Derivation-based Internet of Things equipment key management method and device

Abstract

The invention belongs to the technical field of Internet of Things security, and discloses a derivation-based Internet of Things equipment key management method and device, and the method comprises the steps that a server generates a first-level data transmission key, and stores the first-level data transmission key in a cipher machine; the terminal sends a key request to the server; the server generates a second-level data transmission key through a first key derivation algorithm according to the terminal type and the first-level data transmission key; the server generates a third-level data transmission key through a second key derivation algorithm according to the security chip serial number and the data transmission root key, and issues the third-level data transmission key to the terminal; the terminal generates a session key through a third key derivation algorithm based on the three-level data transmission key and the random number during communication; the server side generates the same session key based on the received random number and the data transmission key calculated by the server side, and the server side only needs to store a small number of platform data transmission root keys in the mode, so that the key storage cost and the management cost are greatly reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things security, and in particular to a derived Internet of Things device key management method and device. BACKGROUND

[0002] In an Internet of Things device, in order to ensure that data is not stolen and tampered with, the security of the data is protected by using an encryption method. In data transmission, symmetric encryption (such as SM4) is usually used. However, when using symmetric encryption, the terminal and the server need to negotiate a symmetric key so that the terminal and the server use the same key for encryption and decryption.

[0003] In addition, in order to further ensure communication and data security, ensure that other devices and communications are not cracked after a single communication or a single device is cracked, generally, an Internet of Things device needs to meet the requirements of "one core one key" and "one-time key": that is, each security chip (which can be understood as a hardware module in an Internet of Things device that serves encryption and decryption and secure storage of keys) has a different key; a different key is used each time communication is performed.

[0004] When the number of Internet of Things devices is huge, the server needs to store a large number of keys (such as 6000W devices, which require 6000W keys). This results in increased storage costs (keys are usually stored in hardware password machines, which are expensive), low query efficiency, and high management costs (such as when keys expire, 6000W keys need to be replaced).

[0005] The above content is only used to assist in understanding the technical solutions of the present application and does not represent an acknowledgement that the above content is prior art. SUMMARY

[0006] The main purpose of the present application is to provide a derived Internet of Things device key management method and device, which aims to solve the technical problem of high storage cost and management cost of the current key method.

[0007] To achieve the above purpose, the present application provides a derived Internet of Things device key management method, which comprises the following steps: The server generates a first data transmission key and stores the first data transmission key in a password machine, the first data transmission key being a platform data transmission root key; The terminal sends a key request to the server, the key request including at least a terminal type and a security chip serial number; The server generates a second data transmission key from the terminal type and the first data transmission key through a first key derivation algorithm, the second data transmission key being a data transmission root key; The server generates a third data transmission key through a second key derivation algorithm according to the security chip serial number and the data transmission root key, and distributes the third data transmission key to the terminal, wherein the third data transmission key is a data transmission key; The terminal generates a session key through a third key derivation algorithm based on the third data transmission key and a random number during communication, and the session key generated by the terminal is used for data encrypted transmission; The server generates the same session key based on the received random number and the data transmission key calculated by itself, and the session key generated by the server is used for data decryption.

[0008] In an embodiment, the platform data transmission root key is a root key uniquely preset by the server, and a plurality of data transmission root keys can be derived according to different terminal types.

[0009] In an embodiment, the first key derivation algorithm, the second key derivation algorithm and the third key derivation algorithm all adopt an SM4-ECB algorithm.

[0010] In an embodiment, the security chip serial number CSN is a 96-bit unique identifier, and one data transmission root key derives a plurality of data transmission keys according to different CSNs.

[0011] In an embodiment, the terminal stores the data transmission key in a secure storage area of the security chip, and the secure storage area is a non-volatile storage area in a hardware encryption module and is only allowed to be accessed internally by the security chip.

[0012] In an embodiment, the secure random number is dynamically generated by the terminal security chip, and the secure random number generated each time is different, so that the derived session key is different.

