Remote control method based on data verification and electronic equipment

Abstract

The invention relates to the technical field of data security processing, in particular to a remote control method based on data verification and electronic equipment. The method comprises the following steps: receiving an encrypted data packet sent by a user side, generating a refresh token after the encrypted data packet passes verification, and sending the refresh token to the user side, so that the user side stores the refresh token; receiving a refresh token fed back by the user side after the user initiates the remote control instruction, generating an access token after the feedback refresh token passes verification, and sending the access token to the user side; receiving an access token and a remote control instruction fed back by the user side, and verifying the fed-back access token and the remote control instruction to obtain a final verification result; and after the final verification result is that the verification is passed, the remote control instruction is sent to the target control end, so that the target control end performs control operation according to the remote control instruction. And remote control is safer through a dual verification process of token refreshing verification and token access verification.

Description

Technical Field

[0001] This application relates to the field of data security processing technology, and in particular to a remote control method and electronic device based on data verification. Background Technology

[0002] Currently, remote control functions are becoming increasingly common. Remote control generally requires the use of the cloud to transmit remote control commands in order to achieve the purpose of remote control.

[0003] However, typical remote control only performs simple security verification, and security cannot be effectively guaranteed. Remote control data is easily attacked or leaked. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a remote control method and electronic device based on data verification, so as to solve the technical problem that the data of current remote control is easily attacked or leaked, and the security cannot be effectively guaranteed.

[0005] To achieve the above objectives, this application provides a data-verified remote control method applied in the cloud, the method comprising: The system receives encrypted data packets from the user terminal. After the encrypted data packets are verified, a refresh token is generated and sent to the user terminal for storage. The system receives a refresh token from the user terminal after the user initiates a remote control command. After the refresh token is verified, an access token is generated and sent to the user terminal. Receive the access token and remote control command from the user terminal, verify the access token and remote control command, and obtain the final verification result. After the final verification result is successful, the remote control command is sent to the target control terminal so that the target control terminal can control the operation according to the remote control command.

[0006] Based on the same inventive concept, this application also provides a remote control method based on data verification, applied to a user terminal, the method comprising: After logging into the application, the encrypted data packet is identified and sent to the cloud for verification. Once the verification is successful, a refresh token is generated. Receive the refresh token sent from the cloud and store the refresh token; The system receives remote control commands initiated by the user and sends the stored refresh token back to the cloud for verification. Once the cloud verifies the refresh token, it generates an access token. The system receives the access token sent from the cloud, sends the access token and the remote control command back to the cloud, and verifies the access token and remote control command. After successful verification, the cloud sends the remote control command to the target control terminal to control the target control terminal to run.

[0007] Based on the same inventive concept, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method described above when executing the computer program.

[0008] As described above, the remote control method and electronic device based on data verification provided in this application involve the user sending encrypted data packets to the cloud. The cloud verifies the encrypted data packets, generates a refresh token upon successful verification, and sends the refresh token to the user. The user then stores the refresh token. After initiating a remote control command, the user sends the refresh token back to the cloud, which verifies it. This completes one layer of authentication. However, to further enhance security, the cloud also generates an access token and sends it to the user. Upon receiving the access token, the user sends it along with the remote control command back to the cloud. The cloud verifies both the access token and the remote control command to obtain the final verification result, thus completing two layers of authentication. If the final verification result is successful, the two layers of authentication are confirmed. This two-layer authentication process ensures the security of the remote control process, allowing the remote control command to be sent to the target control terminal, thereby controlling the target control terminal to execute the remote control command. The entire remote control process undergoes a dual verification process, including both a refresh token verification process and an access token verification process. This makes remote control more secure, reduces the possibility of attacks, minimizes the risk of data leakage, and effectively improves security. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a flowchart illustrating a data-verification-based remote control method applied in the cloud according to an embodiment of this application; Figure 2 This is a flowchart illustrating a data-verification-based remote control method applied to a user terminal according to an embodiment of this application. Figure 3This is a logical diagram illustrating the joint execution of a data-based remote control method by the cloud and the user terminal in an embodiment of this application. Figure 4 This is a structural block diagram of a cloud-based remote control device configured according to data verification, as described in an embodiment of this application. Figure 5 This is a structural block diagram of a data-verification-based remote control device installed on a user terminal, according to an embodiment of this application. Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0012] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0013] RT: Refresh Token.

[0014] AT: Access Token, also known as a short-term access token.

[0015] APP: Application.

[0016] TLS: Transport Layer Security.

[0017] Token: A token is a digital identifier used in various scenarios in the computer field. In information technology, it is a random string or encrypted data block used for authentication, secure access, or authorization control, representing authorization information for a user, device, or session.

[0018] With the rapid development of intelligent connected vehicles (e.g., intelligent vehicle networking), remote control functions (e.g., remote unlocking, remote air conditioning start) are gradually becoming a basic user requirement. However, the security of remote control commands has become a critical issue. Related technologies typically employ fixed authentication mechanisms or simple token verification methods, which are vulnerable to replay attacks, man-in-the-middle attacks, or token leakage.

