator in the Internet of Things security gateway, the ciphertext of the session key is obtained by encrypting the session key using an SM2 public key in the second SM2 key pair, and the signature value of the session key is obtained by signing the session key using an SM2 private key in the second SM2 key pair; Step 1.5, the device end parses the received exchange data to obtain the SPI, the ciphertext of the session key, and the signature value of the session key; Step 1.6, the device end verifies the signature value of the session key using an SM2 private key in the first SM2 key pair, and sends a notification message to the Internet of Things security gateway when the signature value of the session key passes the verification; the notification message is a ciphertext obtained by encrypting the SPI using SM4 algorithm, and the encryption key of the SPI is the session key.

3. The data transmission method of claim 2, wherein, Generating an SM2 key pair based on SM2 algorithm, SM3 algorithm and the device identification code comprises the following steps: Using SM3 algorithm to operate the device identification code, and taking a HASH result obtained by the operation as an SM2 private key of the SM2 key pair; Using SM2 algorithm to generate an SM2 public key of the SM2 key pair based on the SM2 private key; the SM2 key pair is the first SM2 key pair or the second SM2 key pair.

4. The data transmission method of claim 2, wherein, The SPI is 4 bytes of random data randomly generated by a random number generator in the Internet of Things security gateway.

5. The data transmission method of claim 2, wherein, The session key is 16 bytes of random data randomly generated by a random number generator in the Internet of Things security gateway.

6. The data transmission method of claim 1, wherein, The data transmission method further comprises: Step 7, the data platform sends the to-be-transmitted data to be sent to the device end to the Internet of Things security gateway; Step 8, the Internet of Things security gateway encrypts the received to-be-transmitted data using the SM4 algorithm, obtains the check code of the encrypted to-be-transmitted data, and sends the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the data platform; the encryption key of the to-be-transmitted data is the session key, and the encrypted to-be-transmitted data carries the security parameter index; Step 9, the data platform sends the encrypted to-be-transmitted data and the check code of the encrypted to-be-transmitted data to the device end; Step 10, the device end checks the check code of the encrypted to-be-transmitted data, and when the check code of the encrypted to-be-transmitted data passes the check, decrypts the encrypted to-be-transmitted data using the session key to obtain decrypted data.

7. The data transmission method of claim 6, wherein, The check code of the encrypted data and the check code of the encrypted to-be-transmitted data are both checked by the SM3-HMAC algorithm.

8. A data transmission system based on SM series national secret algorithm, characterized in that, It comprises a device end, a data platform and an Internet of Things security gateway. The device end is configured to perform: key agreement with the Internet of Things security gateway based on SM2 and SM3 algorithms, encrypt to-be-transmitted data using the SM4 algorithm to obtain encrypted data, and obtain the check code of the encrypted data, and send the encrypted data and the check code to the data platform; the encryption key of the to-be-transmitted data is the session key after key agreement, the encrypted data carries the security parameter index after key agreement, and the security parameter index is used to uniquely identify the device end in the data transmission system. The data platform is configured to perform: sending the received encrypted data and the check code to the Internet of Things security gateway; The Internet of Things security gateway is configured to perform: checking the check code, and when the check code passes the check, decrypting the encrypted data using the session key to send the decrypted data to the data platform.

Images