CN110430218A - Data transmission security control method and device, computer equipment and Internet of things system - Google Patents

Data transmission security control method and device, computer equipment and Internet of things system Download PDF

Info

Publication number
CN110430218A
CN110430218A CN201910785238.2A CN201910785238A CN110430218A CN 110430218 A CN110430218 A CN 110430218A CN 201910785238 A CN201910785238 A CN 201910785238A CN 110430218 A CN110430218 A CN 110430218A
Authority
CN
China
Prior art keywords
key
target network
terminal
network node
encryption
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201910785238.2A
Other languages
Chinese (zh)
Other versions
CN110430218B (en
Inventor
刘滔
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Shuliantianxia Intelligent Technology Co Ltd
Original Assignee
Shenzhen Heertai Home Furnishing Online Network Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Heertai Home Furnishing Online Network Technology Co Ltd filed Critical Shenzhen Heertai Home Furnishing Online Network Technology Co Ltd
Priority to CN201910785238.2A priority Critical patent/CN110430218B/en
Publication of CN110430218A publication Critical patent/CN110430218A/en
Application granted granted Critical
Publication of CN110430218B publication Critical patent/CN110430218B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/068—Network architectures or network communication protocols for network security for supporting key management in a packet data network using time-dependent keys, e.g. periodically changing keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H04L9/16—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms the keys or algorithms being changed during operation

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

This application involves a kind of data transmission security control method and device, computer equipment and Internet of things system.It wherein, include: the dynamic code for obtaining server and sending applied to the data transmission security control method of target network node terminal；According to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key seed is generated；Key seed is input to Symmetric key generation device, and obtains the first key of Symmetric key generation device generation；Data encryption or decryption are carried out using first key.By being association of activity and inertia to obtain the key seed of dynamic change, the data transmission security of target network node terminal is improved.

