Equipment data migration method and system, medium and product

Abstract

The invention discloses an equipment data migration method and system, a medium and a product. The method comprises the following steps: completing bidirectional identity authentication between old equipment and new equipment based on an equipment certificate preset in a secure element, and generating a session token; binding the session token with the user account and the device serial number to realize decoupling of the device identity and the SIM card, so that the old device can still perform migration authorization based on the device certificate after the SIM card is removed; in response to the migration instruction, performing fragmentation processing on the to-be-migrated data according to a predefined data domain list; and recording the breakpoint index information in real time in the migration process, and synchronously storing the breakpoint index information to a cloud server so as to perform breakpoint recovery or selective skipping based on the breakpoint index information after transmission interruption. According to the invention, the device identity and the SIM card are completely decoupled. The dependence of the existing data migration technology on the SIM card and the stable network is broken through, and a more efficient equipment data migration scheme is realized.

Description

Technical Field

[0001] This application relates to the field of data storage technology, and more specifically, to a device data migration method, system, medium, and product. Background Technology

[0002] Device data migration refers to the secure, complete, and efficient transfer of digital assets accumulated by users on old devices, such as personal data, application configurations, system settings, and usage habits, from old devices to new devices. In existing technologies, users primarily rely on the following models when replacing smart devices: First, re-inserting and reactivating the SIM card at a carrier's store, requiring the old device to remain online and the SIM card still attached; second, data migration via app cloud backup, but this often only covers basic account configurations and has poor robustness in weak network environments; third, some manufacturers offer "point-to-point direct connection," but lack fallback measures for network penetration and authentication failures. Once the migration process is interrupted, it usually requires re-initialization, and users cannot stop or specify a resumption point.

[0003] The aforementioned pain points directly lead to lengthy and high-failure-rate device replacement processes, as well as data inconsistencies and security risks. Therefore, a one-click data migration solution for devices is needed that combines card-free authorization, multi-channel authentication, breakpoint recovery, and rollback capabilities. Summary of the Invention

[0004] To address the numerous technical bottlenecks encountered during equipment replacement, this application discloses a device data migration method, system, medium, and product. This application completely decouples the device identity from the user identity module card. This overcomes the dependence of existing data migration technologies on the user identity module card and a stable network, achieving a more efficient device data migration solution. Specifically, the technical solution of this application is as follows: In a first aspect, this application discloses a device data migration method, comprising: Based on the device certificate pre-installed in the secure element, complete two-way authentication between the old device and the new device and generate a session token; The session token is bound to the user account and the device serial numbers of the old device and the new device to decouple the device identity from the user identity module card, so that the old device can still perform migration authorization based on the device certificate after the user identity module card is removed; In response to the migration command, the data to be migrated is fragmented according to a predefined list of data domains to obtain fragmented data; During the migration process, the breakpoint index information of the fragmented data is recorded in real time and synchronously stored in the cloud server so that breakpoint recovery or selective skipping can be performed based on the breakpoint index information after transmission is interrupted.

[0005] In some implementations, the process of completing two-way authentication between the old and new devices and generating session tokens based on device certificates pre-installed in the secure element includes: The old device initiates a session request to the cloud server, so that after receiving the session request, the cloud server simultaneously sends random challenges to both the new device and the old device. The old device and the new device each use their respective security elements to sign the random challenge with their private keys and exchange certificate chains; After verifying the validity of the private key signature and the certificate chain, the cloud server generates the session token.

[0006] In some implementations, if two-way authentication between the old device and the new device fails, the system switches to a backup authentication channel for user authentication. The backup authentication channel includes at least one of the following channels: verification code channel, offline password channel, and temporary credential channel; The verification code channel is used to obtain a time-sensitive digital verification code, input the digital verification code into the new device for verification to complete the authentication. The offline password channel is used to provide a pre-generated single offline password, which is then input into the new device for verification to complete the authentication. The temporary credential channel is used to generate a temporary credential QR code that carries the purpose, validity period and digital signature. The new device receives the temporary credential QR code and verifies it to complete the authentication.

