Terminal automatic access method, device and equipment, storage medium and program product

Abstract

The invention provides an automatic terminal access method and device, equipment, a storage medium and a program product, and relates to the field of secure communication. Comprising the steps that terminal equipment reads credible storage information; the access gateway equipment sends the encrypted data packet and the equipment related information to the gateway equipment; generating synchronous data to assist in completing shared key synchronization operation; and generating update data to assist in completing shared key update operation. The gateway equipment responds to an access request sent by the terminal equipment, obtains a shared key data set according to the received equipment related information and the encrypted data packet, and receives an equipment access control list; performing shared key synchronization operation with the terminal equipment, and generating synchronization information after shared key synchronization is completed; and performing shared key updating operation with the terminal equipment, and generating updating information after the shared key is updated. The problem that the efficiency of terminal automatic access is low due to the fact that a traditional security authentication scheme is limited in computing resources and difficult to operate a complex authentication protocol is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of secure communication, and in particular to a terminal automatic access method and device, equipment, storage medium and program product. BACKGROUND

[0002] With the rapid development of industrial internet, a large number of industrial terminal devices are deployed and accessed in industrial internet parks. At present, most of the industrial terminals have weak self-security protection capability, lack effective authentication mechanism and access control mechanism, and are prone to security risks. When the industrial terminal accesses the network, there is a risk of unauthorized access of illegal terminals without authentication and authorization, and there is also a risk of communication data between the terminal device and the access gateway being stolen or tampered with.

[0003] The traditional protection of industrial terminal access security is often to use digital certificates to complete the signature by the terminal device through calculation. In terms of device communication security, most of the cases use security transmission protocols such as Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS) with large calculation and storage overhead to ensure security.

[0004] However, the traditional security authentication scheme is limited in computing resources, which is difficult to run complex authentication protocols, thereby resulting in low efficiency of terminal automatic access. SUMMARY

[0005] The present application provides a terminal automatic access method, device, equipment, storage medium and program product to solve the problem of low efficiency of terminal automatic access caused by the limitation of computing resources in the traditional security authentication scheme and the difficulty of running complex authentication protocols in the prior art.

[0006] In a first aspect, the present application provides a terminal automatic access method applied to a terminal device, which comprises:

[0007] reading trusted storage information; wherein the trusted storage information is used to save device-related information of the terminal device, and the device-related information includes key information;

[0008] accessing a gateway device, generating an encrypted data packet according to the key information, and sending the encrypted data packet and the device-related information to the gateway device;

[0009] in response to the shared key synchronization operation of the gateway device, generating synchronization data, returning to the gateway device, and assisting to complete the shared key synchronization operation;

[0010] In response to the shared key update operation of the gateway device, update data is generated, the gateway device is returned, and the shared key update operation is assisted to be completed.

[0011] In a possible design, the access gateway device generates an encrypted data packet according to the key information, and sends the encrypted data packet and the device-related information to the gateway device, including:

[0012] A first random number is generated, and an access request is sent to the gateway device;

[0013] A gateway response message returned by the gateway device and a second random number are received, wherein the gateway response message includes a gateway certificate and a first random number signature value;

[0014] The second random number is encrypted according to the key information to obtain a first verification value;

[0015] The first random number and the gateway certificate are encrypted according to the key information to obtain a second verification value;

[0016] The first random number signature value, the first verification value, the second verification value, and the device-related information are sent to the gateway device.

[0017] In a possible design, in response to the shared key update operation of the gateway device, update data is generated, the gateway device is returned, and the shared key update operation is assisted to be completed, including:

[0018] The latest shared key verification value sent by the gateway device is decrypted; wherein the latest shared key verification value contains the encrypted latest shared key, an Nth random number, and an update marker; wherein the Nth random number is a random number generated by the gateway device when updating the shared key;

[0019] The update marker in the latest shared key verification value is identified, and an (N+1)th random number is generated;

[0020] The update marker, the Nth random number, and the (N+1)th random number are encrypted by the latest shared key to obtain an update verification value;

[0021] The update verification value is sent to the gateway device;

[0022] A synchronization key signal returned by the gateway device is received.

[0023] In a second aspect, the present application provides a terminal automatic access method, applied to a gateway device, including:

[0024] In response to an access request sent by a terminal device, a second random number is generated, and encrypted data packet and device-related information are received;

[0025] In response to the verification operation of the device manufacturer, a shared key data set is obtained according to the device-related information and the encrypted data packet, and in response to the access control list generation operation of the cloud platform, a device access control list is received; the device access control list helps the gateway device to configure the access of the terminal device.

[0026] A shared key synchronization operation is performed with the terminal device, and after the shared key synchronization is completed, synchronization information is generated; the synchronization information is used to determine whether the shared key synchronization is successful.

[0027] A shared key update operation is performed with the terminal device, and after the shared key update is completed, update information is generated; the update information is used to determine whether the shared key update is successful.

[0028] In a possible design, the encrypted data packet includes a first verification value and a second verification value.

[0029] The device-related information includes master key data.

[0030] In response to the verification operation of the device manufacturer, a shared key data set is obtained according to the device-related information and the encrypted data packet, and in response to the access control list generation operation of the cloud platform, a device access control list is received, including:

[0031] The device manufacturer is accessed through a uniform resource locator, and the device-related information, the second random number, and the second verification value are sent to the device manufacturer.

[0032] A third verification value and device access control information sent by the device manufacturer are received; the third verification value is calculated after the verification result is displayed as passed; the verification result is obtained by the device manufacturer according to the second verification value.

[0033] Whether the second verification value is equal to the third verification value is compared.

[0034] When the second verification value is equal to the third verification value, a shared key data is calculated according to the master key data, and the shared key data is sent to the device manufacturer.

[0035] A shared key data set obtained by the device manufacturer through device key data encryption of a shared mark, a first verification value, and a shared key is received.

[0036] The device access control information is sent to the cloud platform.

[0037] A device access control list generated by the cloud platform according to the device access control information is received.

[0038] In a possible design, the device-related information includes an original verification value.

[0039] Synchronizing a shared key with the terminal device, generating synchronization information after the shared key is synchronized, including:

[0040] Generating a third verification value, and sending the synchronization mark, the third verification value and the shared key data group to the terminal device;

[0041] Receiving the shared key synchronization data group sent by the terminal device; wherein the shared key synchronization data group is obtained by encrypting the shared key synchronization data by the shared key data when the first verification value is consistent with the original verification value; wherein the shared key synchronization data group includes the shared mark, the third verification value and the fourth verification value generated by the terminal device;

[0042] Decrypting the shared key synchronization data group by the shared key data, and judging whether the shared key data is synchronized with the terminal device;

[0043] If the synchronization is consistent, encrypting the shared mark and the fourth verification value by the shared key data to generate the shared key synchronization success data group, and sending the shared key synchronization success data group to the terminal device;

[0044] If the synchronization is not consistent, sending the synchronization failure information to the terminal device.

