Communication encryption method, system and device of Internet of Things device and medium

Abstract

The invention discloses a communication encryption method, system and device of an Internet of Things device and a medium. The communication encryption method of the Internet of Things device comprises the steps that in response to time window updating, according to a current time window and device information of the Internet of Things device, a password is updated through a time-based one-time password algorithm, and the Internet of Things device is a resource-limited lightweight security device; calculating a signature field based on the password and the to-be-sent data; and sending the communication message in which the signature field and the to-be-sent data are packaged. Through the above mode, the communication encryption complexity of the Internet of Things equipment can be reduced.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) communication, and in particular to a communication encryption method, system, device, and medium for IoT devices. Background Technology

[0002] In existing technologies, security encryption for IoT devices is primarily based on certificates. There are two main ways to obtain certificates: by pre-writing a certificate on the device, or by obtaining a certificate from the platform after the device connects to the network. In this method, the device and the platform use paired certificates, which are then used for data encryption and decryption during subsequent communication, providing a high level of security.

[0003] However, this method has a problem: if the certificate is pre-written into the device, the manufacturing cost increases; if the certificate is obtained from the platform after connecting to the network, the platform's certificate management function becomes very complex. For low-end IoT devices, using certificates for encryption and decryption is still too complex, resulting in extremely high costs. Therefore, current technologies for security encryption of IoT devices suffer from high complexity and high usage costs. Summary of the Invention

[0004] This application provides a communication encryption method, system, device, and medium for Internet of Things (IoT) devices to address the problem of high complexity in communication encryption for IoT devices.

[0005] To address the aforementioned technical problems, this application provides a communication encryption method for IoT devices, comprising: responding to a time window update, updating a password based on a time-based one-time cryptographic algorithm according to the current time window and the device information of the IoT device, wherein the IoT device is a resource-constrained lightweight security device; calculating a signature field based on the password and data to be sent; and sending a communication message encapsulating the signature field and the data to be sent.

[0006] In some embodiments, updating the password using a time-based one-time password algorithm based on the current time window and the device information of the IoT device includes: calculating a time step counter corresponding to the current time window based on a preset start time and time step; calculating a key hash message authentication code based on the value of the time step counter and a preset key; dynamically truncating the key hash message authentication code and taking the modulo of it to a target length as a new password to update the password.

[0007] In some embodiments, the key is set based on the mobile device identifier of the IoT device.

[0008] In some embodiments, the time step is 24 hours.

[0009] In some embodiments, the communication encryption method further includes: in response to receiving the communication message, performing a validity verification of the communication message based on the signature field in the communication message; and discarding messages that fail the validity verification.

[0010] In some embodiments, the step of verifying the legality of the communication message based on the signature field in the communication message includes: verifying whether the signature field in the communication message is consistent with the locally generated signature field.

[0011] In some embodiments, before updating the password using a time-based one-time password algorithm based on the current time window and the device information of the IoT device in response to a time window update, the method further includes: synchronizing the clock via the computer network of the IoT device to obtain the real-time time window in real time.

[0012] To solve the above-mentioned technical problems, another technical solution adopted in this application is: to provide an encrypted communication system, including an Internet of Things (IoT) device and an IoT platform, wherein the IoT device and the IoT platform respectively generate passwords through the communication encryption method described above, and one end of the IoT device and the IoT platform acts as the sending end to send encrypted communication messages, and the other end acts as the receiving end to receive the communication messages and perform password verification, so as to complete the encrypted communication between the IoT device and the IoT platform.

[0013] This application also provides an Internet of Things (IoT) device, the IoT device comprising: a memory and at least one processor, the memory storing instructions; the at least one processor invokes the instructions in the memory to cause the IoT device to execute the communication data encryption method as described in any one of claims 1-7.

[0014] This application also provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the communication data encryption method described above.