[0007] In other embodiments, each data shard includes corresponding hash verification information; the hash verification information is used for verification by the new device; after successful verification, the new device sends a confirmation response to the cloud server.

[0008] In some embodiments, the device data migration method further includes: performing a rollback operation upon receiving a user's abort instruction; Specifically, it includes: In response to the abort command, the cloud server suspends the new task and terminates all ongoing transmission tasks; and sends a rollback command to the new device and the old device. The new device removes the received but unacknowledged fragment data from the temporary storage area, while retaining the received and acknowledged fragment data unchanged. The cloud server records and generates statistical logs during the rollback operation to ensure that the system is restored to the most recent consistent state after the rollback.

[0009] In other implementations, during data transmission, the cloud server employs an adaptive window to dynamically adjust the size of data fragments based on network quality.

[0010] In other implementations, the backup authentication channel shares a failure counter. If the number of authentication failures exceeds a preset threshold, security risk control is triggered and a second confirmation is requested.

[0011] Secondly, this application also discloses a device data migration system, including a new device, an old device and a cloud server, wherein the device data migration system is used to implement the steps of a device data migration method described in any of the above embodiments; The cloud server is configured to perform two-way authentication between the old device and the new device and generate a session token based on the device certificate pre-installed in the secure element. The session token is bound to the user account and the device serial number to decouple the device identity from the user identity module card, so that the old device can still be migrated and authorized based on the device certificate after the user identity module card is removed. In response to the migration command, the cloud server performs fragmentation processing on the data to be migrated according to a predefined list of data domains to obtain fragmented data; During the migration process, the new device and the old device each record the breakpoint index information of the fragmented data and synchronously store the breakpoint index information to the cloud server so that breakpoint recovery or selective skipping can be performed based on the breakpoint index information after transmission is interrupted.

[0012] Thirdly, this application also discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a device data migration method described in any of the above embodiments.

[0013] Fourthly, this application also discloses a computer program product, including a computer program that, when executed by a processor, implements the steps of a device data migration method described in any of the above embodiments.

[0014] Compared with the prior art, this application has at least one of the following beneficial effects: 1. This application significantly improves the reliability of the table replacement process by decoupling identity authentication from the physical Subscriber Identity Module Card (SIM card). Traditional solutions require the device to maintain a SIM card insertion state, greatly limiting the flexibility of migration scenarios. This method, however, achieves two-way authentication based on the certificate system of the device's built-in security element, completely eliminating reliance on the SIM card. Simultaneously, the system maintains breakpoint index records in real time during the migration process. Even if transmission anomalies occur due to network interruptions or device malfunctions, the interruption point can be accurately located based on the index after recovery, enabling breakpoint resumption rather than full retransmission, ensuring the integrity and recoverability of the data migration.

[0015] 2. With the support of a multi-path authentication mechanism, this application effectively improves the success rate of migration tasks. The system not only provides automatic online authentication as the default channel, but also intelligently switches to backup authentication methods such as verification codes, offline passwords, and temporary credentials in weak network or offline environments, constructing a multi-layered fault-tolerant system. This ensures that even in scenarios with unstable network signals or no network coverage, users can still complete identity verification and migration authorization through at least one available path, greatly reducing the risk of overall process interruption due to authentication failure.

[0016] 3. This application grants users unprecedented control over the migration process. Through the device or application interface, users can pause or abort data migration at any time with a single click. The system immediately freezes the task queue and initiates a controlled rollback process to prevent data inconsistencies caused by misoperation or unforeseen circumstances. Transmitted but unconfirmed data will be securely rolled back to a temporary storage area, while committed data will remain unchanged. The entire process is accompanied by complete statistical logs, balancing operational flexibility with data consistency.

