Data transmission method and related apparatus

Abstract

Embodiments of the present application provide a data transmission method and a related apparatus. The data transmission method comprises: when a terminal establishes a secure connection with an edge agent, the edge agent sends key information corresponding to the terminal to a server; and the server determines a first key between the terminal and the edge agent according to the key information. By means of the first key, the server decrypts data sent by the terminal and forwarded by the edge agent, so that the edge agent does not need to encrypt and decrypt the forwarded data sent by the terminal, thereby reducing the loss of computing resources of the edge agent, and improving the throughput of the edge agent.

Description

Data transmission method and related device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on June 16, 2023, with application number 202310724077.2 and application name “Data transmission method and related device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a data transmission method and related devices. Background Art

[0003] Nowadays, "end-edge-cloud" collaborative services have been widely used in smart cities, smart manufacturing and other industries. End-edge-cloud is a terminal-edge-cloud collaborative architecture. Before collaboration, the end side first establishes a secure connection with the edge side and determines the encryption key between the end side and the edge side; the edge side establishes a secure connection with the cloud side and determines the encryption key between the edge side and the cloud side; when the end side transmits data to the cloud side, in order to ensure the security of data transmission, the end side first encrypts the data through the encryption key between the end side and the edge side, and transmits the encrypted data to the edge side. The edge side decrypts the data based on the encryption key between the end side and the edge side, and then encrypts the decrypted data based on the encryption key between the edge side and the cloud side. The encrypted data is then sent to the cloud side. After receiving the data, the cloud side decrypts the data based on the encryption key between the edge side and the cloud side.

[0004] During the above data transmission process, the edge needs to decrypt and encrypt the forwarded data, which wastes computing resources and reduces the throughput of the edge.

[0005] Summary of the Invention

[0006] The present application provides a data transmission method and related devices, which send key information between a terminal and an edge agent to a server so that the server can generate an encryption key based on the key information and decrypt the data forwarded by the edge agent based on the encryption key. In this way, the edge agent does not need to decrypt and encrypt the data sent by the forwarded terminal, thereby solving the technical problems of waste of computing resources and reduced throughput of edge agents in the prior art.

[0007] To achieve the above objectives, this application adopts the following technical solutions:

[0008] In a first aspect, a data transmission method is provided, which is applied to an edge agent, wherein the edge agent is a server with a reverse proxy function. The data transmission method includes: after the edge agent establishes a secure connection with a terminal, determining first added information corresponding to the terminal, wherein the first added information carries key information, and the key information is used to generate a first key, wherein the first key is the key determined when the terminal establishes a secure connection with the edge agent; forming key transmission data based on the first added information; and sending the key transmission data to a server.

[0009] In this way, after the terminal and the edge agent establish a secure connection, the edge agent sends the key information corresponding to the terminal to the server. The server determines the first key corresponding to the terminal based on the key information and decrypts the data sent by the terminal forwarded by the edge agent based on the first key. As a result, the edge agent does not need to decrypt or encrypt the data sent by the forwarded terminal, reducing the loss of computing resources of the edge agent and improving the throughput of the edge agent. The encryption of the data forwarded by the edge agent is completed by the terminal, and the decryption is completed by the server. The edge agent does not need to decrypt or encrypt the forwarded data, reducing the number of times the encryption key is used on the edge agent side and improving the security of the encryption key.

[0010] Furthermore, at this time, the secure connection between the server and the edge agent is also established. The data between the server and the edge agent can be encrypted by the key between the server and the edge agent, which also ensures the security of the key information transmission between the server and the edge agent.

[0011] In some embodiments of the first aspect, the first added information also carries identification information, the identification information is used to identify the corresponding terminal. After sending the key transmission data to the server, the data transmission method further includes: receiving terminal encrypted data sent by the terminal, the terminal encrypted data being encrypted by the terminal using the first key; determining second added information corresponding to the terminal, the second added information carrying identification information and not carrying the key information; forming data transmission data based on the encrypted data and the second added information; and sending the data transmission data to the server. Furthermore, by identifying the corresponding terminal and the first key corresponding to the terminal using the identification information, the server can determine the corresponding key information based on the identification information, and the data transmission information does not need to carry the key information. The key information only needs to be transmitted once in the key transmission data, thereby avoiding multiple transmissions of the key information and affecting the security of the key.

[0012] In this way, when the edge agent sends key transmission information to the server, it not only carries key information but also carries identification information. The identification information can enable the server to establish an association between the key information and the terminal; after sending the key transmission information to the server, the edge agent forwards data sent by other terminals to the server. The edge agent does not need to add the key information. The server can determine the corresponding first key based on the identification information and decrypt the forwarded data based on the first key, reducing the transmission of key information and ensuring the security of the key information. The association between the terminal and the first key is established through the identification information, which facilitates the edge agent and the server to obtain the corresponding key information based on the identification information.

[0013] In some embodiments of the first aspect, forming key transmission data according to the first additional information includes:

[0014] Receive terminal encrypted data sent by the terminal, where the terminal encrypted data is encrypted by the terminal using the first key; and form the key transmission data according to the terminal encrypted data and the first added information.

[0015] In this way, after the terminal and the edge agent establish a secure connection, the edge agent receives the terminal encrypted data sent by the terminal, and forms key transmission data based on the terminal encrypted data and the first added information carrying the key information, without changing the existing edge agent's data forwarding process, which is easy to implement.

[0016] In some embodiments of the first aspect, the terminal encrypted data in the key transmission data is a first data packet sent by the terminal and received by the edge proxy after the terminal establishes a secure connection with the edge proxy.

[0017] In this way, the terminal encryption data in the key transmission data is the first data packet sent by the terminal received by the edge agent after the terminal establishes a secure connection with the edge agent. That is, after the secure connection is established, the key information is transmitted to the server to ensure the timeliness of the key information transmission, so that the server can decrypt and encrypt the data forwarded by the edge agent based on the key information, thereby reducing the loss of encryption and encryption computing resources of the edge agent as soon as possible.

[0018] In some embodiments of the first aspect, the data transmission method also includes: receiving first encrypted data sent by the server, the first encrypted data carrying third added information, the third added information carrying identification information and not carrying the key information; determining the corresponding terminal based on the identification information; removing the third added information in the first encrypted data to obtain second encrypted data, the second encrypted data being encrypted by the server using the first key corresponding to the terminal; and sending the second encrypted data to the terminal.

[0019] In some embodiments of the first aspect, after the first key between the terminal and the edge agent is updated, the data transmission method further includes: forming the key update message based on the identification information, the key update message carrying a key update indication message and second addition information, the second addition information carrying identification information, and the key update indication message being used to instruct the server to update the first key.

[0020] In this way, after the first key between the terminal and the edge proxy is updated, the key update message is used to trigger the update of the first key in the server, so as to ensure the timeliness and security of the first key in the server.

[0021] In some embodiments of the first aspect, the key information is encrypted by the edge proxy using a second key, where the second key is a key determined when the edge proxy establishes a secure connection with the server.

[0022] In this way, the key information is encrypted by the second key to ensure the security of the key information transmission process.

[0023] In some embodiments of the first aspect, the first added information serves as a tail of a data packet of the key transmission data.

[0024] In this way, the first added information serves as the tail of the data packet of the terminal encrypted data, which is convenient for subsequent devices (such as servers) to parse, thereby reducing the probability of packet loss due to data not being parsed.

[0025] In some embodiments of the first aspect, the first added information further carries flag information, where the flag information is a first value, and the first value is used to indicate that the first added information carries the key information.

[0026] In some embodiments of the first aspect, the identification information includes an edge agent identifier and a terminal identifier, the edge agent identifier is used to identify the corresponding edge agent, and the terminal identifier is used to identify the corresponding terminal.

[0027] In a second aspect, a data transmission method is provided, which is applied to a server. The data transmission method includes: receiving key transmission data sent by an edge agent, the edge agent is a server with a reverse proxy function, the key transmission data carries first added information, the first added information carries key information, the key information is used to generate a first key, the first key is the key determined when the terminal establishes a secure connection with the edge agent; the first key is determined based on the key information.

[0028] In some embodiments of the second aspect, the first added information also carries identification information, and the identification information is used to identify the corresponding terminal. After receiving the key transmission data sent by the edge agent, the data transmission method further includes: receiving data transmission data sent by the edge agent, the data transmission data carrying the second added information and terminal encryption data, the second added information carrying the identification information and not carrying the key information, the terminal encryption data being encrypted by the terminal using the first key; determining the first key corresponding to the terminal based on the identification information; and decrypting the terminal encryption data based on the first key.

[0029] In some embodiments of the second aspect, the key transmission data further carries terminal encrypted data, and the terminal encrypted data is encrypted by the terminal using the first key.