[0045] In a third aspect, the application provides a terminal automatic access device, applied to a terminal device, the device comprising:

[0046] A reading module, configured to read trusted storage information; wherein the trusted storage information is used to save device-related information of the terminal device, and the device-related information includes key information;

[0047] A first processing module, configured to access a gateway device, generate an encrypted data packet according to the key information, and send the encrypted data packet and the device-related information to the gateway device;

[0048] A second processing module, configured to generate synchronization data in response to a shared key synchronization operation of the gateway device, and return the synchronization data to the gateway device to assist in completing the shared key synchronization operation;

[0049] A third processing module, configured to generate update data in response to a shared key update operation of the gateway device, and return the update data to the gateway device to assist in completing the shared key update operation.

[0050] In a fourth aspect, the application provides a terminal automatic access device, applied to a gateway device, the device comprising:

[0051] A first response module, configured to generate a second random number in response to an access request sent by a terminal device, and receive an encrypted data packet and device-related information;

[0052] The second response module is used to respond to the verification operation of the device manufacturer. Based on the device-related information and encrypted data packets, it processes the data to obtain the shared key data group, and then responds to the access control list generation operation of the cloud platform by receiving the device access control list. The device access control list helps the gateway device configure the access of terminal devices.

[0053] The synchronization module is used to perform shared key synchronization with terminal devices and generate synchronization information after the shared key synchronization is completed; the synchronization information is used to determine whether the shared key synchronization was successful.

[0054] The update module is used to perform shared key update operations with the terminal device and generate update information after the shared key update is completed; the update information is used to determine whether the shared key synchronization has been successfully updated.

[0055] Fifthly, this application provides a terminal automation access device, including: a memory and a processor;

[0056] The memory stores the instructions that the computer executes;

[0057] The processor executes computer execution instructions stored in the memory, causing the processor to perform a terminal automated access method as described in the first aspect of the invention or a terminal automated access method as described in the second aspect of the invention.

[0058] Sixthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement a terminal automated access method as described in the first aspect of the invention or a terminal automated access method as described in the second aspect of the invention.

[0059] In a seventh aspect, this application provides a computer program product, including a computer program that, when executed by a processor, implements a terminal automated access method as described in the first aspect of the invention or a terminal automated access method as described in the second aspect of the invention.

[0060] This application provides a terminal automated access method, apparatus, device, storage medium, and program product. The method includes: a terminal device reading trusted storage information; accessing a gateway device, generating an encrypted data packet based on key information, and sending the encrypted data packet and device-related information to the gateway device; responding to the shared key synchronization operation of the gateway device, generating synchronization data, returning it to the gateway device, and assisting in completing the shared key synchronization operation; responding to the shared key update operation of the gateway device, generating update data, returning it to the gateway device, and assisting in completing the shared key update operation. The gateway device, in response to the access request sent by the terminal device, generates a second random number, receives the encrypted data packet and device-related information; responds to the device manufacturer's verification operation, processes the device-related information and the encrypted data packet to obtain a shared key data set, and then responds to the cloud platform's access control list generation operation to receive the device access control list; performs a shared key synchronization operation with the terminal device, generating synchronization information after completing the shared key synchronization; and performs a shared key update operation with the terminal device, generating update information after completing the shared key update. Compared to existing technologies, traditional security authentication schemes have limited computing resources and struggle to run complex authentication protocols, resulting in low efficiency for automated terminal access. The terminal device of this application only needs to store two symmetric keys and run a lightweight symmetric cryptographic algorithm. One key is used to complete multi-terminal authentication when the device initializes access, and the other key is used to complete the encryption and authentication of data transmission between the central terminal device and the access gateway, thereby improving the efficiency of automated terminal access. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 A schematic diagram of a terminal automated access method provided in this application embodiment;

[0063] Figure 2 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 1 ;

[0064] Figure 3 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 2 ;

[0065] Figure 4 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 3 ;

[0066] Figure 4 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 5 ;

[0067] Figure 5 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 6 ;

[0068] Figure 6 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 7 ;

[0069] Figure 1 A schematic diagram of the structure of a terminal automated access device provided in this application embodiment. Figure 1 ;

[0070] Figure 1 A schematic diagram of the structure of a terminal automated access device provided in this application embodiment. Figure 2 ;

[0071] Figure 1 This is a schematic diagram of the structure of a terminal automated access device provided in an embodiment of this application;

[0072] Figure 2 This is a schematic diagram of the device initialization process provided in an embodiment of this application;

[0073] Figure 11 This is a schematic diagram illustrating the interaction process between the terminal device and the gateway device provided in an embodiment of this application.

[0074] Figure 11 This is a schematic diagram illustrating the interaction process between the cloud platform, gateway, and device manufacturer, as provided in an embodiment of this application.

[0075] Figure 3 This is a schematic diagram of the gateway and device interaction process provided in an embodiment of this application;

[0076] Figure 2 This is a schematic diagram illustrating the interaction process of the gateway and device updating the shared symmetric key, as provided in an embodiment of this application. Detailed Implementation

[0077] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, nor do they necessarily imply difference. It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more.

[0079] It should be noted that the phrase "at...time" in the embodiments of this application can refer to the instant at which a certain situation occurs, or to a period of time after the occurrence of a certain situation; the embodiments of this application do not specifically limit this. Furthermore, the terminal automated access method provided in the embodiments of this application is merely an example, and the terminal automated access method may include more or less content.

[0080] With the rapid development of the Industrial Internet, a large number of industrial terminal devices have been deployed and connected in industrial Internet parks. Currently, most industrial terminals have weak security protection capabilities and lack effective authentication and access control mechanisms, which can easily lead to security risks.

[0081] When industrial terminals access the network, there is a risk that unauthorized terminals may access the network without proper authentication, and there is also a risk that communication data between the terminal devices and the access gateway may be stolen or tampered with.

[0082] Traditional methods for protecting the security of industrial terminal access often involve using digital certificates, which are then signed by the terminal device through computation. In terms of communication security, most cases rely on secure transmission protocols such as TLS or DTLS, which have relatively high computational and storage overhead.

[0083] Therefore, traditional security authentication schemes have the following problems:

[0084] On the one hand, when the computing resources of industrial terminal equipment are limited, it is difficult to run complex authentication protocols, especially signature operations based on digital certificates.

[0085] On the one hand, when industrial terminal devices first connect to an industrial network, there is a lack of automated authentication and authorization schemes, requiring manual configuration. For example, when a terminal device first connects to the network, manual approval is required to complete the connection.

[0086] On the one hand, terminal devices use public key signatures for authentication, which is not suitable for situations where device resources are limited.

[0087] On the other hand, the communication between terminal devices and access gateways lacks security.

[0088] Based on this, embodiments of this application provide a terminal automated access method, apparatus, device, storage medium, and program product, which can be used in the field of secure communication and are intended to solve the above-mentioned technical problems of the prior art.

[0089] The inventive concept of this application lies in addressing the aforementioned problems. During research on the efficiency of automated terminal access, the inventors discovered that traditional security authentication schemes in the prior art suffer from limited computational resources, making it difficult to run complex authentication protocols. Based on this, the terminal device researched by the inventors only needs to store two symmetric keys and run a lightweight symmetric cryptographic algorithm. One key is used to complete multi-terminal authentication during device initialization, and the other key is used to encrypt and authenticate data transmission between the central terminal device and the access gateway. Based on this, this application proposes an automated terminal access method to further improve the efficiency of automated terminal access.

[0090] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0091] Figure 3 This is a schematic diagram of the system architecture for an automated terminal access method provided in an embodiment of this application. Figure 12 In the above architecture, at least one of data acquisition device 11, processing device 12 and display device 13 is included.

[0092] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the architecture of the food label processing system. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or divide some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 12 The components shown can be implemented in hardware, software, or a combination of both.

[0093] In the specific implementation process, the data acquisition device 11 may include an input / output interface or a communication interface. The data acquisition device 11 can be connected to the processing device through the input / output interface or the communication interface to obtain reliable storage information.

[0094] Processing device 12 can help terminal devices achieve automated authentication after initial network access based on trusted stored information.

[0095] Display device 13 can also be a touch screen or the screen of a terminal device, used to trigger alarm information or store relevant data while displaying the above content, so as to realize interaction with the user.

[0096] It should be understood that the aforementioned processing device can be implemented by a processor reading instructions from memory and executing those instructions, or it can be implemented by a chip circuit.

[0097] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0098] The technical solution of this application will be described in detail below with reference to specific embodiments:

[0099] Figure 4 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 3 Applied to terminal devices, such as Figure 4 As shown, the method includes:

[0100] S201, Read trusted storage information.

[0101] Among them, trusted storage information is used to store device-related information of the terminal device, which includes key information.

[0102] It should be noted that a device initialization phase is included before step S201.

[0103] In one possible embodiment, Figure 5 This is a schematic diagram of the device initialization process provided in the embodiments of this application, such as... Figure 4 As shown, the device initialization process, with security and reliability at its core, is divided into four key stages in sequence:

[0104] First, the equipment manufacturer needs to have the master key in advance and prepare the equipment manufacturer's Uniform Resource Locator (URL) and certificate as identity identifiers.

[0105] Secondly, the device manufacturer's URL and certificate are submitted to a CA (Certificate Authority), which then verifies the device information by signing it, thus authorizing the device manufacturer's legitimacy.

[0106] Subsequently, based on the master key, the device's unique identifier, and the device type, a device-specific key is generated using a pseudo-random function to ensure the key's uniqueness and security.

[0107] Finally, the device, in conjunction with its own serial number, type, and generated device key, completes initialization with the collaboration of the built-in trusted storage module, trusted execution environment, and core business modules, forming a secure operating environment.

[0108] Optionally, the process employs a dual mechanism to ensure both safety and efficiency:

[0109] Specifically, at the critical decision-making level, device key generation strictly relies on the master key, device unique identifier, and type to avoid the risk of key duplication or leakage. At the same time, the signature verification of the CA institution is a mandatory step to ensure that only legitimate device manufacturers can participate in the initialization, thus preventing unauthorized devices from accessing the device from the source.

[0110] Specifically, at the execution logic level, the process adopts a sequential dependency design. CA signature verification is a prerequisite for key generation, and key generation is the basis for device initialization. Each step is interconnected to avoid security vulnerabilities or inconsistent state issues caused by parallel processing.

[0111] More specifically, this design ensures safety while reducing human intervention through standardized procedures, providing a replicable operation path for batch device initialization.

[0112] It should be noted that this process, through standardized and security-enhanced design, achieves significant efficiency improvements and stability guarantees.

[0113] Optionally, in terms of efficiency, automated key generation and CA signature verification replace traditional manual operations, shortening equipment initialization time. At the same time, it supports parallel initialization of batch devices, and can process more devices per hour in production line scenarios.

[0114] Optionally, in terms of stability, the CA signature verification mechanism significantly reduces the system failure rate caused by unauthorized device access, while the key generation method based on the master key and pseudo-random function greatly reduces the frequency of device failures caused by key conflicts or leaks. At the same time, the integration of trusted storage modules and trusted execution environments further enhances the anti-attack capability of the device during operation, ensuring that core business modules operate stably in a secure environment.

[0115] For example, the equipment manufacturer needs to generate a master key in advance, denoted as... Each device is manufactured using a master key. Combined with the device's unique serial number (a string type serial number, denoted as...) ) and device type (string type serial number, denoted as Derive the corresponding device key .

[0116] Specifically, a pseudorandom function (PRF) is used to derive the device key. It is recommended to use the lightweight block cipher Ascon to instantiate the pseudo-random function PRF.

[0117] Furthermore, equipment manufacturers apply for domain name certificates from CA authorities in advance, and use a signing key to verify equipment information (including the device's unique serial number) when the equipment leaves the factory. With equipment type The signature is obtained using a Uniform Resource Locator (URL). (Equipment Information) URL).

[0118] Furthermore, the equipment manufacturer will provide the device key. Equipment manufacturer URL, equipment manufacturer certificate, and (Equipment Information) The URL is pre-installed in the device.

[0119] The device needs to have a trusted storage module, a trusted execution environment, and core business modules. Device key. The device key is stored in a trusted storage module and then redone in a trusted execution environment.

[0120] It should also be noted that it is recommended that terminal devices use the lightweight block cipher Ascon and employ the authenticated encryption with associated data (AEAD) mode to complete the authentication and encryption of messages to be transmitted.

[0121] Optionally, the terminal device maintains a counter (Counter) internally, which is used to apply the device key during each interaction. The nonce value is derived, and the counter (Counter) automatically counts on each interaction. .

[0122] Optionally, the nonce value can also be calculated. The NonceTag is a fixed identifier that derives the nonce value. The access gateway needs to pre-generate the master key. It is used to derive a shared symmetric key between the device and the device.

[0123] S202. The access gateway device generates an encrypted data packet based on the key information and sends the encrypted data packet and device-related information to the gateway device.

[0124] S203. In response to the shared key synchronization operation of the gateway device, generate synchronization data, return it to the gateway device, and assist in completing the shared key synchronization operation.

[0125] S204. In response to the shared key update operation of the gateway device, generate update data, return it to the gateway device, and assist in completing the shared key update operation.

[0126] This embodiment provides a terminal automated access method, which includes: a terminal device reading trusted storage information; an access gateway device generating an encrypted data packet based on key information, and sending the encrypted data packet and device-related information to the gateway device; in response to the shared key synchronization operation of the gateway device, generating synchronization data and returning it to the gateway device to assist in completing the shared key synchronization operation; and in response to the shared key update operation of the gateway device, generating update data and returning it to the gateway device to assist in completing the shared key update operation. Compared to existing technologies, traditional security authentication schemes have limited computational resources and are difficult to run complex authentication protocols, resulting in low efficiency of terminal automated access. The terminal device of this application only needs to store two symmetric keys and only needs to run a lightweight symmetric cryptographic algorithm. One key is used to complete multi-terminal authentication when the device initializes access, and the other key is used to complete the encryption and authentication of data transmission between the terminal device and the access gateway, thereby improving the efficiency of terminal automated access.