[0017] 4. Regarding migration efficiency, this application employs a strategy combining fragmented transmission and hash verification to achieve efficient and reliable data synchronization. The system divides the data to be migrated into fragmented units with verification information. The new device returns an acknowledgment signal after verifying the integrity, avoiding invalid retransmissions. Combined with a breakpoint indexing mechanism, the system can synchronize only missing or abnormal fragments during recovery, rather than retransmitting the entire content, thereby significantly reducing network traffic consumption and transmission time, and improving overall migration efficiency while ensuring data accuracy. Attached Figure Description

[0018] The preferred embodiments will now be described in a clear and easy-to-understand manner, in conjunction with the accompanying drawings, to further explain the above-mentioned characteristics, technical features, advantages, and implementation methods of this application.

[0019] Figure 1 This is a flowchart illustrating the steps of an embodiment of a device data migration method according to this application; Figure 2 This is a flowchart of a sub-step of step S1 in one embodiment of a device data migration method according to this application; Figure 3 This is a flowchart of the sub-steps of step S1 in another embodiment of a device data migration method according to this application; Figure 4 This is a flowchart of a sub-step of step S5 in another embodiment of a device data migration method of this application; Figure 5 This is a structural block diagram of one embodiment of a device data migration system according to this application. Detailed Implementation

[0020] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0021] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or sets.

[0022] To keep the drawings concise, each figure only schematically shows the parts relevant to the invention, and these do not represent the actual structure of the product. Furthermore, to facilitate understanding, in some figures, only one of components with the same structure or function is schematically depicted, or only one is labeled. In this document, "one" not only means "only one," but can also mean "more than one."

[0023] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] Furthermore, in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0025] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the specific implementation methods of this application will be described below with reference to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without creative effort.

[0026] In modern digital life, smart devices have become crucial carriers of personal data storage and daily interaction, leading to frequent needs for device data migration. This typically occurs when users replace old devices with new ones, devices are sent for repair or reset due to malfunctions, systems undergo major version upgrades, or when switching between different brands or operating systems. The purpose of data migration is to ensure seamless integration and complete inheritance of user data, application configurations, usage habits, and various generated content across different devices, thereby guaranteeing the continuity of user experience and the integrity of data assets. Without an effective migration mechanism, users will face numerous inconveniences such as repeated setup, information loss, and service interruptions, not only reducing efficiency but also potentially leading to the irrecoverability of important data.

[0027] Currently, smart devices cover a wide range of product forms, mainly including smartwatches, smart bracelets, wireless headphones, smart home hubs, tablets, smartphones, portable medical devices, in-vehicle information systems, and various wearable devices and IoT terminals with network connectivity and data storage capabilities. These devices typically carry users' health monitoring data, communication records, media files, personalized settings, and behavioral preferences. The reliability, security, and convenience of their data migration directly affect the continuity of users' daily use and the overall quality of their digital lives.

[0028] Existing technologies present numerous technical bottlenecks and pain points for users when switching devices. The mainstream device replacement process typically relies on both the old and new devices simultaneously inserting SIM cards for authentication and data synchronization. This design severely limits user scenarios and operational flexibility, making the replacement process strictly dependent on the physical SIM card insertion and a stable network connection, resulting in cumbersome prerequisites and low fault tolerance. Furthermore, existing solutions employ relatively simple connection and authentication methods. If automatic network connection fails or a weak network environment is encountered, the entire migration process stalls, lacking an effective backup authentication mechanism. At the data transmission level, most systems use a full synchronization mode. If migration fails due to network fluctuations, device power outages, or user interruptions, all data often needs to be retransmitted from scratch, which is not only time-consuming and labor-intensive but also increases the risk of data inconsistency or loss. Moreover, in existing technologies, the migration process cannot be interrupted once started, and users cannot actively intervene when problems arise, resulting in room for improvement in overall system controllability and user experience.

[0029] To address the numerous technical bottlenecks encountered during device replacement, this application's solution employs a two-way authentication method using a digital certificate and private key pre-installed in the device's security element, completely decoupling the device identity from the physical SIM card. Even if the SIM card has been removed from the old device, secure authorization can still be established based on the certificate chain and a random challenge issued from the cloud, significantly reducing the physical prerequisites for the table replacement operation.

[0030] Reference manual attached Figure 1 As shown, one embodiment of a device data migration method according to this application specifically includes the following steps: S1 completes two-way authentication between the old and new devices and generates a session token based on the device certificate pre-installed in the secure element.

[0031] Specifically, in this embodiment, before execution, device digital certificates and private keys are pre-embedded in the security hardware of both the old and new watches. Upon initiating the migration, the old watch first sends a session request to the cloud server. The cloud generates a random number as a challenge value and sends it to both devices. The device signs the challenge using its private key and returns it, simultaneously submitting its own certificate chain for cloud verification. In addition to verifying the validity of the signature and certificate chain, the cloud also checks in real-time whether the certificate has been revoked through an online certificate status protocol or a certificate revocation list to ensure the certificate is in a legitimate and usable state.

[0032] S2 binds the session token to the user account and the device serial number of the old and new devices to decouple the device identity from the user identity module card, so that the old device can still be migrated and authorized based on the device certificate after the user identity module card is removed.

[0033] Specifically, the Subscriber Identity Module Card (SIM card) is used to bind the session token to the user account associated with the current migration task, the unique serial number of the old device, and the unique serial number of the new device after the session token is generated. This allows the SIM card to continuously represent the legitimacy of the migration operation and the trust relationship between the devices without relying on the physical state of the SIM card.

[0034] Optionally, the session token is used to verify the legitimacy of data transmission requests and also serves as the identity basis for operations such as connection restoration and resume download, ensuring that the migration process is carried out in a secure and controllable authorized environment.

[0035] S3, in response to the migration command, performs fragmentation processing on the data to be migrated according to the predefined list of data domains, and obtains fragmented data.

[0036] Specifically, the migrated content is divided into data domains, such as contacts and activity logs, and then further segmented into multiple "shards." Each shard contains a shard header and the actual data payload, facilitating shard-by-shard transmission, verification, and breakpoint management. Optionally, the shard header information includes the domain ID, shard number, and checksum.

[0037] S4 records the breakpoint index information of the sharded data in real time during the migration process and stores the breakpoint index information synchronously to the cloud server so that breakpoint recovery or selective skipping can be performed based on the breakpoint index information after the transmission is interrupted.

[0038] Specifically, breakpoint index information is a set of metadata that records the status and location of each data shard during the data migration process. Breakpoint index information is synchronously stored on both the cloud server and local devices, forming a dual recovery guarantee mechanism that balances reliability and availability across different scenarios. Cloud storage enables the index to have global accessibility across devices and sessions. Even if a local device fails or is replaced, the migration progress can be quickly resumed through the cloud, ensuring process continuity. Local storage guarantees the system's autonomous recovery capability in network outages or weak network environments. When the network connection is temporarily interrupted, the device can directly perform breakpoint recovery operations based on the local index without relying on real-time cloud access.

[0039] In some optional implementations, each data shard includes corresponding hash verification information. This hash verification information is used for verification by new devices. Upon successful verification, the new device sends a confirmation response to the cloud server.

[0040] Specifically, in addition to fragment header information, actual data payload, and transmission control information, fragmented data also includes corresponding hash verification information.

[0041] Optionally, the cloud server first develops a migration plan based on data importance, prioritizing the transfer of critical data such as account configurations, then processing frequently used data, and finally migrating infrequently used data. Before each data fragment is sent, its transmission record is written to the transmission log for tracking.

[0042] Upon receiving a fragment, the new device (the receiver) verifies its hash check information. If the data is complete and error-free, it returns an acknowledgment (ACK) to the sender. If the old device (the sender) does not receive an ACK within the set timeout period, it determines that the fragment transmission has failed, automatically initiates a retransmission process, and accumulates the number of retries to ensure that each data fragment is reliably delivered.

[0043] In some alternative implementations, during data transmission, the cloud server uses an adaptive window to dynamically adjust the size of data fragments based on network quality.

[0044] Specifically, an adaptive window refers to the system dynamically controlling the number of data fragments allowed to be sent continuously without waiting for acknowledgments (i.e., the window size). When network quality is good, the window can be expanded to increase throughput. When network latency increases or packet loss occurs, the window automatically shrinks to alleviate network pressure and reduce the risk of congestion.

[0045] In some alternative implementations, the cloud server also employs an exponential backoff retransmission mechanism during data transmission.

[0046] Specifically, when a data fragment is sent but no acknowledgment is received from the receiver within a predetermined time, the sender will not immediately resend it. Instead, it will wait for a gradually delayed period before retrying, with the waiting time for each retry typically increasing exponentially—for example, 1 second for the first retry, 2 seconds for the second, and 4 seconds for the third. This exponential backoff retransmission mechanism effectively prevents congestion from being exacerbated by a large number of duplicate packets during moments of network congestion.

[0047] In practice, the system continuously monitors network metrics, such as round-trip latency and packet loss rate, and adjusts the size of fragments and the timeout for waiting for acknowledgments accordingly, thereby achieving efficient utilization of network resources and robustness of the transmission process.

[0048] Based on the above embodiments, please refer to the appendix to the specification. Figure 2 As shown, this application discloses another embodiment of a device data migration method, where step S1 specifically includes the following sub-steps: S11, the old device initiates a session request to the cloud server, so that after receiving the session request, the cloud server sends random challenges to both the new and old devices simultaneously.

[0049] Specifically, the random challenge is an unpredictable and one-time valid random number generated by a cloud server. As a dynamic verification factor, the random challenge is used to ensure the freshness and replayability of the identity authentication process.

[0050] In S12, the old and new devices each use their respective secure elements to sign the random challenge with their private keys and exchange certificate chains.

[0051] Specifically, when faced with a random challenge, both the old and new devices use the private keys pre-installed in their respective secure elements to digitally sign the challenge and submit the signature along with their own digital certificate chains to the cloud. Upon receiving responses from both parties, the cloud first verifies the authenticity and validity of the certificate chains, including checking the issuing authority and certificate revocation status. Then, it uses the public key extracted from the certificates to decrypt the signatures and compares them with the original random challenge.

[0052] S13, after verifying the validity of the private key signature and certificate chain, the cloud server generates a session token.

[0053] Specifically, if both signatures are verified, it indicates that both the old and new devices possess valid and matching key pairs, completing the two-way authentication process. The cloud then verifies the authenticity of the device's identity and generates and issues the session token required for this migration. Optionally, the session token is a time-sensitive and unique digital credential generated by the cloud server after completing the two-way authentication of the old and new devices.

[0054] This application provides another embodiment of a device data migration method. Based on any of the embodiments described above, please refer to the appendix to the specification. Figure 3 As shown, step S13 specifically includes: S131, the cloud server verifies the validity of the private key signature and certificate chain.

[0055] S132, If the two-way authentication is successful, a session token is generated. Based on this, step S1 further includes: S14. If the two-way authentication between the old device and the new device fails, the system will switch to the backup authentication channel for user authentication.

[0056] Specifically, in any embodiment of the method described above in this application, the verification channel used is the default online network channel. The backup authentication channel includes at least one of the following: a verification code channel, an offline password channel, or a temporary credential channel. Optionally, the verification code channel, offline password channel, and temporary credential channel are all fault-tolerant paths used in this solution to provide alternative authentication methods when automatic online authentication fails, and each has different execution steps.

[0057] The verification code channel is used to obtain a time-sensitive digital verification code, input the digital verification code into the new device for verification, and complete the authentication.

[0058] The offline password channel is used to provide a pre-generated one-time offline password, which is then entered into a new device for verification to complete the authentication.

[0059] The temporary credential channel is used to generate a temporary credential QR code that includes the intended use, validity period, and digital signature. The new device receives the temporary credential QR code and verifies it to complete the authentication.