[0030] In some embodiments of the second aspect, after the server receives the key transmission data, the data transmission method further includes: determining third added information corresponding to the terminal, the third added information carrying the identification information but not the key information; forming first encrypted data based on the third added information; and sending the first encrypted data to the edge agent.

[0031] In some embodiments of the second aspect, the data transmission method also includes: receiving a key update message, the key update message carrying a key update indication message and second added information, the second added information carrying identification information, the key update indication message being used to instruct the server to update the first key; determining the corresponding terminal based on the identification information; and updating the first key corresponding to the terminal based on the key update indication message.

[0032] In some embodiments of the second aspect, the key information is encrypted by the edge agent using a second key, and the second key is a key determined when the edge agent establishes a secure connection with the server; determining the first key based on the key information includes: decrypting the key information using the second key to obtain decrypted key information; and determining the first key based on the decrypted key information.

[0033] In some embodiments of the second aspect, the first added information serves as the tail of a data packet of the key transmission data.

[0034] In some embodiments of the second aspect, the first added information further carries flag information, and the flag information is a first value. The data transmission method further includes: determining, based on the first value, that the first added information carries the key information.

[0035] In some embodiments of the second aspect, the first added information further carries integrity information, and the data transmission method further includes: verifying the integrity of the key transmission data based on the first key and the integrity information.

[0036] In a third aspect, an edge agent is provided, including:

[0037] a memory comprising computer-readable instructions;

[0038] A processor in communication with the memory, the processor being configured to execute the computer-readable instructions so that the edge agent performs the data transmission method according to any one of the first aspects.

[0039] In a fourth aspect, a server is provided, comprising:

[0040] a memory comprising computer-readable instructions;

[0041] A processor in communication with the memory, the processor being configured to execute the computer-readable instructions so that the server executes the data transmission method according to any one of the second aspects.

[0042] In a fifth aspect, a data transmission system is provided, comprising a server and an edge agent, wherein the edge agent is used to execute the data transmission method described in any one of the first aspects, and the server is used to execute the data transmission method described in any one of the second aspects.

[0043] In a sixth aspect, a computer-readable storage medium is provided, comprising a program or instruction, which, when executed by a processor, implements the data transmission method as described in any one of the first aspect or the second aspect.

[0044] In a seventh aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the data transmission method as described in any one of the first aspect or the second aspect.

[0045] The beneficial effects brought about by each possible implementation method of the data transmission method provided in the second aspect of the embodiment of this application, the edge agent provided in the third aspect, the server provided in the fourth aspect, the data transmission system provided in the fifth aspect, the computer-readable storage medium provided in the sixth aspect, and the computer program product provided in the seventh aspect can be referred to the description of the various possible implementation methods in the first aspect, and will not be repeated here one by one. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] FIG1A is a schematic diagram of the architecture of a data transmission system;

[0047] FIG1B is a schematic diagram of the architecture of another data transmission system;

[0048] FIG1C is a schematic diagram of the architecture of yet another data transmission system;

[0049] FIG2 is a schematic diagram of the architecture of the data transmission system shown in FIG1A for establishing a TLS secure connection;

[0050] FIG3 is a flow chart of a data transmission method provided in an embodiment of the present application;

[0051] FIG4 is a schematic diagram of a message format of first added information provided in an embodiment of the present application;

[0052] FIG5 is a schematic diagram of a message encapsulation format of key transmission data provided in an embodiment of the present application;

[0053] FIG6 is a flow chart of another data transmission method provided in an embodiment of the present application;

[0054] FIG7 is a schematic diagram of a process of forming a key transmission data by an edge agent according to an embodiment of the present application;

[0055] FIG8 is a schematic diagram of a process of a server processing key transmission data provided by an embodiment of the present application;

[0056] FIG9 is a schematic flow chart of another data transmission method provided in an embodiment of the present application;

[0057] FIG10 is a schematic diagram of a message encapsulation format for transmitting data provided in an embodiment of the present application;

[0058] FIG11 is a schematic diagram of a process of edge agent combined data transmission provided by an embodiment of the present application;

[0059] FIG12 is a schematic flow chart of another data transmission method provided in an embodiment of the present application;

[0060] FIG13 is a schematic diagram of a process of processing first encrypted data by an edge proxy provided in an embodiment of the present application;

[0061] FIG14 is a flow chart of another data transmission method provided in an embodiment of the present application;

[0062] FIG15 is a schematic diagram of the structure of an edge proxy provided in an embodiment of the present application;

[0063] FIG16 is a schematic diagram of the structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The technical solutions in this application will be described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this specification, rather than all the embodiments.

[0065] To facilitate understanding, the terms involved in the embodiments of the present application are first briefly introduced.

[0066] 1. Reverse Proxy

[0067] As a type of proxy server, the reverse proxy is located between the user and the server. However, for the user, the reverse proxy server is equivalent to the server, that is, the user can obtain the server's resources by directly accessing the reverse proxy server.

[0068] 2. Elastic Load Balance (ELB)

[0069] ELB is used to automatically distribute access traffic to multiple cloud servers, expand the external service capabilities of the application system, and achieve a higher level of application fault tolerance. Among them, ELB can be used as a function of the cloud server.

[0070] Please refer to Figure 1A, which is a schematic diagram of the architecture of a data transmission system. The data transmission system in Figure 1A includes a terminal, an edge proxy, and a server. The data transmission system in Figure 1A is also known as an end-edge-cloud architecture, where the terminal serves as the end side, the edge proxy serves as the edge side, and the server serves as the cloud side.

[0071] Among them, the terminal serves as the user side, that is, the end side. The terminal can be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) device, virtual reality (VR) device, artificial intelligence (AI) device, wearable device, vehicle-mounted device, smart home device and / or smart city device. The embodiment of the present application does not impose any special restrictions on the specific type of the terminal. The terminal can be equipped with iOS, Android, Microsoft or other operating systems.

[0072] An edge proxy is a server with reverse proxy functionality, used to forward data sent by a terminal to a server, or to forward data sent by a server to a corresponding terminal, so that the terminal can access resources on the server through the above channels.

[0073] The server can be used to provide terminals with data storage, data processing, data transmission, Elastic Cloud Server (ECS) and other services.

[0074] Figure 1A only illustrates one server. It can be understood that in other embodiments, the number of servers on the cloud side may be multiple. As shown in Figure 1B, the cloud side of the data transmission architecture is provided with a data center, and the data center includes three servers. In order to distribute the terminal access traffic to the corresponding server according to the policy, a corresponding ELB can be set between the server and the edge agent. The ELB can receive incoming traffic from the edge agent and forward the incoming traffic to one or more backend servers.

[0075] Furthermore, ELB can be a server with data distribution function, or it can be a logical function of the back-end business server. For ease of understanding, in the following description, data centers are collectively referred to as servers. Server can be a collective name for one or more servers, or a collective name for multiple servers including ELB functions.

[0076] To ensure the security of data transmission, before data transmission, the terminal must first establish a Transport Layer Security (TLS) connection with the edge proxy. That is, the terminal and the edge proxy establish a secure connection based on the TLS protocol, and the edge proxy also establishes a TLS connection with the corresponding server.

[0077] In order to reduce the number of connections established between the edge agent and the server and reduce the overhead on the server side, when multiple terminals establish TLS connections with the edge agent, the edge agent and the server can only establish one TLS long connection and maintain the long connection. For example, only when the first terminal establishes a TLS connection with the edge agent, the edge agent initiates the establishment of a TLS connection with the server.

[0078] Of course, in other embodiments, the number of TLS connections between the edge proxy and the server can be set according to actual needs and is not limited to one TLS connection.

[0079] Please refer to Figure 1C, which is a schematic diagram of the architecture of another data transmission system. Figure 1C is similar to the data transmission system in Figure 1A. The data transmission system in Figure 1C includes a terminal, an edge agent and a server. The terminal and the edge agent establish corresponding TLS connections; the edge agent and the server establish corresponding TLS connections. The difference is that: the data transmission system in Figure 1C includes multiple terminals, and multiple terminals establish TLS connections with the same edge agent at the same time. The edge agent establishes a TLS long connection with a server (i.e., the main channel in Figure 1C), and the data transmitted between multiple terminals and the server must pass through the long connection between the edge agent and the server.

[0080] It is easy to understand that the above main channel is only an example explanation of the secure connection between the edge agent and the server for ease of understanding.

[0081] In order to facilitate understanding of the process of establishing a TLS connection, the following is explained using Figure 2 as an example. Please refer to Figure 2, which is a schematic diagram of the establishment of a secure connection for the data transmission architecture shown in Figure 1A. The secure connection of the data transmission architecture includes the establishment of a TLS connection between the terminal and the edge agent and the establishment of a TLS connection between the edge agent and the server. Since the process of establishing a TLS connection between the terminal and the edge agent is similar to the process of establishing a TLS connection between the edge agent and the server, both are based on the handshake and negotiation process of the TLS protocol. The following only uses the TLS handshake and key negotiation process between the terminal and the edge agent as an example for explanation, wherein the TLS handshake and key negotiation process between the terminal and the edge agent includes the following steps:

[0082] After the terminal establishes a Transmission Control Protocol (TCP) connection with the edge proxy, the terminal sends a Client Hello message to the edge proxy. The Client Hello message carries the encryption suite supported by the terminal and a random number.