[0013] In addition, in order to achieve the above-mentioned purpose, the application further provides a derived Internet of Things device key management device, which is applied to the derived Internet of Things device key management method as described above, and the device comprises: The server is configured to generate a first data transmission key and store the first data transmission key in a cryptographic machine, wherein the first data transmission key is a platform data transmission root key; The terminal is configured to send a key request to the server, wherein the key request at least includes a terminal type and a security chip serial number; The server is configured to generate a second data transmission key through a first key derivation algorithm according to the terminal type and the first data transmission key, wherein the second data transmission key is a data transmission root key; The server is used to generate a three-level data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm, and then send the three-level data transmission key to the terminal. The three-level data transmission key is the data transmission key. A terminal is used to generate a session key based on the three-level data transmission key and a random number during communication, using a third key derivation algorithm. The session key generated by the terminal is used for encrypted data transmission. The server is used to generate the same session key based on the received random number and the data transmission key it calculates. The session key generated by the server is used for data decryption.

[0014] In one embodiment, the platform data transmission root key is a uniquely pre-set root key on the server, and multiple data transmission root keys can be derived according to different terminal types.

[0015] Furthermore, to achieve the above objectives, the present invention also proposes a derived IoT device key management device, which includes: a memory, a processor, and a derived IoT device key management program stored in the memory and executable on the processor. The derived IoT device key management program is configured to implement the steps of the derived IoT device key management method described above.

[0016] Furthermore, to achieve the above objectives, the present invention also proposes a storage medium storing a derived Internet of Things (IoT) device key management program, which, when executed by a processor, implements the steps of the derived IoT device key management method described above.

[0017] In this invention, the server generates a primary data transmission key and stores it in a cryptographic device. The terminal sends a key request to the server. The server generates a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm. The server generates a tertiary data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm and distributes the tertiary data transmission key to the terminal. During communication, the terminal generates a session key based on the tertiary data transmission key and a random number using a third key derivation algorithm. The server generates the same session key based on the received random number and its own calculated data transmission key. This method requires the server to store only a small amount of platform data transmission root keys, significantly reducing key storage costs and management costs. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the first embodiment of the derived IoT device key management method of the present invention. Figure 2 This is a schematic diagram of the key derivation system in the IoT device key management method based on derivation of the present invention; Figure 3 This is a structural block diagram of the first embodiment of the IoT device key management device based on the present invention.

[0019] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0021] This invention provides a derived IoT device key management method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of a derived IoT device key management method according to the present invention.

[0022] In this embodiment, the derived IoT device key management method includes the following steps: Step S10: The server generates a primary data transmission key and stores the primary data transmission key in a cryptographic machine.

[0023] In this embodiment, the execution entity is a derived IoT device key management device, which has functions such as data processing, data communication, and program execution. The derived IoT device key management device can be a computer terminal device or other network device, or other devices with similar functions. This embodiment does not limit this.

[0024] It's important to note that in IoT devices, encryption is used to protect data security and prevent theft and tampering. Symmetric encryption (such as SM4) is typically used for data transmission. However, symmetric encryption requires the terminal and server to negotiate a symmetric key so that both can use the same key for encryption and decryption. Furthermore, to further ensure communication and data security, and to prevent compromise of other devices and communications after a single communication or device is compromised, IoT devices typically adhere to "one key per chip" and "one key per transaction": each security chip (which can be understood as the hardware module in the IoT device for service encryption / decryption and key security storage) has a different key; and a different key is used for each communication. When the number of IoT devices is enormous, the server needs to store a large number of keys (e.g., 60 million keys are needed when the number of devices reaches 60 million). This leads to increased storage costs (keys are usually stored in expensive hardware cryptographic machines), low query efficiency, and high management costs (e.g., 60 million keys need to be replaced when keys expire).

[0025] To address the aforementioned technical issues, in this embodiment, the server generates a primary data transmission key and stores it in a cryptographic device. The terminal sends a key request to the server. The server generates a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm. The server generates a tertiary data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm and distributes the tertiary data transmission key to the terminal. During communication, the terminal generates a session key based on the tertiary data transmission key and a random number using a third key derivation algorithm. The server generates the same session key based on the received random number and its own calculated data transmission key. This method requires the server to store only a small amount of platform data transmission root keys, significantly reducing key storage costs and management costs. Specifically, it can be implemented as follows.

[0026] In this embodiment, the specific key derivation system can be referred to Figure 2As shown, the server stores only a small number of platform data transmission root keys. The key management system of this invention includes: a server: responsible for generating and storing platform data transmission root keys and executing multi-level key derivation algorithms; a terminal device: equipped with a security chip, responsible for initiating key requests, securely storing derived keys, generating session keys, and performing data encryption and decryption; and a communication channel: used for key requests, key distribution, and data transmission between the terminal and the server. The terminal holds a three-level data transmission key. Since the three-level key is derived from the security chip serial number, which is a unique identifier for the terminal hardware, the three-level key is also unique, satisfying the "one chip, one key" requirement. The overall process is as follows: Step 1: The server generates the platform data transmission root key and stores it in a cryptographic device. Step 2: The terminal requests a data transmission key. Step 3: The server receives the request, uses the platform data transmission root key as the key, and the terminal type in the request message as plaintext, and uses the SM4-ECB algorithm mode to obtain the derived data transmission root key. In this step, one platform data transmission root key can derive N data transmission root keys based on different terminal types. Step 4: The server uses the data transmission root key as the key, the CSN in the request message as plaintext, and the SM4-ECB algorithm mode to obtain the derived data transmission key. In this step, one data transmission root key can derive N data transmission keys based on different CSNs. Step 5: The server sends the data transmission key generated in Step 4 to the terminal, and the terminal saves the data transmission key in the secure storage area of ​​the security chip. This completes the "one chip, one key" process. Step 6: The terminal calls the security chip, using the data transmission key saved in Step 5 as the key, and a secure random number generated by the security chip as plaintext, and the SM4-ECB algorithm mode to obtain the derived session key. Step 7: The security chip uses the session key to encrypt the business data using SM4 and reports the data. Step 8: The server receives the reporting request and repeats Steps 3 to 5 to obtain the same data transmission key as stored in the security chip. (Note that, based on communication security requirements, the server calculates the data transmission key, not transmits it in the request). Step Nine: The server uses the data transmission key from Step Eight as the key, the random number in the request message as the plaintext, and the SM4-ECB algorithm mode to obtain the derived session key. (Note that the SM4-ECB algorithm mode ensures that the terminal and server can calculate the same session key). Step Ten: The server uses the session key from Step Nine to complete the decryption.

[0027] In the specific implementation, the server generates the platform data transmission root key (level 1 key) in the hardware cryptographic machine. This key is the foundation key of the entire system. The level 1 data transmission key is the platform data transmission root key, which is a uniquely pre-set root key on the server, and multiple data transmission root keys can be derived according to different terminal types.

[0028] Furthermore, the first key derivation algorithm, the second key derivation algorithm, and the third key derivation algorithm all adopt the SM4-ECB algorithm. SM4-ECB is a symmetric algorithm in the national cryptographic algorithm, that is, the electronic codebook mode of the block cipher algorithm. Its characteristics are fast encryption performance, and the ciphertext is the same after encryption with the same plaintext and the same key.

[0029] Step S20: The terminal sends a key request to the server.

[0030] In practice, a key request must include at least the terminal type and the security chip serial number (CSN). The CSN is a unique identifier for the security chip, consisting of 96 bits. A single data transmission root key can derive multiple data transmission keys based on its CSN. The key request message format is as follows:

[0031] Convert the message from bytes to hexadecimal as follows:

[0032] Step S30: The server generates a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm.

[0033] In this embodiment, upon receiving a request, the server uses the platform data transmission root key as the key and the terminal type in the request message as plaintext, and employs the SM4-ECB algorithm to obtain a derived data transmission root key. This secondary data transmission key is the data transmission root key, and one platform data transmission root key can derive N data transmission root keys based on different terminal types.

[0034] Step S40: The server generates a third-level data transmission key based on the security chip serial number and the data transmission root key using the second key derivation algorithm, and sends the third-level data transmission key to the terminal.

[0035] In this embodiment, the third-level data transmission key is a data transmission key. The server sends the data transmission key generated in step four to the terminal, and the terminal saves the data transmission key to the secure storage area of ​​the security chip. The secure storage area is a non-volatile storage area within the hardware encryption module, which can only be accessed internally by the security chip, thus effectively preventing key leakage.

[0036] Step S50: During communication, the terminal generates a session key based on the three-level data transmission key and the random number through a third key derivation algorithm.