[0060] Specifically, the verification code channel is characterized by obtaining a short, valid digital code with a limited duration through end-to-end encryption. During execution, the user needs to view and manually enter this code on the old device or associated application into the new device to complete verification. The offline password channel relies on a pre-generated or received long character sequence via SMS, offering complete offline usability. The user needs to enter this password on the new device's interface to complete identity verification. The temporary credential channel uses dynamically generated QR codes or sound waves as carriers. The credential embeds its purpose, validity period, and digital signature information. During execution, the user scans or receives the credential on the new device, the system automatically parses and verifies the signature, and then establishes a secure temporary connection for authentication.

[0061] In some optional implementations, the backup authentication channel shares a failure counter. If the number of authentication failures exceeds a preset threshold, security risk control is triggered and a second confirmation is requested.

[0062] Specifically, this solution employs a unified failure counting mechanism across its various backup authentication channels, including verification codes, offline passwords, and temporary credentials. This means that regardless of which channel a user attempts to authenticate, all failures are accumulated into a single, shared failure counter, rather than each channel counting independently. If the accumulated failure count exceeds the system's preset security threshold (optionally set at 5 times), the system will automatically trigger risk control measures.

[0063] In some alternative implementations, risk control strategies include temporarily locking the migration session and requiring the user to complete a secondary confirmation through a higher-security process, such as manual customer service review or re-authentication, to prevent brute-force attacks or credential leakage risks, thereby ensuring the security of the authentication process.

[0064] This application provides another embodiment of a device data migration method, which, based on any of the above embodiments, further includes: S5, performing a rollback operation upon receiving a user's abort instruction.

[0065] Reference manual attached Figure 4 As shown, the specific steps include the following: S51, the cloud server responds to the abort command, suspends new tasks and stops all ongoing transmission tasks, and sends rollback commands to both the new and old devices.

[0066] S52, the new device removes received but unacknowledged fragment data from the temporary storage area, while retaining received and acknowledged fragment data unchanged.

[0067] S53, the cloud server records and generates statistical logs during the rollback operation, ensuring that the system is restored to the most recent consistent state after the rollback.

[0068] In this embodiment, when data transmission is interrupted or paused, the system performs a consistency rollback operation. Specifically, the consistency rollback operation refers to a series of controlled recovery actions performed by the system to ensure the integrity and logical consistency of the data state when the data migration process is interrupted due to user-initiated termination or an anomaly. This operation first freezes all ongoing transmission tasks, then withdraws data fragments that have been sent but not yet acknowledged by the receiving end from the temporary storage area, while retaining successfully committed and acknowledged data results unchanged. The entire process is accompanied by detailed recording and version marking in the statistical log, ensuring that the system can recover to the most recent consistent state after the rollback, and that subsequent operations will not conflict due to duplicate or residual data. This maintains the reliability and data integrity of the migration process while supporting user self-control.

[0069] Based on the same concept, this application also discloses a device data migration system. It includes a new device, an old device, and a cloud server, and the system is used to implement the steps described in any of the above method embodiments. Specifically, an embodiment of the device data migration system of this application is provided with reference to the appendix to the specification. Figure 5 As shown, it specifically includes: The cloud server is configured to perform two-way authentication between old and new devices and generate session tokens based on the device certificate pre-installed in the secure element.

[0070] The session token is bound to the user account and the device serial number to decouple the device identity from the user identity module card, so that the old device can still be migrated and authorized based on the device certificate after the user identity module card is removed.

[0071] In response to the migration command, the cloud server segments the data to be migrated according to a predefined list of data domains, resulting in segmented data.

[0072] During the migration process, both the new and old devices record the breakpoint index information of the fragmented data and synchronously store the breakpoint index information to the cloud server so that breakpoint recovery or selective skipping can be performed based on the breakpoint index information after transmission is interrupted.

[0073] Based on the same technical concept, this application also discloses a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of a device data migration method described in any of the above embodiments.

[0074] This application also discloses a computer program product, including a computer program that, when executed by a processor, implements the steps of a device data migration method as described in any of the above embodiments.

[0075] The device data migration method, system, medium, and product of this application have the same technical concept, and the technical details of the embodiments of the four are applicable to each other. In order to reduce repetition, they will not be described again here.