[0083] After receiving the Client Hello from the terminal, the edge proxy returns a Server Hello to the terminal. The Server Hello carries the encryption suite selected by the edge proxy from the list of supported key suites provided by the terminal, and also carries a random number.

[0084] The edge agent sends a certificate to the terminal, which contains the public key and signature;

[0085] The terminal verifies the certificate sent by the edge agent. After the verification is passed, the terminal generates a pre-master secret, extracts the public key from the certificate, encrypts the pre-master secret with the public key of the certificate, and then sends it to the edge agent.

[0086] The terminal generates an encryption key based on the random number generated when sending the Client Hello, the random number carried in the Server Hello sent by the edge proxy, and the pre-master key generated by the terminal. The encryption key is used to encrypt and decrypt data transmitted between the terminal and the edge proxy.

[0087] The terminal then sends a Change Cipher Spec message to the edge proxy, notifying it that it will subsequently use the negotiated encryption key to encrypt data before transmission. It also sends a Client Key Exchange and Finished message to the edge proxy, where the Finished message is encrypted using the encryption key.

[0088] After receiving the Client Key Exchange message, the edge proxy extracts the encrypted pre-master key from the message, decrypts it using the private key in the certificate, and generates an encryption key based on the random number carried in the Client Hello message, the random number carried in the Server Hello message, and the pre-master key.

[0089] The edge agent sends a Change Cipher Spec message to the terminal, notifying the terminal that it will use the negotiated encryption key to encrypt subsequent data before transmission.

[0090] From this point on, the TLS handshake between the endpoint and the edge proxy is complete, and communication begins using encryption keys.

[0091] Furthermore, the TLS handshake and key negotiation process between the edge agent and the server is similar to the TLS handshake and key negotiation process between the terminal and the edge agent. After the TLS handshake and key negotiation process between the edge agent and the server is completed, the encryption key between the edge agent and the server is determined, and then the edge agent and the server begin to communicate using the encryption key.

[0092] However, after the terminal establishes a TLS connection with the edge proxy, and the edge proxy establishes a TLS connection with the server, the data transmission architectures shown in Figures 1A, 1B, and 1C present the following issues: When the terminal sends data to the server, it must send the data to the edge proxy, which then sends the data to the corresponding server. To ensure data transmission security, both data transmitted between the terminal and the edge proxy and data transmitted between the edge proxy and the server must be securely encrypted. Because the encryption key between the terminal and the edge proxy is different from the encryption key between the edge proxy and the server, when the edge proxy forwards data sent from the terminal to the server, it must first decrypt the data using the encryption key between the terminal and the edge proxy to obtain the decrypted data. The edge proxy then encrypts the decrypted data using the encryption key between the edge proxy and the server and sends the encrypted data to the corresponding server. During this data transmission process, the edge proxy needs to frequently decrypt and encrypt the forwarded data, which consumes significant computing resources and affects the edge proxy's throughput. Furthermore, each time the edge proxy forwards data, it must encrypt and decrypt the data, requiring frequent use of the encryption key, which affects the key's security.

[0093] Based on the above problems, an embodiment of the present application provides a data transmission method. After a secure connection is established between a terminal and an edge agent, the edge agent forwards the key information corresponding to the terminal to the server. The server determines the encryption key between the terminal and the edge agent based on the key information. The edge agent can forward the data sent by the terminal to the edge agent directly to the server without decrypting and encrypting the data. The server can decrypt the data forwarded by the edge agent based on the encryption key corresponding to the terminal. Since the edge agent does not need to encrypt and decrypt the forwarded data, the computing resource consumption of the edge agent is reduced and the throughput of the edge agent is improved. The encryption of the data forwarded by the edge agent is completed by the terminal, and the decryption is completed by the server. The edge agent does not need to decrypt and encrypt the forwarded data, which reduces the number of times the encryption key on the edge agent side is used and improves the security of the encryption key.

[0094] Please refer to Figure 3, which is a flow chart of a data transmission method provided in an embodiment of the present application. The data transmission method provided in an embodiment of the present application can be applied to the data transmission system shown in Figures 1A, 1B and 1C. After the terminal establishes a secure connection with the corresponding edge agent, the edge agent sends the key information corresponding to the terminal to the server so that the server can determine the encryption key between the terminal and the edge agent based on the key information.

[0095] The following describes the data transmission method as applied to the data transmission architecture shown in Figure 1A as an example. As shown in Figure 3, the method includes S301-S304.

[0096] S301: After a secure connection is established between a terminal and an edge proxy, the edge proxy determines first added information corresponding to the terminal.

[0097] The first added information carries key information, and the key information is used to generate a first key. The first key is a key determined when the terminal establishes a secure connection (eg, a TLS connection) with the edge proxy.

[0098] Specifically, after the edge agent and the terminal establish a secure connection and determine the encryption key (i.e., the first key) between the edge agent and the terminal, the data transmitted between the edge agent and the terminal can be encrypted by the first key; the edge agent determines the first added information corresponding to the terminal, i.e., the key information of the key determined by the edge agent and the terminal to establish a secure connection.

[0099] In some embodiments, the key information includes an application secret ciphertext (application_secret), which is used for deriving and updating the first key.

[0100] Exemplarily, the application secret ciphertext is the key parameters for key derivation in the TLS1.3 standard: client_application_secret and client_application_secret, and an encryption key, ie, the first key, can be generated based on the application secret ciphertext.

[0101] Of course, the key information may also be other parameters involved in other key generation processes, such as random numbers generated during the handshake and key negotiation process between the terminal and the edge agent, as long as the server can generate the corresponding first key based on the key information.

[0102] In some embodiments, the key information further includes a cipher suite (also referred to as an encryption suite), which is used to identify the algorithm involved in the derivation process of the first key. It is understood that if the cipher suite corresponding to the key generated in the terminal and the edge agent is fixed, the key information may not include the cipher suite.

[0103] In some embodiments, the first additional information further includes flag information for identifying whether the first additional information includes key information. For example, if the flag information is 0, the first additional information carries both the flag information and the key information. That is, if the flag information is a first value, the first value indicates that the first additional information carries key information.

[0104] In some embodiments, the first added information also carries integrity information, where the integrity information, also known as an integrity check code, is used to verify the integrity of the first added information to provide integrity protection for the first added information. Specifically, the first added information remains undamaged, unmodified, unlost, and unauthorizedly altered during transmission by the edge proxy. The integrity information is determined by the edge proxy using an integrity key and a preset integrity algorithm, where the integrity key is the same as the first key.

[0105] In some embodiments, the first additional information further carries length information, where the length is used to indicate the length of the first additional information, wherein the length can be a fixed length agreed upon or a length determined according to actual needs.

[0106] S302: The edge agent forms key transmission data according to the first added information.

[0107] Specifically, the edge agent forms key transmission data according to the first added information, so as to transmit the key information in the first added information through the key transmission data.

[0108] Exemplarily, after the edge proxy and the terminal establish a secure connection, the edge proxy actively generates key transmission data according to the first added information corresponding to the terminal.

[0109] In some embodiments, the first additional information is placed at the end of the key transmission data packet to facilitate parsing by subsequent devices (e.g., a server), thereby reducing the probability of packet loss due to data not being parsed. It is understood that the first additional information may also be placed elsewhere in the key transmission data packet, such as in the middle of the key transmission data packet or at another designated location.

[0110] S303: The edge agent sends key transmission data to the server.

[0111] The key transmission data carries the first added information.

[0112] S304: The server receives the key transmission data sent by the edge agent, and determines the first key according to the key information in the key transmission data.

[0113] Specifically, since the key transmission data transmitted by the edge agent carries key information, after receiving the key transmission data, the server can determine the corresponding first key according to the key information.

[0114] In some embodiments, the first key may be generated by: the server uses the key information as input to a preset key derivation algorithm, and uses the output of the key derivation algorithm as the first key. The key derivation algorithm may be SHA256.

[0115] In this way, after the terminal establishes a secure connection with the edge proxy, the edge proxy sends the terminal's corresponding key information to the server. The server can generate a first key between the edge proxy and the terminal based on the key information, and can decrypt the data forwarded by the edge proxy based on the first key. The edge proxy does not need to decrypt or encrypt the data sent by the forwarded terminal, which reduces the consumption of the edge proxy's computing resources and improves the edge proxy's throughput. The encryption of the data forwarded by the edge proxy is completed by the terminal, and the decryption is completed by the server. The edge proxy does not need to decrypt or encrypt the forwarded data, which reduces the number of times the encryption key is used on the edge proxy side and improves the security of the encryption key.

[0116] In some embodiments, the key information in the first added information in S302 is encrypted by the edge proxy using a second key. The second key is a key determined when the edge proxy and the server establish a secure connection (e.g., a TLS connection). After receiving the key transmission data, the server can decrypt the key information using the second key corresponding to the edge proxy. By decrypting the key information, the security of the key information transmission is ensured.

[0117] In other embodiments, the edge proxy may encrypt the key transmission data. For example, the edge proxy may use a second key to encrypt the payload and first additional information in the key transmission data. The server may then decrypt the payload and first additional information using the second key and then determine the first key based on the key information in the decrypted first additional information. In this manner, the edge proxy only needs to perform encryption using the second key, while the server performs all decryption operations, reducing computational overhead on the edge proxy.

[0118] In some embodiments, the first added information further includes integrity information. In this case, after S304, the method may further include:

[0119] determining integrity check information based on the first key and the second encrypted data;

[0120] The integrity of the second encrypted data is determined based on the integrity information and the integrity check information.

[0121] Specifically, the server calculates the integrity check information based on the second encrypted data, the second key and the preset integrity algorithm. If the integrity check information and the integrity information are the same (for example, if the values ​​of the integrity check information and the integrity information are both 10, they are equal), it is determined that the second encrypted data has integrity, that is, it has not been damaged or tampered with during the transmission process; if the integrity check information and the integrity information are different, it is determined that the second encrypted data does not have integrity, and the second encrypted data can be discarded subsequently.

[0122] In some embodiments, the first added information also carries length information, and the server can determine the length of the first added information as the tail of the second encrypted data based on the length information.

[0123] Please refer to Figure 4, which is a schematic diagram of a message format of a first added information provided in an embodiment of the present application.

[0124] In FIG4 , the length of the first additional information is 20 bytes, of which the length of TAG is 8 bytes; TAG is integrity information and is 8 bytes long; CID (Connection ID) is identification information and is 16 bytes long; the length of the cipher suite (Cipher_ID) is 2 bytes, Length is length information and is 1 byte long; Flag is flag information and is 1 byte long. If the value of Flag is 0, the first additional information carries key information (and Cipher_ID). It will be understood that FIG4 is only an example of the message format of the first additional information and does not constitute a limitation on the content or format of the first additional information.

[0125] Please refer to Figure 5, which is a schematic diagram of the message encapsulation format of a key transmission data provided in an embodiment of the present application, wherein the key transmission data includes terminal encryption data and first added information. The specific content of the first added information has been stated in Figure 5 and will not be repeated here. The source IP and destination IP in Figure 5 are the addresses of the two nodes in the data transmission process, for example, if the terminal sends data to the edge agent, the source IP is the IP address of the terminal, and the destination IP is the IP address of the edge agent. Similarly, the source port is the port address corresponding to the terminal, and the destination port is the port address corresponding to the edge agent.

[0126] After receiving the terminal-encrypted data, the edge proxy re-encapsulates it. Specifically, the terminal IP address in the Source IP field in Figure 5 is replaced with the edge proxy's IP address, and the destination IP address in the Destination IP field is replaced with the server's IP address. The source and destination ports are adjusted based on the actual scenario, and the first appended information is added to the end of the terminal-encrypted data to form the key transmission data.

[0127] Since the first additional information in FIG. 5 carries key information (ie, application secret ciphertext and cipher suite), the Flag (flag information) in FIG. 5 is a first value, indicating that the first additional information in the key transmission data carries key information.

[0128] It is understood that after the terminal establishes a secure connection with the edge proxy, the edge proxy forms key transmission data based on the first added information in order to send the first added information carrying the key information to the server, and then sends the key transmission data to the server. The key transmission data can also be formed based on the data packet and the first added information after the terminal sends a data packet to the edge proxy after the terminal establishes a secure connection with the edge proxy. As shown in FIG6 , FIG6 is a flow chart of another data transmission method provided in an embodiment of the present application. As shown in FIG6 , the method includes S601-S605.

[0129] S601: The terminal sends terminal encrypted data to the edge proxy, where the terminal encrypted data is encrypted using a first key.

[0130] Specifically, after the terminal and the edge proxy establish a secure connection based on the TLS protocol, an encryption key (i.e., a first key) is determined between the terminal and the edge proxy. When the terminal needs to use server resources, it sends data to the server. To ensure data security, the terminal first encrypts the data to be transmitted using the first key, resulting in terminal-encrypted data.

[0131] It is understood that in other embodiments, a secure connection using other security protocols, such as HTTPS, may be established between the terminal and the edge proxy.

[0132] S602: The edge proxy receives terminal encrypted data sent by the terminal, and determines first added information corresponding to the terminal.

[0133] The first added information carries key information.

[0134] Specifically, after the terminal establishes a secure connection with the edge proxy, the edge proxy receives terminal encrypted data sent by the terminal, and then determines the first added information corresponding to the terminal.

[0135] S603: The edge agent generates key transmission data according to the terminal encryption data and the first added information.

[0136] In some embodiments, the first added information is used as the tail of the data packet of the terminal encrypted data, so as to facilitate parsing by subsequent devices (such as a server), thereby reducing the probability of packet loss due to data not being parsed.

[0137] S604: The edge agent sends key transmission data to the server.

[0138] S605: The server receives the key transmission data sent by the edge agent, determines the first key according to the key information, and decrypts the terminal encrypted data using the first key.

[0139] In this way, a secure connection is established between the terminal and the edge agent, and the edge agent receives the terminal encrypted data sent by the terminal. The edge agent forms key transmission data based on the terminal encrypted data and the first added information corresponding to the terminal, and then sends the key information corresponding to the terminal to the server, so that the server can determine the corresponding first key based on the key information, so that the server can decrypt the data sent by the terminal forwarded by the edge agent based on the first key, and the edge agent does not need to decrypt and encrypt the forwarded data, which reduces the consumption of computing resources of the edge agent and improves the throughput of the edge agent.

[0140] In some embodiments, the server may decrypt the terminal encrypted data by using the first key and the terminal encrypted data as inputs of a preset encryption algorithm, and the output of the encryption algorithm is the decrypted terminal encrypted data.

[0141] In some embodiments, the terminal encrypted data carried by the key transmission data may be the first data packet sent by the terminal to the edge proxy after the terminal establishes a secure connection with the edge proxy.

[0142] In this way, after a terminal establishes a secure connection with the edge proxy, the edge proxy sends the terminal's corresponding key information to the server through the first transmitted data packet sent by the terminal. The server can then decrypt all data packets sent by the terminal through the edge proxy after the secure connection is established between the terminal and the edge proxy. The edge proxy does not need to decrypt and encrypt the forwarded data, reducing the edge proxy's computing resource consumption and improving the edge proxy's throughput. The triggering moment of the key information is determined by the first data packet, facilitating subsequent implementation and detection.

[0143] Furthermore, if the edge agent establishes a secure connection with the terminal, the terminal sends the first data packet to the edge agent, and the edge agent forms key transmission data based on the first data packet and the first added data carrying key information and sends it to the server; when the terminal sends a non-first data packet to the edge agent, when the edge agent forwards the non-first data packet to the server, the forwarded non-first data packet does not need to carry key information.

[0144] It can be understood that in other embodiments, the terminal encryption data carried by the key transmission data may be a non-first data packet sent by the terminal to the edge agent after the terminal and the edge agent establish a secure connection. For example, the preset instruction in the edge agent is used to enable the edge agent to form key transmission data with the key information and the Nth data packet when receiving the Nth data packet sent by the terminal, and then send the key transmission data to the server, where N is a positive integer greater than 1; further, when the terminal sends the N+1th data packet to the edge agent, when the edge agent forwards the N+1th data packet to the server, the forwarded N+1th data packet does not need to carry key information.

[0145] In some embodiments, the first added information also carries identification information, which is used to identify the corresponding terminal. It is understood that each edge agent can establish a secure connection with multiple terminals. In order to distinguish multiple terminals, the edge agent can set a corresponding identification, i.e., identification information, for each terminal, so that the edge agent can determine the corresponding terminal and the first key corresponding to the terminal based on the identification information. The identification information can be randomly generated and assigned by the edge agent after receiving the first transmission data sent by the terminal after establishing a secure connection with the edge agent, or it can be pre-set in the edge agent by the user, and then the edge agent selects one of the multiple identification information as the identification information of the corresponding terminal.

[0146] Furthermore, after the edge agent determines the identification information corresponding to the terminal, the edge agent and the server may store the identification information so that the corresponding terminal and the first key corresponding to the terminal can be identified later based on the identification information.

