WO2017143685A1

WO2017143685A1 - Key updating method, device, and system

Info

Publication number: WO2017143685A1
Application number: PCT/CN2016/083676
Authority: WO
Inventors: 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-02-23
Filing date: 2016-05-27
Publication date: 2017-08-31
Also published as: CN107104932A

Abstract

A key updating method comprises: a server receives user identification information of an Internet of Things (IOT) device, and determines whether the user identification information is received during a valid duration, wherein the valid duration is a duration set by the server each time after the IOT device completes an access authentication process; and if so, the server transmits to the IOT device designated information of a session key.

Description

Key update method, device and system

Technical field

The present application relates to, but is not limited to, the field of communications, and in particular, to a key update method, apparatus, and system.

Background technique

In the Enhanced Data Rate for GSM Evolution (EGPRS) technology, authentication and key agreement are in an authentication and key agreement protocol (Authentication). And Key Agreement (referred to as AKA) is completed in the process. For the Internet of Things (IoT) device, it does not need to continuously send data, so it does not need to be online at all times, and only needs to access the network when sending data. Every time you access the network, you need to authenticate and key the IoT device to ensure the security of the communication. Authentication and key agreement are done in an AKA process.

However, in the Cellular Internet of Things (CIoT) system, the number of IoT devices is huge, and IoT devices may continuously and intermittently send data. The system needs to authenticate and key the IoT device every time the access network sends data. This makes the CIoT system require a lot of system resources to process the AKA process of the IoT device.

In the related art, the IoT device needs to perform the problem of wasting network resources caused by authentication every time the data is transmitted to the network, and an effective solution has not been proposed.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The present invention provides a method, a device and a system for updating a key to at least solve the problem of waste of network resources caused by the authentication of the Internet of Things IoT device in the related art.

An embodiment of the present invention provides a key update method, including: receiving, by a server, user identity information of an Internet of Things IOT device, and determining whether a time point of receiving the user identity information is within a valid duration, where the effective duration The duration set by the server after the access authentication is completed each time the IOT device completes; if the determination result is yes, the server sends the specified information for generating the session key of the IOT device to The IOT device.

Optionally, the method further includes: when the determining result is negative, the server terminates the timing operation of the valid duration, and triggers an operation of performing access authentication on the IOT device, and triggering the A re-timed operation that describes the effective duration.

Optionally, the effective duration is determined by: setting, by the server, the time point of the IOT device access authentication as a starting time of the effective duration, and setting and configuring all the IOT devices in the cellular Internet of Things CIoT system. The duration of the effective duration is the same; or the time when the server completes the access authentication by using the IOT devices in the cellular IoT CIoT system as the starting point of the effective duration, respectively, setting the effective duration of each of the IOT devices.

Optionally, the specifying information includes: a random number used to generate the IOT device session key.

Optionally, the server receiving the user identity information of the Internet of Things IOT device includes: the server receiving user identity information forwarded by the Internet of Things IOT device by the network side node; the server is configured to generate the session secret of the IOT device Sending the designation information of the key to the IOT device includes: the server transmitting, by the network side node, specified information for generating a session key of the IOT device to the IOT device.

Optionally, before the sending, by the server, the specified information for generating the session key of the IOT device to the IOT device, the method further includes: receiving, by the server, the user private secret sent by the IOT device a key; the server generates a session key using the random number and the user private key, and transmits the session key to a network side node.

Optionally, the server includes any one of the following: a home location register HLR, and a home subscription subscriber server HSS.

The embodiment of the present invention further provides a key update method, including: the Internet of Things IOT device sends the user identity information to the server; the IOT device determines whether the specified information for generating the session key sent by the server is received, The specified information is sent to the time when it is determined that the time when the server receives the user identity information is within a preset effective time period. The information of the IOT device, the effective duration is the duration set by the server after each time the IOT device completes the access authentication; if the determination result is yes, the IOT device generates the location according to the specified information. The session key.

Optionally, the method further includes: when the determining result is no, the IOT device re-initiates an access authentication operation.

Optionally, the generating, by the IOT device, the session key according to the specified information comprises: the IOT device receiving the random number forwarded by the server by a network side node; the IOT device using a user private key and The random number generates the session key.

Optionally, the generating, by the IOT device, the session key according to the specified information comprises: the IOT device receiving a random number forwarded by the server by a network side node, and a randomization after performing encryption processing by the network side node The IOT device generates a session key using the user secret key and the random number, and decrypts the encrypted random number according to the session key to obtain a decrypted random number; the IOT device Determining whether the decrypted random number and the random number forwarded by the server by the network side node are the same; if the determination result is yes, the IOT device sends the data to be sent to the network side node; If the result is no, the IOT device sends a request message to the server, wherein the request message is used to request the server to resend the random number.

The embodiment of the invention further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.

The embodiment of the present invention further provides a key updating apparatus, which is applied to a server, and includes: a first processing module, configured to: receive user identity information of an Internet of Things IOT device, and determine a time point of receiving the user identity information. Whether the effective duration is the duration set by the server after each time the IOT device completes the access authentication; the first sending module is configured to: if the determination result is yes, The specified information for generating the session key of the IOT device is sent to the IOT device.

Optionally, the device further includes: a second processing module, configured to: if the determination result is negative, terminate the timing operation of the valid duration, and trigger an access authentication for the IOT device Operation, and a retiming operation that triggers the effective duration.