Description

Data transmission security control method and device, computer equipment and Internet of things system
Technical field
The present invention relates to field of information security technology, more particularly to a kind of data transmission security control method and device, Computer equipment and Internet of things system.
Background technique
Here statement only provides background information related with the application, without inevitably constituting the prior art.
Intelligent internet of things (AIoT, Artificial Internet of Thing) is flourishing, intelligent terminal (Smart Terminal) quantity sharply increases, and security risk is big, and safe link accounting is low in Internet of Things industrial chain.Internet of Things industry Multiple industries, comprehensive influence people's lives are goed deep into business, and corresponding safety problem will also be brought and seriously threaten, or even including life And property safety, terminal security are more and more concerned.Wherein, the data transmission security in communication process is crucial in terminal security A ring.
In Intelligent internet of things in traditional technology, some terminals using symmetric cryptography (Symmetric Encryption, SE) technology carries out the business datum of terminal, private data, certification and identity data in wireless and wired communications The safety of information transmission to a certain extent is realized in encryption, but this kind of Encryption Algorithm is single and fixed, is easy inversely to be broken Solution, data transmission security are low.
Summary of the invention
Based on this, it is necessary to for the low problem of data encryption in traditional technology or decryption safety, provide a kind of data Transmit method of controlling security and device, computer equipment and Internet of things system.
On the one hand, the embodiment of the present application provides a kind of data transmission security control method, and this method is applied to target network Network nodal terminal, this method comprises:
Obtain the dynamic code that server is sent；
According to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key seed is generated；
Key seed is input to Symmetric key generation device, and obtains the first key of Symmetric key generation device generation；
Data encryption or decryption are carried out using first key.
One or more embodiment provided by the invention at least has the advantages that by using the dynamic of dynamic change The configuration information and key seed generating algorithm of state code and target network node terminal generate dynamic change key seed, with Symmetric key generation device combines, and generates the key of dynamic change, improves the anti-crack ability of key, is counted to improve terminal Safety when according to transmission.
The configuration information of target network node terminal includes: equipment management key, using soft in one of the embodiments, Part manages key and media access control address；
According to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key seed is generated The step of include:
Target network node terminal is by equipment management key, application software management key and media access control address by pre- If regularly arranged, to generate the static seed factor；
Target network node terminal generates key kind according to dynamic code, the static seed factor and key seed generating algorithm Son.
Dynamic code is Pseudo-Random Noise Code in one of the embodiments,；
According to dynamic code, the static seed factor and key seed generating algorithm, the step of generating key seed, includes:
Static seed factor step-by-step is scrambled according to Pseudo-Random Noise Code, generates Scrambling seeds source；
According to Scrambling seeds source and key seed generating algorithm, key seed is generated.
Data transmission security control method in one of the embodiments, further include:
The second key is generated according to dynamic code and scrambling algorithms.
Data transmission security control method in one of the embodiments, further include:
In the case where the first kind for receiving server generation encrypts pattern, pattern is encrypted according to the first kind and is alternately used First key and the second key carry out data encryption or decryption；
Or
In the case where the second class for receiving server generation encrypts pattern, pattern is encrypted according to the second class and uses first Key carries out data encryption or decryption；
Wherein, first kind encryption pattern is what server was generated when determining target network node terminal overload operation； Second class encryption pattern is that server is generated in the non-overload operation of judgement target network node terminal.
First kind encryption pattern and the second class encryption pattern include N block identifiers in one of the embodiments, often The corresponding block of information to be encrypted of position block identifier or block of information to be decrypted；
It is the first value that the first kind, which encrypts the N-i position block identifier in pattern, and the first kind encrypts the position the i block identifier in pattern For second value, N and i are the natural number more than or equal to 1, and i≤N, the corresponding original information block of each block identifier or one Block of information to be decrypted；
The position the N block identifier that second class encrypts pattern is the first value；
Wherein, the first value is used to indicate target network node terminal and is believed using first key the corresponding target of block identifier Breath block is encrypted or is decrypted；It is corresponding using the second key pair block identifier that second value is used to indicate target network node terminal Target information block is encrypted or is decrypted；Target information block is block of information to be encrypted or block of information to be decrypted.
A kind of data transmission security control method, this method are applied to server, this method comprises:
Dynamic code is sent to target network node terminal, keeps target network terminal whole according to dynamic code, target network node The configuration information at end generates first key, and first key is by target network node terminal for carrying out data encryption or decryption.
Data transmission security control method in one of the embodiments, further include:
Obtain the configuration information of target network node terminal；
According to the configuration information of target network node terminal, judge target network node terminal whether overload operation；
If it is determined that target network node terminal overload operation, then generate and send the first kind and encrypt pattern to target network Nodal terminal, first kind encryption pattern are used to indicate target network node terminal and carry out data encryption or solution by the first preset rules It is close；
If it is determined that the non-overload operation of target network node terminal, then generate and send the second class and encrypt pattern to target network Network nodal terminal, the second class encryption pattern be used to indicate target network node terminal by the second preset rules carry out data encryption or Decryption；
Wherein, terminal processing capacity needed for carrying out data encryption or decryption by the first preset rules is lower than default by second Terminal processing capacity needed for rule carries out data encryption or decryption.
First kind encryption pattern and the second class encryption pattern include N block identifiers in one of the embodiments, often The corresponding block of information to be encrypted of position block identifier or block of information to be decrypted；
It is the first value that the first kind, which encrypts the N-i position block identifier in pattern, and the first kind encrypts the position the i block identifier in pattern For second value, N and i are the natural number more than or equal to 1, and i≤N, the corresponding original information block of each block identifier or one Block of information to be decrypted；
The position the N block identifier that second class encrypts pattern is the first value；
Wherein, the first value is used to indicate target network node terminal and is believed using first key the corresponding target of block identifier Breath block is encrypted or is decrypted；It is corresponding using the second key pair block identifier that second value is used to indicate target network node terminal Target information block is encrypted or is decrypted；Target information block is block of information to be encrypted or block of information to be decrypted.
Data transmission security control method in one of the embodiments, further include:
Dynamic code is updated before each network connection disconnects；Or
Timing updates dynamic code；Or
Dynamic code is updated in the first update request command for receiving the transmission of target network node terminal.
Data transmission security control method in one of the embodiments, further include:
First kind encryption pattern is updated before each network connection disconnects and the second class encrypts pattern；Or
Timing updates first kind encryption pattern and the second class encrypts pattern；Or
Receive target network node terminal transmission second update request command when update the first kind encryption pattern and Second class encrypts pattern；Or
In keep alive timer time-out, updates first kind encryption pattern and the second class encrypts pattern.
A kind of data transmission security control device, the device are applied to target network node terminal, which includes:
Key seed parameter acquisition module, for obtaining the dynamic code of server transmission；
Key seed generation module, for according to dynamic code, the configuration information of target network node terminal and key seed Generating algorithm generates key seed；
First key determining module, for key seed to be input to Symmetric key generation device, and it is raw to obtain symmetric key It grows up to be a useful person the first key of generation；
Encryption/decryption module, for carrying out data encryption or decryption using first key.
A kind of data transmission security control device, device are applied to server, and device includes:
Dynamic code sending module makes target network terminal according to dynamic for sending dynamic code to target network node terminal State code and the configuration information of target network node terminal generate first key, first key by target network node terminal be used for into Row data encryption or decryption.
A kind of computer equipment, including memory and processor, memory are stored with computer program, and processor executes meter The step of realizing above-mentioned data transmission security control method when calculation machine program.
A kind of Internet of things system, comprising:
Server, server include memory and processor, and memory is stored with computer program, and processor executes calculating The step of data transmission security control method of above-mentioned server side is realized when machine program；
Multiple terminals, each terminal include memory and processor, and memory is stored with computer program, the target in terminal The step of processor of the network terminal realizes the data transmission security control method of above-mentioned terminal side when executing computer program.
A kind of computer readable storage medium, is stored thereon with computer program, realization when which is executed by processor The step of above-mentioned data transmission security control method.
Detailed description of the invention
Fig. 1 is that the applied environment figure of data transmission security control method and the structure of Internet of things system are shown in one embodiment It is intended to；
Fig. 2 is the flow diagram of data transmission security control method in one embodiment；
Fig. 3 is to be generated in one embodiment according to dynamic code, the configuration information of target network node terminal and key seed The flow diagram of the step of algorithm, generation key seed；
Fig. 4 is to generate key kind according to dynamic code, the static seed factor and key seed generating algorithm in one embodiment The flow diagram of the step of son；
The step of Fig. 5 is in one embodiment according to Scrambling seeds source and key seed generating algorithm, generates key seed Flow diagram；
Fig. 6 is the flow diagram of data transmission security control method in another embodiment；
Fig. 7 is the flow diagram of data transmission security control method in one embodiment；
Fig. 8 is the structure chart of data transmission security control device in one embodiment；
Fig. 9 is the structural schematic diagram of key seed generation module in one embodiment；
Figure 10 is the structural schematic diagram of dynamic key seed determination unit in one embodiment；
Figure 11 is the structural schematic diagram of descrambling key seed determination unit in one embodiment；
Figure 12 is the structural schematic diagram of data transmission security control device in another embodiment；
Figure 13 is the internal structure chart of computer equipment in one embodiment.
Specific embodiment
To facilitate the understanding of the present invention, a more comprehensive description of the invention is given in the following sections with reference to the relevant attached drawings.In attached drawing Give preferred embodiment of the invention.But the invention can be realized in many different forms, however it is not limited to this paper institute The embodiment of description.On the contrary, purpose of providing these embodiments is make it is more thorough and comprehensive to the disclosure.
It should be noted that it can be directly to separately when an element is considered as " connection " another element One element and it is in combination be integrated, or may be simultaneously present centering elements.Term as used herein " installation ", " one End ", " other end " and similar statement are for illustrative purposes only.
Unless otherwise defined, all technical and scientific terms used herein and belong to technical field of the invention The normally understood meaning of technical staff is identical.Term as used herein in the specification of the present invention is intended merely to description tool The purpose of the embodiment of body, it is not intended that in the limitation present invention.Term " and or " used herein includes one or more phases Any and all combinations of the listed item of pass.
Data transmission security control method provided by the present application, can be applied in application environment as shown in Figure 1.Its In, each terminal 102 is communicated with server 104 by network by network, forms Intelligent internet of things (Artificial Internet of Thing, AIoT), in communication transmission process, each terminal 102 carries out the number to transmitting-receiving according to Encryption Algorithm According to being decrypted and encrypting respectively, to ensure the safety of data transmission.Wherein, terminal 102 can be, but not limited to be various Intelligent terminals (the Smart such as people's computer, laptop, smart phone, tablet computer and portable wearable device Terminal, ST), server 104 can be with the server cluster of the either multiple server compositions of independent server come real Existing, server 104 can also be one in intelligent terminal 102.
For the low problem of data encryption in traditional technology or the safety of decryption method, as shown in Fig. 2, the present invention is implemented Example provides a kind of data transmission security control method, and this method is applied to target network node terminal, this method comprises:
S10: the dynamic code that server is sent is obtained；
S20: according to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key is generated Seed；
S30: being input to Symmetric key generation device for key seed, obtains the first key that Symmetric key generation device generates；
S40: data encryption or decryption are carried out using first key.
Wherein, target network node terminal can be one or more terminals in Intelligent internet of things, which can be into Row data encryption or decryption, with safe sending and receiving data.When the target network node terminal needs transmission data outward, to be added Ciphertext data generates ciphertext after being encrypted, and is issued with ciphertext form, which needs to receive other equipment biography When defeated ciphertext to be decrypted, the step of decrypting to ciphertext to be decrypted is executed, obtains the be-encrypted data that other equipment want transmission. Configuration information may include the hardware parameter for being able to reflect the target network node terminal and the application software parameter installed thereon Deng can be and obtained from server, be also possible to the hardware parameter that has been arranged when terminal factory.Dynamic code can be it is pseudo- with Machine noise (Pseudorandom Noise, PN) code or code according to other regular dynamic changes.Key seed generating algorithm is It refers to obtain the algorithm of key seed according to certain input parameter.Symmetric key generation device is to be applied to data ciphering and deciphering Using the scene of same key, for example, it (may include receiving number that server, which will generate dynamic code and each target network node terminal, According to terminal with send data terminal) configuration information synchronize be sent to send data terminal and receive data terminal, Two terminals carry out encryption and decryption using identical data key, realize data communication.
Specifically, in order to better illustrate the data transmission security control method provided in the embodiment of the present application, with service It is illustrated for interaction scenarios between device and each network nodes terminal.Server can send out the dynamic code generated at random It send to the target network node terminal for needing to carry out data encryption or decryption, the terminal is whole according to dynamic code, target network node The configuration information and key seed generating algorithm at end obtain the key seed of dynamic change, then key seed input is symmetrical close Key generator dynamic generation first key, then extracts the first key, avoids only using fixed key kind in traditional technology The shortcomings that son causes key to remain unchanged for a long period of time.After terminal generates the first key, if the terminal is needed to outgoing data encryption or right It is stored after received data encryption, then the terminal can encrypt be-encrypted data using the first key, generate ciphertext It issues or stores afterwards, if the terminal needs to receive at present external device (can be other network nodes terminals or server) transmission When the ciphertext to be decrypted of (or forwarding), which can be decrypted (the mesh to received ciphertext to be decrypted according to first key It marks and uses identical key, i.e. symmetry algorithm, Ke Yiyou between network nodes terminal and the external device for sending ciphertext to be decrypted Server complete two equipment rooms key synchronization), it is similar, the target network node terminal receive simultaneously ciphertext to be decrypted with Encryption and decryption when needing to be sent out be-encrypted data can also be all made of first key realization.
Encryption Algorithm used by the Symmetric key generation device provided in the embodiment of the present application in one of the embodiments, It can be AES (Advance Encryption Standard, Advanced Encryption Standard) symmetric encipherment algorithm, for example, optional AES128,AES192,AES256.AES is the password an of iteration, symmetric key grouping, and 128,192 and can be used in it 256 keys, and with 128 (block of information of 16 bytes) block encryptions and ciphertext data, symmetric key cipher uses phase Same key encrypting and decrypting data, and the digit of the encryption data returned by block cipher and the data of input (will be outward The be-encrypted data of transmission or received ciphertext to be decrypted) it is identical.Iterative cryptographic uses a loop structure, weighs in the cycle The data changed (permutations) and replace (substitutions) input reset.
Data transmission security control method provided by the invention, by using matching for dynamic code and target network node terminal Confidence breath cooperates key seed generating algorithm after combining, and the key seed of dynamic change is generated, further by the dynamic change Key seed is input to Symmetric key generation device, obtains the first key of dynamic change, and carry out data using the first key Encryption or decryption, improve the anti-crack ability of key, to improve the data transmission security of the systems such as Intelligent internet of things.
In one of the embodiments, as shown in figure 3, the configuration information of target network node terminal includes: equipment management Key, application software management key and media access control address；
According to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key seed is generated Step S20 include:
S21: equipment management key, application software management key and media access control address are arranged by preset rules, Generate the static seed factor；
S22: according to dynamic code, the static seed factor and key seed generating algorithm, key seed is generated.
Wherein, equipment management key (DeviceKey) can be distributed unitedly by the server of Intelligent internet of things, and length can To be 32 bytes.Application software management key (UserKey) refers to the application software management on the application terminal of Intelligent internet of things Key is distributed unitedly by application software, is uniquely that length can be 32 bytes in application terminal.Media access control The address (Media Access Control, MAC), specific form can be the different communications such as WiFi, BT, NB-IoT, LoRa Network address under technology, length can be 6 bytes.Preset rules can be equipment management key, application software management is close Key and media access control address are by byte progress head and the tail splicing.The static seed factor can refer to influence key seed generation Changeless signal.
Data transmission security control method proposed by the present invention, dynamic code is applied on symmetric encipherment algorithm, will such as be moved State code applies the seed generating algorithm in AES (Advanced Encryption Standard, Advanced Encryption Standard) algorithm Input terminal plays the role of the scrambling generated to static seed.For example, realization process is generated to better illustrate key seed, with Dynamic code is to illustrate for Pseudo-Random Noise Code (PN code): the digits long of Pseudo-Random Noise Code, which designs, can be used 32, follow Thus ring length is 231=2147483648 times, dynamic code is in continuous variable condition, and recurrence probability is small.First setting 32 bytes The media access control address of standby management key, 32 byte application softwares management key and 6 bytes forms static kind of 70 bytes The sub- factor scrambles the static seed factor of 70 byte (for less than 32 by the step-by-step of 32 Pseudo-Random Noise Codes Can make zero padding registration process, can also be other cover alignment thereofs, such as mend 1 alignment), after the scrambling for generating 70 bytes The seed factor, and be re-used as input and be supplied to key seed generating algorithm, key seed is obtained, which is dynamic Variation, by carrying out step scrambling processing to key seed generating process, improve the corresponding key generated of key seed more Pseudo-randomness and preventing decryption ability, improve data transfer safety.
In one of the embodiments, as shown in figure 4, dynamic code is Pseudo-Random Noise Code；According to dynamic code, static seed The factor and key seed generating algorithm, the step S22 for generating key seed include:
S221: static seed factor step-by-step is scrambled according to Pseudo-Random Noise Code, generates Scrambling seeds source；
S222: according to Scrambling seeds source and key seed generating algorithm, key seed is generated.
It, can be by static kind if the coding that Pseudo-Random Noise Code is 32 by taking the static seed factor of 70 bytes as an example The sub- factor is divided into one group by every four bytes, and 32 Pseudo-Random Noise Codes are respectively corresponded 32 static seeds with each group The factor carries out scrambling operation, such as carries out XOR operation, Scrambling seeds source is obtained, by carrying out at scrambling to the static seed factor Reason, obtains the Scrambling seeds source of dynamic change, and the key seed generated with the cooperation of key seed generating algorithm has dynamic change Property, it is highly-safe.It should be noted that different with configuration according to the requirement of target network node terminal, the static seed factor is simultaneously Concrete example in being not limited to the above embodiment, this example are intended merely to the preferably side of helping skilled in the art to understand Case does not impact the real protection scope of the application.
It is calculated in one of the embodiments, as shown in figure 5, being generated according to the Scrambling seeds source and the key seed Method, the step S222 for generating key seed include:
S2221: Scrambling seeds source is ranked up；
S2222: being input to RC4 algorithm model for the Scrambling seeds source after sequence, and obtains the close of RC4 algorithm model generation Key seed.
The S-box length of the core of RC4 algorithm model can be any, but generally 256 bytes, the speed of the algorithm It can achieve 10 times or so of des encryption, arithmetic speed is fast.Specifically, being ranked up processing, sequencer procedure to seed source first Can requirement according to RC4 algorithm model to input signal, shift sort generates 128 or 256 signals, then will sequence Input of the Scrambling seeds source as RC4 algorithm model afterwards extracts the seed of RC4 algorithm model generation as key seed.Clothes Device end be engaged in when generating seed, does same processing.Key seed generating algorithm provided by the embodiments of the present application is in standard pair On the basis of claiming Encryption Algorithm, one layer of scrambling processing has been done, more one layer of encipherment protection crack difficulty height, reliability is stronger.
In one of the embodiments, as shown in fig. 6, data transmission security control method further include:
S50: the second key is generated according to the dynamic code and scrambling algorithms.
Intelligent terminal for Internet of things has diversity, different industries, different user, all terminals used of different application scene Capacity of water in terms of computing capability, storage resource, traffic rate, power consumption is different.For example, wisdom cell The internet-of-things terminals such as intelligent water, electricity and gas table, environment PM2.5 detector, controller for road lamp, have been generally configured with central processing function mould Block and network communicating function module, have certain function of safety protection.And the intelligent video camera head of smart city, intelligence are paid eventually End, intelligent gateway such as control in intelligent car networking at the terminals, itself has operating system, has powerful arithmetic element, storage energy Power, communication capacity, external sensible ability.Single enciphering and deciphering algorithm is used in traditional technology, is not able to satisfy different disposal ability Intelligent terminal, resource allocation is unreasonable.In response to this problem, data transmission security control method provided by the embodiments of the present application, It is selective that two kinds of keys can be generated in target network node terminal.In view of the second key generated using scrambling algorithms is counted It is more many fastly than the processing speed for carrying out data encryption or decryption using above-mentioned first key according to the processing speed of encryption or decryption, The data transmission security control method of the embodiment of the present application, it is raw by dynamic code (for example, Pseudo-Random Noise Code) and scrambling algorithms At the second key, for being used when data encryption or decryption.Wherein, if the Pseudo-Random Noise Code that dynamic code is 32, second Key can serve to indicate that the data to be sent that are sent out of needs are grouped by 32 (4 bytes) and Pseudo-Random Noise Code into Row exclusive or etc. scrambles operation, generates ciphertext, decrypting process of the terminal to ciphertext to be decrypted and the ciphering process to data to be sent Similar, this will not be repeated here.
In one of the embodiments, as shown in fig. 6, data transmission security control method further include:
S60: in the case where the first kind for receiving server generation encrypts pattern, pattern alternating is encrypted according to the first kind Data encryption or decryption are carried out using first key and the second key；
Or
S70: in the case where the second class for receiving server generation encrypts pattern, pattern is encrypted according to the second class and is used First key carries out data encryption or decryption；
Wherein, first kind encryption pattern is what server was generated when determining target network node terminal overload operation； Second class encryption pattern is that server is generated in the non-overload operation of judgement target network node terminal.
The data transmission security control method provided in the application one embodiment can determine terminal excess load fortune When row, sends the first kind and encrypt pattern to the terminal, to indicate that the terminal alternately uses first key and the second key pair to receive and dispatch Data carry out encryption or decryption process, to reduce terminal burden, guarantee that the terminal can operate normally.For the number of different content According to the requirement of safety coefficient height when carrying out data transmission to it is often different, for example, being related in the sensitivity such as internal list The data of appearance, it is generally higher to security request data, and the data such as time in journal file, to security request data generally compared with It is low.It, alternately can using the detailed process that first key and the second key pair sending and receiving data carry out encryption or decryption process based on this To be: data higher for security request data can be carried out using the first key that arithmetic speed is slow but security performance is high Encryption or decryption process, data lower for security request data can be carried out using faster second key of arithmetic speed Encryption or decryption process.Under the premise of ensureing data transmission security, can be according to target network node terminal the case where, is adaptive Terminal key selection should be adjusted, processing speed, reasonable distribution resource are improved.For target network node terminal processing capacity foot In the case where enough, total data can be encrypted or be decrypted using first key, do not influence the normal operation of terminal and In the case where data processing speed, improve data transfer safety.
First kind encryption pattern and the second class encryption pattern include N block identifiers in one of the embodiments, often The corresponding block of information to be encrypted of position block identifier or block of information to be decrypted；
It is the first value that the first kind, which encrypts the N-i position block identifier in pattern, and the first kind encrypts the position the i block identifier in pattern For second value, N and i are the natural number more than or equal to 1, and i≤N, the corresponding original information block of each block identifier or one Block of information to be decrypted；
The position the N block identifier that second class encrypts pattern is the first value；
Wherein, the first value is used to indicate target network node terminal and is believed using first key the corresponding target of block identifier Breath block is encrypted or is decrypted；It is corresponding using the second key pair block identifier that second value is used to indicate target network node terminal Target information block is encrypted or is decrypted；Target information block is block of information to be encrypted or block of information to be decrypted.
Wherein, data to be sent are drawn by byte and are segmented into multiple above-mentioned block of informations to be encrypted, and ciphertext to be decrypted presses byte It draws and is segmented into multiple above-mentioned block of informations to be decrypted.When the first value and second value are binary machine code, the first value can be with It is 1 or 0, second value can be 0 or 1, and the first value is not equal to second value.
It is generally configured with stronger security protection capable terminal, there is also more attack approach, and have Generally Recognized as safe The terminal of protective capacities, although it is less by the approach of outside world, its processing capacity is lower, carries out data encryption or solution The Diversity of requirement and the terminal self-ability of the close processing to network nodes terminal processing capacity forms contradiction.Consider Arrive, in onesize original information block, its processing speed of different Encryption Algorithm difference is larger, for example, based on it is pseudo- with The scrambling algorithms of machine noise code 80~100 times of processing speed faster than symmetric encipherment algorithm.Preferably to implement to the application The course of work for the key selection generation method that example provides is described, and is herein raw using symmetric encipherment algorithm with first key At key and the second key be the key that scrambling algorithms based on Pseudo-Random Noise Code generate for, be illustrated.
Specifically, needing to comprehensively consider the data-handling capacity and current sending and receiving data amount of target network node terminal, example Such as, the configuration information of target network node terminal may include the data-handling capacity of the terminal, can first obtain the data The sending and receiving data amount of processing capacity parameter and the target network node terminal, then according to the data-handling capacity parameter, The sending and receiving data amount of the target network node terminal and preset excess load threshold value judge that the target network node terminal is No overload operation, deterministic process can be, and by current sending and receiving data amount divided by the data-handling capacity parameter of the terminal, obtain Current working capacity occupancy illustrates that the current terminal is in excess load fortune if occupancy is more than preset excess load threshold value Row state can send the first kind at this time and encrypt pattern to the terminal, and first kind encryption pattern can be 32 bytes (128 Position) variable, can be generated by server by random algorithm, the quantity balanced proportions of the controllable bit 1 and 0 of random algorithm. When corresponding bit is 1, then the block identifier on this is 1, is used to indicate terminal to the original information block of corresponding byte-sized It is encrypted or is decrypted using first key, when corresponding bit is 0, then the block identifier on this is 0, is used to indicate the terminal The original information block of corresponding byte is encrypted or decrypted using the second key, so that terminal is to a part of raw information Block is encrypted or is decrypted using the first key that symmetric encipherment algorithm generates, and ensures high confidentiality when significant data transmission, The data of lightweight security requirements can be encrypted or be decrypted using the second key that scrambling algorithms generate, due to scrambling Algorithm is more many fastly than symmetric encipherment algorithm processing speed, therefore saves computing resource, while also avoiding the exposure of plaintext, While ensureing data safety, it can be realized terminal encryption and adaptively adjust.Wherein, terminal is receiving first key and When two keys, nandflash can be stored it in.Wherein, first key and the second key be in addition to using the algorithm in citing, It can also be realized by other algorithms with processing speed difference, this will not be repeated here.
On the other hand, the embodiment of the present application also provides a kind of data transmission security control method as shown in Figure 7, the party Method includes:
S100: dynamic code is sent to target network node terminal, makes target network terminal according to dynamic code and target network The configuration information of nodal terminal generates first key, and first key is by target network node terminal for carrying out data encryption or solution It is close.
For improve data transfer safety, data transmission security control method provided by the embodiments of the present application can also be given birth to At and send target network node terminal configuration information and dynamic code to each target network node terminal, for each target network section Point terminal is used when generating key, specifically, the configuration information and dynamic code of target network node terminal can be with key kinds Sub- generating algorithm combines, and generates the key seed of dynamic change, which can be used as the input of Symmetric key generation device, leads to Cross the Symmetric key generation device generate can dynamic change first key, compared to traditional technology use static keys side Formula, anti-reversing crack ability are stronger.
In one of the embodiments, as shown in fig. 7, data transmission security control method further include:
S200: the configuration information of target network node terminal is obtained；
S300: according to the configuration information of target network node terminal, judging target network node terminal, whether excess load is transported Row；
S400: if it is determined that target network node terminal overload operation, then generate and send the first kind and encrypt pattern to mesh Network nodes terminal is marked, first kind encryption pattern is used to indicate target network node terminal and adds by the first preset rules progress data Close or decryption；
S500: if it is determined that the non-overload operation of target network node terminal, then generate and send the second class encryption pattern extremely Target network node terminal, the second class encryption pattern are used to indicate target network node terminal and carry out data by the second preset rules Encryption or decryption；
Wherein, terminal processing capacity needed for carrying out data encryption or decryption by the first preset rules is lower than default by second Terminal processing capacity needed for rule carries out data encryption or decryption.
Wherein, target network node terminal can be one or more terminals in Intelligent internet of things, which can be into Row data encryption or decryption, with safe sending and receiving data.When the target network node terminal needs transmission data outward, to pending Ciphertext is generated after sending data to be encrypted, is issued with ciphertext form, which needs to receive other equipment biography When defeated ciphertext to be decrypted, the step of decrypting to ciphertext to be decrypted is executed, obtains the data to be sent that other equipment want transmission. Configuration information may include the hardware parameter for being able to reflect the target network node terminal and the application software parameter installed thereon Deng can be and obtained from server, be also possible to the hardware parameter that has been arranged when terminal factory.Needed for encryption or decryption The cpu resource of terminal processing capacity required occupancy when referring to same data progress encryption or decryption process.
For under the premise of guaranteeing data transmission security, the resource of reasonable distribution target network node terminal is at Preferably working condition, data transmission security control method provided by the embodiments of the present application are whole by obtaining target network node The configuration information at end, to judge the terminal at present whether in overload operation state, if it is determined that overload operation, then explanation should Terminal data volume to be dealt with exceed terminal data-handling capacity, will cause terminal operating slowly or data processing speed Phenomena such as slow is spent, at this point it is possible to which sending the first kind encrypts pattern to the terminal, first kind encryption pattern is used to indicate terminal use First preset rules carry out encryption or decryption process to sending and receiving data, to reduce terminal burden, guarantee that the terminal can be transported normally Row.If it is determined that the non-overload operation of target network node terminal, server then generates and sends the second class and encrypts pattern to target Network nodes terminal makes target network node terminal carry out encryption or decryption process to sending and receiving data using the second preset rules, The terminal resource is made full use of to carry out data encryption or decryption.Wherein, data are encrypted or is solved using the first preset rules Close data transmission security can be lower than the data transmission security for being encrypted or being decrypted to data using the second preset rules Property, data transmission security is higher, frequently with key it is more complicated, consumed terminal resource is more.In target network section In the point enough situations of terminal processing capacity, it can be carried out at data encryption or decryption using the high key of preventing decryption ability Reason, improve data transfer safety；In the insufficient situation of the terminal processing capacity, it can be taken second place using preventing decryption ability close Key carries out data encryption or decryption processing, under the premise of data transmission security, guarantees the normal operation of the terminal.
