Disclosure of Invention
According to the problems in the prior art, a method and a system for information secure transmission are provided, wherein a communication process between a security gateway and a cloud service platform is encrypted by using a national cryptographic chip and a national cryptographic algorithm, and a secret key is updated according to a preset condition, so that the encryption algorithm is independent and controllable, a certification authority is authoritative and credible, the security and the reliability of information transmission are greatly improved, and the communication security between an intelligent home and the cloud service platform is ensured.
The technical scheme specifically comprises the following steps:
the information security transmission method is applied to an intelligent home system and is characterized in that the intelligent home system comprises a cloud service platform and a plurality of security gateways, the cloud service platform is remotely connected with the plurality of security gateways, a national password chip is arranged in each security gateway, and the information security transmission method comprises the following steps:
step S1, the cloud service platform generates a first key corresponding to the security gateway after receiving a predetermined signal of the security gateway, the first key comprises a public key and a private key, and the first key is generated according to an asymmetric cryptographic algorithm;
step S2, the cloud service platform saves the private key and sends the public key to the corresponding security gateway;
step S3, after receiving the public key, the security gateway writes the public key into the national password chip;
step S4, the national password chip generates a second key according to a symmetric cryptographic algorithm, and encrypts the second key by using the public key;
step S5, the security gateway transmits the encrypted second key to the cloud service platform;
step S6, the cloud service platform decrypts the encrypted second key through the private key, and obtains and stores the second key corresponding to the security gateway;
step S7, the cloud service platform and the security gateway perform encryption and decryption operations on the data to be transmitted through the second key.
Preferably, in step S3, after the public key is written into the cryptographic chip, the security gateway sends a write receipt to the cloud service platform.
Preferably, the symmetric cryptographic algorithm is a domestic cryptographic algorithm SM1 or SM4, among others.
Preferably, the asymmetric cryptographic algorithm is a domestic cryptographic algorithm SM 2.
Preferably, the predetermined signal is a first predetermined signal generated and sent by the security gateway at initialization time, or a second predetermined signal sent by the security gateway for indicating to update the first key.
Preferably, wherein the second key is updated before each data transmission; or
The second key is updated after a predetermined time interval.
An intelligent home system, characterized in that the information security transmission method according to claim 1 is applied, wherein the cloud service platform comprises:
the first receiving module is used for receiving a predetermined signal sent by the security gateway;
the generating module is connected with the first receiving module and used for generating the first key according to the preset signal;
the storage module is connected with the generation module and used for storing the private key;
the first sending module is connected with the generating module and used for sending the public key to the corresponding security gateway;
the encryption and decryption module is connected with the storage module and is used for carrying out encryption and decryption operations on the transmitted data;
the security gateway includes:
a second receiving module, configured to receive the public key;
the writing module is connected with the second receiving module and the national secret chip and used for writing the public key into the national secret chip;
and the second sending module is connected with the national secret chip and used for sending the encrypted second secret key to the cloud service platform.
Preferably, the security gateway further includes a third sending module connected to the writing module, the writing module writes the public key into the cryptographic chip and then generates a written receipt, and the third sending module sends the written receipt to the cloud service platform.
Preferably, wherein the second key is updated before each data transmission; or
The second key is updated after a predetermined time interval.
Preferably, the predetermined signal is a first predetermined signal generated and sent by the security gateway at initialization time, or a second predetermined signal sent by the security gateway for indicating to update the first key.
The beneficial effects of the above technical scheme are that:
the communication process of the security gateway and the cloud service platform is encrypted by utilizing the national cryptographic chip and the national cryptographic algorithm, and the secret key is updated according to the preset conditions, so that the autonomous controllability of the encryption algorithm is ensured, the authority of a certificate authority is credible, the safety and the reliability of information transmission are greatly improved, and the communication safety of the smart home and the cloud service platform is ensured.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the embodiments and features of the embodiments may be combined with each other without conflict.
The invention is further described with reference to the following drawings and specific examples, which are not intended to be limiting.