[0015] The beneficial effects of this application are as follows: Unlike existing technologies, this application discloses a communication encryption method, system, device, and medium for IoT devices. Responding to a time window update, the password is updated using a time-based one-time cryptographic algorithm based on the current time window and the device information of the IoT device. The IoT device is a resource-constrained, lightweight security device. No real-time network update is required, and no interaction between the two communication ends is needed to generate a unique password consistent between both ends based on time and device. Compared to traditional certificate-based encryption methods, this significantly reduces encryption and decryption complexity. Based on the password and the data to be sent, a signature field is calculated. Any tampering with the data content will cause signature verification to fail, and the computational complexity is low, requiring no complex encryption and decryption operations, making it more suitable for devices with limited storage and computing power. A communication message encapsulating the signature field and the data to be sent is sent. No separate key or certificate transmission is required; data and signature are sent in the same packet, reducing the number of communication interactions and traffic consumption. Any tampering with the data content will cause signature verification to fail. Signature verification confirms that the data originates from a legitimate device, preventing counterfeit devices from accessing the network and ensuring data security. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein: Figure 1 This is a flowchart illustrating an embodiment of the communication encryption method for IoT devices provided in this application; Figure 2 Is it like this? Figure 1 A flowchart illustrating an embodiment of step 10 of the method shown; Figure 3 This is a schematic diagram of the structure of an embodiment of the encrypted communication system provided in this application; Figure 4 This is a schematic diagram of the structure of a computer device according to an embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0018] The terms "first," "second," and "third" used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first," "second," or "third" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0019] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0020] See Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the communication encryption method for IoT devices provided in this application. The communication encryption method for IoT devices includes the following steps: 10: Responding to time window updates, the password is updated using a time-based one-time password algorithm based on the current time window and the device information of the IoT device. The IoT device is a resource-constrained, lightweight security device.

[0021] When a resource-constrained lightweight security device is triggered to update a short-term valid offline password within a preset time window, it uses a time-based one-time password algorithm to autonomously calculate and update the password based on the current time window parameters and the device's unique identifier information, thereby achieving dynamic key management with low resource consumption.

[0022] A time window update is a fixed time period, or time step, pre-agreed between the device and the platform, used to trigger periodic password updates. For example, setting the time step to 24 hours means that a password update is triggered once a day at 00:00:00, forming a daily time window update mechanism.

[0023] The password is updated at a fixed period to avoid high-frequency calculations and to adapt to the limited computing power and battery life of low-end devices. Periodic updates ensure that the key is valid for a short period of time, while avoiding the communication costs of real-time network updates.

[0024] The Time-Based One-Time Password (TOTP) algorithm generates short-term valid one-time passwords using three elements: a shared key, the current time window, and the time step.

[0025] A unique password is generated for each time window. Even if the key is leaked, its validity period is only one time window, reducing long-term risks. No internet connection is required to obtain the key; it can be calculated locally on the device, solving the complexity problem of traditional certificate schemes that rely on internet connectivity.

[0026] Resource-constrained lightweight security devices are low-end IoT devices with limited computing power, storage capacity, and power consumption, such as battery-powered smoke detectors and soil moisture sensors. Their hardware typically does not support complex encryption / decryption algorithms or certificate management.

[0027] By simplifying the algorithm, the computation time is controlled to the millisecond level, and the storage requirements are only 20 bytes of key and 8 bytes of current password, which meets resource constraints; there is no need to pre-install certificates or integrate complex security chips, which reduces the manufacturing cost of the device, while eliminating the certificate management module on the IoT platform side, reducing system complexity.

[0028] See Figure 2 Step 10 further includes the following steps: 11: Calculate the time step counter corresponding to the current time window based on the preset start time and time step.

[0029] Based on the preset start time and time step, calculate the time step counter corresponding to the current time window.

[0030] The start time is the pre-agreed starting point for time calculation between the device and the platform, serving as the benchmark for the time step counter. The start time ensures consistent time synchronization between the device and the platform, preventing discrepancies in key calculation results due to initial time deviations, and providing a unified time benchmark for offline key generation.

[0031] The time step is the sliding step size of the time window, referring to the fixed time period at which a password update is triggered. For example, setting the time step to 24 hours means a new time window is generated every 24 hours; setting the time step to 30 seconds means a new time window is generated every 30 seconds. A longer time step reduces the computation frequency of low-end devices, requiring only one key calculation per day, thus reducing computing power and power consumption, and adapting to the battery life requirements of resource-constrained devices. The time step counter is an integer calculated based on the current time, start time, and time step. It can discretize continuous time into an integer counter, ensuring that the device and the platform generate the same counter value within the same time window, thus providing a time reference for key synchronization.

[0032] Specifically, the formula for calculating the time step counter T is: T = floor((Current Unix Time - T0) / X).

[0033] Where Current Unix Time is the current Unix timestamp, T0 is the start time, and X is the time step, i.e., the validity period of the password.

[0034] For example, the current time is 2023-10-27 12:00:30 UTC, and the corresponding Unix timestamp is 1698408030. T = floor(1698408030 / 30) = floor(56613601) = 56613601. In this case, the time step counter T will increment by 1 every 30 seconds.

[0035] Optionally, the time step is 24 hours.

[0036] If the time step is set to 24 hours, the key is calculated only once a day, achieving one key per day and dynamic updates. This ensures security while reducing the computing power consumption of low-end devices and adapting to the low power consumption requirements of battery-powered devices.

[0037] 12: Calculate the key hash message authentication code based on the value of the time step counter and the preset key.

[0038] Using the time step counter T value calculated in the first step as the message, and combined with the preset key K, calculate the key hash message authentication code HMAC-SHA-1 value.

[0039] Specifically, the key hash message authentication code H = HMAC-SHA-1(K, T). HMAC then generates a 20-byte hash value. This value is a binary string.

[0040] The key hash message authentication code is a hash value generated by the HMAC algorithm based on a time step counter and a preset key. It uses the HMAC-SHA-1 algorithm to output a 20-byte binary string, which is used to prove that the user holds the key and the time is correct.

[0041] By combining a key and a counter to achieve dynamic key generation, different keys are generated by the same device in different time windows, which is more secure than static keys; the hash message authentication code algorithm has anti-tampering characteristics, and even a slight change in the counter value will result in a completely different hash value, thus improving key uniqueness.

[0042] Alternatively, the key is set based on the mobile device identification code of the IoT device.

[0043] The Mobile Device Identifier (MDI) of an IoT device is a unique hardware identifier for the IoT device, such as the device's IMEI number, and serves as the original input for the preset key.

[0044] The mobile device identification code of IoT devices is unique to each device, eliminating the need for additional key allocation and simplifying the pre-configuration process; moreover, the identifier is bound to the device hardware, and physical tampering with the device will cause the key to become invalid, thus improving the resistance to physical attacks.

[0045] Setting keys based on mobile device identification codes of IoT devices enables one key per device, saving certificate management costs and eliminating the need for pre-installed keys during device production. No network interaction is required; the key calculation is completed locally on the device, overcoming the limitations of traditional certificate solutions that rely on the network and improving availability in weak network and offline scenarios.

[0046] 13: Dynamically truncate the key hash message authentication code and take the modulo of it to the target length as the new password to update the password.

[0047] The target length number is obtained after dynamic truncation and modulo processing, which serves as the updated password to achieve periodic key self-update.

[0048] Specifically, the binary key hash message authentication code hash value obtained in step 12 is converted into a convenient number. The lower 4 bits of the last byte are taken from the hash value and used as an offset. Starting from the offset-th byte of the hash value, four consecutive bytes (32 bits) are taken. These four bytes are combined into a big-endian integer, ignoring the highest sign bit (i.e., only the lower 31 bits) to obtain a number, Snum. This process ensures that even slight changes in the key-based hash authentication result will result in a completely different final number.

[0049] Finally, take the modulo of Snum to obtain the numeric password OTP of the specified length: OTP = Snum % 10^Digits. Here, Digits is usually 8, meaning the password length is specified as 8 bits. 10^8 = 100000000. Therefore, the final result will be an 8-bit number between 00000000 and 99999999.

[0050] Optionally, prior to step 10, clock synchronization is performed via a computer network of IoT devices to obtain a real-time time window.

[0051] IoT devices synchronize their local time through the computer network they are connected to using the Network Time Protocol (NTP) to obtain the current real-time time window. This ensures that the device and the platform calculate the time step counter based on the same time base, providing a unified time parameter for offline key generation.

[0052] The computer network of IoT devices is the communication network that IoT devices access for data transmission and time synchronization. This includes, but is not limited to, mobile networks such as 4G, NB-IoT, and 5G, as well as infrastructure such as local area networks and the Internet. It serves as the channel for devices to interact with external time sources, such as NTP servers.

[0053] By accessing an external time source server via the network, the device's local time is calibrated with the standard time, ensuring time consistency between the device and the platform and preventing key calculation errors due to time discrepancies. It adapts to the low-bandwidth and low-power requirements of low-end devices; for example, the narrowband characteristics of NB-IoT networks can meet the low-volume transmission of time synchronization messages, reducing device communication costs.

[0054] The time synchronization capabilities provided by computer networks enable devices and platforms to generate consistent time step counters based on the same real-time time window even without real-time interaction. This lays the foundation for generating identical offline keys for time-based one-time cryptography algorithms. It eliminates the need for a separate hardware clock calibration module, achieving time synchronization through existing network resources, reducing device hardware costs and platform management overhead, and adapting to the low-cost, lightweight design requirements of low-end IoT devices. The dynamic updating of the real-time time window, combined with the precise time of network synchronization, ensures that keys are updated according to a preset cycle, balancing security and resource consumption.

[0055] The computer network of IoT devices supports the acquisition of real-time time windows by providing a time synchronization channel, and is the core infrastructure of the offline key generation mechanism. Its technical effects focus on low-cost time calibration and cross-device time consistency, providing key support for resource-constrained devices to achieve secure communication in certificate-free scenarios.

[0056] 20: Calculate the signature field based on the password and the data to be sent.

[0057] The fields of the data to be sent are concatenated according to preset rules, combined with the current password, and then a fixed-length string is calculated using a hash algorithm. This string is the signature field, used to verify the integrity and legality of the data.

[0058] The signature field is a fixed-length hash value generated by concatenating the data to be sent into a string and combining it with the password, then hashing it using an algorithm (MD5 in this embodiment). This hash value serves as a verification identifier for data integrity and source legitimacy. The signature field acts as a hash verification identifier between the data to be sent and the dynamic password. Its core technological advantages lie in tamper-proofing, authentication, and lightweight computation, providing a low-cost, highly adaptable secure communication solution for resource-constrained IoT devices.

[0059] For example, if the data to be sent is {"battery_level": 90, "smoke_density": 65} and the password is 42931192, then the concatenated string is battery_level=90&smoke_density=65&key=42931192, and the signature field obtained by MD5 calculation is 9bbceb6a73f430ad6c872212d51a6e34.

[0060] Any tampering with the data content will result in a change to the signature field. The platform can accurately identify tampering by comparing the locally calculated signature with the received signature field. The generation of the signature field relies on the device's unique password; only legitimate devices can generate the correct signature, preventing counterfeit devices from sending illegal data. Low-complexity hash algorithms such as MD5 are used, resulting in short computation time and low resource consumption, making them suitable for IoT devices with limited storage and computing power, such as smoke detectors and soil sensors.

[0061] 30: Send a communication message containing a signature field and the data to be sent.

[0062] The Internet of Things (IoT) device combines the data to be sent, such as battery level and smoke concentration collected by sensors, with the signature field in a preset format to form a complete communication message, and sends it to the platform through the IoT device's computer network, realizing the integrated transmission of data and signature.

[0063] The signature field is transmitted in the same packet as the data, eliminating the need for additional handshakes or certificate interactions, thus reducing communication latency and bandwidth consumption. The device performs signature calculations and message encapsulation locally, without needing to connect to the network to obtain certificates or keys, solving the problem of secure data transmission in weak or offline network scenarios. Without the need for pre-installed certificates or integrated complex encryption modules, device production and platform maintenance costs are reduced by more than 30%, promoting the widespread adoption of secure communication in low-end IoT devices.

[0064] like Figure 1 The method shown also includes, in response to receiving a communication message, verifying the validity of the communication message based on the signature field in the communication message. Messages that fail the validity verification are discarded.