It in some possible embodiments, can be according to the configuration information of target network node terminal and preset super negative Lotus threshold value come judge the terminal whether overload operation.For example, as used by the data-handling capacity and the terminal of terminal The dominant frequency parameter of CPU has important relationship, and the configuration information of target network node terminal may include the dominant frequency parameter of CPU, super negative Lotus threshold value can be the dominant frequency parameter of 1GHz, and (according to application scenarios difference, the occurrence of the excess load threshold value can be adjusted accordingly It is whole), in this case, if the dominant frequency parameter of the CPU of target network node terminal is greater than 1GHz, determine the non-excess load of the terminal Operation determines the terminal overload operation if the dominant frequency parameter of the CPU of target network node terminal is less than 1GHz.
In other feasible embodiments, it can also directly be judged according to the configuration information of target network node terminal Target network node terminal whether overload operation.For example, can be according to the process performance of target network node terminal by target Network node is divided into two kinds of network nodes terminals, and two kinds of network nodes terminals are respectively the high network nodes terminal of process performance The low network nodes terminal of (terminal for not having operating system for example) and process performance (for example, has the end of operating system End)；The type that then can determine target network node terminal according to the configuration information of target network node terminal, when according to target network When the configuration information of network nodal terminal determines that target network node terminal is process performance high network nodes terminal, then net is judged The non-overload operation of network nodal terminal；When determining that target network node terminal is according to the configuration information of target network node terminal When the low network nodes terminal of process performance, then network nodes terminal overload operation is judged.It is not limited to be previously mentioned two kinds Mode can also have more embodiments to judge that target network node terminal is come the configuration information according to target network node No overload operation, the embodiment of the present application is with no restrictions.
First kind encryption pattern and the second class encryption pattern include N block identifiers in one of the embodiments, often The corresponding block of information to be encrypted of position block identifier or block of information to be decrypted；
It is the first value that the first kind, which encrypts the N-i position block identifier in pattern, and the first kind encrypts the position the i block identifier in pattern For second value, N and i are the natural number more than or equal to 1, and i≤N, the corresponding original information block of each block identifier or one Block of information to be decrypted；
The position the N block identifier that second class encrypts pattern is the first value；
Wherein, the first value is used to indicate target network node terminal and is believed using first key the corresponding target of block identifier Breath block is encrypted or is decrypted；It is corresponding using the second key pair block identifier that second value is used to indicate target network node terminal Target information block is encrypted or is decrypted；Target information block is block of information to be encrypted or block of information to be decrypted.
Wherein, data to be sent are drawn by byte and are segmented into multiple above-mentioned block of informations to be encrypted, and ciphertext to be decrypted presses byte It draws and is segmented into multiple above-mentioned block of informations to be decrypted.When the first value and second value are binary machine code, the first value can be with It is 1 or 0, second value can be 0 or 1, and the first value is not equal to second value.
It is generally configured with stronger security protection capable terminal, there is also more attack approach, and have Generally Recognized as safe The terminal of protective capacities, although it is less by the approach of outside world, its processing capacity is lower, carries out data encryption or solution The Diversity of requirement and the terminal self-ability of the close processing to network nodes terminal processing capacity forms contradiction.Consider Arrive, in onesize original information block, its processing speed of different Encryption Algorithm difference is larger, for example, based on it is pseudo- with The scrambling algorithms of machine noise code 80~100 times of processing speed faster than symmetric encipherment algorithm.Preferably to implement to the application The course of work for the key selection generation method that example provides is described, and is herein raw using symmetric encipherment algorithm with first key At key and the second key be the key that scrambling algorithms based on Pseudo-Random Noise Code generate for, be illustrated.
The generating process of first kind encryption pattern and the second class encryption pattern may is that server first obtains data processing energy The sending and receiving data amount of force parameter and the target network node terminal, then according to data-handling capacity parameter, target network section Point terminal sending and receiving data amount and preset excess load threshold value, judge target network node terminal whether overload operation, judgement Process can be, and by current sending and receiving data amount divided by the data-handling capacity parameter of the terminal, obtains current working capacity and occupies Rate illustrates that the current terminal is in overload operation state, can send out at this time if occupancy is more than preset excess load threshold value The first kind is sent to encrypt pattern to the terminal, first kind encryption pattern can be the variable of 32 bytes (128), can be by taking Device be engaged in by random algorithm generation, random algorithm can control the quantity balanced proportions of bit 1 and 0.When corresponding bit is 1, then Block identifier on this is 1, is used to indicate terminal and is added to the original information block of corresponding byte-sized using first key Decryption, when corresponding bit is 0, then the block identifier on this is 0, is used to indicate the terminal to the original information block of corresponding byte Encryption and decryption is carried out using the second key so that terminal a part of original information block is generated using symmetric encipherment algorithm the One key carries out encryption and decryption, ensures high confidentiality when significant data transmission, the data of lightweight security requirements can be adopted Encryption and decryption is carried out with the second key that scrambling algorithms generate, fastly very than symmetric encipherment algorithm processing speed due to scrambling algorithms It is more, therefore computing resource is saved, while also avoiding the exposure of plaintext, while ensureing data safety, it can be realized end Hold encryption self-adaptation adjustment.Wherein, terminal can store it in Nand_ when receiving first key and the second key flash.Wherein, 1 and the 0 of block identifier, which puts in order, can be the preset orders periodic arrangements such as 10101, can also be according to number It is arranged according to importance, the corresponding information block identifier of significant data is assigned as 1, it will number lower for security requirement 0 is assigned as according to corresponding information block identifier.
Data transmission security control method in one of the embodiments, further include:
Dynamic code is updated before each network connection disconnects；Or
Timing updates dynamic code；Or
Dynamic code is updated in the first update request command for receiving the transmission of target network node terminal.
In the embodiment of the present application, the update method of dynamic code is additionally provided, it can be in the disconnection of each server and target network When the TCP/IP connection of network nodal terminal, by the server update dynamic code, the first key generated according to the dynamic code is synchronous It is broadcast to each network nodes terminal of Intelligent internet of things, can preferably to realize data interaction between each terminal.In addition, dynamic The update of state code can also be to be forced to update by server, for example, it may be timing updates, generates new dynamic code.It can also be by Server is updated according to the request of target network node terminal, for example, receiving the first of network nodes terminal transmission When updating request command, the dynamic code is updated, the first update request command can be what the terminal generated during idle time, can also be with It is that terminal timing generates.
Data transmission security control method in one of the embodiments, further include:
First kind encryption pattern is updated before each network connection disconnects and the second class encrypts pattern；Or
Timing updates first kind encryption pattern and the second class encrypts pattern；Or
Receive target network node terminal transmission second update request command when update the first kind encryption pattern and Second class encrypts pattern；Or
In keep alive timer time-out, updates first kind encryption pattern and the second class encrypts pattern.
Key management control method provided by the embodiments of the present application updates protection by providing encryption pattern, increases by one layer Dynamic security protection.Specifically, can be when each server be disconnected and being connect with the TCP/IP of target network node terminal, by taking The device update first kind of being engaged in encrypts pattern and the second class encrypts pattern, again according to the processing capacity sum number of target network node terminal Key selection is carried out according to transmitting-receiving amount to generate；It can also be and updated by server timing；Or receiving the of terminal transmission It is updated when two update request commands, for example, active transmission second updates request command to service when the terminal idle Device, instruction server carry out the update of first kind encryption pattern and the second class encryption pattern.Further, it is also possible in keep alive timer When overtime, i.e., the terminal disconnection is connect with server after be more than that certain time still fails to establish TCP/IP connection, then server is more New first kind encryption pattern and the second class encrypt pattern.The present invention encrypts pattern by the setting first kind and the second class encrypts pattern Update mechanism, guarantee and target network node terminal between block of information identifier space consistency, while can handle because The packet loss that outwardly and inwardly factor generates such as network problem, plant issue, disorder phenomenon, guarantee to apply the key management controlling party The reliability service of the adaptive terminal encryption system of method.Wherein, first update request command and second update request command can be with It is identical order, when the two is identical order, dynamic code and first kind encryption pattern/second class encryption figure may be implemented The synchronized update of sample.
Data transmission security control method in one of the embodiments, further include:
The first key and second key synchronization are broadcasted to other network nodes terminals.
It, will after generating first key and/or the second key for convenience of data interaction is carried out between each network nodes terminal Result synchronized broadcast is generated to other network nodes terminals.
It should be understood that although each step in the flow chart of Fig. 2-7 is successively shown according to the instruction of arrow, These steps are not that the inevitable sequence according to arrow instruction successively executes.Unless expressly stating otherwise herein, these steps Execution there is no stringent sequences to limit, these steps can execute in other order.Moreover, at least one in Fig. 2-7 Part steps may include that perhaps these sub-steps of multiple stages or stage are not necessarily in synchronization to multiple sub-steps Completion is executed, but can be executed at different times, the execution sequence in these sub-steps or stage is also not necessarily successively It carries out, but can be at least part of the sub-step or stage of other steps or other steps in turn or alternately It executes.
The embodiment of the present application provides a kind of data transmission security control device, as shown in Figure 8, comprising:
Dynamic code obtains module 1, for obtaining the dynamic code of server transmission；
Key seed generation module 2, for according to dynamic code, the configuration information of target network node terminal and key seed Generating algorithm generates key seed；
First key determining module 3, for key seed to be input to Symmetric key generation device, and it is raw to obtain symmetric key It grows up to be a useful person the first key of generation；
Encryption/decryption module 4, for carrying out data encryption or decryption using first key.
Wherein, each module in data transmission security control device, the realization of step performed by unit are referred to State the explanation in the embodiment in data transmission security control method.A kind of data provided by the embodiments of the present application add transmission control Device obtains the dynamic codes such as the Pseudo-Random Noise Code that the acquisition server of module 1 generates by dynamic code, and it is raw to pass through key seed Key seed is generated according to the configuration information and key seed generating algorithm of the dynamic code code and the terminal at module 2, then into one Step, using the key seed as the input of Symmetric key generation device, is obtained first key, avoided by first key determining module 3 The problem of static keys of single fixation are easily inversely cracked, then it is to be encrypted to this according to the first key by encryption/decryption module 4 Ciphertext to be decrypted is decrypted in data encryption, improves the safety of terminal data transmission.
In one of the embodiments, as shown in figure 9, key seed generation module 2 includes:
Static seed factor generation unit 21, for equipment management key, application software to be managed key and media interviews It controls address to arrange by preset rules, to generate the static seed factor；
Dynamic key seed determination unit 22 is used for according to dynamic code, the static seed factor and key seed generating algorithm, Generate key seed.
In one of the embodiments, as shown in Figure 10, dynamic key seed determination unit 22 includes:
Scrambling seeds source generation unit 221 is generated for being scrambled according to Pseudo-Random Noise Code to static seed factor step-by-step Scrambling seeds source；
Descrambling key seed determination unit 222, for generating key according to Scrambling seeds source and key seed generating algorithm Seed.
In one of the embodiments, as shown in figure 11, descrambling key seed determination unit 222 includes:
Scrambling seeds source sequencing unit 2221, for being ranked up to Scrambling seeds source；
RC4 key seed determination unit 2222, for the Scrambling seeds source after sequence to be input to RC4 algorithm model, and Obtain the key seed that RC4 algorithm model generates.
In one of the embodiments, as shown in figure 8, data transmission security control device further include:
Second key determining module 5, for generating the second key according to dynamic code and scrambling algorithms.
In one of the embodiments, as shown in figure 8, data transmission security control device further include:
Alternating keys selecting module 6, in the case where for encrypting pattern in the first kind for receiving server generation, according to First kind encryption pattern alternately uses first key and the second key to carry out data encryption or decryption；
Or
Single key selecting module 7, in the case where for encrypting pattern in the second class for receiving server generation, according to Second class encrypts pattern and carries out data encryption or decryption using first key；
Wherein, first kind encryption pattern is what server was generated when determining target network node terminal overload operation； Second class encryption pattern is that server is generated in the non-overload operation of judgement target network node terminal.
The embodiment of the present application also provides a kind of data transmission security control devices, as shown in figure 12, comprising:
Dynamic code sending module 100, for sending dynamic code to target network node terminal, make target network terminal according to Dynamic code and the configuration information of target network node terminal generate first key, and first key is used for by target network node terminal Carry out data encryption or decryption.
Data transmission security control device in one of the embodiments, as shown in figure 12, further includes:
Selection parameter obtains module 200, for obtaining the configuration information of target network node terminal；
Excess load judgment module 300 judges target network node for the configuration information according to target network node terminal Terminal whether overload operation；
First operating mode selecting module 400, for generating simultaneously when determining target network node terminal overload operation Send the first kind and encrypt pattern to target network node terminal, first kind encryption pattern be used to indicate target network node terminal by First preset rules carry out data encryption or decryption；
Second operating mode selecting module 500, for generating in the non-overload operation of judgement target network node terminal And send the second class and encrypt pattern to target network node terminal, the second class encryption pattern is used to indicate target network node terminal Data encryption or decryption are carried out by the second preset rules；
Wherein, terminal processing capacity needed for carrying out data encryption or decryption by the first preset rules is lower than default by second Terminal processing capacity needed for rule carries out data encryption or decryption.
Key management control device in one of the embodiments, further include:
Dynamic code update module, for updating dynamic code before each network connection disconnects；Or timing updates dynamic code； Or when receive the transmission of target network node terminal first updates request command, update dynamic code.It is updated by dynamic code Module updates dynamic code, further increases data transmission security.
Key management control device in one of the embodiments, further include:
Pattern update module is encrypted, for updating first kind encryption pattern and the second class before each network connection disconnects Encrypt pattern；Or timing updates first kind encryption pattern and the second class encrypts pattern；Or receiving target network node terminal Second sent updates the first kind encryption pattern when updating request command and the second class encrypts pattern；Or in keep alive timer time-out When, it updates first kind encryption pattern and the second class encrypts pattern.The first kind, which is updated, by encryption pattern update module encrypts pattern Pattern is encrypted with the second class, intermittently to modulate key management controlling party according to the processing capacity of target network node terminal Case makes target network node terminal be in preferable working condition.
It should be noted that modules in the control of above-mentioned data transmission security can be fully or partially through software, hard Part and combinations thereof is realized.Above-mentioned each module can be embedded in the form of hardware or independently of in the processor in computer equipment, It can also be stored in a software form in the memory in computer equipment, execute the above modules in order to which processor calls Corresponding operation.
In one embodiment, a kind of computer equipment is provided, which can be terminal or server, Internal structure chart can be as shown in figure 13.The computer equipment includes processor, the memory, network connected by system bus Interface, display screen and input unit.Wherein, the processor of the computer equipment is for providing calculating and control ability.The calculating The memory of machine equipment includes non-volatile memory medium, built-in storage.The non-volatile memory medium is stored with operating system And computer program.The built-in storage provides ring for the operation of operating system and computer program in non-volatile memory medium Border.The network interface of the computer equipment is used to communicate with external terminal by network connection.The computer program is processed To realize a kind of data transmission security control method when device executes.The display screen of the computer equipment can be liquid crystal display or Person's electric ink display screen, the input unit of the computer equipment can be the touch layer covered on display screen, be also possible to count Key, trace ball or the Trackpad being arranged on machine equipment shell are calculated, can also be external keyboard, Trackpad or mouse etc..
It will be understood by those skilled in the art that structure shown in Figure 13, only part relevant to application scheme The block diagram of structure, does not constitute the restriction for the computer equipment being applied thereon to application scheme, and specific computer is set Standby may include perhaps combining certain components or with different component layouts than more or fewer components as shown in the figure.
A kind of computer equipment provided by the embodiments of the present application, including memory and processor, memory are stored with calculating Machine program, processor perform the steps of when executing computer program
S10: the dynamic code that server is sent is obtained；
S20: according to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key is generated Seed；
S30: being input to Symmetric key generation device for key seed, obtains the first key that Symmetric key generation device generates；
S40: data encryption or decryption are carried out using first key.
Wherein, the paraphrase of the nouns such as be-encrypted data is identical as the paraphrase in above-mentioned data transmission security control method, herein It does not repeat them here.Computer equipment can be server or terminal, which can be with each net in Intelligent internet of things Network nodal terminal is communicated.Specifically, computer equipment provided by the embodiments of the present application is using the dynamic such as Pseudo-Random Noise Code Code and target network node terminal configuration information, obtain can more new change key seed, and using the key seed as The input of Symmetric key generation device, obtains first key, which can be set for updating according to user, such as every Secondary TCP/IP connection is updated before disconnecting, and perhaps forces to update or by terminal idle state by computer equipment (server) When actively to computer equipment (server) apply update.For the key obtained compared to traditional Symmetric key generation device, The Information Security that its applied internet-of-things terminal is waited at runtime is higher.It should be noted that the embodiment of the present application provides Computer equipment, processor thereon can also realize in above-mentioned data transmission security control method when executing computer program Other steps, the beneficial effect realized also is same as above, and therefore not to repeat here.
A kind of Internet of things system, as shown in Figure 1, comprising:
Server 104, server include memory and processor, and memory is stored with computer program, and processor executes The step of data transmission security control method of above-mentioned server side is realized when computer program；
Multiple terminals 102, each terminal include memory and processor, and memory is stored with computer program, in terminal The processor of target network terminal realizes the step of the data transmission security control method of above-mentioned terminal side when executing computer program Suddenly.
Server 104 and each terminal 102 in Internet of things system provided by the embodiments of the present application can execute above-mentioned side Step in method embodiment realizes identical beneficial effect, and this will not be repeated here.
Present invention also provides a kind of computer readable storage mediums, are stored thereon with computer program, computer program It is performed the steps of when being executed by processor
S10: the dynamic code that server is sent is obtained；
S20: according to dynamic code, the configuration information of target network node terminal and key seed generating algorithm, key is generated Seed；
S30: being input to Symmetric key generation device for key seed, obtains the first key that Symmetric key generation device generates；
S40: data encryption or decryption are carried out using first key.
Those of ordinary skill in the art will appreciate that realizing all or part of the process in above-described embodiment method, being can be with Relevant hardware is instructed to complete by computer program, the computer program can be stored in a non-volatile computer In read/write memory medium, the computer program is when being executed, it may include such as the process of the embodiment of above-mentioned each method.Wherein, To any reference of memory, storage, database or other media used in each embodiment provided herein, Including non-volatile and/or volatile memory.Nonvolatile memory may include read-only memory (ROM), programming ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM) or flash memory.Volatile memory may include Random access memory (RAM) or external cache.By way of illustration and not limitation, RAM is available in many forms, Such as static state RAM (SRAM), dynamic ram (DRAM), synchronous dram (SDRAM), double data rate sdram (DDRSDRAM), enhancing Type SDRAM (ESDRAM), synchronization link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic ram (DRDRAM) and memory bus dynamic ram (RDRAM) etc..The application is real In the computer storage medium that example offer is provided, also realize that above-mentioned data pass when the computer program stored thereon is executed by processor The step of defeated method of controlling security, this will not be repeated here.
Each technical characteristic of embodiment described above can be combined arbitrarily, for simplicity of description, not to above-mentioned reality It applies all possible combination of each technical characteristic in example to be all described, as long as however, the combination of these technical characteristics is not deposited In contradiction, all should be considered as described in this specification.
The embodiments described above only express several embodiments of the present invention, and the description thereof is more specific and detailed, but simultaneously Limitations on the scope of the patent of the present invention therefore cannot be interpreted as.It should be pointed out that for those of ordinary skill in the art For, without departing from the inventive concept of the premise, various modifications and improvements can be made, these belong to guarantor of the invention Protect range.Therefore, the scope of protection of the patent of the invention shall be subject to the appended claims.

Claims (15)

1. a kind of data transmission security control method, which is characterized in that the method is applied to target network node terminal, described Method includes:
Obtain the dynamic code that server is sent；
According to the dynamic code, the configuration information of the target network node terminal and key seed generating algorithm, key is generated Seed；
The key seed is input to Symmetric key generation device, and it is close to obtain the Symmetric key generation device generates first Key；
Data encryption or decryption are carried out using the first key.
2. data transmission security control method according to claim 1, which is characterized in that the target network node terminal Configuration information include: equipment management key, application software management key and media access control address；
It is described according to the dynamic code, the configuration information of the target network node terminal and key seed generating algorithm, generate The step of key seed includes:
The equipment management key, application software management key and media access control address are arranged by preset rules, with life At the static seed factor；
According to the dynamic code, the static seed factor and the key seed generating algorithm, the key seed is generated.
3. data transmission security control method according to claim 2, which is characterized in that the dynamic code is pseudo random noise Acoustic code；
It is described according to the dynamic code, the static seed factor and the key seed generating algorithm, generate key seed Step includes:
The static seed factor step-by-step is scrambled according to the Pseudo-Random Noise Code, generates Scrambling seeds source；
According to the Scrambling seeds source and the key seed generating algorithm, key seed is generated.
4. data transmission security control method according to any one of claim 1-3, which is characterized in that the method is also Include:
The second key is generated according to the dynamic code and scrambling algorithms.
5. data transmission security control method according to claim 4, which is characterized in that the method also includes:
In the case where the first kind for receiving server generation encrypts pattern, pattern is encrypted according to the first kind and is alternately used The first key and second key carry out data encryption or decryption；
Or
In the case where the second class for receiving server generation encrypts pattern, according to second class encryption pattern use First key carries out data encryption or decryption；
Wherein, the first kind encryption pattern is the server when determining the target network node terminal overload operation It generates；The second class encryption pattern is the server in the non-overload operation of the judgement target network node terminal It generates.
6. data transmission security control method according to claim 5, which is characterized in that first kind encryption pattern and The second class encryption pattern includes N block identifiers, the corresponding block of information to be encrypted or to be decrypted of every block identifier Block of information；
N-i position block identifier in the first kind encryption pattern is the first value, the position the i block mark in the first kind encryption pattern Knowing symbol is second value, and N and i are the natural number more than or equal to 1, and i≤N；
The position the N block identifier of the second class encryption pattern is first value；
Wherein, it is corresponding to block identifier using the first key to be used to indicate the target network node terminal for first value Target information block encrypted or decrypted；The second value is used to indicate the target network node terminal using described second The corresponding target information block of key pair block identifier is encrypted or is decrypted；The target information block is the block of information to be encrypted Or block of information to be decrypted.
7. a kind of data transmission security control method, which is characterized in that the method is applied to server, which comprises
Dynamic code is sent to target network node terminal, makes the target network terminal according to the dynamic code and target network section The configuration information of point terminal generates first key, and the first key is added by the target network node terminal for carrying out data Close or decryption.
8. data transmission security control method according to claim 7, which is characterized in that the method also includes:
Obtain the configuration information of target network node terminal；
According to the configuration information of the target network node terminal, judging the target network node terminal, whether excess load is transported Row；
If it is determined that the target network node terminal overload operation, then generate and send the first kind and encrypt pattern to the target Network nodes terminal, the first kind encryption pattern are used to indicate the target network node terminal and carry out by the first preset rules Data encryption or decryption；
If it is determined that the non-overload operation of target network node terminal, then generate and send the second class and encrypt pattern to the mesh Mark network nodes terminal, second class encryption pattern be used to indicate the target network node terminal by the second preset rules into Row data encryption or decryption；
Wherein, terminal processing capacity needed for carrying out data encryption or decryption by the first preset rules, which is lower than, presses the second preset rules Terminal processing capacity needed for carrying out data encryption or decryption.
9. data transmission security control method according to claim 7 or 8, which is characterized in that the method also includes:
The dynamic code is updated before each network connection disconnects；Or
Timing updates the dynamic code；Or
The dynamic code is updated when receiving the first update request command that the target network node terminal is sent.
10. data transmission security control method according to claim 8, which is characterized in that the method also includes:
The first kind encryption pattern is updated before each network connection disconnects and second class encrypts pattern；Or
Timing updates the first kind encryption pattern and second class encryption pattern；Or
The first kind encryption figure is updated when receiving the second update request command that the target network node terminal is sent Sample and second class encrypt pattern；Or
In keep alive timer time-out, the first kind encryption pattern and second class encryption pattern are updated.
11. a kind of data transmission security control device, which is characterized in that described device is applied to target network node terminal, institute Stating device includes:
Key seed parameter acquisition module, for obtaining the dynamic code of server transmission；
Key seed generation module, for according to the dynamic code, the configuration information of target network node terminal and key seed Generating algorithm generates key seed；
First key determining module for the key seed to be input to Symmetric key generation device, and obtains described symmetrical close The first key that key generator generates；
Encryption/decryption module, for carrying out data encryption or decryption using the first key.
12. a kind of data transmission security control device, which is characterized in that described device is applied to server, and described device includes:
Dynamic code sending module makes the target network terminal according to institute for sending dynamic code to target network node terminal The configuration information for stating dynamic code and target network node terminal generates first key, and the first key is by the target network section Point terminal is for carrying out data encryption or decryption.
13. a kind of computer equipment, which is characterized in that including memory and processor, memory is stored with computer program, place It manages when device executes computer program and realizes data transmission security control described in any one of any one of claim 1-6 or 7-10 The step of method processed.
14. a kind of Internet of things system characterized by comprising
Server, the server include memory and processor, and memory is stored with computer program, and processor executes calculating The step of data transmission security control method described in any one of claim 7-10 is realized when machine program；
Multiple terminals, each terminal include memory and processor, and memory is stored with computer program, in the terminal The processor of target network terminal realizes data transmission security of any of claims 1-6 when executing computer program The step of control method.
15. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the program is by processor The step of data transmission security control method described in any one of any one of claim 1-6 or 7-10 is realized when execution.
CN201910785238.2A 2019-08-23 2019-08-23 Data transmission safety control method and device, computer equipment and Internet of things system Active CN110430218B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910785238.2A CN110430218B (en) 2019-08-23 2019-08-23 Data transmission safety control method and device, computer equipment and Internet of things system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910785238.2A CN110430218B (en) 2019-08-23 2019-08-23 Data transmission safety control method and device, computer equipment and Internet of things system