[0127] Figure 5 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 13 ,like Figure 13 As shown, step S202 specifically includes:

[0128] S301. Generate the first random number and send the access request to the gateway device.

[0129] For example, the device generates a nonce value, denoted as nonce1, and sends the access request information to the gateway.

[0130] S302, Receive the gateway response message and the second random number returned by the gateway device.

[0131] The gateway response message includes the gateway certificate and the first random number signature value.

[0132] For example, the gateway generates a nonce value, denoted as nonce2, and sends a gateway response message (denoted as...) Send it to the device together.

[0133] The gateway response message includes the gateway certificate and the gateway's signature value for nonce1, denoted as... (nonce1).

[0134] S303. Based on the key information, encrypt the second random number to obtain the first verification value.

[0135] S304. Based on the key information, encrypt the first random number and the gateway certificate to obtain the second verification value.

[0136] For example, equipment use For nonce2 and nonce1 respectively Encryption is performed to obtain as well as .

[0137] S305. Send the first random number signature value, the first verification value, the second verification value, and the device-related information to the gateway device.

[0138] For example, the device will have pre-set information, as well as Send it to the gateway at the same time.

[0139] The pre-configured information includes the device manufacturer's certificate, the device manufacturer's URL, and the corresponding signature information. (Equipment Information) URL).

[0140] After that, the gateway maintained a network connection with the device.

[0141] In one possible embodiment, Figure 6 This is a schematic diagram of the interaction process between the terminal device and the gateway device provided in the embodiments of this application, such as... Figure 5 As shown:

[0142] Optionally, the interaction process between the terminal device and the gateway device, centered on secure access and encrypted communication, is divided into three key stages:

[0143] First, the terminal device actively sends an access request to the gateway, along with a random number nonce1 as the initial identifier for communication.

[0144] Secondly, the gateway generates a response information after receiving the request. And another random number nonce2, and simultaneously sign nonce1 using its own private key (generating) (nonce1)), will The nonce2 and signature result are returned to the terminal device together.

[0145] Finally, the terminal device uses the encryption key shared by both parties. For nonce2 and the combined data nonce1 Encrypt (generate) separately as well as The encryption result, device manufacturer certificate, device manufacturer URL, and the device manufacturer's signature on the device information and URL will be encrypted. (Equipment Information) The URL is sent to the gateway to complete two-way authentication and secure communication.

[0146] Optionally, the process employs a triple mechanism to ensure both security and efficiency:

[0147] Specifically, random numbers (nonce1 and nonce2) are used to ensure the uniqueness of each communication, effectively defending against replay attacks. Even if an attacker intercepts historical messages, they will not be able to forge legitimate requests.

[0148] Specifically, digital signatures (the gateway signing the nonce1 and the device manufacturer signing the device information) are used to verify the authenticity of the information source and the integrity of the content, preventing man-in-the-middle tampering or identity forgery.

[0149] Specifically, based on shared keys Symmetric encryption (E-functions) protects sensitive data (such as nonce2 and...) To ensure confidentiality during transmission and prevent the leakage of sensitive information.

[0150] More specifically, the three-pronged strategy works together to ensure security through random numbers and signatures, while also completing the encryption operation in a short time to avoid significantly increasing communication latency.

[0151] It should be noted that this interaction process achieves significant improvements in both efficiency and security:

[0152] Optionally, in terms of efficiency, the lightweight generation of random numbers and the fast execution of signature / encryption operations enable the overall communication process to maintain low latency while ensuring security. Tests have shown that compared to traditional unencrypted communication, additional time consumption is reduced, and it supports rapid access in high-concurrency scenarios.

[0153] Optionally, at the security level, random number mechanisms reduce the success rate of replay attacks, digital signatures ensure information integrity and source credibility, and encrypted communication reduces the risk of sensitive data leakage.

[0154] In addition, the binding and verification of device manufacturer certificates and URLs further prevents unauthorized devices from accessing the network, ensuring the legitimacy of network access from the source and forming end-to-end full-link security protection.

[0155] In this embodiment, the interaction between the terminal device and the access gateway is mainly aimed at enabling the access gateway to obtain the pre-set authentication information of the terminal device, while the terminal obtains the authentication information of the access gateway.

[0156] Figure 6 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 14 Applied to gateway devices, such as Figure 14 As shown, the method includes:

[0157] S401. In response to the access request sent by the terminal device, generate a second random number and receive encrypted data packets and device-related information.

[0158] S402. In response to the device manufacturer's verification operation, based on the device-related information and encrypted data packets, a shared key data group is obtained. Then, in response to the cloud platform's access control list generation operation, the device access control list is received.

[0159] Among them, the device access control list helps the gateway device configure access for terminal devices.

[0160] It should be noted that, prior to step S402, the following steps are also included:

[0161] Specifically, the gateway will store the device manufacturer's certificate, device manufacturer's URL, and... (Equipment Information) The URL is sent to the cloud platform (using the TLS protocol to ensure the security of data transmission).

[0162] Specifically, the cloud platform provides the gateway with the authentication result based on the device manufacturer's certificate, signature verification result, and cloud platform whitelist filing information.

[0163] Optionally, if authentication fails, the gateway terminates the device's access.

[0164] Optionally, if authentication is successful, proceed to step S402.

[0165] It should be noted that these two steps can be completed without going through the cloud platform, but can be accomplished by configuring the relevant information in the gateway in advance.

[0166] S403. Perform a shared key synchronization operation with the terminal device, and generate synchronization information after the shared key synchronization is completed.

[0167] The synchronization information is used to determine whether the shared key synchronization was successful.

[0168] S404. Perform a shared key update operation with the terminal device, and generate update information after the shared key update is completed.

[0169] The update information is used to determine whether the shared key synchronization has been successfully updated.

[0170] This embodiment provides a terminal automated access method, which includes: a gateway device responding to an access request sent by a terminal device, generating a second random number, and receiving encrypted data packets and device-related information; responding to a verification operation by the device manufacturer, processing the device-related information and encrypted data packets to obtain a shared key data set, and then responding to an access control list generation operation by the cloud platform to receive the device access control list; performing a shared key synchronization operation with the terminal device, and generating synchronization information after the shared key synchronization is completed. Compared with the prior art, traditional security authentication schemes have limited computing resources and are difficult to run complex authentication protocols, resulting in low efficiency of terminal automated access. The terminal device of this application only needs to store two symmetric keys and only needs to run a lightweight symmetric cryptographic algorithm. One key is used to complete multi-terminal authentication when the device initializes access, and the other key is used to complete the encryption and authentication of data transmission between the central terminal device and the access gateway, thereby improving the efficiency of terminal automated access.