[0037] In its implementation, the terminal invokes the security chip, using the stored data transmission key as the key and a secure random number generated by the security chip as the plaintext. The SM4-ECB algorithm is then used to derive the derived session key. This secure random number is dynamically generated by the terminal's security chip, and each communication generates a different secure random number, resulting in a different derived session key.

[0038] Furthermore, the security chip uses the session key to encrypt the service data using SM4 and then reports the data. The request message format is as follows:

[0039] Convert the message from bytes to hexadecimal as follows:

[0040] Step S60: The server generates the same session key based on the received random number and the data transmission key it calculates.

[0041] In the specific implementation, the server receives the reporting request and obtains the same data transmission key as stored in the security chip. Then, using this data transmission key as the encryption key and the random number in the request message as plaintext, it uses the SM4-ECB algorithm to obtain the derived session key. Finally, the session key is used to complete the decryption.

[0042] In this embodiment, the server generates a primary data transmission key and stores it in a cryptographic device. The terminal sends a key request to the server. The server generates a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm. The server generates a tertiary data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm and distributes the tertiary data transmission key to the terminal. During communication, the terminal generates a session key based on the tertiary data transmission key and a random number using a third key derivation algorithm. The server generates the same session key based on the received random number and its own calculated data transmission key. This method requires the server to store only a small amount of platform data transmission root keys, significantly reducing key storage costs and management costs.

[0043] Furthermore, this embodiment of the invention also proposes a storage medium storing a derived IoT device key management program, which, when executed by a processor, implements the steps of the derived IoT device key management method described above.

[0044] Reference Figure 3 , Figure 3 This is a structural block diagram of the first embodiment of the IoT device key management device based on the present invention.

[0045] like Figure 3 As shown, the derived IoT device key management device proposed in this embodiment of the invention includes: Server 10 is used to generate a primary data transmission key and store the primary data transmission key in a cryptographic machine. The primary data transmission key is the platform's data transmission root key. Terminal 20 is used to send a key request to the server, the key request including at least the terminal type and the security chip serial number; Server 10 is used to generate a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm, wherein the secondary data transmission key is the data transmission root key; Server 10 is used to generate a three-level data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm, and to send the three-level data transmission key to the terminal. The three-level data transmission key is a data transmission key. Terminal 20 is used to generate a session key based on the three-level data transmission key and a random number during communication, using a third key derivation algorithm. The session key generated by the terminal is used for encrypted data transmission. Server 10 is used to generate the same session key based on the received random number and the data transmission key calculated by itself. The session key generated by the server is used for data decryption.

[0046] In this embodiment, the server generates a primary data transmission key and stores it in a cryptographic device. The terminal sends a key request to the server. The server generates a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm. The server generates a tertiary data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm and distributes the tertiary data transmission key to the terminal. During communication, the terminal generates a session key based on the tertiary data transmission key and a random number using a third key derivation algorithm. The server generates the same session key based on the received random number and its own calculated data transmission key. This method requires the server to store only a small amount of platform data transmission root keys, significantly reducing key storage costs and management costs.

[0047] In one embodiment, the platform data transmission root key is a uniquely pre-set root key on the server, and multiple data transmission root keys can be derived according to different terminal types.

[0048] In one embodiment, the first key derivation algorithm, the second key derivation algorithm, and the third key derivation algorithm all employ the SM4-ECB algorithm.

[0049] In one embodiment, the security chip serial number (CSN) is a 96-bit unique identifier, and a data transmission root key can derive multiple data transmission keys based on different CSNs.

[0050] In one embodiment, the terminal stores the data transmission key in the secure storage area of ​​the security chip. The secure storage area is a non-volatile storage area within the hardware encryption module, which can only be accessed internally by the security chip.

[0051] In one embodiment, the secure random number is dynamically generated by the terminal security chip, and the secure random number generated each time communication occurs is different, resulting in different derived session keys.

[0052] This application embodiment also provides a derived IoT device key management device, including a processor, a communication interface, a memory, and a communication bus. The processor, communication interface, and memory communicate with each other through the communication bus. The memory is used to store the derived IoT device key management program. When the processor executes the program stored in the memory, it implements the above-mentioned derived IoT device key management method.

[0053] The communication bus mentioned in the above-mentioned IoT device key management device based on derivatives can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc.