Publications (2)

Publication Number Publication Date
CN110430218A true CN110430218A (en) 2019-11-08
CN110430218B CN110430218B (en) 2021-08-13

Family

ID=68415774

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910785238.2A Active CN110430218B (en) 2019-08-23 2019-08-23 Data transmission safety control method and device, computer equipment and Internet of things system

Country Status (1)

Country Link
CN (1) CN110430218B (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110868294A (en) * 2019-12-09 2020-03-06 北京智宝云科科技有限公司 Key updating method, device and equipment
CN112260823A (en) * 2020-09-16 2021-01-22 浙江大华技术股份有限公司 Data transmission method, intelligent terminal and computer readable storage medium
CN113518056A (en) * 2020-04-09 2021-10-19 武汉慧禹信息科技有限公司 Safe transmission method for link of Internet of things
CN113965425A (en) * 2020-07-01 2022-01-21 珠海优特智厨科技有限公司 Access method, device and equipment of Internet of things equipment and computer readable storage medium
CN115134637A (en) * 2022-06-29 2022-09-30 北京奇艺世纪科技有限公司 Streaming media playing system, method and device, electronic equipment and storage medium

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102742250A (en) * 2012-03-13 2012-10-17 华为终端有限公司 Secret key transmitting method based on transport layer safety, intelligent meter reading terminal and server
CN102780698A (en) * 2012-07-24 2012-11-14 南京邮电大学 User terminal safety communication method in platform of Internet of Things
CN103795534A (en) * 2012-10-31 2014-05-14 三星Sds株式会社 Password-based authentication method and apparatus executing the method
CN104182867A (en) * 2014-08-20 2014-12-03 深圳一卡通新技术有限公司 Order sending method, receiving method, sending device, receiving device and system
US20160014100A1 (en) * 2014-07-10 2016-01-14 Panasonic Intellectual Property Management Co., Ltd. Communication system, communication device, key management apparatus, and communication method
CN107171789A (en) * 2017-04-20 2017-09-15 努比亚技术有限公司 A kind of safe login method, client device and server
CN108370316A (en) * 2015-10-02 2018-08-03 韩国框架研究院 The integral authentication system being authenticated using disposable random number
CN109525565A (en) * 2018-11-01 2019-03-26 石豫扬 A kind of defence method and system for SMS interception attack

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102742250A (en) * 2012-03-13 2012-10-17 华为终端有限公司 Secret key transmitting method based on transport layer safety, intelligent meter reading terminal and server
CN102780698A (en) * 2012-07-24 2012-11-14 南京邮电大学 User terminal safety communication method in platform of Internet of Things
CN103795534A (en) * 2012-10-31 2014-05-14 三星Sds株式会社 Password-based authentication method and apparatus executing the method
US20160014100A1 (en) * 2014-07-10 2016-01-14 Panasonic Intellectual Property Management Co., Ltd. Communication system, communication device, key management apparatus, and communication method
CN104182867A (en) * 2014-08-20 2014-12-03 深圳一卡通新技术有限公司 Order sending method, receiving method, sending device, receiving device and system
CN108370316A (en) * 2015-10-02 2018-08-03 韩国框架研究院 The integral authentication system being authenticated using disposable random number
CN107171789A (en) * 2017-04-20 2017-09-15 努比亚技术有限公司 A kind of safe login method, client device and server
CN109525565A (en) * 2018-11-01 2019-03-26 石豫扬 A kind of defence method and system for SMS interception attack

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110868294A (en) * 2019-12-09 2020-03-06 北京智宝云科科技有限公司 Key updating method, device and equipment
CN110868294B (en) * 2019-12-09 2023-03-24 北京智宝云科科技有限公司 Key updating method, device and equipment
CN113518056A (en) * 2020-04-09 2021-10-19 武汉慧禹信息科技有限公司 Safe transmission method for link of Internet of things
CN113965425A (en) * 2020-07-01 2022-01-21 珠海优特智厨科技有限公司 Access method, device and equipment of Internet of things equipment and computer readable storage medium
CN113965425B (en) * 2020-07-01 2023-07-18 珠海优特智厨科技有限公司 Access method, device and equipment of Internet of things equipment and computer readable storage medium
CN112260823A (en) * 2020-09-16 2021-01-22 浙江大华技术股份有限公司 Data transmission method, intelligent terminal and computer readable storage medium
CN112260823B (en) * 2020-09-16 2022-08-09 浙江大华技术股份有限公司 Data transmission method, intelligent terminal and computer readable storage medium
CN115134637A (en) * 2022-06-29 2022-09-30 北京奇艺世纪科技有限公司 Streaming media playing system, method and device, electronic equipment and storage medium
CN115134637B (en) * 2022-06-29 2024-04-12 北京奇艺世纪科技有限公司 Streaming media playing system, method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN110430218B (en) 2021-08-13

Similar Documents

Publication Publication Date Title
CN110430218A (en) Data transmission security control method and device, computer equipment and Internet of things system
CN110545176B (en) Encryption and decryption method and device and Internet of things system
Gandino et al. Key management for static wireless sensor networks with node adding
CN102799800B (en) Security encryption coprocessor and wireless sensor network node chip
CN108075890A (en) Data sending terminal, data receiver, data transmission method and system
CN104717297A (en) Safety cloud storage method and system
Nakkar et al. Lightweight broadcast authentication protocol for edge-based applications
CN110289952A (en) A kind of quantal data chain secrecy terminal and secret communication network
CN105306194A (en) Multiple encryption method and multiple encryption system for encrypting file and/or communication protocol
CN101738516A (en) Electronic electric energy meter and data secure transmission method thereof
Arman et al. Design and implementation of a modified AES cryptography with fast key generation technique
Genge et al. Engineering security-aware control applications for data authentication in smart industrial cyber–physical systems
Hu et al. Smart contract assisted privacy-preserving data aggregation and management scheme for smart grid
CN116208330A (en) Industrial Internet cloud-edge cooperative data secure transmission method and system based on quantum encryption
Jammula et al. Performance evaluation of lightweight cryptographic algorithms for heterogeneous IoT environment
CN109040120A (en) A kind of SV message encryption and decryption method based on IEC61850 standard
Reza et al. Salsa20 based lightweight security scheme for smart meter communication in smart grid
KR20180138349A (en) IoT TERMINAL APPARATUS FOR GENERATING DYNAMIC SESSION KEY AND METHOD FOR USING THE SAME
CN103249035A (en) Wireless sensor network data encryption transmission method
CN105790926A (en) Method for realizing working mode of block cipher algorithm for WIA-PA security
Jamshaid et al. SEKEN: secure and efficient key exchange for sensor networks
Cao A security communication device based on narrowband internet of things
Kadam et al. Lightweight Cryptography to Secure Internet of Things (IoT)
CN110047181B (en) Intelligent door lock safety control method based on Zigbee
CN106788968A (en) It is applied to the implementation method of the security coprocessor of WIA-PA agreements

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right
TA01 Transfer of patent application right

Effective date of registration: 20210205

Address after: B1601, Shenzhen national engineering laboratory building, No.20, Gaoxin South 7th Road, high tech Zone community, Yuehai street, Shan District, Shenzhen, Guangdong 518000

Applicant after: Shenzhen shuliantianxia Intelligent Technology Co.,Ltd.

Address before: 1003, 10 / F, block D, Shenzhen Institute of Aerospace Science and technology innovation building, no.6, South Science and technology 10 road, high tech South District, Nanshan District, Shenzhen, Guangdong 518051

Applicant before: SHENZHEN H & T HOME ONLINE NETWORK TECHNOLOGY Co.,Ltd.

GR01 Patent grant
GR01 Patent grant