[0076] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of program modules is merely an example. In practical applications, the above functions can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program units or modules to complete all or part of the functions described above. The program modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one processing unit. The integrated unit can be implemented in hardware or as a software program unit. Furthermore, the specific names of the program modules are only for easy differentiation and are not intended to limit the scope of protection of this application.

[0077] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for migrating device data, characterized in that, include: Based on the device certificate pre-installed in the secure element, complete two-way authentication between the old device and the new device and generate a session token; The session token is bound to the user account and the device serial numbers of the old device and the new device to decouple the device identity from the user identity module card, so that the old device can still perform migration authorization based on the device certificate after the user identity module card is removed; In response to the migration command, the data to be migrated is fragmented according to a predefined list of data domains to obtain fragmented data; During the migration process, the breakpoint index information of the fragmented data is recorded in real time and synchronously stored in the cloud server so that breakpoint recovery or selective skipping can be performed based on the breakpoint index information after transmission is interrupted.

2. The device data migration method as described in claim 1, characterized in that, The process of completing two-way authentication between the old and new devices and generating session tokens based on the device certificate pre-installed in the secure element includes: The old device initiates a session request to the cloud server, so that after receiving the session request, the cloud server simultaneously sends random challenges to both the new device and the old device. The old device and the new device each use their respective security elements to sign the random challenge with their private keys and exchange certificate chains; After verifying the validity of the private key signature and the certificate chain, the cloud server generates the session token.

3. A device data migration method as described in claim 1 or 2, characterized in that, Also includes: If the two-way authentication between the old device and the new device fails, the user authentication will be switched to the backup authentication channel. The backup authentication channel includes at least one of the following channels: verification code channel, offline password channel, and temporary credential channel; The verification code channel is used to obtain a time-sensitive digital verification code, input the digital verification code into the new device for verification to complete the authentication. The offline password channel is used to provide a pre-generated single offline password, which is then input into the new device for verification to complete the authentication. The temporary credential channel is used to generate a temporary credential QR code that carries the purpose, validity period and digital signature. The new device receives the temporary credential QR code and verifies it to complete the authentication.

4. The device data migration method as described in claim 1, characterized in that, Each data shard includes corresponding hash verification information; the hash verification information is used for verification by the new device; after successful verification, the new device sends a confirmation response to the cloud server.

5. The device data migration method as described in claim 4, characterized in that, Also includes: Upon receiving a user's abort command, a rollback operation is performed; Specifically, it includes: In response to the abort command, the cloud server suspends the new task and terminates all ongoing transmission tasks; and sends a rollback command to the new device and the old device. The new device removes the received but unacknowledged fragment data from the temporary storage area, while retaining the received and acknowledged fragment data unchanged. The cloud server records and generates statistical logs during the rollback operation to ensure that the system is restored to the most recent consistent state after the rollback.

6. The device data migration method as described in claim 1, characterized in that, Also includes: During data transmission, the cloud server uses an adaptive window to dynamically adjust the size of data fragments based on network quality.

7. The device data migration method as described in claim 3, characterized in that, Also includes: The backup authentication channel shares a failure counter. If the number of authentication failures exceeds a preset threshold, security risk control is triggered and a second confirmation is requested.

8. A device data migration system, comprising new device, old device, and cloud server, characterized in that, The device data migration system is used to implement the steps of the device data migration method according to any one of claims 1-7; The cloud server is configured to perform two-way authentication between the old device and the new device and generate a session token based on the device certificate pre-installed in the secure element. The session token is bound to the user account and the device serial number to decouple the device identity from the user identity module card, so that the old device can still be migrated and authorized based on the device certificate after the user identity module card is removed. In response to the migration command, the cloud server performs fragmentation processing on the data to be migrated according to a predefined list of data domains to obtain fragmented data; During the migration process, the new device and the old device each record the breakpoint index information of the fragmented data and synchronously store the breakpoint index information to the cloud server so that breakpoint recovery or selective skipping can be performed based on the breakpoint index information after transmission is interrupted.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of a device data migration method according to any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of a device data migration method according to any one of claims 1-7.

Images