[0054] The communication interface is used for communication between the aforementioned IoT device key management device and other devices based on the derived technology.

[0055] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0056] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0057] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0058] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0059] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0060] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0061] It should be understood that the above are merely illustrative examples and do not constitute any limitation on the technical solutions of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any restrictions on this.

[0062] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0063] In addition, for technical details not described in detail in this embodiment, please refer to the derived IoT device key management method provided in any embodiment of the present invention, which will not be repeated here.

[0064] Furthermore, it should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0065] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0066] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0067] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

[0068] It is understood that the system provided in the embodiments of the present invention corresponds to the method provided in the embodiments of the present invention, and the explanation, examples and beneficial effects of the relevant content can be referred to the corresponding parts of the above methods.

Claims

1. A method for managing IoT device keys based on derivation, characterized in that, The derived IoT device key management method includes: The server generates a primary data transmission key and stores it in a cryptographic machine. The primary data transmission key is the platform's root key for data transmission. The terminal sends a key request to the server, and the key request includes at least the terminal type and the security chip serial number. The server generates a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm. The secondary data transmission key is the data transmission root key. The server generates a three-level data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm, and sends the three-level data transmission key to the terminal. The three-level data transmission key is the data transmission key. During communication, the terminal generates a session key based on the three-level data transmission key and a random number, using a third key derivation algorithm. The session key generated by the terminal is used for encrypted data transmission. The server generates the same session key based on the received random number and the data transmission key it calculates. The session key generated by the server is used for data decryption.

2. The IoT device key management method based on derivation as described in claim 1, characterized in that, The platform's data transmission root key is a unique, pre-set root key on the server side, and multiple data transmission root keys can be derived based on different terminal types.

3. The IoT device key management method based on derivation as described in claim 1, characterized in that, The first key derivation algorithm, the second key derivation algorithm, and the third key derivation algorithm all use the SM4-ECB algorithm.

4. The IoT device key management method based on derivation as described in claim 1, characterized in that, The security chip serial number (CSN) is a 96-bit unique identifier. A single data transmission root key can derive multiple data transmission keys based on different CSNs.

5. The IoT device key management method based on derivation as described in claim 1, characterized in that, The terminal stores the data transmission key in the secure storage area of ​​the security chip. The secure storage area is a non-volatile storage area within the hardware encryption module, which can only be accessed internally by the security chip.

6. The IoT device key management method based on derivation as described in claim 1, characterized in that, The secure random number is dynamically generated by the terminal security chip. The secure random number generated each time is different, resulting in different derived session keys.

7. A derived Internet of Things (IoT) device key management device, characterized in that, The derived IoT device key management device is applied to the derived IoT device key management method as described in any one of claims 1 to 6, the device comprising: The server is used to generate a primary data transmission key and store the primary data transmission key in a cryptographic machine. The primary data transmission key is the platform's data transmission root key. A terminal is used to send a key request to the server, the key request including at least the terminal type and the security chip serial number; The server is used to generate a secondary data transmission key based on the terminal type and the primary data transmission key using a first key derivation algorithm. The secondary data transmission key is the data transmission root key. The server is used to generate a three-level data transmission key based on the security chip serial number and the data transmission root key using a second key derivation algorithm, and then send the three-level data transmission key to the terminal. The three-level data transmission key is the data transmission key. A terminal is used to generate a session key based on the three-level data transmission key and a random number during communication, using a third key derivation algorithm. The session key generated by the terminal is used for encrypted data transmission. The server is used to generate the same session key based on the received random number and the data transmission key it calculates. The session key generated by the server is used for data decryption.

8. The IoT device key management device based on derivation as described in claim 1, characterized in that, The platform's data transmission root key is a unique, pre-set root key on the server side, and multiple data transmission root keys can be derived based on different terminal types.

9. A derived Internet of Things (IoT) device key management device, characterized in that, The derived IoT device key management device includes: a memory, a processor, and a derived IoT device key management program stored on the memory and executable on the processor, wherein the derived IoT device key management program is configured to implement the steps of the derived IoT device key management method as described in any one of claims 1 to 6.

10. A storage medium, characterized in that, The storage medium stores a derived IoT device key management program, which, when executed by a processor, implements the steps of the derived IoT device key management method as described in any one of claims 1 to 6.

Images