Optionally, the first processing module is further configured to: determine an effective duration by using a time point at which the IOT device accesses the authentication as a starting time of the valid duration, and is all under the cellular Internet of Things CIoT system. The IOT device is set to have the same duration as the effective duration; or, the time point at which all the IOT devices under the cellular IoT CIoT system respectively complete the access authentication is used as the starting point of the effective duration, and the respective IOT devices are respectively set to be effective. duration.

Optionally, the first processing module includes a first processing unit, where the first processing unit is configured to: receive user identity information of the Internet of Things IOT device, where the server receives the IoT IOT device forwarded by the network side node. User identity information; the first sending module includes a first sending unit, and the sending unit is configured to: send, by the network side node, specified information for generating a session key of the IOT device to the IOT device .

Optionally, the device further includes: a receiving module, configured to: before the server sends the designation information for generating the session key of the IOT device to the IOT device, receive the sending by the IOT device a user privacy key; the third processing module is configured to: use the random number and the user privacy before the server sends the designation information for generating the session key of the IOT device to the IOT device The key generates a session key and sends the session key to the network side node.

The embodiment of the present invention further provides a key updating apparatus, which is applied to an IoT IOT device, and includes: a second sending module, configured to: send user identity information to a server; and the determining module is configured to: determine whether the The specified information sent by the server for generating a session key, wherein the specified information is sent to the IOT device when it is determined that the time point when the server receives the user identity information is within a preset effective time period And the effective duration is the duration set by the server after each time the IOT device completes the access authentication; the obtaining module is configured to: when the determination result is yes, generate the location according to the specified information The session key.

Optionally, the device further includes: a fourth processing module, configured to re-initiate the access authentication operation if the determination result is negative.

Optionally, the specifying information includes: setting: generating the IOT device session key Number of machines.

Optionally, the acquiring module includes: a first receiving unit, configured to: receive the random number forwarded by the server by a network side node; and the acquiring unit is configured to: generate a user private key and the random number The session key.

Optionally, the acquiring module includes: a second receiving unit, configured to: receive a random number forwarded by the server by the network side node, and a random number that is encrypted by the network side node; and a second processing unit, The method is configured to: generate a session key by using a user secret key and the random number, and decrypt the encrypted random number according to the session key to obtain a decrypted random number; and the determining unit is configured to: determine Whether the decrypted random number and the random number forwarded by the server through the network side node are the same; the second sending unit is configured to: send the data to be sent to the network side node if the determination result is yes And a third sending unit, configured to: when the determination result is no, send a request message to the server, wherein the request message is used to request the server to resend the random number.

The embodiment of the present invention further provides a key update system, including: an Internet of Things IOT device, configured to: send user identity information to a network side node; the network side node is configured to: send the user identity information to a server, and Sending, to the IOT device, the specified information for generating the session key of the IOT device; the server is configured to: after receiving the user identity information, determine whether the time point of receiving the user identity information is Within the valid duration; if so, the specified information is sent to the network side node.

According to the embodiment of the present invention, the server receives the user identity information of the Internet of Things IOT device, and determines whether the time point of receiving the identity information of the user is within a valid duration, where the effective duration is that the IOT device completes access every time. After the authentication, the server sets the duration; if the judgment result is yes, the server sends the specified information for generating the session key of the IOT device to the IOT device. That is, in the embodiment of the present invention, after the IOT device completes the access authentication, the server sets the effective duration of the IOT device access authentication, and if the user identity information sent by the IOT device is received within the valid duration, only You need to generate a session key, and you do not need to perform IOT device access authentication. Through the embodiments of the present invention, the problem of waste of network resources caused by the authentication of the Internet of Things IoT device in each time when the Internet access IoT device transmits data is solved, thereby achieving the effect of saving network resources and further improving. The efficiency of key updates.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a flow chart of a first method of key update according to an embodiment of the present invention;

2 is a flowchart of an IoT device authentication method according to an embodiment of the present invention;

3 is a flowchart of an IoT device re-authentication method according to an embodiment of the present invention;

4 is a flowchart of a second method of key update according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of a first type of key update apparatus according to an embodiment of the present invention; FIG.

6 is a structural block diagram of a second type of key update apparatus according to an embodiment of the present invention;

FIG. 7 is a structural block diagram of a third type of key updating apparatus according to an embodiment of the present invention; FIG.

FIG. 8 is a structural block diagram of a fourth type of key update apparatus according to an embodiment of the present invention; FIG.

9 is a structural block diagram of an IOT device authentication management apparatus according to an embodiment of the present invention;

FIG. 10 is a structural block diagram of an IOT device session key checking apparatus according to an embodiment of the present invention; FIG.

11 is a flowchart of a third method of key update according to an embodiment of the present invention;

FIG. 12 is a flowchart of a fourth key update method according to an embodiment of the present invention; FIG.

FIG. 13 is a structural block diagram of a fifth type of key updating apparatus according to an embodiment of the present invention; FIG.

FIG. 14 is a structural block diagram of a sixth type of key updating apparatus according to an embodiment of the present invention; FIG.

15 is a block diagram showing the structure of a seventh type of key updating apparatus according to an embodiment of the present invention;

16 is a block diagram showing the structure of a key update system according to an embodiment of the present invention.

Preferred embodiment of the invention

Embodiments of the present invention will be described below with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the various manners in the embodiments may be combined with each other without conflict.

It should be noted that the terms "first", "second" and the like are used herein to distinguish similar objects, and are not necessarily used to describe a particular order or order.