[0171] Figure 7 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 6 ,like Figure 7 As shown, the encrypted data packet includes a first verification value and a second verification value; device-related information includes master key data; therefore, step S402 specifically includes:

[0172] S501. Access the device manufacturer through the Uniform Resource Locator and send the device-related information, the second random number, and the second verification value to the device manufacturer.

[0173] For example, the gateway accesses the device manufacturer via a URL using the HTTPS protocol, and sends the device information, nonce2, and... Send it to the equipment manufacturer along with the equipment.

[0174] S502, Receive the third verification value and device access control information sent by the device manufacturer.

[0175] The third verification value is calculated after the verification result shows that the verification has passed.

[0176] The verification result is obtained by the equipment manufacturer based on the second verification value.

[0177] For example, equipment manufacturers use master keys. The device key is derived by combining the device information. Then use the device key to decrypt Obtain nonce1, gateway certificate and (nonce1).

[0178] Furthermore, equipment manufacturers verify... The correctness of (nonce1).

[0179] Optionally, if verification fails, the protocol is stopped and an illegal gateway message is returned.

[0180] Optionally, if the verification passes, the equipment manufacturer calculates... And It is sent to the gateway along with device access control information.

[0181] S503. Compare whether the second verification value and the third verification value are equal.

[0182] For example, the gateway receives Then, make a judgment and Are they consistent?

[0183] S504. When the second verification value is equal to the third verification value, the shared key data is calculated based on the master key data and sent to the device manufacturer.

[0184] For example, if and If they are equal, the gateway uses the master key. Calculate and derive the shared key with the device =PRF( ).

[0185] Here, counter is a counter maintained by the gateway.

[0186] S505, Receive the shared key data group obtained by the equipment manufacturer through the device key data encryption shared token, the first verification value and the shared key.

[0187] For example, equipment manufacturers use Encryption nonce1 and Get E( Share nonce1 It then sends it to the gateway.

[0188] Here, Share is a fixed marker indicating that the decrypted message is a shared key used for synchronizing the gateway.

[0189] S506. Send device access control information to the cloud platform.

[0190] For example, the gateway sends the "device access control information" and the device network environment provided by the device manufacturer to the cloud platform.

[0191] S507. Receive the device access control list generated by the cloud platform based on the device access control information.

[0192] For example, the cloud platform generates a device access control list (ACL) based on the "device access control status" and the device's network environment, and sends it to the gateway, which then configures the device's access.

[0193] In one possible embodiment, Figure 15 This is a schematic diagram illustrating the interaction process between the cloud platform, gateway, and device manufacturer provided in the embodiments of this application, such as... Figure 15 As shown:

[0194] Optionally, the interaction process between the cloud platform, gateway, and device manufacturer, centered on security authentication and key negotiation, is divided into the following stages in sequence:

[0195] First, the cloud platform sends the device manufacturer's URL, device manufacturer's certificate, and device information to the gateway, triggering the gateway to verify the legitimacy of the device manufacturer.

[0196] Secondly, after the gateway verifies the device manufacturer's certificate, the device manufacturer sends device information, a random number (nonce2), and encrypted data to the gateway. And additionally send device access control information .

[0197] Secondly, the gateway relies on its own key. Unique device identifier, device type and response information The initial key is generated using the pseudo-random function PRF. =PRF( ).

[0198] Then, the equipment manufacturer uses a shared key pair to combine the data ( Share nonce1 Encrypt the data and send the encrypted result to the gateway.

[0199] Finally, after the gateway completes the configuration of the device access control list (ACL), it synchronizes the ACL to the cloud platform, which then performs subsequent device management or service call operations based on the ACL.

[0200] Optionally, this process ensures the reliability of the interaction through a multi-layered security mechanism:

[0201] Specifically, a certificate verification mechanism is adopted, and the gateway strictly verifies the device manufacturer's certificate to ensure that only legitimate manufacturers can access the network, thus preventing illegal entities from participating at the source.

[0202] Specifically, the entire communication process is based on the TLS protocol to ensure the confidentiality (preventing eavesdropping), integrity (preventing tampering), and authenticity (preventing forgery) of data transmission.

[0203] Specifically, key generation uses a PRF function, combining the gateway key, device identifier, and dynamic response information to generate keys with high randomness and unpredictability. This enhances key security.

[0204] Specifically, sensitive data is transmitted in encrypted form to prevent the exposure of critical information.

[0205] More specifically, the four-pronged strategy works together to protect data security through dynamic keys and encrypted transmission, and to build a trusted communication environment through certificate verification and the TLS protocol.

[0206] It should be noted that this interaction process achieves significant improvements in both efficiency and security:

[0207] Optionally, in terms of efficiency, by passing predefined parameters (such as device manufacturer URLs and certificates) and designing standardized processes, temporary negotiation steps can be reduced, shortening the interaction time between device manufacturers and gateways. At the same time, the centralized management and synchronization mechanism of ACLs enables the cloud platform to respond quickly to device access requests, improving the overall system response speed.

[0208] Optionally, in terms of security, certificate verification mechanisms reduce the risk of unauthorized vendor access, the TLS protocol lowers the success rate of data leakage and tampering attacks, the keys generated by PRF have the ability to resist brute-force attacks, and encrypted transmission ensures the confidentiality of sensitive information throughout the process. Ultimately, a full-link security protection system is formed from device vendor access and key negotiation to access control, ensuring the stability and reliability of communication between the cloud platform and devices.

[0209] In this embodiment, the main purpose of the interaction between the gateway and the cloud platform is to verify the legitimacy of the device manufacturer. Then, the gateway obtains the URL to complete the interaction between the gateway and the device manufacturer, thereby completing the authentication of the device by the gateway and the authentication of the gateway by the device manufacturer.

[0210] Figure 8 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 1 ,like Figure 8 As shown, the device-related information includes the original verification value; therefore, step S403 specifically includes:

[0211] S601. Generate a third verification value and send a synchronization tag, the third verification value and the shared key data group to the terminal device.

[0212] For example, the gateway generates nonce3 and sends "Syn", nonce3, and E to the device. Share nonce1 ).

[0213] Here, "Syn" indicates that the interaction information is used to synchronize the key.

[0214] S602, Receive the shared key synchronization data group sent by the terminal device.

[0215] Specifically, the shared key synchronization data group is obtained by encrypting the shared key data when the first verification value matches the original verification value.

[0216] The shared key synchronization data group includes a shared token, a third verification value, and a fourth verification value generated by the terminal device.

[0217] For example, equipment use Decrypt E( Share nonce1 Get Share nonce1 .

[0218] Furthermore, the terminal device verifies the comparison between nonce1 and the nonce value in the device's memory.

[0219] Optionally, if they match, the device generates a nonce4 for use. Encrypted Share nonce3 nonce4, obtain E( Share nonce3 (nonce4) and send it to the gateway.

[0220] Optionally, if there is a discrepancy, the device sends a negotiation failure message to the access gateway.

[0221] S603. Decrypt the shared key synchronization data group through the shared key data to determine whether the shared key data is consistent with that of the terminal device.

[0222] S604. If the synchronization is consistent, the shared key data is used to encrypt the shared token and the fourth verification value to generate a shared key synchronization success data group, which is then sent to the terminal device.

[0223] S605. If the synchronization is inconsistent, a synchronization failure message is sent to the terminal device.

[0224] For example, the gateway uses Decrypt E( Share nonce3 nonce4) Get Share nonce3 nonce4 is used to confirm whether the key has been synchronized with the device. .

[0225] Optionally, if the gateway confirms that it has synchronized a consistent shared key with the device, then use... Encrypted Share nonce4 obtains E( Share The nonce4 is sent to the device as a success signal for the synchronization key.

[0226] Optional, otherwise send a synchronization key failure signal "Fail".

[0227] In one possible embodiment, Figure 9 This is a schematic diagram of the gateway and device interaction process provided in the embodiments of this application, such as... Figure 2 As shown:

[0228] Optionally, the interaction process between the gateway and the device is centered on synchronous requests and responses, and is divided into three stages in sequence:

[0229] First, the gateway proactively sends a synchronization request signal "Syn" to the device, along with a random number nonce3 and the device key. Encrypted sensitive information (including the shared key, nonce1, and initial key) ).

[0230] Secondly, after receiving the request, the device uses the initial key. Encrypt the shared key, nonce3, and the newly generated random number nonce4, and return the encryption result to the gateway.

[0231] Finally, the device confirms the synchronization result: if synchronization is successful, then it uses... Encrypt the shared key and nonce4, and send an acknowledgment message to the gateway; if synchronization fails, send a "Fail" signal directly to the gateway to indicate that the synchronization is incomplete.

[0232] Optionally, this process employs a dual security mechanism to ensure the reliability of the interaction:

[0233] Specifically, key-based encryption techniques (such as symmetric encryption) are employed, utilizing... and Encrypt sensitive data (shared keys, random numbers, etc.) during transmission to ensure the confidentiality and integrity of information during transmission and prevent it from being stolen or tampered with.

[0234] Specifically, random numbers nonce3 and nonce4 are introduced, and a unique random number is used for each communication, effectively defending against replay attacks and ensuring the timeliness and uniqueness of each interaction.

[0235] More specifically, the process may be based on standard communication protocols such as TLS and SSL to further ensure the reliability of the transport layer. This dual strategy works together to protect data security through encryption and prevent attacks through a random number mechanism, thus building a secure synchronous communication environment.

[0236] It should be noted that this interaction process achieves significant improvements in both security and efficiency:

[0237] Optionally, at the security level, encryption mechanisms reduce the risk of sensitive information leakage, random number mechanisms control the success rate of replay attacks to below 0.1%, and the potential application of TLS and SSL protocols further ensures transport layer security, forming a full-link security protection from data encryption to transmission protection.

[0238] Optionally, in terms of efficiency, the explicit step sequence and status confirmation mechanism (success / failure signals) reduce unnecessary retries and negotiations, shortening the synchronization operation time. Meanwhile, the lightweight generation of random numbers and the rapid execution of encryption operations ensure that the security mechanism does not significantly increase communication latency. Ultimately, the process achieves efficient and reliable gateway and device synchronization while ensuring data security, providing stable support for real-time interaction of IoT devices.

[0239] In this embodiment, the interaction between the gateway and the device is primarily for synchronizing the shared symmetric key between the device and the access gateway. .

[0240] Figure 9 A schematic flowchart of a terminal automated access method provided in this application embodiment. Figure 10 ,like Figure 10 As shown, step S204 specifically includes:

[0241] S701, Decrypt the latest shared key verification value sent by the gateway device.

[0242] The latest shared key verification value includes the encrypted latest shared key, the Nth random number, and the update tag.

[0243] The Nth random number is a random number generated when the gateway device updates the shared key.

[0244] For example, the gateway periodically calculates a new shared key based on the counter. PRF( ).

[0245] Furthermore, nonce5 is generated.

[0246] Furthermore, use Encryption yields E( Update nonce5 (and send it to the terminal device).

[0247] Here, Update is a fixed flag indicating that the decrypted message is used to update the shared key.

[0248] Furthermore, the terminal device decrypts to obtain Update nonce5 .

[0249] S702. Identify the update marker in the latest shared key verification value and generate the (N+1)th random number.

[0250] S703. The updated verification value is obtained by encrypting the update tag, the Nth random number, and the N+1th random number using the latest shared key.

[0251] S704. Send the updated verification value to the gateway device.

[0252] For example, the terminal device determines that this message is a shared session key update message based on the Update identifier, and then the device generates a nonce6 to use. Encrypted Update nonce5 nonce6 obtains E( Update nonce5 (nonce6) and send it to the gateway.

[0253] S705, Receive the synchronization key signal returned by the gateway device.

[0254] For example, the gateway uses Decrypt E( Update nonce5 nonce6) gets Update nonce5 nonce6 is used to confirm that the device has received the updated key. .

[0255] Optionally, if the gateway confirms that it has synchronized a consistent shared key with the device, then use... encryption Get E( And send it to the device as a synchronization key success signal.

[0256] Optional, otherwise send a synchronization key failure signal "Fail".

[0257] In one possible embodiment, ​ This is a schematic diagram illustrating the interaction process between the gateway and the device for updating the shared symmetric key, as provided in the embodiments of this application. ​ As shown:

[0258] Optionally, the shared symmetric key update process between the gateway and the device, with secure synchronization as its core, is divided into three stages in sequence:

[0259] First, the gateway proactively sends an "Update" message to the device, along with the initial shared symmetric key. Encrypted " "The ciphertext (nonce5 is a random number)" (The new key to be updated).

[0260] Secondly, after decryption, the device verifies the validity of nonce5, generates a new random number nonce6, and uses it. encryption" "and return to the gateway."

[0261] Finally, the gateway decrypts and verifies the nonce5 consistency. If the verification passes and synchronization is successful, then... encryption" "Send confirmation, and the device decrypts and completes the key update; if synchronization fails, the gateway sends a 'Fail' signal to terminate the process."

[0262] Optionally, this process employs a dual mechanism to ensure the security and efficiency of key updates:

[0263] Specifically, a "regular update + event-triggered update" strategy is adopted, with key rotation triggered at preset time intervals, and updates initiated immediately when network anomalies or security threats are detected, thus shortening the key exposure cycle.

[0264] Specifically, replay attacks are defended using random numbers (nonce5, nonce6). A unique random number is used for each interaction to ensure message timeliness. Combined with symmetric encryption (such as AES), sensitive information such as "Update command, random number, and new key" is encrypted and transmitted to ensure message confidentiality and integrity.

[0265] More specifically, the two strategies work together to improve key security through dynamic updates and prevent man-in-the-middle attacks and data tampering through random numbers and encryption.