[0019] In addition, some remote control processes in related technologies use short-term access tokens (AT) for authentication, but the process of obtaining short-term access tokens (AT) often lacks sufficient security and does not fully utilize the security capabilities of the user's local device (such as secure memory, TEE, etc.).

[0020] Therefore, there is an urgent need for a safer and more reliable remote control transmission mechanism.

[0021] Based on the above, the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0022] The data-verification-based remote control method proposed in the embodiments of this application is applied in the cloud, such as... Figure 1 As shown, the method includes: Step 101: Receive the encrypted data packet sent by the user terminal. After the encrypted data packet is verified, generate a refresh token and send the refresh token to the user terminal for the user terminal to store the refresh token.

[0023] In practice, the user end includes, but is not limited to, desktop computers, mobile phones, mobile computers, tablets, media players, smart wearable devices, personal digital assistants (PDAs), or other electronic devices capable of performing the corresponding functions.

[0024] The user terminal has an application (APP) for remotely controlling the target control device (e.g., vehicle, smart appliance, or smart home device). Users can operate the user terminal, and after opening the application through the user terminal, they will receive an encrypted data packet, which is then sent to the cloud.

[0025] Once the cloud receives the encrypted data packet, it verifies its correctness. If the verification fails, the cloud stops operating, and subsequent remote control commands issued by the user will not be processed by the cloud. This effectively prevents the encrypted data packet from being tampered with. Only after the encrypted data packet has been successfully verified will a refresh token be generated and sent to the user's client for storage.

[0026] Step 102: Receive the refresh token fed back by the user terminal after the user initiates a remote control command. After the refresh token is verified, generate an access token and send the access token to the user terminal.

[0027] In practice, remote control commands include: data retrieval commands and / or function control commands. Data retrieval commands include at least one of: image retrieval, fault data retrieval, and stored data retrieval. Function control commands include at least one of: enabling the target function, disabling the target function, executing the target function, and adjusting the target function. The target function is the function the user wants to remotely control.

[0028] After a user initiates a remote control command through the client, the stored refresh token is first retrieved and sent to the cloud. The cloud then verifies the refresh token to prevent it from being tampered with. If the refresh token verification fails, the cloud will not generate an access token, and subsequent processes cannot be executed. If the user issues a remote control command through the client, the cloud will not process it, effectively preventing the risk of refresh token tampering. If the refresh token verification succeeds, the cloud will generate an access token and send it to the client, thus enabling the execution of the subsequent remote control process.

[0029] Step 103: Receive the access token and remote control command from the user terminal, verify the access token and remote control command, and obtain the final verification result.

[0030] In practice, once the user receives the access token, the user can confirm that the refresh token sent back to the cloud is correct and has not been tampered with. Therefore, the user can combine the access token with the remote control command and send it back to the cloud.

[0031] This allows the cloud to perform double verification on the returned access token and remote control command. If either the returned access token or the remote control command is incorrect, the final verification result is verification failure. Only if both the returned access token and remote control command are correct will the final verification result be verification success.

[0032] The specific verification process can be customized based on actual needs, specifically the order in which the access token and remote control command are verified. The access token can be verified first, followed by the remote control command; alternatively, the remote control command can be verified first, followed by the access token; or both can be verified simultaneously. In this embodiment, it is preferable to verify the access token first, followed by the remote control command.

[0033] Step 104: After the final verification result is successful, the remote control command is sent to the target control terminal so that the target control terminal can control the operation according to the remote control command.

[0034] In practice, once the cloud determines that the final verification result is successful, it proves that both verifications are secure and that the remote control process is secure. The cloud can then send the remote control command to the target control terminal, thereby controlling the target control terminal to execute the remote control command.

[0035] The remote control command carries the identity information of the target control terminal. The cloud can determine the target control terminal based on this identity information, then establish a communication connection between the cloud and the target control terminal, and then send the remote control command to the target control terminal.

[0036] After receiving the remote control command, the target control terminal will also authenticate the sender of the remote control command (i.e., the user terminal) to determine that the sender is a user terminal that can remotely control the target control terminal. Then, the target control terminal will control the operation according to the remote control command.

[0037] Through the above scheme, the cloud can verify the encrypted data packets sent by the user terminal. Upon successful verification, the cloud generates a refresh token and sends it to the user terminal for storage. The cloud then verifies the refresh token returned by the user after initiating a remote control command. Successful verification completes one layer of authentication. However, to further enhance security, the cloud also generates an access token and sends it to the user terminal. The cloud receives the access token and the remote control command from the user, verifies both, and obtains the final verification result, thus completing two layers of authentication. If the final verification result is successful, the two-layer authentication is confirmed. This two-layer authentication process ensures the security of the remote control process, allowing the remote control command to be sent to the target control terminal and executed. The entire remote control process undergoes a dual verification process—refresh token verification and access token verification—making remote control more secure, reducing the risk of attacks and data leaks, and effectively improving security.

[0038] In some embodiments, the encrypted data packet includes: a login token and password data.

[0039] The login token is the login token obtained by the user when registering using the client. The login token includes: Header: Specifies the type and signature algorithm; Payload: Stores the actual data to be transmitted, such as user ID, username, expiration time, etc. Signature: Generated by the cloud using a secret key to sign the header and payload, used to prevent the login token from being tampered with.

[0040] Password data is the password that the user sets when registering using the client.

[0041] Step 101 includes: Step 1011: Receive the encrypted data packet sent by the user terminal, and decrypt the encrypted data packet to obtain the login token and password data.

[0042] In practice, to ensure the security of login tokens and passwords, the user end encrypts them (e.g., using TLS encryption, hash encryption, or symmetric encryption) to obtain encrypted data packets. The cloud receives these encrypted data packets and needs to decrypt them according to the encryption method to obtain the accurate login tokens and passwords.

[0043] Step 1012: Verify the validity of the login token and the password data.

[0044] In practice, since the login token includes a header, payload, and signature, the cloud first decrypts the signature, then uses the decrypted signature to determine the header and payload, and verifies the validity of the header and payload.

[0045] If both the decrypted Header and Payload are valid, the validity verification has passed; if either the decrypted Header or Payload is invalid, the validity verification has failed. If the validity verification passes, execution can continue; otherwise, the cloud will send a verification failure message to the user and notify them to continue execution.

[0046] Step 1013: In response to the successful verification of the validity of the login token and the password data, a random value is generated and used as a refresh token.

[0047] In practice, if the login token and password data pass the validity verification, it proves that the user's identity is legitimate. The cloud will then generate a random value, which can be a random number of 128 to 256 bytes. It can be generated using methods such as SecureRandom / crypto.randomBytes. This random value can then be used as a refresh token.

[0048] Step 1014: Determine the metadata corresponding to the user terminal, associate and store the metadata with the refresh token, and send the refresh token to the user terminal.

[0049] In practice, the metadata corresponding to the user terminal includes at least one of the following: user ID, client ID, authorized scope, expiration time, and user terminal device number.

[0050] After the cloud receives the corresponding metadata from the user's client, it associates the refresh token with the metadata and stores it in the cloud (for example, storing the refresh token as the key and the metadata as the value in a key-value pair). Once the cloud has completed storage, it sends the refresh token to the user's client via a communication channel. The user can then store the refresh token and use it to exchange for an access token from the cloud later.

[0051] Through the above scheme, the cloud can verify the validity of the login token and password data in the encrypted data packets sent by the user, preventing the encrypted data packets from being tampered with or transmitted incorrectly. After the validity verification is successful, an accurate refresh token can be generated, stored in the cloud, and then sent to the user. In this way, when the user wants to perform remote control in the future, he / she can use the refresh token to exchange for the corresponding access token and access the device.

[0052] In some embodiments, step 102, receiving the refresh token from the user terminal after the user initiates a remote control command, and generating an access token (AT) after the refresh token is verified, includes: Step 1021: Receive the refresh token fed back by the user terminal after the user initiates a remote control command, and verify whether the refresh token fed back is correct.

[0053] In practice, after receiving the refresh token, the user terminal can perform remote control. In this way, the user can initiate remote control commands to the target control terminal through the user terminal (for example, the target control terminal is the vehicle terminal, which can be used to lock or unlock the vehicle terminal, turn the air conditioner on or off, or raise or lower the windows, etc.).

[0054] To ensure the secure and accurate transmission of the remote control command, the client first sends a stored refresh token to the cloud. The cloud then verifies the refresh token, specifically by checking its existence. If the token exists, the cloud retrieves the corresponding stored metadata and checks its expiration. If the token is valid, the refresh token is considered correct, and the process can continue. Otherwise, the refresh token is deemed incorrect, an error message is sent to the client, and further execution is halted.

[0055] Step 1022: In response to the feedback that the refresh token is correct, determine the user's identity information and verify the identity information.

[0056] In practice, after confirming that the refresh token is correct, the user's identity information will be verified to ensure that the user is a terminal device capable of remotely controlling the target control terminal.

[0057] The identity information includes at least one of the following: client ID information, client certificate, and client_id + secret.

[0058] Step 1023: In response to the successful verification of the identity information, determine the field data corresponding to the user terminal, and generate the access token by combining the private key in the cloud with the field data.

[0059] In practice, once the user's identity information is verified, it proves that the user is legitimate and capable of remotely controlling the target control terminal. Then, to generate a unique access token for the user, the user's field data (e.g., at least one of the following: algorithm, validity period, user type, domain name, permission scope, and user ID) is determined. This field data is then combined with a private key stored in the cloud to generate a unique access token. After sending this access token to the user, the user knows that the token verification has been successful and can subsequently transmit remote control commands.

[0060] The above scheme enables accurate verification of refresh tokens via the cloud. After successful refresh token verification, user identity verification is performed, ensuring the accuracy of the user's identity. Once the user's identity is verified, the user's field data is accurately combined with the private key in the cloud to generate an accurate access token. This access token can be used for the next stage of the verification process, further ensuring the security of the remote control process.

[0061] In some embodiments, step 103 includes: Step 1031: Receive the access token and remote control command from the user terminal, and verify whether the access token is correct.

[0062] In practice, after receiving the access token, the user client combines it with the remote control command and sends it to the cloud. As a preferred embodiment, the user client can encrypt the access token and remote control command, and then send the encrypted access token and remote control command back to the cloud. The cloud can then decrypt the encrypted access token and remote control command. After decrypting the returned access token and remote control command, the cloud verifies the returned access token. The cloud uses its private key to decode the returned access token and determines whether the field data corresponds to the user client's field data. If it does, the returned access token is considered correct; otherwise, the returned access token is incorrect.

[0063] Step 1032: In response to the correctness of the access token feedback, determine whether the feedback time of the access token feedback is within the predetermined period.

[0064] Step 1033: In response to the feedback time being within the predetermined period, determine the basic information of the user terminal from the remote control command, verify the basic information, and obtain the final verification result.

[0065] In practice, after confirming the correctness of the returned access token, the system retrieves the corresponding feedback time from the access token to determine if it is within the predetermined period. If the access token verification is successful, the returned remote control command needs further verification to ensure its validity. Specifically, the system retrieves basic user information (e.g., at least one of the user domain name, user type, and user ID) from the remote control command. After verifying this basic information, both the returned access token and the remote control command are confirmed to be accurate and valid. The final verification result is then considered successful, allowing the subsequent transmission of remote control commands. Otherwise, the final verification result is failure, prohibiting the transmission of remote control commands and sending a notification to the user.

[0066] The above scheme allows for the verification of the access token combined with the remote control command after the refresh token verification is completed. This dual verification makes remote control more secure, reduces the possibility of attacks, reduces the risk of leakage, and effectively improves security.

[0067] Based on the same inventive concept, another embodiment of this application proposes a remote control method based on data verification, which is applied to a user terminal, including but not limited to desktop computers, mobile phones, mobile computers, tablet computers, media players, smart wearable devices, personal digital assistants (PDAs), or other electronic devices capable of performing corresponding functions.

[0068] like Figure 2 As shown, the method includes: Step 201: After logging into the application, identify the encrypted data packet and send the encrypted data packet to the cloud for verification. Once the verification is successful, a refresh token is generated.

[0069] In practice, the user terminal has an application (APP) for remotely controlling the target control device (e.g., vehicle, smart appliance, or smart home device). The user can operate the user terminal; after opening the application, they receive an encrypted data packet, which they then send to the cloud. Only after the cloud verifies the encrypted data packet will it generate a refresh token and send it to the user terminal.

[0070] Step 202: Receive the refresh token sent from the cloud and store the refresh token.

[0071] In practice, after receiving the refresh token from the cloud, the user terminal stores the refresh token in secure memory to prevent it from being tampered with. Secure memory refers to a memory repository that uses encryption keys for encrypted storage.

[0072] Step 203: Receive the remote control command initiated by the user, and send the stored refresh token back to the cloud so that the cloud can verify the refresh token. After successful verification, an access token is generated.

[0073] In practice, the user generates remote control commands by operating the application on their client. The client then retrieves a refresh token from secure memory and sends it to the cloud. The cloud verifies the refresh token to prevent tampering. If the refresh token verification fails, the cloud will not generate an access token, and subsequent processes cannot be executed. Similarly, if the user issues remote control commands through the client, the cloud will not process them, effectively preventing the risk of refresh token tampering. If the refresh token verification succeeds, the cloud generates an access token, sends it to the client, and then executes the subsequent remote control process.

[0074] Step 204: Receive the access token sent from the cloud, and send the access token and the remote control command back to the cloud so that the cloud can verify the access token and the remote control command. After the verification is successful, send the remote control command to the target control terminal to control the target control terminal to run.

[0075] In practice, once the user receives the access token from the cloud, it proves that the previously returned refresh token was correct and passed the first verification process. At this point, remote control commands can be sent, sending both the access token and the remote control command back to the cloud. The cloud then performs a second verification on the returned access token and remote control command. If either the returned access token or the remote control command is incorrect, the remote control command cannot be sent to the target control terminal. Only when both the returned access token and remote control command are correct is the final verification result considered successful, proving that the second verification is secure and the corresponding remote control process is secure. Thus, the cloud can send the remote control command to the target control terminal, thereby controlling the target control terminal to execute the remote control command.

[0076] The above scheme involves the user client sending encrypted data packets to the cloud. The cloud verifies the encrypted data packets and generates a refresh token, which is then sent to the user client. The user client stores this refresh token. When the user initiates a remote control command, the stored refresh token is sent back to the cloud. The cloud performs a first-level authentication on the refresh token. Upon successful first-level authentication, an access token is generated and sent to the user client. The user client, after receiving the access token and confirming successful first-level authentication, sends it along with the remote control command to the cloud. The cloud then performs a second-level authentication on both the access token and the remote control command. Successful second-level authentication ensures the remote control process is secure, allowing the cloud to send the remote control command to the target control terminal, thus controlling the target control terminal to execute the command. This dual-verification process—using both the refresh token and access token—enhances the security of remote control, reduces the risk of attacks and data leaks, and effectively improves overall security.

[0077] In some embodiments, step 201 includes: Step 2011: After logging into the application, obtain the login token and the preset password data.

[0078] In practice, the login token is the login token obtained by the user when registering using the client. The login token includes: Header: Specifies the type and signature algorithm; Payload: Stores the actual data to be transmitted, such as user ID, username, expiration time, etc. Signature: Generated by the cloud using a secret key to sign the header and payload, used to prevent the login token from being tampered with.

[0079] Password data is the password that the user sets when registering using the client.

[0080] Step 2012: Encrypt the login token and the password data to obtain an encrypted data packet, and send the encrypted data packet to the cloud.

[0081] In practice, to ensure the security of login tokens and password data, the user client encrypts them (e.g., using TLS encryption, hash value encryption, or symmetric encryption, preferably TLS encryption) to obtain an encrypted data packet. This encrypted data packet is then transmitted to the cloud, which needs to decrypt it according to the encryption method to obtain the accurate login token and password data for subsequent verification processes (i.e., steps 202 to 204).

[0082] The above method can obtain accurate login token and password data. Then, the two are integrated and encrypted for secure transmission, making the transmission of the encrypted data packet more secure and accurate.

[0083] In some embodiments, step 202 includes: Step 2021: Receive the refresh token sent from the cloud and retrieve the hardware key of the application layer.

[0084] In practice, once the user receives the refresh token from the cloud, it can confirm that the encrypted data packet is verified to be accurate and secure. In this way, the user can retrieve the corresponding hardware key from the application layer.

[0085] The hardware key is stored in TEE / Secure Enclave / Keystore. The user's operating system ensures that the application layer cannot directly read the hardware key, making the hardware key secure.

[0086] Step 2022: Encrypt the refresh token using the hardware key of the application layer, and store the encrypted refresh token in the user-side repository.

[0087] In practice, to ensure more secure storage of refresh tokens, they are encrypted with a hardware key and stored in the user's repository to prevent malicious extraction.

[0088] The above scheme enables the hardware key to encrypt and store the refresh token, making the refresh token storage more secure and effectively preventing the refresh token from being maliciously extracted or tampered with.

[0089] In some embodiments, step 203 includes: Step 2031: Receive the remote control command initiated by the user and retrieve the encrypted refresh token from the user's repository.

[0090] In practice, after receiving the refresh token, the user terminal can perform remote control. In this way, the user can initiate remote control commands to the target control terminal through the user terminal (for example, the target control terminal is the vehicle terminal, which can be used to lock or unlock the vehicle terminal, turn the air conditioner on or off, or raise or lower the windows, etc.).

[0091] Before sending remote control commands, the client then retrieves an encrypted refresh token from a repository (e.g., a private repository).

[0092] Step 2032: Retrieve the hardware key from the application layer, use the hardware key to decrypt the encrypted refresh token to obtain the decrypted refresh token, and send the decrypted refresh token back to the cloud.

[0093] In practice, the retrieved encrypted refresh token cannot be directly sent to the cloud. It needs to be decrypted using the hardware key retrieved from the application layer to obtain the accurate decrypted refresh token before being sent back to the cloud. The cloud will verify the returned refresh token, specifically by checking if it exists. If it exists, it will retrieve the corresponding stored metadata based on the refresh token and verify if the returned refresh token has expired. If it has not expired, the returned refresh token is considered correct, and the subsequent process can continue. Otherwise, the returned refresh token is considered incorrect, and an error message will be sent to the client, stopping further execution.

[0094] The above method can ensure the accuracy and security of the refresh token and effectively reduce the risk of the refresh token being tampered with.

[0095] In some embodiments, step 204 includes: Step 2041: Receive the access token sent from the cloud, and fuse the access token with the remote control command to obtain fused data.

[0096] In practice, after receiving the access token from the cloud, it can be confirmed that the refresh token verification has been successfully passed, and the remote control command can be sent. However, in order to ensure the accuracy of the transmission of the remote control command, the remote control command and the access token need to be merged together to obtain merged data.