[0147] The following example illustrates how, after establishing a secure connection with a terminal, the edge proxy receives terminal-encrypted data from the terminal and generates the data transmission data shown in FIG5 based on the terminal-encrypted data. FIG7 is a schematic diagram illustrating the process of generating key transmission data using an edge proxy according to an embodiment of the present application. As shown in FIG7 , the process includes steps S701-S704.

[0148] S701. Set the value of Flag.

[0149] Specifically, the terminal and the edge agent establish a secure connection. After the edge agent sends the key information corresponding to the terminal to the server, the edge agent receives the terminal encrypted data sent by the terminal and determines that the Flag is a first value. Exemplarily, the first value is 0, indicating that the first added information does not carry key information.

[0150] Furthermore, if the terminal encrypted data carried by the key transmission data is the first data packet sent by the terminal to the edge proxy after the terminal and the edge proxy establish a secure connection, the first value is also used to indicate that the terminal encrypted data is not the first data packet;

[0151] If the terminal encryption data carried by the key transmission data is not the first data packet sent by the terminal to the edge agent after a secure connection is established between the terminal and the edge agent, the first value indicates that the first added information does not carry key information; the non-first data packet may be the Nth data packet sent by the terminal to the edge agent after a secure connection is established between the terminal and the edge agent, where N is a positive integer greater than 1.

[0152] S702: Determine the cipher suite, CID, and Length.

[0153] Specifically, the edge agent can query the cipher suite corresponding to the terminal from the memory and then set the cipher_ID; CID is identification information, the edge agent can randomly assign it to the terminal, or assign it according to preset rules, for example, the CID has 64 bits, the first 32 bits of the CID are set to 0, and the last 32 bits are set to a random value; Length is the length of the first added information, which can be a fixed value or a value set according to the actual scenario.

[0154] S703. Calculate application secret ciphertext and integrity information.

[0155] Specifically, the edge proxy determines the application secret ciphertext corresponding to the terminal, that is, the application secret ciphertexts for establishing a TLS connection between the terminal and the edge proxy: Client_application_secret_A and EdgeLB_application_secret_A, and the encryption key generated when the edge proxy establishes a TLS connection with the server: the second key (for example, EdgeLB_application_key_B); then the application secret ciphertext is encrypting by the second key and the preset encryption algorithm, and the integrity information corresponding to the first added information is calculated based on the second key and the preset integrity protection algorithm.

[0156] S704, assemble the package.

[0157] Specifically, the above-mentioned Flag, cipher suite, CID, Length, application secret ciphertext and integrity information are formed into the first additional information, and the first additional information is used as the tail of the terminal encrypted data to combine into a new data packet, namely, key transmission data.

[0158] After receiving the key transmission data sent by the edge agent, the server can perform corresponding processing on the relevant fields in the key transmission data. Please refer to Figure 8, which is a schematic diagram of the process of a server processing key transmission data provided by an embodiment of the present application. As shown in Figure 8, the process of the server processing key transmission data includes: S801-S804.

[0159] S801: Determine whether Flag is a first value.

[0160] Specifically, the server receives the key transmission data sent by the edge agent, and the key transmission data carries the terminal encryption data and the first added information. The server first determines whether the Flag (i.e., the flag information) is a first value (for example, 0). If it is the first value, it determines that the first added information carries identification information and key information; if the Flag is a second value (for example, 1), the data packet is discarded.

[0161] S802: Decrypt the key information according to the second key, determine the first key according to the decrypted key information, and calculate integrity check information.

[0162] Specifically, if Flag is the first value, then the added information carries identification information and key information. The server decrypts the key information using the second key and generates the corresponding first key based on the decrypted key information. The key derivation method is not described here in detail.

[0163] Then, corresponding integrity check information (eg, a check code) is determined based on the first key and the key transmission data.

[0164] S803: Determine whether the value corresponding to the integrity information and the value corresponding to the integrity check information are equal.

[0165] Specifically, if the integrity information and the integrity check information both carry corresponding integrity values, and if their values ​​are equal (for example, if both are 10, they are equal), it is determined that the key transmission data has integrity, that is, the key transmission data has not been damaged or tampered with during the transmission process, and subsequent steps can be executed; if the integrity information and the integrity check information are not equal, it is determined that the second encrypted data does not have integrity, for example, it has been destroyed or modified, and the data packet is discarded.

[0166] S804: Determine the CID and the association relationship.

[0167] Specifically, the CID is the identification information carried by the first added information received by the server. The server then establishes an association between the identification information, the terminal and the corresponding first key, so that the corresponding first key or identification information can be found based on the association later.

[0168] It can be understood that after the edge agent sends key transmission data to the server, the server receives the key transmission data and can form a first key based on the key information in the key transmission data. The server can store the first key corresponding to the terminal. Therefore, when the edge agent forwards the data sent by the terminal to the server, it does not need to decrypt and encrypt the data and can directly forward the data to the server. Please refer to Figure 9, which shows another data transmission method provided by an embodiment of the present application. After the edge agent sends key transmission data to the server, as shown in Figure 9, the method includes S901-S905.

[0169] S901. The terminal sends terminal encrypted data to the edge proxy.

[0170] The terminal encrypted data is encrypted by the terminal using a first key.

[0171] It can be understood that the terminal encrypted data may be the first data packet or a non-first data packet sent by the terminal to the edge proxy after the terminal and the edge proxy establish a secure connection.

[0172] S902. The edge proxy receives terminal encrypted data sent by the terminal and determines second added information corresponding to the terminal.

[0173] The second added information carries identification information but does not carry key information.

[0174] In some embodiments, the edge agent sends key transmission data to the server, and the edge agent stores identification information corresponding to the terminal, that is, the edge agent can find the corresponding identification information according to the terminal.

[0175] Furthermore, the edge proxy may establish an association between the terminal and the identification information, and may determine the corresponding identification information based on the association and the terminal. It is understood that in other embodiments, the identification information includes information corresponding to the terminal, and the terminal searches all identification information stored by the edge proxy to determine the identification information corresponding to the terminal.

[0176] In some embodiments, the identification information includes an identification portion and a distinguishing portion, wherein the identification portion is a device identifier of the corresponding edge agent, such as the Internet Protocol (IP) address of the edge agent. Of course, the identification portion can also be other identifiers, such as a Media Access Control (MAC) address. The distinguishing portion can be a random value. For example, the edge agent generates five random values ​​and uses the five random values ​​as the distinguishing portions of the five identification information. Of course, the distinguishing portion can also be other types of values ​​as long as they can be used to distinguish multiple terminals.

[0177] In some embodiments, the second additional information further includes flag information for identifying whether the second additional information includes key information. For example, if the flag information is 0, the second additional information carries the flag information but does not carry the key information. That is, if the flag information is a second value, the second value indicates that the second additional information does not carry the key information.

[0178] In some embodiments, the second added information also carries integrity information, which is also called an integrity check code and is used to verify the integrity of the second added information to provide integrity protection for the second added information. Specifically, the second added information is protected from damage, modification, loss, or unauthorized alteration during transmission by the edge proxy. The edge proxy determines the integrity information using an integrity key and a preset integrity algorithm, where the integrity key is the same as the first key.

[0179] In some embodiments, the second additional information further carries length information, which is used to indicate the length of the second additional information, wherein the length can be a fixed length agreed upon or a length determined according to actual needs.

[0180] S903: Generate data transmission data according to the terminal encryption data and the second added information.

[0181] In some embodiments, the second additional information is placed at the end of the data packet of the data transmission data, facilitating parsing by subsequent devices (e.g., a server), thereby reducing the probability of packet loss due to data not being parsed. It is understood that the second additional information may also be placed elsewhere in the data transmission data, such as in the middle of the data transmission data or at another designated location.

[0182] It can be understood that after the terminal and the edge agent establish a secure connection, the terminal encrypted data sent by the terminal to the edge agent can be the first data packet or a non-first data packet. Since the edge agent has sent the key information corresponding to the terminal to the server at this time, the edge agent forwards the first data packet and the non-first data packet in the same way, that is, adding the corresponding second added information to form data transmission data.

[0183] S904: The edge proxy sends data transmission data to the server.

[0184] S905: The server receives the data transmission data sent by the edge proxy, determines the first key corresponding to the terminal according to the identification information, and decrypts the terminal encrypted data according to the first key.

[0185] The data transmission data carries the second added information and the first encrypted data, the second added information carries the identification information but does not carry the key information, and the terminal encrypted data is encrypted by the terminal using the first key.

[0186] In some embodiments, after receiving the key transmission data carrying the first additional information, the server establishes an association between the first key and the identification information, and determines the corresponding first key based on the association and the identification information. Of course, in other embodiments, the server stores the identification information corresponding to the terminal and the first key corresponding to the terminal, and determines the corresponding terminal based on the identification information, thereby determining the first key corresponding to the terminal.

[0187] In this way, after the edge agent sends the key information corresponding to the terminal to the server via key transmission data, the edge agent and the server store the identification information corresponding to the terminal and can use the identification information to identify the terminal and the first key corresponding to the terminal. Therefore, when the edge agent subsequently receives data sent by the terminal to the server, the edge agent does not need to add key information during the forwarding process. By adding identification information to the data transmission data, the server determines the first key corresponding to the terminal based on the identification information in the second added information and can decrypt the terminal encrypted data based on the first key, reducing the size of the data transmission. The edge agent does not need to encrypt or decrypt the data during data forwarding, reducing the consumption of computing resources of the edge agent and improving the throughput of the edge agent. In addition, the key information only needs to be transmitted once in the key transmission data, avoiding the security risks of multiple transmissions of key information and keys.

[0188] Please refer to Figure 10, which is a schematic diagram of a message encapsulation format of data transmission provided in an embodiment of the present application. The data transmission data in Figure 10 is similar to the key transmission data in Figure 4. The data transmission data in Figure 10 includes terminal encrypted data and second added information. The terminal encrypted data includes the source IP, destination IP, source port, destination port, and payload, which is the same as the terminal encrypted data in the key transmission data, except that:

[0189] The second added information in FIG10 does not carry key information (ie, application secret ciphertext and cipher suite), and the Flag (flag information) in FIG10 is a second value, which is used to indicate that the second added information does not carry key information.

[0190] Please refer to Figure 11, which is a schematic diagram of a process of combining data transmission by an edge agent according to an embodiment of the present application. As shown in Figure 11, the process of combining data transmission includes: S1101-S1104.

[0191] S1101. Set the value of Flag.

[0192] Specifically, the edge agent receives the terminal encrypted data sent by the terminal, and determines that the terminal encrypted data is not the first data packet sent by the terminal received by the edge agent after the terminal and the edge agent establish a secure connection, then determines that the Flag is a second value. Exemplarily, the second value is 1, indicating that the second added information does not need to carry key information.

[0193] S1102: Determine CID and Length.

[0194] Specifically, CID is identification information. The edge agent can establish an association between the identification information and the corresponding terminal, and search for the corresponding identification information based on the terminal and the association. Length is the length of the second added information, which can be a fixed value or a value set according to the actual scenario.

[0195] S1103. Calculate integrity information.

[0196] Specifically, the edge proxy determines the encryption key generated by establishing a TLS connection between the edge proxy and the terminal: a first key; and calculates the integrity information corresponding to the second added information and the terminal encrypted data based on the second key and a preset integrity protection algorithm.

[0197] S1104, assemble the package.

[0198] Specifically, the above Flag, CID, Length and integrity information are formed into second added information, and the second added information is used as the tail of the first terminal encrypted data to be combined into a new data packet, that is, data transmission data.

[0199] It can be understood that after the terminal establishes a secure connection with the edge proxy, the terminal sends data to the server through the edge proxy, and the server can also send data to the server through the edge proxy. The data can be response data corresponding to the data sent by the terminal, or data actively sent by the server to the edge proxy. After the terminal establishes a secure connection with the edge proxy, the edge proxy sends the key information corresponding to the terminal to the server. The server determines the first key corresponding to the terminal based on the key information. When the server sends data to the terminal, it can encrypt the data based on the first key. Then, when the edge proxy forwards the data to the terminal, it does not need to decrypt the data and can directly forward it to the terminal. Please refer to Figure 12. Figure 12 is another data transmission method provided in an embodiment of the present application. As shown in Figure 12, after the edge proxy sends the key transmission data to the server, the data transmission method also includes S1201-S1204.

[0200] S1201: The server determines third additional information corresponding to the terminal, and forms the first encrypted data according to the data to be transmitted and the third additional information.

[0201] The third added information carries flag information but does not carry key information; the data to be transmitted is encrypted by the server using the first key corresponding to the terminal.

[0202] The data to be transmitted is the data sent by the server to the terminal through the edge proxy.

[0203] In some embodiments, the third additional information further includes flag information for identifying whether the third additional information includes key information. For example, if the flag information is 0, the third additional information carries the flag information but does not carry the key information. That is, if the flag information is a second value, the second value indicates that the third additional information does not carry the key information.

[0204] In some embodiments, the third added information also carries integrity information, also known as an integrity check code, which is used to verify the integrity of the second added information, thereby providing integrity protection for the third added information. Specifically, the third added information is protected from corruption, modification, loss, and unauthorized alteration during transmission by the edge proxy. The edge proxy determines the integrity information using an integrity key and a pre-defined integrity algorithm, where the integrity key is the same as the first key.

[0205] In some embodiments, the third additional information further carries length information, which is used to indicate the length of the third additional information, wherein the length can be a fixed length agreed upon or a length determined according to actual needs.

[0206] S1202: The server sends first encrypted data to the edge proxy.

[0207] S1203: The edge proxy receives the first encrypted data sent by the server, determines the corresponding terminal according to the identification information, and removes the third added information from the first encrypted data to obtain second encrypted data.

[0208] The first encrypted data carries the third added information, the third added information carries identification information but does not carry key information; the second encrypted data is encrypted by the server using the first key corresponding to the terminal.

[0209] S1204: The server sends second encrypted data to the terminal.

[0210] In this way, after the server receives the key transmission data sent by the terminal, it can also send data to the terminal through the server. The server uses the stored terminal first key to encrypt the data. The edge agent does not need to decrypt and encrypt the data. After removing the third added information in the data, it forwards it to the terminal. Since the edge agent does not need to decrypt and encrypt the data, the consumption of computing resources of the edge agent is reduced and the throughput of the edge agent is improved.

[0211] Please refer to Figure 13, which is a schematic diagram of a process of processing first encrypted data by an edge proxy according to an embodiment of the present application. As shown in Figure 13, the process of processing the first encrypted data includes S1301-S1304.

[0212] S1301. Determine whether Flag is a second value.

[0213] Specifically, the Flag (i.e., flag information) in the third encrypted data sent by the server is a fixed value, i.e., the second value (e.g., 1). If the Flag is not the second value, it is determined that the third encrypted data is damaged or lost, and the third data packet is discarded; if the Flag is the second value, the subsequent steps are executed.

[0214] S1302: Determine the corresponding terminal and first key based on the identification information, and calculate integrity check information based on the first key.

[0215] Specifically, the first encrypted data carries the third added information and the second encrypted data, and the third added information carries identification information. The edge agent determines the corresponding terminal based on the identification information, and then determines the first key corresponding to the terminal; then determines the calculated integrity verification information based on the first key, the second encrypted data and the preset integrity algorithm.

[0216] S1303: Determine whether the value corresponding to the integrity information and the value corresponding to the integrity check information are equal.

[0217] Specifically, if the value corresponding to the integrity information and the value corresponding to the integrity verification information are equal, it is determined that the second encrypted data has integrity and subsequent steps can be executed; if the value corresponding to the integrity information and the value corresponding to the integrity verification information are not equal, it is determined that the second encrypted data does not have integrity, for example, it is destroyed or modified, and the edge agent discards the data packet.

[0218] S1304: Remove the third added information from the first encrypted data to obtain second encrypted data.

[0219] Specifically, after determining that the first encrypted data has integrity and the Flag is the second value, the third added information in the first encrypted data is removed to obtain the second encrypted data, so that the edge agent can send the second encrypted data to the corresponding terminal.

[0220] It is understood that after a secure connection is established between the edge agent and the terminal, in order to ensure the security of data transmission, the encryption key between the edge agent and the terminal needs to be periodically updated. When the key is updated between the edge agent and the terminal, that is, after the first key is updated, the edge agent instructs the server to update the key corresponding to the terminal through a key update message to ensure the security of the key corresponding to the server-side terminal. Please refer to Figure 14, which is a flow diagram of another data transmission method provided in an embodiment of the present application. As shown in Figure 14, after the first key between the terminal and the edge agent is updated, the method also includes: S1401-S1403.

[0221] S1401: The edge agent forms a key update message based on identification information.

[0222] The key update message carries a key update instruction message and second addition information, the second addition information carries identification information, and the key update instruction message is used to instruct the server to update the first key;

[0223] The key update indication message is an indication message (Key Update (KU)) used for key update in the TLS standard, which will not be described in detail here.

[0224] The key update message can be initiated by the terminal or the edge agent. If it is initiated by the terminal, the edge agent encrypts the key update indication message and forwards it to the server; if it is initiated by the edge agent, the edge agent sends the key update indication message to the terminal and then forwards it to the server.

[0225] S1402: The edge agent sends a key update message to the server.

[0226] S1403: The server receives the key update message, determines the corresponding terminal according to the identification information, and updates the first key corresponding to the terminal according to the key update instruction message.

[0227] The key update message carries a key update instruction message and second addition information, the second addition information carries identification information, and the key update instruction message is used to instruct the server to update the first key.

[0228] In this way, when the key between the terminal and the edge agent is updated, the edge agent forms a key update message and then sends the key update message to the server. The server updates the first key according to the key update indication message in the key update message, and synchronizes the first key with the server, terminal, and edge agent to ensure the security of the first key.

[0229] In some embodiments, the key update indication message is encrypted by the edge agent using the first key. After the server receives the key update message, it determines the first key corresponding to the terminal based on the identification information, encrypts the key update message based on the first key, and updates the first key based on the decrypted key update indication message. By encrypting the key update indication message, the security of message transmission is ensured.

[0230] The data transmission method provided by this application is as follows: after a terminal and an edge agent establish a secure connection, the edge agent sends the key information corresponding to the terminal to the server. The server determines the first key corresponding to the terminal based on the key information. When the edge agent forwards the data sent by the terminal to the server, it does not need to decrypt or encrypt the data, thereby reducing the consumption of computing resources of the edge agent and improving the throughput of the edge agent. The encryption of the data forwarded by the edge agent is completed by the terminal, and the decryption is completed by the server. The edge agent does not need to decrypt or encrypt the forwarded data, which reduces the number of times the encryption key on the edge agent side is used and improves the security of the encryption key.

[0231] It should be understood that the above is only intended to help those skilled in the art better understand the embodiments of the present application, and is not intended to limit the scope of the embodiments of the present application. Based on the above examples given, those skilled in the art can obviously make various equivalent modifications or changes. For example, certain steps in each of the above methods may not be necessary, or certain new steps may be added. Or a combination of any two or any multiple of the above embodiments. Such modifications, changes, or combined solutions also fall within the scope of the embodiments of the present application.

[0232] It should also be understood that the division of the modes, situations, categories and embodiments in the embodiments of the present application is only for the convenience of description and should not constitute a special limitation. The features of various modes, categories, situations and embodiments can be combined without contradiction.

[0233] It should also be understood that the various numerical numbers involved in the embodiments of this application are only for the convenience of description and are not intended to limit the scope of the embodiments of this application. The order of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0234] It should also be understood that the above description of the embodiments of the present application focuses on emphasizing the differences between the various embodiments. The same or similar points that are not mentioned can be referenced with each other. For the sake of brevity, they will not be repeated here.

[0235] The above description of the method and system embodiments provided by the present application in combination with Figures 3 to 14 is as follows. The communication device provided by the present application embodiments is described below.

[0236] This embodiment can divide the functional modules of each device (including the above-mentioned first terminal device (such as a mobile phone), the second terminal device (such as a home storage device), the protocol configuration gateway, and the TURN server) according to the above method. For example, it can be divided into various functional modules corresponding to each function, or two or more functions can be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0237] It should be noted that the relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0238] The communication device provided in the embodiment of the present application (including the above-mentioned terminal device, protocol configuration gateway, and TURN server) is used to execute the data transmission method provided in the above-mentioned method embodiment, so that the same effect as the above-mentioned implementation method can be achieved. In the case of adopting an integrated unit, the terminal device, protocol configuration gateway or TURN server may include a processing module, a storage module and a communication module. Among them, the processing module can be used to control and manage the actions of the terminal device, protocol configuration gateway or TURN server. For example, it can be used to support the terminal device, protocol configuration gateway or TURN server to execute the steps performed by the processing unit. The storage module can be used to support the storage of program code and data, etc. The communication module can be used to support the communication between the terminal device, protocol configuration gateway or TURN server and other devices.

[0239] The processing module may be a processor or a controller. It may be a device that implements or executes the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processing (DSP) and a microprocessor, and so on. The storage module may be a memory. The communication module may specifically be a device that interacts with other terminal devices, such as a radio frequency circuit, a Bluetooth chip, or a Wi-Fi chip.

[0240] Refer to Figure 15, which shows a schematic structural diagram of an exemplary edge agent of the present application. The edge agent shown in Figure 15 can execute the steps in the data transmission method executed by any edge agent provided in the embodiments of the present application.

[0241] The edge agent 1500 includes at least one processor 1501 , a memory 1503 , and at least one network interface 1504 .

[0242] The processor 1501 is, for example, a general-purpose CPU, a digital signal processor (DSP), a network processor (NP), a GPU, a neural network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASICs) for implementing the solution of the present application, a programmable logic device (PLD) or other programmable logic devices, a transistor logic device, a hardware component, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0243] Optionally, edge agent 1500 also includes a bus 1502. Bus 1502 is used to transmit information between the various components of edge agent 1500. Bus 1502 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Bus 1502 may be classified as an address bus, a data bus, a control bus, etc. For ease of illustration, FIG15 shows only one thick line, but this does not indicate that there is only one bus or only one type of bus.

[0244] The memory 1503 is, for example, a read-only memory (ROM) or other type of storage device that can store static information and instructions, or a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CDROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1503 is, for example, independent and connected to the processor 1501 via the bus 1502. The memory 1503 can also be integrated with the processor 1501.

[0245] The network interface 1504 uses any transceiver-like device for communicating with other devices or communication networks, and the communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The network interface 1504 can include a wired network interface and a wireless network interface. Specifically, the network interface 1504 can be an Ethernet interface, such as a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a WLAN interface, a cellular network interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of the present application, the network interface 1504 can be used for the edge agent 1500 to communicate with other devices.

[0246] In a specific implementation, as some embodiments, the processor 1501 may include one or more CPUs. Each of these processors may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0247] In a specific implementation, as some embodiments, the edge agent 1500 may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0248] In some embodiments, memory 1503 is used to store program instructions for executing the solution of the present application, and processor 1501 can execute the program instructions stored in memory 1503. That is, edge agent 1500 can implement the method provided by the method embodiment shown in the above embodiment through processor 1501 and the program instructions in memory 1503. The program instructions may include one or more software modules. Optionally, processor 1501 itself may also store program instructions for executing the solution of the present application.

[0249] During the specific implementation process, the processor 1501 in the edge agent 1500 of the present application reads the instructions in the memory 1503, so that the edge agent 1500 shown in Figure 15 can execute all or part of the steps in the data transmission method performed by the edge agent in Figures 3, 4, 5, 6, and 7.

[0250] The steps of the method described in the above embodiments are performed by hardware integrated logic circuits or software instructions in the processor of edge agent 1500. The steps of the method embodiments disclosed in this application can be directly implemented as being executed by a hardware processor, or by a combination of hardware and software modules in the processor. The software modules can be located in a storage medium well-established in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in a memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method embodiments. To avoid repetition, they are not described in detail here.

[0251] Refer to Figure 16, which shows a structural diagram of an exemplary server of the present application. The server shown in Figure 16 can execute the steps in the data transmission method executed by the server in Figures 3, 4, 5, 6, and 7.

[0252] The server 1600 includes at least one processor 1601 , a memory 1603 , and at least one network interface 1604 .

[0253] The processor 1601 is, for example, a general-purpose CPU, a digital signal processor (DSP), a network processor (NP), a GPU, a neural network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASICs) for implementing the solution of the present application, a programmable logic device (PLD) or other programmable logic devices, a transistor logic device, a hardware component, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0254] Optionally, server 1600 further includes a bus 1602. Bus 1602 is used to transmit information between the various components of server 1600. Bus 1602 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Bus 1602 may be classified as an address bus, a data bus, a control bus, etc. For ease of illustration, FIG16 shows only one thick line, but this does not imply that there is only one bus or only one type of bus.

[0255] The memory 1603 is, for example, a read-only memory (ROM) or other type of storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CDROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1603 is, for example, independent and connected to the processor 1601 via the bus 1602. The memory 1603 can also be integrated with the processor 1601.

[0256] The network interface 1604 uses any transceiver-like device to communicate with other devices or communication networks. The communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The network interface 1604 can include a wired network interface or a wireless network interface. Specifically, the network interface 1604 can be an Ethernet interface, such as a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a WLAN interface, a cellular network interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of the present application, the network interface 1604 can be used for the server 1600 to communicate with other devices.

[0257] In a specific implementation, as some embodiments, the processor 1601 may include one or more CPUs. Each of these processors may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0258] In a specific implementation, as some embodiments, the server 1600 may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0259] In some embodiments, the memory 1603 is used to store program instructions for executing the solution of the present application, and the processor 1601 can execute the program instructions stored in the memory 1603. That is, the server 1600 can implement the method provided by the method embodiment shown in the above embodiment through the processor 1601 and the program instructions in the memory 1603. The program instructions may include one or more software modules. Optionally, the processor 1601 itself may also store program instructions for executing the solution of the present application.

[0260] Among them, each step of the method described in the above embodiment is completed by the hardware integrated logic circuit or software instructions in the processor of server 1600. The steps of the method embodiment disclosed in this application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a storage medium mature in the art such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method embodiment in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0261] It should be understood that the processor described above may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor. It is worth noting that the processor may be a processor that supports the Advanced RISC Machine (ARM) architecture.

[0262] Furthermore, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store device type information.

[0263] The memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache memory. By way of example and not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0264] An embodiment of the present application also provides a data transmission system, including a server and an edge agent, wherein the server can execute the steps of the data transmission method executed by any server provided in the embodiment of the present application, and the edge agent can execute the steps of the data transmission method executed by any edge agent provided in the embodiment of the present application.

[0265] In an exemplary embodiment, an embodiment of the present application provides a computer program (product), which includes: computer program code, which, when run by a computer, enables the computer to execute the steps in the data transmission method executed by any server provided in the embodiment of the present application.

[0266] In an exemplary embodiment, an embodiment of the present application provides a computer program (product), which includes: computer program code, which, when run by a computer, enables the computer to execute the steps in the data transmission method performed by any edge agent provided in the embodiment of the present application.

[0267] In an exemplary embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a program or instruction. When the program or instruction runs on a computer, the data transmission method executed by any server provided in the embodiment of the present application is executed.

[0268] In an exemplary embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a program or instruction. When the program or instruction runs on a computer, the data transmission method performed by any edge agent provided in the embodiment of the present application is executed.

[0269] In an exemplary embodiment, an embodiment of the present application provides a chip, including a processor, for calling and executing instructions stored in the memory from a memory, so that a communication device equipped with the chip executes a data transmission method performed by any edge agent provided in an embodiment of the present application.

[0270] In an exemplary embodiment, an embodiment of the present application provides a chip, including a processor, for calling and executing instructions stored in the memory from a memory, so that a communication device equipped with the chip executes a data transmission method executed by any server provided in an embodiment of the present application.

[0271] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described herein are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0272] In this application, the terms "first," "second," and the like are used to distinguish between identical or similar items having substantially the same function or effect. It should be understood that "first," "second," and "nth" do not have a logical or temporal dependency, nor do they limit quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," and the like to describe various elements, these elements should not be limited by these terms. These terms are simply used to distinguish one element from another.

[0273] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0274] In this application, the term "at least one" means one or more, and the term "plurality" means two or more. For example, "plurality of second devices" means two or more second devices. The terms "system" and "network" are often used interchangeably herein.

[0275] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0276] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the listed items. The term "and / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0277] It should also be understood that the terms “if” and “if” may be interpreted to mean “when” or “upon” or “in response to determining” or “in response to detecting.” Similarly, the phrases “if it is determined that ” or “if [stated condition or event] is detected” may be interpreted to mean “upon determining ” or “in response to determining ” or “upon detecting [stated condition or event]” or “in response to detecting [stated condition or event],” depending on the context.

[0278] The above description is merely an embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

[0279] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A data transmission method, characterized in that: Applied to an edge proxy, the edge proxy is a server with a reverse proxy function, the method comprises: After the edge proxy establishes a secure connection with the terminal, determine first added information corresponding to the terminal, the first added information carries key information, the key information is used to generate a first key, and the first key is a key determined when the terminal establishes a secure connection with the edge proxy; forming key transmission data according to the first added information; The key transmission data is sent to the server.

2. The method according to claim 1, characterized in that The first added information further carries identification information, and the identification information is used to identify the corresponding terminal. After sending the key transmission data to the server, the data transmission method further includes: receiving terminal encrypted data sent by the terminal, the terminal encrypted data being encrypted by the terminal using the first key; Determine second added information corresponding to the terminal, where the second added information carries identification information but does not carry the key information; forming data transmission data according to the encrypted data and the second added information; The data transmission data is sent to the server.

3. The method according to claim 1 or 2, characterized in that: The forming of key transmission data according to the first added information comprises: receiving terminal encrypted data sent by the terminal, the terminal encrypted data being encrypted by the terminal using the first key; The key transmission data is formed according to the terminal encryption data and the first added information.

4. The method according to claim 3, characterized in that The terminal encrypted data in the key transmission data is the first data packet sent by the terminal and received by the edge proxy after the terminal establishes a secure connection with the edge proxy.

5. The method according to claim 2, characterized in that: The method further comprises: receiving first encrypted data sent by the server, wherein the first encrypted data carries third added information, and the third added information carries identification information but does not carry the key information; Determining a corresponding terminal according to the identification information; Removing the third added information from the first encrypted data to obtain second encrypted data, wherein the second encrypted data is encrypted using a first key corresponding to the terminal; The second encrypted data is sent to the terminal.

6. The method according to claim 2 or 5, characterized in that: After the first key between the terminal and the edge proxy is updated, the data transmission method further includes: The key update message is formed according to the identification information, the key update message carries a key update indication message and second added information, the second added information carries identification information, and the key update indication message is used to instruct the server to update the first key.

7. The method according to any one of claims 1 to 6, characterized in that The key information is encrypted by the edge proxy using a second key, where the second key is a key determined when the edge proxy establishes a secure connection with the server.

8. The method according to any one of claims 1 to 7, characterized in that The first added information serves as the tail of the data packet of the key transmission data.

9. The method according to any one of claims 1 to 8, characterized in that The first added information further carries flag information, where the flag information is a first value, and the first value is used to indicate that the first added information carries the key information.

10. The method according to claim 2 or 5, characterized in that: The identification information includes an edge proxy identification and a terminal identification, wherein the edge proxy identification is used to identify the corresponding edge proxy, and the terminal identification is used to identify the corresponding terminal.

11. A data transmission method, characterized in that: Applied to a server, the data transmission method includes: Receiving key transmission data sent by an edge proxy, the edge proxy being a server with a reverse proxy function, the key transmission data carrying first added information, the first added information carrying key information, the key information being used to generate a first key, the first key being a key determined when a terminal establishes a secure connection with the edge proxy; The first key is determined according to the key information.

12. The method according to claim 11, characterized in that The first added information also carries identification information, and the identification information is used to identify the corresponding terminal. After receiving the key transmission data sent by the edge agent, the data transmission method further includes: receiving data transmission sent by the edge proxy, the data transmission data carrying second added information and terminal encrypted data, the second added information carrying the identification information but not carrying the key information, the terminal encrypted data being encrypted by the terminal using the first key; Determining a first key corresponding to the terminal according to the identification information; The terminal encrypted data is decrypted according to the first key.

13. The method according to claim 11 or 12, characterized in that: The key transmission data also carries terminal encryption data, and the terminal encryption data is encrypted by the terminal using the first key.

14. The method according to claim 12, characterized in that After the server receives the key transmission data, the method further includes: Determine third added information corresponding to the terminal, where the third added information carries the identification information but does not carry the key information; forming first encrypted data according to the third added information; First encrypted data is sent to the edge proxy.

15. The method according to any one of claims 11 to 14, characterized in that The data transmission method further comprises: receiving a key update message, the key update message carrying a key update indication message and second addition information, the second addition information carrying identification information, the key update indication message being used to instruct the server to update the first key; Determining a corresponding terminal according to the identification information; The first key corresponding to the terminal is updated according to the key update indication message.

16. The method according to any one of claims 11 to 15, characterized in that The key information is encrypted by the edge proxy using a second key, where the second key is a key determined when the edge proxy establishes a secure connection with the server; Determining the first key according to the key information includes: Decrypting the key information using the second key to obtain decrypted key information; The first key is determined according to the decrypted key information.

17. The method according to any one of claims 11 to 16, characterized in that The first added information serves as the tail of the data packet of the key transmission data.

18. The method according to any one of claims 11 to 17, characterized in that The first added information further carries flag information, where the flag information is a first value, and the data transmission method further includes: Determine, according to the first value, that the first added information carries the key information.

19. The method according to any one of claims 11 to 18, characterized in that The first added information also carries integrity information, and the data transmission method further includes: The integrity of the key transmission data is verified according to the first key and the integrity information.

20. An edge proxy, characterized in that: include: a memory including computer-readable instructions; A processor in communication with the memory, the processor being configured to execute the computer-readable instructions so that the edge agent executes the data transmission method according to any one of claims 1 to 10.

21. A server, characterized in that: include: a memory including computer-readable instructions; A processor in communication with the memory, the processor being configured to execute the computer-readable instructions so that the server executes the data transmission method according to any one of claims 11 to 19.

22. A data transmission system, characterized in that: The method comprises a server and an edge agent, wherein the edge agent is used to execute the data transmission method according to any one of claims 1 to 10, and the server is used to execute the data transmission method according to any one of claims 11 to 19.

23. A computer-readable storage medium, characterized in that: The method comprises a program or an instruction, which, when executed by a processor, implements the data transmission method according to any one of claims 1 to 19.

24. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the data transmission method according to any one of claims 1 to 19.

Images