[0266] It should be noted that this process achieves significant improvements in key security and resistance to attacks:

[0267] Optionally, in terms of key security, regular updates shorten the average key usage period, and event-triggered updates further shorten the key exposure time in abnormal scenarios, reducing the effective time window for attackers to crack the key.

[0268] Optionally, in terms of attack resistance, the random number mechanism reduces the success rate of replay attacks, and symmetric encryption ensures the protection of sensitive information (such as new keys). The system maintains complete confidentiality throughout transmission, ensuring that even if an attacker intercepts the message, they cannot decrypt it to obtain critical information. Ultimately, the process, through dynamic key updates and multiple security protections, constructs a communication environment for IoT devices that meets high security requirements.

[0269] In this embodiment, the device and the gateway periodically update the shared key.

[0270] ​ A schematic diagram of the structure of a terminal automated access device provided in this application embodiment. ​ ,like ​ As shown, the device is applied to a terminal device and includes: a reading module 81, a first processing module 82, a second processing module 83, and a third processing module 84.

[0271] The reading module 81 is used to read trusted storage information; wherein, the trusted storage information is used to store device-related information of the terminal device, and the device-related information includes key information;

[0272] The first processing module 82 is used to access the gateway device, generate an encrypted data packet based on the key information, and send the encrypted data packet and device-related information to the gateway device.

[0273] The second processing module 83 is used to respond to the shared key synchronization operation of the gateway device, generate synchronization data, return it to the gateway device, and assist in completing the shared key synchronization operation.

[0274] The third processing module 84 is used to respond to the shared key update operation of the gateway device, generate update data, return it to the gateway device, and assist in completing the shared key update operation.

[0275] In one possible design, the access gateway device generates an encrypted data packet based on the key information, and sends the encrypted data packet along with device-related information to the gateway device, including:

[0276] The first processing module 82 is also used to generate a first random number and send an access request to the gateway device;

[0277] Receive the gateway response message and the second random number returned by the gateway device, wherein the gateway response message includes the gateway certificate and the signature value of the first random number;

[0278] Based on the key information, encrypt the second random number to obtain the first verification value;

[0279] Based on the key information, encrypt the first random number and the gateway certificate to obtain the second verification value;

[0280] Send the first random number signature value, the first verification value, the second verification value, and the device-related information to the gateway device.

[0281] In one possible design, in response to a shared key update operation by the gateway device, update data is generated and returned to the gateway device to assist in completing the shared key update operation, including:

[0282] The third processing module 84 is also used to decrypt the latest shared key verification value sent by the gateway device; wherein, the latest shared key verification value contains the encrypted latest shared key, the Nth random number and the update flag; wherein, the Nth random number is a random number generated by the gateway device when updating the shared key;

[0283] Identify the update marker in the latest shared key verification value and generate the (N+1)th random number;

[0284] The updated verification value is obtained by encrypting the update token, the Nth random number, and the (N+1)th random number using the latest shared key.

[0285] Send the updated verification value to the gateway device;

[0286] Receive the synchronization key signal returned by the gateway device.

[0287] The terminal automated access device provided in this embodiment can execute a terminal automated access method of the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0288] In a specific implementation of the aforementioned terminal automated access method, each module can be implemented as a processor. The processor can execute computer execution instructions stored in the memory, thereby enabling the processor to execute the aforementioned terminal automated access method.

[0289] ​ A schematic diagram of the structure of a terminal automated access device provided in this application embodiment. ​ ,like ​As shown, this device is applied to a gateway device and includes: a first response module 91, a second response module 92, a synchronization module 93, and an update module 94.

[0290] The first response module 91 is used to respond to the access request sent by the terminal device, generate a second random number, and receive encrypted data packets and device-related information.

[0291] The second response module 92 is used to respond to the verification operation of the device manufacturer, process the shared key data group according to the device-related information and encrypted data packets, and then respond to the access control list generation operation of the cloud platform to receive the device access control list; wherein, the device access control list helps the gateway device configure the access of the terminal device;

[0292] The synchronization module 93 is used to perform shared key synchronization with the terminal device and generate synchronization information after the shared key synchronization is completed; the synchronization information is used to determine whether the shared key synchronization is successful.

[0293] The update module 94 is used to perform a shared key update operation with the terminal device and generate update information after the shared key update is completed; the update information is used to determine whether the shared key synchronization has been successfully updated.

[0294] In one possible design, the encrypted data packet includes a first verification value and a second verification value;

[0295] Device-related information includes master key data;

[0296] In response to the device manufacturer's verification operation, based on the device-related information and encrypted data packets, a shared key data set is obtained. Then, in response to the cloud platform's access control list generation operation, the device access control list is received, including:

[0297] The second response module 92 is also used to access the device manufacturer through a Uniform Resource Locator and send the device-related information, the second random number and the second verification value to the device manufacturer.

[0298] Receives a third verification value and device access control information sent by the device manufacturer; wherein the third verification value is calculated after the verification result shows that it has passed; wherein the verification result is obtained by the device manufacturer based on the second verification value;

[0299] Compare whether the second verification value and the third verification value are equal;

[0300] When the second verification value is equal to the third verification value, the shared key data is calculated based on the master key data and then sent to the device manufacturer.

[0301] The receiving equipment manufacturer obtains a shared key data group by encrypting the shared token, the first verification value, and the shared key using the equipment key data encryption.

[0302] Send device access control information to the cloud platform;

[0303] Receive the device access control list generated by the cloud platform based on the device access control information.

[0304] In one possible design, the device-related information includes the original verification value;

[0305] Perform a shared key synchronization operation with the terminal device. After the shared key synchronization is completed, generate synchronization information, including:

[0306] The synchronization module 93 is also used to generate a third verification value and send a synchronization tag, the third verification value and the shared key data group to the terminal device;

[0307] The terminal device receives a shared key synchronization data group; wherein, when the first verification value matches the original verification value, the shared key synchronization data group is obtained by encrypting the shared key data; wherein, the shared key synchronization data group includes a shared token, a third verification value, and a fourth verification value generated by the terminal device;

[0308] Decrypt the shared key synchronization data group by sharing key data to determine whether the shared key data is consistent with the terminal device;

[0309] If the synchronization is successful, the shared key data is used to encrypt the shared token and the fourth verification value to generate a shared key synchronization success data group, which is then sent to the terminal device.

[0310] If synchronization is inconsistent, a synchronization failure message is sent to the terminal device.

[0311] The terminal automated access device provided in this embodiment can execute a terminal automated access method of the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0312] In a specific implementation of the aforementioned terminal automated access method, each module can be implemented as a processor. The processor can execute computer execution instructions stored in the memory, thereby enabling the processor to execute the aforementioned terminal automated access method.

[0313] ​ This is a schematic diagram of the structure of a terminal automated access device provided in an embodiment of this application. ​As shown, the terminal automation access device 100 includes at least one processor 101 and a memory 102. The terminal automation access device 100 also includes a communication component 103. The processor 101, memory 102, and communication component 103 are connected via a second bus 104.