[0065] The signature field is generated by hashing the data to be sent and the key. Any tampering with the data field will result in a discrepancy between the recalculated signature and the received signature. The platform can accurately identify whether data has been tampered with during transmission, avoiding decisions based on erroneous data. The generation of the signature field relies on the device's unique identification information and the dynamic key for the day. Unauthorized devices cannot forge legitimate signatures, preventing malicious devices from forging data to access the platform, ensuring that only messages from registered devices are processed, and reducing the risk of forgery attacks.

[0066] Furthermore, verify whether the signature field in the communication message is consistent with the locally generated signature field.

[0067] After receiving a communication message from an IoT device, the platform extracts the data field to be sent and the signature field from the message. It then concatenates the data field according to preset rules and recalculates the signature using the key for the day. The calculated result is compared with the received signature field. If they match, the message passes the validity verification; otherwise, it is deemed an invalid message and discarded.

[0068] The verification process only requires concatenating and hashing the data fields, without the need for complex certificate parsing or decryption operations. It has low computational complexity and can adapt to the message verification needs of a large number of low-end devices. The platform can process high-concurrency messages in parallel, avoiding performance bottlenecks caused by complex verification logic.

[0069] The platform independently calculates signatures based on locally stored IoT device information, preset start times and time steps, and the current time window. It eliminates the need for real-time interaction with devices or third parties, freeing it from reliance on online certificate verification services. Even under network fluctuations or outages, it can still verify message validity, improving system stability. This reduces the complexity and operational costs of platform certificate management and avoids security risks caused by expired or leaked certificates, making it particularly suitable for large-scale IoT device deployments.

[0070] The communication encryption method for IoT devices in the embodiments of the present invention has been described above. The encrypted communication system in the embodiments of the present invention will be described below. Please refer to [link / reference]. Figure 3 , Figure 3 This is a schematic diagram of an embodiment of the encrypted communication system provided in this application. The encrypted communication system includes an Internet of Things (IoT) device and an IoT platform. The IoT device and the IoT platform generate passwords using the communication encryption method described above. One end of the IoT device and the IoT platform acts as the sender to send encrypted communication messages, while the other end acts as the receiver to receive the communication messages and verify the passwords, thereby completing the encrypted communication between the IoT device and the IoT platform.

[0071] IoT devices and platforms independently generate dynamic passwords based on a shared key and local information. The sending end signs the data with the password and sends an encrypted message, while the receiving end verifies the validity of the signature, thus achieving secure offline communication.

[0072] It requires only one password calculation per day, replacing the real-time encryption of traditional encryption methods. The signature calculation complexity is low, making it more suitable for devices with limited computing power or storage, such as smoke detectors and soil sensors, thus avoiding the high resource consumption of existing certificate encryption schemes.

[0073] Password generation and signature verification are based on local parameters, eliminating the need to obtain certificates or keys online. This frees the system from dependence on online certificate services and enables secure communication even in weak or offline network scenarios, improving system stability and achieving offline autonomous secure communication.

[0074] above Figure 3 The feature extraction device in the embodiments of the present invention will be described in detail from the perspective of modular functional entities. The computer device in the embodiments of the present invention will be described in detail from the perspective of hardware processing.

[0075] Figure 4 This is a schematic diagram of a computer device 500 provided in an embodiment of the present invention. The computer device 500 can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs) 510 (e.g., one or more processors) and a memory 520, and one or more storage media 530 (e.g., one or more mass storage devices) for storing application programs 533 or data 532. The memory 520 and storage media 530 can be temporary or persistent storage. The program stored in the storage media 530 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the computer device 500. Furthermore, the processor 510 may be configured to communicate with the storage media 530 and execute the series of instruction operations in the storage media 530 on the computer device 500.

[0076] Computer device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input / output interfaces 560, and / or one or more operating systems 531, such as Windows Server, MacOSX, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 4 The computer device structure shown does not constitute a limitation on the computer device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0077] The present invention also provides a computer device, the computer device including a memory and a processor, the memory storing computer-readable instructions, which, when executed by the processor, cause the processor to perform the steps of the communication encryption method in the above embodiments.

[0078] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the communication encryption method.

[0079] Unlike existing technologies, this application employs a time-based one-time cryptographic algorithm to calculate the password. Since the pre-agreed key, start time, and duration between the device and the platform are short, both parties independently calculate the password based on their local time. This serves as offline encrypted information for daily communication, eliminating the need for real-time interaction and ensuring the independence of each device's key. This eliminates the risk of key leakage from multiple devices, resulting in low computational complexity and making it more suitable for lightweight devices with limited computing power and storage. The sending end concatenates the data field to be sent with the dynamic password for the day to generate a signature field, which is then combined with the data field to form a verification message. Hash signatures replace complex certificate encryption, reducing computational resource consumption. The signature field is generated from the hash of the data and the dynamic password; any data tampering will cause the signature comparison to fail, ensuring the integrity of transmitted data. Only devices with legitimate device identification information and dynamic passwords can generate the correct signature, preventing counterfeit devices from accessing the platform. The computational efficiency is high, requiring no security chip support and eliminating additional hardware costs for the device. The generation and verification of the password in this application are based on local parameters, eliminating the need for network access to obtain certificates and solving secure communication problems in weak or offline network scenarios. Furthermore, no pre-installed certificates are required during the device production stage, reducing security configuration costs in the manufacturing process.

[0080] This solution combines a time-based one-time cryptography algorithm with a lightweight signature, ensuring data integrity and source legitimacy while solving the problems of high complexity, high cost, and high resource consumption of existing certificate-based encryption schemes. It provides a practical and feasible secure communication solution for low-end IoT devices.

[0081] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the storage medium embodiments and computer device embodiments are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0082] This application can be used in a wide range of general-purpose or specialized in-vehicle computing system environments or configurations. Examples include: personal computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, network PCs, minicomputers, and distributed computing environments including any of the above systems or devices.

[0083] In the several embodiments provided in this application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are merely illustrative; multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed.

[0084] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0085] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0086] The above description is merely an embodiment of this application and does not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A communication encryption method for Internet of Things (IoT) devices, characterized in that, include: In response to a time window update, the password is updated using a time-based one-time password algorithm based on the current time window and the device information of the IoT device, wherein the IoT device is a resource-constrained lightweight security device. Calculate the signature field based on the password and the data to be sent; Send a communication message containing the signature field and the data to be sent.

2. The communication encryption method for IoT devices according to claim 1, characterized in that, The step of updating the password using a time-based one-time password algorithm based on the current time window and the device information of the IoT device includes: Calculate the time step counter corresponding to the current time window based on the preset start time and time step. Calculate the key hash message authentication code based on the value of the time step counter and the preset key; The key hash message authentication code is dynamically truncated, and a number modulo the target length is used as the new password to update the password.

3. The communication encryption method for IoT devices according to claim 2, characterized in that, The key is set based on the mobile device identification code of the IoT device.

4. The communication encryption method for IoT devices according to claim 2, characterized in that, The time step is 24 hours.

5. The communication encryption method for IoT devices according to claim 1, characterized in that, The communication encryption method further includes: In response to receiving the communication message, the validity of the communication message is verified based on the signature field in the communication message; Discard messages that fail the validity verification.

6. The communication encryption method for IoT devices according to claim 5, characterized in that, The step of verifying the validity of the communication message based on the signature field in the communication message includes: Verify whether the signature field in the communication message is consistent with the locally generated signature field.

7. The communication encryption method for IoT devices according to claim 1, characterized in that, Before updating the password using a time-based one-time password algorithm based on the current time window and the device information of the IoT device in response to the time window update, the method further includes: Clock synchronization is performed via the computer network of the IoT device to obtain real-time time windows.

8. An encrypted communication system, characterized in that, The system includes an IoT device and an IoT platform. The IoT device and the IoT platform respectively generate a password using the communication encryption method described in any one of claims 1-7. One end of the IoT device and the IoT platform acts as the sender to send an encrypted communication message, and the other end acts as the receiver to receive the communication message and perform password verification, thereby completing the encrypted communication between the IoT device and the IoT platform.

9. An Internet of Things (IoT) device, characterized in that, The Internet of Things device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the Internet of Things device to execute the communication data encryption method as described in any one of claims 1-7.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instruction is executed by the processor, it implements the communication data encryption method as described in any one of claims 1-7.

Images