[0097] Step 2042: Encrypt the fused data using a public key to obtain public key encrypted fused data, and send the public key encrypted fused data to the cloud so that the cloud can decrypt the public key encrypted fused data and verify the decrypted access token and remote control command.

[0098] In practice, the security of the fused data is still not high enough. Therefore, the user end uses a public key to encrypt the fused data and then sends the encrypted fused data to the cloud. After receiving the encrypted fused data, the cloud first uses the public key to decrypt the fused data, obtaining an access token and remote control command. The cloud then verifies the access token, and only after the access token is verified is the remote control command verified. Only after both verifications are successful will the remote control command be sent to the target control end, allowing the target control end to execute the remote control command and complete the remote control process.

[0099] The above scheme can encrypt the access token and remote control command with a public key before transmission, which can improve the security of transmission and prevent the access token and remote control command from being tampered with during transmission.

[0100] The following describes a specific embodiment in which the user terminal and the cloud jointly execute the data verification-based remote control method of this application embodiment, such as... Figure 3 The logic diagram shown below illustrates the specific process as follows: User-side execution: 1. Obtain the user's login token (i.e., login token) and the preset security password (i.e., password data).

[0101] 2. TLS encryption yields TLS-encrypted data packets (i.e., encrypted data packets).

[0102] 3. Send the TLS-encrypted data packet (i.e., the encrypted data packet) to the cloud.

[0103] Cloud execution: 4. Decrypt the TLS-encrypted data packet to obtain the Token (i.e., login token) and the security password (i.e., password data).

[0104] 5. Verify the validity of the Token (i.e., login token) and security password (i.e., password data).

[0105] 6. After successful verification of the Token and security password, a refresh token RT is generated.

[0106] Generate a random value, which can be a random number between 128 and 256 bytes. You can use methods such as SecureRandom / crypto.randomBytes to generate it. This random value can then be used as a refresh token.

[0107] Determine at least one of the following as the metadata of the user: user ID, client ID, authorization scope, expiration time, and user device number.

[0108] Refresh tokens are associated with metadata and stored together (for example, the refresh token is used as the key and the metadata is used as the value, and the key-value pairs are stored in the backend in the cloud (RDBMS, Redis or Mongo).

[0109] 7. Send the refresh token RT to the client.

[0110] User-side execution: 8. Store the refresh token RT in local secure memory (i.e., the repository).

[0111] The client can then retrieve the corresponding hardware key from the application layer (located in TEE / SecureEnclave / Keystore), encrypt the refresh token with the hardware key, and store it in the client's repository (e.g., a private repository) to prevent the refresh token from being maliciously extracted.

[0112] 9. The user initiates a vehicle control command to read the refresh token RT from the secure memory.

[0113] 10. Send the refresh token RT to the cloud.

[0114] Cloud execution: 11. Verify the validity of the refresh token RT.

[0115] The cloud will verify the refresh token. Specifically, it can check if the refresh token exists. If it does, it will retrieve the corresponding stored metadata based on the refresh token and check if the refresh token has expired based on the metadata. If it has not expired, the refresh token is considered correct and the subsequent process can continue. Otherwise, the refresh token is considered incorrect, and an error message will be sent to the client and the subsequent execution will be stopped.

[0116] After confirming that the refresh token is correct, the user's identity information will be verified to ensure that the user is a terminal device capable of remotely controlling the target control terminal.

[0117] If the user's identity information is verified successfully, it proves that the refresh token RT verification is successful, confirming that the user is legitimate and can remotely control the target control terminal normally.

[0118] 12. After the refresh token RT is verified, a short-term access token AT (i.e., access token) is generated.

[0119] It will use JWT (JSON Web Token) to determine the user's field data (for example, using at least one of the following: algorithm, validity period, user type, domain name, permission scope, and user ID), and combine the field data with the private key stored in the cloud to generate a user-specific short-term access token AT (i.e., access token).

[0120] 13. A short-term access token (AT) (i.e., an access token) is sent to the client.

[0121] User-side execution: 14. Send the short-term access token (AT) (i.e., access token) to the cloud along with the vehicle control command (i.e., remote control command).

[0122] Cloud execution: 15. Verify the validity of the short-term access token (AT) and the vehicle control command (i.e., remote control command).

[0123] First, verify whether the short-term access token AT is correct. After confirming that it is correct, determine whether the short-term access token AT is within the predetermined period, and then determine whether the short-term access token AT has expired. If it has not expired, it proves that the short-term access token AT is accurate.

[0124] Then, the basic information of the vehicle control command (i.e., remote control command) (e.g., at least one of the user terminal domain name, user terminal type, and user terminal ID) is verified. After the basic information is verified, it is proven that the returned access token and remote control command are accurate and valid.

[0125] 16. After successful verification, the vehicle control command (i.e., the remote control command) is sent to the vehicle terminal (i.e., the target control terminal) to execute the vehicle control command (i.e., the remote control command).