[0314] In the specific implementation process, at least one processor 101 executes computer execution instructions stored in memory 102, causing at least one processor 101 to execute a terminal automation access method as described above on the terminal automation access device side.

[0315] The specific implementation process of processor 101 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0316] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0317] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage.

[0318] The second bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0319] The above description of the functions implemented by the terminal automated access device and the main control device illustrates the solutions provided by the embodiments of the present invention. It is understood that, in order to achieve the above functions, the terminal automated access device or the main control device includes hardware structures and / or software modules corresponding to the execution of each function. By combining the units and algorithm steps of the various examples described in the embodiments of the present invention, the embodiments of the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present invention.

[0320] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the above-described terminal automated access method.

[0321] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0322] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in a terminal automation access device or a main control device.

[0323] This application also provides a computer program product, which includes: a computer program stored in a readable storage medium, at least one processor of a terminal automated access device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the terminal automated access device to perform the solution provided in any of the above embodiments.

[0324] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0325] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A terminal automated access method, characterized in that, Applied to a terminal device, the method includes: Read trusted storage information; wherein, the trusted storage information is used to store device-related information of the terminal device, and the device-related information includes key information; The access gateway device generates an encrypted data packet based on the key information and sends the encrypted data packet along with the device-related information to the gateway device. In response to the shared key synchronization operation of the gateway device, synchronization data is generated and returned to the gateway device to assist in completing the shared key synchronization operation; In response to the shared key update operation of the gateway device, update data is generated and returned to the gateway device to assist in completing the shared key update operation.

2. The method according to claim 1, characterized in that, The access gateway device generates an encrypted data packet based on the key information, and sends the encrypted data packet along with the device-related information to the gateway device, including: Generate a first random number and send an access request to the gateway device; Receive the gateway response message and the second random number returned by the gateway device, wherein the gateway response message includes the gateway certificate and the first random number signature value; Based on the key information, the second random number is encrypted to obtain the first verification value; Based on the key information, the first random number and the gateway certificate are encrypted to obtain the second verification value; The first random number signature value, the first verification value, the second verification value, and the device-related information are sent to the gateway device.

3. The method according to claim 2, characterized in that, The step of generating update data in response to the shared key update operation of the gateway device and returning it to the gateway device to assist in completing the shared key update operation includes: Decrypt the latest shared key verification value sent by the gateway device; wherein the latest shared key verification value contains the encrypted latest shared key, the Nth random number, and an update flag; wherein the Nth random number is a random number generated by the gateway device when updating the shared key; Identify the update marker in the latest shared key verification value and generate the (N+1)th random number; The update token, the Nth random number, and the (N+1)th random number are encrypted using the latest shared key to obtain the update verification value; Send the updated verification value to the gateway device; Receive the synchronization key signal returned by the gateway device.

4. A terminal automated access method, characterized in that, Applied to a gateway device, the method includes: In response to an access request sent by a terminal device, a second random number is generated, and encrypted data packets and device-related information are received. In response to the device manufacturer's verification operation, a shared key data group is obtained based on the device-related information and the encrypted data packet. Then, in response to the cloud platform's access control list generation operation, the device access control list is received. The device access control list helps the gateway device configure the access of the terminal device. A shared key synchronization operation is performed with the terminal device, and synchronization information is generated after the shared key synchronization is completed; wherein, the synchronization information is used to determine whether the shared key synchronization is successful. A shared key update operation is performed with the terminal device, and update information is generated after the shared key update is completed; wherein, the update information is used to determine whether the shared key synchronization has been successfully updated.

5. The method according to claim 4, characterized in that, The encrypted data packet includes a first verification value and a second verification value; The device-related information includes master key data; In response to the device manufacturer's verification operation, a shared key data group is obtained based on the device-related information and the encrypted data packet. Then, in response to the cloud platform's access control list generation operation, the device access control list is received, including: Access the device manufacturer through a Uniform Resource Locator and send the device-related information, the second random number, and the second verification value to the device manufacturer. The device receives a third verification value and device access control information sent by the device manufacturer; wherein the third verification value is calculated after the verification result shows that the verification is successful; wherein the verification result is obtained by the device manufacturer based on the second verification value. Compare whether the second verification value and the third verification value are equal; When the second verification value is equal to the third verification value, the shared key data is calculated based on the master key data, and the shared key data is sent to the device manufacturer. Receive a shared key data group obtained by the device manufacturer through encrypting the shared token using device key data, the first verification value, and the shared key; Send the device access control information to the cloud platform; Receive the device access control list generated by the cloud platform based on the device access control information.

6. The method according to claim 5, characterized in that, The device-related information includes the original verification value; The shared key synchronization operation with the terminal device, and the generation of synchronization information after the shared key synchronization is completed, includes: A third verification value is generated, and a synchronization tag, the third verification value, and the shared key data group are sent to the terminal device. The terminal device receives a shared key synchronization data group; wherein the shared key synchronization data group is obtained by encrypting shared key data when the first verification value is consistent with the original verification value; wherein the shared key synchronization data group includes the shared token, the third verification value, and a fourth verification value generated by the terminal device. Decrypt the shared key synchronization data group using the shared key data to determine whether the shared key data is synchronized with the terminal device; If the synchronization is successful, the shared token and the fourth verification value are encrypted using the shared key data to generate a shared key synchronization success data group, which is then sent to the terminal device. If synchronization is inconsistent, a synchronization failure message is sent to the terminal device.

7. A terminal automated access device, characterized in that, Applied to a terminal device, the device includes: A reading module is used to read trusted storage information; wherein, the trusted storage information is used to store device-related information of the terminal device, and the device-related information includes key information; The first processing module is used to access the gateway device, generate an encrypted data packet based on the key information, and send the encrypted data packet and the device-related information to the gateway device. The second processing module is used to respond to the shared key synchronization operation of the gateway device, generate synchronization data, return it to the gateway device, and assist in completing the shared key synchronization operation. The third processing module is used to respond to the shared key update operation of the gateway device, generate update data, return it to the gateway device, and assist in completing the shared key update operation.

8. A terminal automated access device, characterized in that, Applied to a gateway device, the device includes: The first response module is used to respond to the access request sent by the terminal device, generate a second random number, and receive encrypted data packets and device-related information. The second response module is used to respond to the verification operation of the device manufacturer, process the device-related information and the encrypted data packet to obtain a shared key data group, and then respond to the access control list generation operation of the cloud platform to receive the device access control list; wherein, the device access control list helps the gateway device configure the access of the terminal device; A synchronization module is used to perform a shared key synchronization operation with the terminal device, and generate synchronization information after the shared key synchronization is completed; wherein, the synchronization information is used to determine whether the shared key synchronization is successful. The update module is used to perform a shared key update operation with the terminal device and generate update information after the shared key update is completed; wherein, the update information is used to determine whether the shared key synchronization has been successfully updated.

9. A terminal automated access device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-3 or any one of claims 4-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-3 or any one of claims 4-6.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1-3 or any one of claims 4-6.

Images