An information security transmission method is applied to an intelligent home system, as shown in fig. 1, wherein the intelligent home system includes a cloud service platform 1 and a plurality of security gateways 2, the cloud service platform 1 is remotely connected to the plurality of security gateways 2, a national security chip 22 is disposed in each security gateway 2, and the information security transmission method includes:
step S1, the cloud service platform 1 generates a first key corresponding to the security gateway 2 after receiving a predetermined signal of the security gateway 2, the first key comprises a public key and a private key, and the first key is generated according to an asymmetric cryptographic algorithm;
step S2, the cloud service platform 1 stores the private key and sends the public key to the corresponding security gateway 2;
step S3, after receiving the public key, the security gateway 2 writes the public key into the national password chip 22;
step S4, the cryptographic chip 22 generates a second key according to the symmetric cryptographic algorithm, and encrypts the second key using the public key;
step S5, the security gateway 2 transmits the encrypted second key to the cloud service platform 1;
step S6, the cloud service platform 1 decrypts the encrypted second key through the private key, obtains the second key corresponding to the security gateway 2 and stores the second key;
in step S7, the cloud service platform 1 and the security gateway 2 perform encryption and decryption operations on the data to be transmitted through the second key.
As a preferred implementation, the national cipher, i.e. the domestic cryptographic algorithm identified by the national cryptology authority, belongs to the commercial cipher, and the national cryptographic algorithm is a series of algorithms specified by the national cryptology authority, including a symmetric encryption algorithm, an elliptic curve asymmetric encryption algorithm and a hash algorithm. In the invention, a secure transmission system between the cloud service platform 1 and the plurality of security gateways 2 is constructed by adopting a national cryptographic algorithm.
Firstly, a national cryptographic chip 22 capable of supporting a national cryptographic algorithm is required to be pre-embedded in each security gateway 2, wherein the cloud service platform 1 is an open system, any security gateway 2 embedded with the national cryptographic chip 22 can be connected with the cloud service platform 1 through the internet, and various services provided by the cloud service platform 1 are used, specifically, the invention adopts an asymmetric cryptographic algorithm to encrypt a first key, and adopts a symmetric cryptographic algorithm to encrypt service data between the security gateway 2 and the cloud service platform 1.
In the process of information transmission between the cloud service platform 1 and the security gateway 2, the security gateway 2 firstly sends a predetermined signal to the cloud service platform 1, and after receiving the predetermined signal, the cloud service platform 1 generates a first key associated with the security gateway 2 according to an asymmetric cryptographic algorithm in a national cryptographic algorithm, wherein the first key exists in a form of a pair of a public key and a private key. Subsequently, the cloud service platform 1 stores the private key in the generated first key in the cloud service platform 1, and sends the public key in the first key to the security gateways 2 associated with the first key, and after the process is completed, each security gateway 2 corresponds to a pair of public and private keys.
After receiving the public key sent by the cloud service platform 1, the security gateway 2 writes the public key into the national key chip 22, then the national key chip 22 in the security gateway 2 generates a second key according to a symmetric cryptographic algorithm, encrypts the generated second key with the public key in the first key, transmits the encrypted second key to the cloud service platform 1 through the internet, after receiving the encrypted second key data, the cloud service platform 1 calls the private key of the first key stored in the cloud service platform 1 and associated with the security gateway 2, decrypts the encrypted second key data through the private key to obtain the second key, similarly, the second key is also associated with the corresponding security gateway 2, after the process is completed, the same second key exists in the cloud service platform 1 and the security gateway 2, when the subsequent cloud service platform 1 and the security gateway 2 perform service data interaction, and carrying out encryption and decryption operation by using the second key to safely transmit data.
In a preferred embodiment of the present invention, in step S3, after the public key is written into the cryptographic chip 22, the security gateway 2 sends a write receipt to the cloud service platform 1.
Specifically, in this embodiment, the cloud service platform 1 sends the public key in the corresponding first key to the security gateway 2 through the internet, the security gateway 2 writes the public key into the cryptographic chip 22 after receiving the public key, and generates a write-in receipt after writing, and sends the write-in receipt back to the cloud service platform 1 to confirm that the public key has been received and stored to the cloud service platform 1, and then, the encryption and decryption operations of the second key can be performed through the public key and the private key.
In a preferred embodiment of the present invention, the symmetric cryptographic algorithm is a domestic cryptographic algorithm SM1 or SM 4.
In a preferred embodiment of the present invention, the asymmetric cryptographic algorithm is the domestic cryptographic algorithm SM 2.
In a preferred embodiment of the present invention, the predetermined signal is a first predetermined signal generated and transmitted by the security gateway 2 at initialization, or a second predetermined signal transmitted by the security gateway 2 to indicate updating of the first key.
Specifically, in this embodiment, the predetermined signal has two types, one is that when the security gateway 2 is started and requests to perform authentication connection with the cloud service platform 1, the security gateway 2 sends an initialization signal to the cloud service platform 1, and the cloud service platform 1 starts to perform subsequent steps of generating and exchanging the first key and the second key after receiving the initialization signal. The second type is a first key updating instruction sent by the security gateway 2, the security gateway 2 regenerates the first key after receiving the first key updating instruction, and sends a public key in the first key to the security gateway 2, the security gateway 2 writes the public key into the national key chip 22 and then sends a write-in receipt to the cloud service platform 1, the cloud service platform 1 confirms that the updating of the first key is completed after receiving the write-in receipt, and the whole updating process of the first key is finished.