[0126] In summary, the entire remote control process involves a dual verification process, including both a refresh token verification process and an access token verification process. This makes remote control more secure, reduces the likelihood of attacks, minimizes the risk of data leakage, and effectively improves security.

[0127] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0128] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0129] Based on the same inventive concept, corresponding to the aforementioned cloud-based remote control method based on data verification, this application also provides a data verification-based remote control device, which is located in the cloud.

[0130] refer to Figure 4 The data-verified remote control device includes: The first verification module 301 is configured to receive encrypted data packets sent by the user terminal, generate a refresh token after the encrypted data packets are verified, and send the refresh token to the user terminal for the user terminal to store the refresh token. The second verification module 302 is configured to receive a refresh token fed back by the user terminal after the user initiates a remote control command, generate an access token after the refresh token is verified, and send the access token to the user terminal. The third verification module 303 is configured to receive the access token and remote control command fed back by the user terminal, verify the fed-back access token and remote control command, and obtain the final verification result. The remote control forwarding module 304 is configured to send the remote control command to the target control terminal after the final verification result is successful, so that the target control terminal can perform control operation according to the remote control command.

[0131] In some embodiments, the encrypted data packet includes: a login token and password data; The first verification module 301 is specifically configured as follows: Receive encrypted data packets sent by the user terminal, and decrypt the encrypted data packets to obtain the login token and password data; The login token and the password data are validated. In response to the successful verification of the validity of the login token and the password data, a random value is generated and used as a refresh token; Determine the metadata corresponding to the user terminal, associate the metadata with the refresh token and store it, and send the refresh token to the user terminal.

[0132] In some embodiments, the second verification module 302 is specifically configured as follows: Receive the refresh token fed back by the user terminal after the user initiates a remote control command, and verify whether the refresh token fed back is correct; If the refresh token is correct in response to the feedback, the user's identity information is determined and verified. In response to the successful verification of the identity information, the field data corresponding to the user terminal is determined, and the access token is generated by combining the private key in the cloud with the field data.

[0133] In some embodiments, the third verification module 303 is specifically configured as follows: Receive the access token and remote control command fed back from the user terminal, and verify whether the fed-back access token is correct; In response to the correctness of the access token feedback, determine whether the feedback time of the access token feedback is within the predetermined period; In response to the feedback time within the predetermined period, the basic information of the user terminal is determined from the remote control command, the basic information is verified, and the final verification result is obtained.

[0134] Based on the same inventive concept, corresponding to the aforementioned remote control method based on data verification executed by the user terminal, this application also provides a remote control device based on data verification, which is installed at the user terminal.

[0135] refer to Figure 5 The data-verified remote control device includes: After being configured as a login application, the login module 401 determines the encrypted data packet and sends the encrypted data packet to the cloud for verification. Once the verification is successful, a refresh token is generated. The refresh token storage module 402 is configured to receive the refresh token sent from the cloud and store the refresh token; The refresh token feedback module 403 is configured to receive remote control commands initiated by the user, and send the stored refresh token back to the cloud for the cloud to verify the refresh token. After successful verification, an access token is generated. The access token and remote control command feedback module 404 is configured to receive the access token sent from the cloud, and feed back the access token and the remote control command to the cloud so that the cloud can verify the fed-back access token and remote control command, and after successful verification, send the remote control command to the target control terminal to control the target control terminal to run.

[0136] In some embodiments, the login module 401 is specifically configured as follows: After logging into the application, obtain a login token and the preset password data; The login token and the password data are encrypted to obtain an encrypted data packet, which is then sent to the cloud.

[0137] In some embodiments, the refresh token storage module 402 is specifically configured as follows: Receive the refresh token sent from the cloud and retrieve the hardware key at the application layer; The refresh token is encrypted using the hardware key of the application layer, and the encrypted refresh token is stored in the user-side repository.

[0138] In some embodiments, the refresh token feedback module 403 is specifically configured as follows: Receive remote control commands initiated by the user and retrieve the encrypted refresh token from the user's repository; The hardware key is retrieved from the application layer, and the encrypted refresh token is decrypted using the hardware key to obtain the decrypted refresh token. The decrypted refresh token is then sent back to the cloud.

[0139] In some embodiments, the access token and remote control command feedback module 404 is specifically configured as follows: Receive the access token sent from the cloud, and fuse the access token with the remote control command to obtain fused data; The fused data is encrypted using a public key to obtain public key encrypted fused data. The public key encrypted fused data is then sent to the cloud, whereby the cloud uses the public key to decrypt the public key encrypted fused data and verifies the decrypted access token and remote control command.

[0140] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0141] The apparatus of the above embodiments is used to implement the corresponding method in any of the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0142] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the methods described in any of the above embodiments.

[0143] Figure 6 This embodiment illustrates a more specific hardware structure of an electronic device. The device may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0144] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0145] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0146] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0147] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0148] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0149] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0150] The electronic devices described above are used to implement the corresponding methods in any of the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0151] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to perform the methods described in any of the above embodiments.

[0152] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital video disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0153] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to perform the methods described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0154] Based on the same concept, corresponding to any of the above embodiments, this application also provides a computer program product, including computer program instructions, which, when run on a computer, cause the computer to perform the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0155] It is understood that before using the technical solutions of the various embodiments in this application, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0156] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations described in this application.

[0157] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0158] It is understood that the above notification and user authorization process is merely illustrative and does not limit the implementation of this application. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this application.

[0159] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0160] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0161] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0162] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A remote control method based on data verification, characterized in that, Applied to the cloud, the method includes: The system receives encrypted data packets from the user terminal. After the encrypted data packets are verified, a refresh token is generated and sent to the user terminal for storage. The system receives a refresh token from the user terminal after the user initiates a remote control command. After the refresh token is verified, an access token is generated and sent to the user terminal. Receive the access token and remote control command from the user terminal, verify the access token and remote control command, and obtain the final verification result. After the final verification result is successful, the remote control command is sent to the target control terminal so that the target control terminal can control the operation according to the remote control command.

2. The method according to claim 1, characterized in that, The encrypted data packet includes: a login token and password data; The process of receiving encrypted data packets from the user terminal, generating a refresh token after the encrypted data packets are verified, and sending the refresh token to the user terminal includes: Receive encrypted data packets sent by the user terminal, and decrypt the encrypted data packets to obtain the login token and password data; The login token and the password data are validated. In response to the successful verification of the validity of the login token and the password data, a random value is generated and used as a refresh token; Determine the metadata corresponding to the user terminal, associate the metadata with the refresh token and store it, and send the refresh token to the user terminal.

3. The method according to claim 1, characterized in that, The step of receiving the refresh token fed back by the user terminal after the user initiates a remote control command, and generating an access token after the refresh token is verified, includes: Receive the refresh token fed back by the user terminal after the user initiates a remote control command, and verify whether the refresh token fed back is correct; If the refresh token is correct in response to the feedback, the user's identity information is determined and verified. In response to the successful verification of the identity information, the field data corresponding to the user terminal is determined, and the access token is generated by combining the private key in the cloud with the field data.

4. The method according to claim 1, characterized in that, The process of receiving the access token and remote control command from the user terminal, verifying the access token and remote control command, and obtaining the final verification result includes: Receive the access token and remote control command fed back from the user terminal, and verify whether the fed-back access token is correct; In response to the correctness of the access token feedback, determine whether the feedback time of the access token feedback is within the predetermined period; In response to the feedback time within the predetermined period, the basic information of the user terminal is determined from the remote control command, the basic information is verified, and the final verification result is obtained.

5. A remote control method based on data verification, characterized in that, When applied to a user terminal, the method includes: After logging into the application, the encrypted data packet is identified and sent to the cloud for verification. Once the verification is successful, a refresh token is generated. Receive the refresh token sent from the cloud and store the refresh token; The system receives remote control commands initiated by the user and sends the stored refresh token back to the cloud for verification. Once the cloud verifies the refresh token, it generates an access token. The system receives the access token sent from the cloud, sends the access token and the remote control command back to the cloud, and verifies the access token and remote control command. After successful verification, the cloud sends the remote control command to the target control terminal to control the target control terminal to run.

6. The method according to claim 5, characterized in that, After logging into the application, the encrypted data packet is determined, and the encrypted data packet is sent to the cloud, including: After logging into the application, obtain a login token and the preset password data; The login token and the password data are encrypted to obtain an encrypted data packet, which is then sent to the cloud.

7. The method according to claim 5, characterized in that, Receiving the refresh token sent from the cloud and storing the refresh token includes: Receive the refresh token sent from the cloud and retrieve the hardware key at the application layer; The refresh token is encrypted using the hardware key of the application layer, and the encrypted refresh token is stored in the user-side repository.

8. The method according to claim 5, characterized in that, The step of receiving a remote control command initiated by the user and sending the stored refresh token back to the cloud includes: Receive remote control commands initiated by the user and retrieve the encrypted refresh token from the user's repository; The hardware key is retrieved from the application layer, and the encrypted refresh token is decrypted using the hardware key to obtain the decrypted refresh token. The decrypted refresh token is then sent back to the cloud.

9. The method according to claim 5, characterized in that, The step of receiving the access token sent from the cloud and sending the access token and the remote control command back to the cloud for verification by the cloud includes: Receive the access token sent from the cloud, and fuse the access token with the remote control command to obtain fused data; The fused data is encrypted using a public key to obtain public key encrypted fused data. The public key encrypted fused data is then sent to the cloud, whereby the cloud uses the public key to decrypt the public key encrypted fused data and verifies the decrypted access token and remote control command.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1 to 9.

Images