In this embodiment, a key update method is provided. FIG. 1 is a flowchart of a first key update method according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:

Step S102: The server receives the user identity information of the IoT IOT device, and determines whether the time point of receiving the user identity information is within a valid duration, where the effective duration is after each time the IOT device completes the access authentication, The length of time the server is set;

Step S104: If the determination result is yes, the server sends the designation information for generating the session key of the IOT device to the IOT device.

Optionally, in this embodiment, the application scenario of the foregoing key update method may include, but is not limited to, a Cellular Internet of Things (CIoT) system, where a large number of objects may be disposed in the system. Internet of Things (IoT) devices. In the application scenario, the server may receive the user identity information of the IoT IOT device, and determine whether the time point of receiving the identity information of the user is within a valid duration, where the effective duration may be completed each time the IOT device is completed. After the access authentication, the length of time set by the server; if the judgment result is yes, the server may send the specified information for generating the session key of the IOT device to the IOT device. That is, in the embodiment of the present invention, after the IOT device completes the access authentication, the server sets the effective duration of the IOT device access authentication, and if the user identity information sent by the IOT device is received within the valid duration, only You need to generate a session key, and you do not need to perform IOT device access authentication. Through the embodiments of the present invention, the problem of waste of network resources caused by the authentication of the Internet of Things IoT device in each time when the Internet access IoT device transmits data is solved, thereby achieving the effect of saving network resources and further improving. The efficiency of key updates.

The present embodiment will be exemplified below with reference to specific examples.

The present embodiment provides a key update method, which is applicable to a cellular Internet of Things (CIOT) communication system including an IoT device, wherein the server uses a Home Location Register/Home Subscriber Server (Home Location Register/Home Subscriber Server, For example, the HLR/HSS is used as an example. The IoT device may include a Subscriber Identity Module (SIM)/Universal Subscriber Identity Module (USIM) card, which may include the following content:

After the IoT device access authentication is completed, the HLR/HSS determines when to re-authenticate the IoT device, as defined by the HLR/HSS for each authentication effective duration. HLR/HSS can define a uniform authentication effective duration for all IoT devices, and can also define a separate authentication effective duration for different IoT devices. After each IoT access authentication is completed, the HLR/HSS can initiate the authentication timing of the IoT device. When the authentication timing exceeds the validity period of the authentication, the HLR/HSS may terminate the authentication timing of the IoT device. All uncertified IoT devices will need to be certified subsequently. For example, HLR/HSS can define the effective duration of an IoT device. The HLR/HSS can set a counter for the IoT device. When the counter reaches the authentication valid period, the HLR/HSS can clear the counter and cancel the counting for the IoT device. Upon subsequent receipt of the user identity information sent by the IoT device, the HLR/HSS will initiate the authentication process.

Alternatively, the HLR/HSS may initiate the authentication process for the IoT device after receiving the identity information sent by the IoT device;

After the IoT device access authentication is completed, the HLR/HSS can perform authentication timing for the IoT device.

When the IoT device needs to send data, the IoT device user identity information may be sent to a network side node, such as a Serving General Packet Radio Service Node (Serving GPRS Support Node, SGSN);

The network side node, such as the SGSN, may forward the information to the HLR/HSS after receiving the identity information sent by the IoT device;

After receiving the user identity information sent by the IoT device, the HLR/HSS can check whether the authentication duration of the IoT device reaches the validity time of the authentication according to the defined validity period. If the authentication is valid or exceeded, the HLR/HSS can initiate an authentication process for the IoT device. If the authentication validity period is not reached, the HLR/HSS can generate a new random number for the IoT device and generate a new session key using the new random number and the IoT device user secret key, and then the new session key. And sending a new random number to the network side node, such as the SGSN;

After receiving the new session key and the new random number, the SGSN can send the new random number to the IoT device;

Optionally, to ensure security, the SGSN may encrypt the new random number with a new session, and then send the new random number together with the encrypted new random number to the IoT device;

After receiving the new random number, the IoT device may generate a session key according to the user secret key saved on the SIM/USIM and the new random number received;

Optionally, after receiving the new random number and the encrypted new random number, the IoT device may generate a session key according to the user secret key saved on the SIM/USIM and the received new random number, and use the session secret. The key decrypts the encrypted new random number and checks whether the decrypted new random number is the same as the received new random number. If different, the IoT device can request retransmission to the network side node, such as the SGSN; if the same, the IoT device can communicate securely with the network side node, such as the SGSN.

In an optional implementation manner, when it is determined that the time point when the user identity information is received is not within the valid duration, the method may include the following steps:

In step S11, the server terminates the timing operation of the valid duration, and triggers an operation of performing access authentication on the IOT device, and a re-timing operation that triggers the effective duration.

In this optional implementation manner, when it is determined that the time point when the user identity information is received is not within the valid duration, the server terminates the timing operation of the valid duration, and triggers an operation of performing access authentication on the IOT device to implement the IOT. The secure communication between the device and the network side node avoids the problem that the communication security caused by the access authentication operation is not reduced even if the time point of the user identity information sent by the IOT device is not within the effective duration.

In this embodiment, an IoT device authentication method is provided, wherein the effective duration can be implemented by a timer counter, and the server is described by taking an HLR/HSS as an example. As shown in Figure 2, the following steps are included:

Step S201, the IoT device accesses the network and completes AKA authentication;

Step S202, the HLR/HSS starts a timing counter for the IoT device;

In step S203, when the counter reaches the authentication valid duration of the IoT device set by the HLR/HSS, the HLR/HSS clears the counter and cancels the counting for the IoT device.

In this embodiment, an IoT device re-authentication method is also provided. The server uses the HLR/HSS as an example. As shown in Figure 3, the following steps are included:

Step S301, when the IoT device needs to send data, send the IoT device user identity information to the network side node SGSN;

Step S302, after receiving the user identity information sent by the IoT device, the network side node SGSN forwards the IoT device user identity information to the HLR/HSS;

Step S303, after receiving the IoT device user identity information, the HLR/HSS checks whether there is a timing counter of the IoT device. If not, the HLR/HSS determines that the IoT device needs to be re-authenticated.

Step S304, an AKA authentication process is performed between the HLR/HSS and the IoT.

Step S305, after the end of the authentication between the HLR/HSS and the IoT, the HLR/HSS starts a new timing counter for the IoT device.

In an alternative embodiment, the effective duration can be determined by the following steps:

In step S21, the time point at which the server accesses the authentication by the IOT device is used as the starting point of the effective duration, and all the IOT devices in the cellular IoT CIoT system are set to have the same duration as the effective duration; or

In step S22, the server uses the time point for completing the access authentication for all the IOT devices in the cellular Internet of Things (CIoT system) as the starting point of the effective duration, and sets the effective duration of each of the IOT devices.

Through the optional implementation manner, the effective duration is preset for all the IOT devices in the cellular Internet of Things CIoT system by using a predetermined rule, and the dynamic setting of the effective duration is realized.

In an optional implementation manner, the foregoing specifying information may include: a random number used to generate the IOT device session key.

It should be noted that, in this optional embodiment, the random number may be used to generate a security key according to the random number after receiving the random number by the IOT device.

In an optional implementation manner, the server receiving the user identity information of the Internet of Things IOT device may include the following steps:

Step S31, the server receives user identity information forwarded by the Internet of Things IOT device through the network side node;

The server sends the specified information for generating the session key of the IOT device to the IOT device, which may include the following steps:

Step S32: The server sends the specified information for generating the session key of the IOT device to the IOT device through the network side node.

In this optional implementation, the network side node is used as an intermediate node for receiving user identity information and transmitting designated information, and the related art is required, and the IoT device needs to perform authentication every time the data is sent to the network. The resulting problem of wasted network resources, thereby achieving the effect of saving network resources, and further improving the efficiency of key update.

In an optional implementation manner, before the server sends the specified information for generating the session key of the IOT device to the IOT device, the method may further include the following steps:

Step S41: The server receives the user secret key sent by the IOT device.

Step S42, the server generates the session key by using the random number and the user private key, and sends the session key to the network side node.

Optionally, in this alternative embodiment, the user secret key may be saved on the SIM/USIM.

In this optional implementation manner, the server generates a session key by using a user secret key and a random number sent by the IOT device, and sends the session key to the network side node, thereby further implementing secure communication between the IOT device and the network side node. effect.

In this embodiment, an IoT device key update method is provided. The server is described by taking the HLR/HSS as an example. As shown in FIG. 4, the method includes the following steps:

Step S401, when the IoT device needs to send data, send the IoT device user identity information to the network side node SGSN;

Step S402, after receiving the user identity information sent by the IoT device, the network side node SGSN forwards the IoT device user identity information to the HLR/HSS;

Step S403, after receiving the IoT device user identity information, the HLR/HSS checks whether there is a timing counter of the IoT device, and if so, the HLR/HSS generates a new random number for the IoT device, and uses the new random number and The IoT device user private key generates a new session key.

Step S404, the HLR/HSS sends the new session key and the new random number to the network side node, such as the SGSN;

Step S405, after receiving the new session key and the new random number, the SGSN sends the new random number to the IoT device.

Step S406: After receiving the new random number, the IoT device generates a session key according to the user secret key saved on the SIM/USIM and the received new random number.

In step S407, the IoT device performs secure communication with the network side node, such as the SGSN.

In an optional implementation manner, the server may include any one of the following: a home location register HLR, a home subscription subscriber server HSS.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium (such as ROM/RAM, disk). The optical disc includes a plurality of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method described in the embodiments of the present invention.

In this embodiment, a key update device is also provided, which is configured to implement the foregoing embodiments and optional implementations, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the devices described in the following embodiments may be implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

FIG. 5 is a structural block diagram of a first type of key update apparatus according to an embodiment of the present invention. As shown in FIG. 5, the apparatus includes:

1) The first processing module 52 is configured to: receive user identity information of the Internet of Things IOT device, and determine whether the time point of receiving the user identity information is within a valid duration, wherein the effective duration is each time the IOT device The length of time set by the server after the access authentication is completed;

2) The first sending module 54 is configured to: when the determination result is YES, send designation information for generating a session key of the IOT device to the IOT device.

Optionally, in this embodiment, the application scenario of the foregoing key update method may include, but is not limited to, a Cellular Internet of Things (CIoT) system, where A large number of Internet of Things (IoT) devices are installed in the system. In the application scenario, the server may receive the user identity information of the IoT IOT device, and determine whether the time point of receiving the identity information of the user is within a valid duration, where the effective duration may be completed each time the IOT device is completed. After the access authentication, the length of time set by the server; if the judgment result is yes, the server may send the specified information for generating the session key of the IOT device to the IOT device. That is, in the embodiment of the present invention, after the IOT device completes the access authentication, the server may set the effective duration of the IOT device access authentication, and if the user identity information sent by the IOT device is received within the valid duration, Simply generate a session key and no need to perform IOT device access authentication. Through the embodiments of the present invention, the problem of waste of network resources caused by the authentication of the Internet of Things IoT device during each access to the network is required to be solved, thereby achieving the effect of saving network resources and further improving the density. The efficiency of key updates.

The present embodiment provides a key update method, which can be applied to a cellular IoT CIoT communication system including an IoT device, wherein the server is described by taking an HLR/HSS as an example, and the IoT device can include a SIM/USIM card. , can include the following steps:

After the IoT device access authentication is completed, the HLR/HSS determines when the IoT device is re-authenticated, for example, the HLR/HSS can define the effective duration of each authentication. HLR/HSS can define a uniform authentication effective duration for all IoT devices, and can also define a separate authentication effective duration for different IoT devices. After each IoT access authentication is completed, the HLR/HSS can initiate the authentication timing of the IoT device. When the authentication timing exceeds the validity period of the authentication, the HLR/HSS may terminate the authentication timing of the IoT device. All uncertified IoT devices will need to be certified subsequently. For example, HLR/HSS can define the effective duration of an IoT device. The HLR/HSS can set a counter for the IoT device. When the counter reaches the authentication valid period, the HLR/HSS can clear the counter and cancel the counting for the IoT device. Upon subsequent receipt of the user identity information sent by the IoT device, the HLR/HSS will initiate the authentication process.

When the IoT device needs to send data, it can send the IoT device to the network side node, such as the SGSN. User identity information;

FIG. 6 is a structural block diagram of a second type of key update apparatus according to an embodiment of the present invention. As shown in FIG. 6, the apparatus includes, in addition to all the modules shown in FIG.

1) The second processing module 62 is configured to: if the determination result is negative, terminate the timing operation of the valid duration, trigger an operation of performing access authentication on the IOT device, and trigger a re-timed of the valid duration operating.

In this optional implementation manner, when it is determined that the time point when the user identity information is received is not within the valid duration, the server may terminate the timing operation of the valid duration, and trigger an operation of performing access authentication on the IOT device, thereby implementing Secure communication between the IOT device and the network side node, avoiding even When the time point of the user identity information sent by the IOT device is not within the valid duration, the communication security caused by the access authentication operation is not reduced.

In an optional implementation manner, the first processing module may be further configured to: determine an effective duration by using a time point at which the IOT device accesses the authentication as a starting point of the effective duration, and is a cellular IoT system under the CIoT system. All the IOT devices are set to have the same duration as the effective duration; or, the time points at which all the IOT devices under the cellular IoT CIoT system respectively complete the access authentication are used as the starting point of the effective duration, and the respective IOT devices are respectively set to be effective. duration.

Through the optional implementation manner, the effective duration can be preset for all IOT devices under the cellular Internet of Things CIoT system through predetermined rules, and the dynamic setting of the effective duration is realized.

In an optional implementation manner, the specifying information may include: a random number used to generate the IOT device session key.

In an alternative embodiment, FIG. 7 is a structural block diagram of a third type of key updating apparatus according to an embodiment of the present invention. As shown in FIG. 7, the first processing module 52 includes:

1) The first processing unit 72 is configured to: receive user identity information of the Internet of Things IOT device, where the server receives user identity information forwarded by the Internet of Things IOT device through the network side node;

The first sending module 54 includes:

2) The first sending unit 74 is configured to: send the designation information for generating the session key of the IOT device to the IOT device through the network side node.

In an alternative embodiment, FIG. 8 is a structural block diagram of a fourth key updating apparatus according to an embodiment of the present invention. As shown in FIG. 8, the apparatus includes, in addition to all the modules shown in FIG. :

1) The receiving module 82 is configured to: the session secret that the server will use to generate the IOT device Receiving the user secret key sent by the IOT device before sending the specified information of the key to the IOT device;

2) The third processing module 84 is configured to: before the server sends the designation information for generating the session key of the IOT device to the IOT device, generate the session key by using the random number and the user secret key, And send the session key to the network side node.

In this optional implementation manner, the server may generate a session key by using a user secret key and a random number sent by the IOT device, and send the session key to the network side node, thereby further implementing secure communication between the IOT device and the network side node. Effect.

In an optional implementation manner, the foregoing server may include any one of the following: a home location register HLR, and a home subscription subscriber server HSS.

Optionally, an IOT device authentication management device is further provided in this embodiment. As shown in FIG. 9, the method includes:

1) The authentication timing module 92 is configured to: perform authentication timing for the IoT device after the AKA process ends;

2) The management module 94, the user HLR/HSS manages the authentication timing module, and checks whether the timing counter for one IoT device timing module has reached the authentication effective duration. When the authentication is valid for a long time, the counter is cleared and the timing for the IoT device is cancelled.

3) The checking module 96 is configured to: check whether the IoT device needs to be authenticated according to the IoT device user identity information, or update the session key;

In another optional implementation, a session key checking apparatus is further provided, as shown in FIG. 10, including:

1) The session key check management module 1002 is configured to: update the IoT device session key, and check whether the update session key needs to be renegotiated.

A key update method is also provided in this embodiment. FIG. 11 is a flowchart of a third key update method according to an embodiment of the present invention. As shown in FIG. 11, the method includes the following steps:

Step S1102: The Internet of Things IOT device sends user identity information to the server.

Step S1104: The IOT device determines whether the specified information for generating the session key sent by the server is received, where the specified information is when the time point when the server receives the user identity information is within a preset effective time period. The information sent to the IOT device, the effective duration being the length of time set by the server after the IOT device completes the access authentication;

In step S1106, if the determination result is yes, the IOT device generates the session key according to the specified information.

Optionally, in this embodiment, the application scenario of the foregoing key update method may include, but is not limited to, a Cellular Internet of Things (CIoT) system, where a large number of Internet of Things is set in the system. (Internet of Things, referred to as IoT) devices. In the application scenario, the IoT IOT device may send the user identity information to the server; the IOT device may determine whether the specified information sent by the server for generating the session key is received, wherein the specified information may be determining the server. The information sent to the IOT device when the time point of receiving the user identity information is within a preset effective time period, and the effective duration may be the duration set by the server after each time the IOT device completes the access authentication; If the determination result is yes, the IOT device may generate the session key according to the specified information. That is, after the IOT device sends the user identity information to the server, if the specified information for generating the session key sent by the server is received within the length of the IOT device authentication, the access authentication is not required, but can be directly based on The specified information generates the session key, thereby solving the problem of waste of network resources caused by the authentication of the IoT IoT device in each of the related technologies in the related art, thereby achieving the effect of saving network resources. , further improve the efficiency of key update.

In an optional implementation manner, when the IOT device determines that the specified information sent by the server for generating the session key is not received, the method may include the following steps:

In step S51, the IOT device re-initiates the access authentication operation.

Optionally, in the optional implementation, the IOT device re-initiates the access authentication operation when the IOT device determines that the specified information for generating the session key sent by the server is not received, thereby avoiding related technologies. Each time the data is sent to the network, the problem of wasted network resources caused by the authentication is required, thereby achieving the effect of saving network resources and further improving the efficiency of key update.

In an optional implementation manner, the foregoing specifying information may include: used to generate the IOT device The random number of the session key.

In an optional implementation manner, the generating, by the IOT device, the session key according to the specified information may include the following steps:

Step S61, the IOT device receives the random number forwarded by the server through the network side node;

Step S62, the IOT device generates the session key by using the user secret key and the random number.

In this optional implementation manner, the IOT device may receive a random number sent by the server, and generate the session key according to the user private key and the random number to further implement secure communication.

Step S71: The IOT device receives the random number forwarded by the server through the network side node and the random number after the network side node performs encryption processing.

Step S72: The IOT device generates a session key by using the user secret key and the random number, and decrypts the encrypted random number according to the session key to obtain the decrypted random number.

Step S73, the IOT device determines whether the decrypted random number is the same as the random number forwarded by the server through the network side node;

Step S74, in the case that the determination result is yes, the IOT device sends the data to be sent to the network side node;

Step S75: If the determination result is no, the IOT device sends a request message to the server, where the request message is used to request the server to resend the random number.

In this optional implementation manner, the IOT device can compare the random number sent by the receiving server with the decrypted random number, and perform corresponding operations according to the comparison result, which solves the problem that the Internet of Things IoT device sends in each access network. When data is used, the problem of wasted network resources caused by authentication is required, and the effect of saving network resources is achieved at the same time. The secure communication of the IOT device is further guaranteed.

In this alternative embodiment, an IoT device key update method is provided, where the server takes the HLR/HSS as an example. As shown in Figure 12, the following steps are included:

Step S1201: When the IoT device needs to send data, send the IoT device user identity information to the network side node SGSN.

Step S1202: After receiving the user identity information sent by the IoT device, the network side node SGSN forwards the IoT device user identity information to the HLR/HSS.

Step S1203: After receiving the IoT device user identity information, the HLR/HSS checks whether there is a counter of the IoT device, and if so, the HLR/HSS generates a new random number for the IoT device, and uses the new random number and IoT. The device user private key generates a new session key.

Step S1204, the HLR/HSS sends the new session key and the new random number to the network side node, such as the SGSN;

Step S1205, the SGSN encrypts the new random number with the new session, and then sends the new random number together with the encrypted new random number to the IoT device;

Step S1206: After receiving the new random number and the encrypted new random number, the IoT device generates a session key according to the user secret key saved on the SIM/USIM and the received new random number, and decrypts the session key. The encrypted new random number checks whether the decrypted new random number is the same as the received new random number. If they are the same, step 407 is performed. If different, the IoT device requests retransmission from the network side node, such as the SGSN.

In step S1207, the IoT device performs secure communication with the network side node, such as the SGSN.

In the embodiment, a key update device is further provided, which is configured to implement the above implementation. The examples and optional embodiments have not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the devices described in the following embodiments may be implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

FIG. 13 is a structural block diagram of a fifth type of key update apparatus according to an embodiment of the present invention. As shown in FIG. 13, the apparatus includes:

1) The second sending module 1302 is configured to: send user identity information to the server;

2) The determining module 1304 is configured to: determine whether the specified information for generating the session key sent by the server is received, where the specified information is pre-set at a time point when determining that the server receives the user identity information The information sent to the IOT device during the effective duration is the duration set by the server after each time the IOT device completes the access authentication;

3) The obtaining module 1306 is configured to: when the determination result is YES, generate the session key according to the specified information.

Optionally, in this embodiment, the application scenario of the foregoing key update method may include, but is not limited to, a Cellular Internet of Things (CIoT) system, where a large number of objects may be disposed in the system. Internet of Things (IoT) devices. In the application scenario, the IoT IOT device may send the user identity information to the server; the IOT device may determine whether the specified information sent by the server for generating the session key is received, wherein the specified information may be determining the server. The information sent to the IOT device when the time point of receiving the user identity information is within a preset effective time period, and the effective duration may be the duration set by the server after each time the IOT device completes the access authentication; If the determination result is yes, the IOT device may generate the session key according to the specified information. That is, after the IOT device sends the user identity information to the server, if the specified information for generating the session key sent by the server is received within the length of the IOT device authentication, the access authentication is not required, but directly according to the The specified information generates the session key, thereby solving the problem of waste of network resources caused by the authentication of the IoT IoT device in each of the related technologies in the related art, thereby achieving the effect of saving network resources. Further improve the efficiency of key update.

In an alternative embodiment, FIG. 14 is a structural block diagram of a sixth key updating apparatus according to an embodiment of the present invention. As shown in FIG. 14, the apparatus includes all the modules shown in FIG. Also includes:

1) The fourth processing module 1402 is configured to: re-initiate the access authentication operation if the determination result is no.

In an alternative embodiment, FIG. 15 is a structural block diagram of a seventh key updating apparatus according to an embodiment of the present invention. As shown in FIG. 15, the obtaining module 1306 includes:

1) The first receiving unit 1502 is configured to: receive the random number forwarded by the server by the network side node;

2) The obtaining unit 1504 is configured to generate the session key using the user private key and the random number.

In an optional implementation manner, the unit included in the obtaining module 106 may also perform equivalent replacement by using the following unit: 1) the second receiving unit is configured to: receive the random number forwarded by the server through the network side node, and a random number after the network side node performs encryption processing; 2) the second processing unit is configured to: generate a session key by using the user private key and the random number, and randomly process the encrypted process according to the session key The number is decrypted to obtain the decrypted random number; 3) the determining unit is configured to: determine whether the decrypted random number is the same as the random number forwarded by the server through the network side node; 4) the second sending unit is set to: If the determination result is yes, the data to be sent is sent to the network side node; 5) the third sending unit is configured to: if the determination result is no, send a request message to the server, where the request message Used to request the server to resend a random number.

A key update system is also provided in this embodiment. As shown in FIG. 16, the system includes:

1) The Internet of Things IOT device 1602 is configured to: send user identity information to the network side node;

2) The network side node 1604 is configured to: send the user identity information to the server, and send the designated information for generating the session key of the IOT device to the IOT device;

3) The server 1606 is configured to: after receiving the identity information of the user, determine whether the time point of receiving the identity information of the user is within a valid duration; if yes, send the specified information to the network side node.

Optionally, the server 1606 may include: a home location register HLR, a home subscription subscriber server HSS.

It should be noted that the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are respectively located in multiple processes. In the device.

The embodiment of the invention further provides a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1. The server receives the user identity information of the IoT IOT device, and determines whether the time point of receiving the identity information of the user is within a valid duration, where the effective duration is after each time the IOT device completes the access authentication, the server The length of time set;

S2. If the determination result is yes, the server sends the designation information for generating the session key of the IOT device to the IOT device.

Alternatively, the storage medium may also be arranged to store program code for performing the following steps:

S3, the Internet of Things IOT device sends user identity information to the server;

S4: The IOT device determines whether the specified information for generating the session key sent by the server is received, where the specified information is determined to be within a preset effective time when the server receives the identity information of the user. The information sent to the IOT device, the effective duration is the duration set by the server after each time the IOT device completes the access authentication;

S5. If the determination result is yes, the IOT device generates the session key according to the specified information.

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

Optionally, in this embodiment, the processor may perform the foregoing steps S1, S2 according to the stored program code in the storage medium.

Optionally, in this embodiment, the processor may perform the foregoing steps S3, S4, and S5 according to the stored program code in the storage medium.

For example, the specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, processor, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

A person skilled in the art can understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present application. The scope of protection of this application is defined by the scope defined by the claims.

Industrial applicability

Claims

A key update method includes:

The server receives the user identity information of the IoT IOT device, and determines whether the time point of receiving the user identity information is within a valid duration, where the effective duration is after each time the IOT device completes the access authentication. The length of time the server is set up;

In a case where the determination result is YES, the server transmits designation information for generating a session key of the IOT device to the IOT device.
The method of claim 1 further comprising:

If the determination result is negative, the server terminates the timing operation of the valid duration, and triggers an operation of performing access authentication on the IOT device, and triggering a re-timing operation of the valid duration.
The method of claim 1 wherein said effective duration is determined by:

The time when the server accesses the authentication by the IOT device is used as a starting point of the effective duration, and all the IOT devices under the cellular IoT CIoT system are set to have the same duration as the effective duration; or

The server uses the time point at which all the IOT devices under the cellular IoT CIoT system complete the access authentication as the starting point of the effective duration, and sets the effective duration of each of the IOT devices.
The method of claim 1, wherein the designation information comprises a random number for generating the IOT device session key.
The method of claim 1 wherein

Receiving user identity information of the IoT IOT device by the server includes: the server receiving user identity information forwarded by the Internet of Things IOT device by the network side node;

Sending, by the server, the designation information for generating the session key of the IOT device to the IOT device includes: the server uses the network side node to generate specified information of a session key of the IOT device Sent to the IOT device.
The method according to claim 4, before the server sends the designation information for generating the session key of the IOT device to the IOT device, the method further includes:

Receiving, by the server, a user private key sent by the IOT device;

The server generates a session key using the random number and the user private key, and transmits the session key to a network side node.
The method according to any one of claims 1 to 6, wherein the server comprises any one of the following: a home location register HLR, a home subscriber server HSS.
A key update method includes:

The IoT IOT device sends user identity information to the server;

Determining, by the IOT device, whether the information specified by the server for generating a session key is received, wherein the specifying information is valid in a preset time when determining that the server receives the user identity information The duration of the duration, the information sent to the IOT device, the effective duration is the duration set by the server after each time the IOT device completes the access authentication;

In a case where the determination result is YES, the IOT device generates the session key according to the specified information.
The method of claim 8 further comprising:

In the case that the determination result is no, the IOT device re-initiates an access authentication operation.
The method of claim 8, wherein the designation information comprises a random number for generating the IOT device session key.
The method of claim 10, wherein the generating, by the IOT device, the session key according to the specified information comprises:

Receiving, by the IOT device, the random number forwarded by the server by a network side node;

The IOT device generates the session key using a user private key and the random number.
The method of claim 8, wherein the generating, by the IOT device, the session key according to the specified information comprises:

The IOT device receives a random number forwarded by the server through a network side node and passes through The network side node performs a cryptographically processed random number;

The IOT device generates a session key by using a user secret key and the random number, and decrypts the encrypted random number according to the session key to obtain a decrypted random number;

Determining, by the IOT device, whether the decrypted random number and the random number forwarded by the server by the network side node are the same;

If the judgment result is yes, the IOT device sends the data to be sent to the network side node;

If the determination result is no, the IOT device sends a request message to the server, where the request message is used to request the server to resend the random number.
A key update device, applied to a server, comprising:

The first processing module is configured to: receive user identity information of the IoT IOT device, and determine whether the time point of receiving the user identity information is within a valid duration, wherein the effective duration is each time the IOT device The length of time set by the server after the access authentication is completed;

The first sending module is configured to: when the determination result is yes, send designation information for generating a session key of the IOT device to the IOT device.
The apparatus of claim 13 further comprising:

The second processing module is configured to: if the determination result is negative, terminate the timing operation of the valid duration, trigger an operation of performing access authentication on the IOT device, and trigger a restart of the effective duration Timing operation.
The apparatus according to claim 13, wherein the first processing module is further configured to: determine an effective duration by:

Setting a time point for accessing the authentication by the IOT device as a starting point of the effective duration, and setting a duration of the same effective duration for all IOT devices under the cellular Internet of Things CIoT system; or

The time point at which all the IOT devices under the cellular IoT CIoT system respectively complete the access authentication is used as the starting point of the effective duration, and the effective durations of all the IOT devices are respectively set.
The apparatus of claim 13, wherein the specified information comprises: for A random number of the IOT device session key.
The device according to claim 13, wherein

The first processing module includes a first processing unit, and the first processing unit is configured to: the server receives user identity information forwarded by the Internet of Things IOT device by the network side node;

The first sending module includes a first sending unit, and the sending unit is configured to: send, by the network side node, specified information for generating a session key of the IOT device to the IOT device.
The apparatus of claim 16 further comprising:

a receiving module, configured to: before the server sends the specified information for generating the session key of the IOT device to the IOT device, receive a user private key sent by the IOT device;

a third processing module, configured to: generate a session secret using the random number and the user private key before the server sends the designation information for generating the session key of the IOT device to the IOT device Key and send the session key to the network side node.
The apparatus according to any one of claims 13 to 18, wherein the server comprises any one of the following: a home location register HLR, a home subscriber server HSS.
A key update device for an Internet of Things IOT device, comprising:

a second sending module, configured to: send user identity information to the server;

The determining module is configured to: determine whether the specified information for generating the session key sent by the server is received, wherein the specified information is preset in determining that the server receives the user identity information The information sent to the IOT device during the effective duration is the duration set by the server after each time the IOT device completes the access authentication;

The acquisition module generates the session key based on the specified information if the determination result is YES.
The apparatus of claim 20, the apparatus further comprising:

The fourth processing module is configured to: re-initiate the access if the determination result is negative Certification operation.
The apparatus of claim 20, wherein the designation information comprises a random number for generating the IOT device session key.
The apparatus of claim 22, wherein the obtaining module comprises:

The first receiving unit is configured to: receive the random number forwarded by the server by the network side node;

And an obtaining unit, configured to: generate the session key by using a user private key and the random number.
The apparatus of claim 20, wherein the obtaining module comprises:

a second receiving unit, configured to: receive a random number forwarded by the server by the network side node, and a random number after the network side node performs encryption processing;

a second processing unit, configured to: generate a session key by using a user secret key and the random number, and decrypt the encrypted random number according to the session key to obtain a decrypted random number;

a determining unit, configured to: determine whether the decrypted random number is the same as the random number forwarded by the server by the network side node;

The second sending unit is configured to: when the determination result is yes, send the data to be sent to the network side node;

The third sending unit is configured to: when the determination result is no, send a request message to the server, where the request message is used to request the server to resend the random number.
A key update system comprising:

The Internet of Things IOT device is configured to: send user identity information to the network side node;

a network side node, configured to: send the user identity information to a server, and send specified information for generating a session key of the IOT device to the IOT device;

The server is configured to: after receiving the user identity information, determine whether the time point of receiving the user identity information is within a valid duration; if yes, send the specified information to the network side node.