In a preferred embodiment of the present invention, the second key is updated before each data transmission; or
The second key is updated after a predetermined time interval.
Specifically, in the present embodiment, the information secure transmission method supports both the form of one-time pad and the form of periodic key exchange, that is, allows the second key of the security gateway 2 to be exchanged after or before each traffic operation (e.g., data transmission), or sets the second key of the security gateway 2 to be exchanged after a predetermined time (e.g., 5 minutes) has elapsed. In a specific embodiment, after receiving an instruction that the cloud service platform 1 requests a new second key, the security gateway 2 sends an instruction (i.e., a key update triggering instruction) to generate the second key to the national cryptographic chip 22, the national cryptographic chip 22 calls the key generator located inside the chip to regenerate the second key, and encrypts the newly generated second key using the public key stored inside the national cryptographic chip 22, then the security gateway 2 sends the encrypted new second key to the cloud service platform 1, the cloud service platform 1 receives the encrypted data and decrypts the encrypted data by using the private key corresponding to the security gateway 2 to obtain the new second key and store the new second key, and subsequent service data interaction between the cloud service platform 1 and the security gateway 2 performs encryption and decryption operations using the new second key.
An information security transmission system, to which the above information security transmission method is applied, is shown in fig. 2, where the information security transmission system includes a cloud service platform 1 and a plurality of security gateways 2;
as shown in fig. 3, the cloud service platform 1 further includes:
a first receiving module 10, configured to receive a predetermined signal sent by the security gateway 2;
a generating module 11, connected to the first receiving module 10, for generating a first key according to a predetermined signal;
the storage module 12 is connected with the generation module 11 and used for storing the private key;
the first sending module 13 is connected to the generating module 11 and is used for sending the public key to the corresponding security gateway 2;
the encryption and decryption module 14 is connected with the storage module 12 and is used for carrying out encryption and decryption operations on the transmitted data;
as shown in fig. 4, the security gateway 2 further includes:
a second receiving module 20, configured to receive a public key;
the writing module 21 is connected with the second receiving module 20 and the national cryptographic chip 22 and is used for writing the public key into the national cryptographic chip 22;
the second sending module 23 is connected to the cryptographic chip 22, and is configured to send the encrypted second key to the cloud service platform 1.
As a preferred embodiment, the information security transmission system is disposed in an intelligent home system, wherein the first receiving module 10 and the first sending module 13 are further configured to receive and send encrypted service data transmitted between the cloud service platform 1 and the security gateway 2, respectively, in this case, the encryption/decryption module 14 is connected to the first receiving module 10 and the first sending module 13 at the same time and is configured to perform encryption/decryption operation on the transmitted service data, and similarly, the second sending module 23 and the second receiving module 20 are also configured to receive and send encrypted service data transmitted between the cloud service platform 1 and the security gateway 2 at the same time, in this case, the cryptographic chip 22 is connected to the second sending module 23 and the second receiving module 20 at the same time.
In a preferred embodiment of the present invention, the security gateway 2 further includes a third sending module 24, which is connected to the writing module 21, the writing module 21 writes the public key into the cryptographic chip 22 to generate a written receipt, and the third sending module 24 sends the written receipt to the cloud service platform 1.
Specifically, in this embodiment, the third sending module 24 and the second sending module 23 may be separately configured, and in another embodiment of the present invention, the third sending module 24 and the second sending module 23 are integrated into the same sending functional unit.
In a preferred embodiment of the present invention, the second key is updated before each data transmission; or
The second key is updated after a predetermined time interval.
In a preferred embodiment of the present invention, the predetermined signal is a first predetermined signal generated and transmitted by the security gateway 2 at initialization, or a second predetermined signal transmitted by the security gateway 2 to indicate updating of the first key.
The beneficial effects of the above technical scheme are that:
the communication process of the security gateway and the cloud service platform is encrypted by utilizing the national cryptographic chip and the national cryptographic algorithm, and the secret key is updated according to the preset conditions, so that the autonomous controllability of the encryption algorithm is ensured, the authority of a certificate authority is credible, the safety and the reliability of information transmission are greatly improved, and the communication safety of the smart home and the cloud service platform is ensured.
While the invention has been described with reference to a preferred embodiment, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention.