TW201828641A - Key generating method and device for ensuring a more secure data transmission and reducing the risk of illegally intercepting data - Google Patents

Abstract

The present invention provides a key generating method and device. The key generating method comprises: using an initial key to encrypt a first key factor generated by a first equipment, and transmitting the encrypted first key factor to the second equipment through a first secure channel, wherein the initial key is a key preset between the first equipment and the second equipment; receiving a second key factor that has been encrypted by the initial key through the first secure channel, wherein the second key factor is generated by the second equipment; decrypting the second key factor that has been encrypted by the initial key through the first secure channel, so as to obtain the second key factor; generating a shared key between the first equipment and the second equipment based on the first key factor and the second key factor. With the technical scheme of the present invention, a gateway equipment is unable to obtain the shared key negotiated between the first equipment and the second equipment, thereby ensuring a more secure data transmission between the first equipment and the second equipment, and further reducing the risk of illegally intercepting data during the transmission process.

Description

 Key generation method and device  

The present application relates to the field of network security technologies, and in particular, to a key generation method and apparatus.

In order to ensure the safe transmission of data between the terminal equipment and the gateway equipment, the gateway equipment and the public network server, security is usually established between the terminal equipment and the gateway equipment, the gateway equipment and the public network server respectively. The transmission channel, the gateway device forwards the data from one secure channel to another, thereby realizing the function of data forwarding. In the process of forwarding the data, the gateway device needs to decrypt the shared device with the terminal device through the terminal device. The encrypted data is encrypted and then forwarded to the server with the shared key of the server, so there is a risk that the gateway device will leak information.

In view of this, the present application provides a new technical solution, which can make the gateway device unable to obtain the shared key between the two devices, thereby reducing the risk of data being illegally intercepted during network transmission.

In order to achieve the above object, the present application provides the technical solution as follows: According to the first aspect of the present application, a method for generating a key is provided, which is applied to a first device, and includes: generating, by using an initial key, the first device The key is encrypted and sent to the second device by using the first secure channel, where the initial key is a preset key between the first device and the second device; The secure channel receives a second key factor encrypted by the initial key, wherein the second key factor is generated by the second device; and the initial gold received through the first secure channel Decrypting the second key factor of the key encryption to obtain the second key factor; generating the sharing of the first device and the second device according to the first key factor and the second key factor Key.

According to a second aspect of the present application, a method for generating a key, which is applied to a second device, includes: receiving, by a second secure channel, a first key factor encrypted by an initial key from a first device, where The initial key is a preset key between the first device and the second device; decrypting the first key factor encrypted by the initial key to obtain the first encryption Generating a shared key of the first device and the second device according to the first key factor and the second key factor generated by the second device.

According to the third party device of the present application, a key generation device is provided, which is applied to the first device, and includes: a first encryption module, configured to use the initial key to generate a first key factor generated by the first device Encrypting and transmitting to the second device through the first secure channel, where the initial key is a preset key between the first device and the second device; the first receiving module is configured to transmit The first secure channel receives a second key factor encrypted by the initial key, wherein the second key factor is generated by the second device; and the first decryption module is configured to The first receiving module decrypts the second key factor received by the initial key through the first secure channel to obtain the second key factor; the first key generating module, And generating a shared key of the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module.

According to a fourth aspect of the present application, a key generation apparatus is provided, which is applied to a second device, and includes: a third receiving module, configured to receive an initial key encryption from a first device through a second secure channel a first key factor, wherein the initial key is a preset key between the first device and the second device; and a third decryption module is configured to encrypt the initial key The first key factor is decrypted to obtain the first encryption factor, and the second key generation module is configured to generate according to the first key factor and the second key factor generated by the second device. a shared key of the first device and the second device.

It can be seen from the above technical solution that since the first key factor and the second key factor are encrypted by the initial key in the forwarding process of the gateway device, the initial key is preset between the first device and the second device. a key, so the gateway device does not know the first key factor and the second key factor; and the shared key between the first device and the second device is generated by the first key factor and the second key factor, The shared key for achieving the final negotiation is only known to the first device and the second device, and the gateway device still cannot obtain the shared key for negotiation, thereby ensuring more secure transmission of data between the first device and the second device, further Reduce the risk of data being illegally intercepted during transmission.

101‧‧‧Steps

102‧‧‧Steps

103‧‧‧Steps

104‧‧‧Steps

201‧‧‧Steps

202‧‧‧Steps

203‧‧‧Steps

204‧‧‧Steps

205‧‧‧Steps

301‧‧‧Steps

302‧‧‧Steps

303‧‧ steps

401‧‧‧ steps

402‧‧‧Steps

403‧‧‧Steps

404‧‧‧Steps

501‧‧‧Steps

502‧‧‧Steps

503‧‧‧Steps

601‧‧ steps

602‧‧ steps

701‧‧‧Steps

702‧‧‧Steps

703‧‧‧Steps

704‧‧‧Steps

705‧‧‧Steps

1201‧‧‧First encryption module

12011‧‧‧First Factor Generation Unit

12012‧‧‧First encryption unit

12013‧‧‧Second encryption unit

1202‧‧‧First Receiver Module

1203‧‧‧First Decryption Module

12031‧‧‧First Decryption Unit

12032‧‧‧Second encryption unit

1204‧‧‧First Key Generation Module

12041‧‧‧First determination unit

12042‧‧‧first factor generating unit

1205‧‧‧First Confirmation Module

1206‧‧‧Second determination module

1207‧‧‧First replacement module

1208‧‧‧ third determination module

1209‧‧‧ Data Encryption Module

1210‧‧‧second receiving module

1211‧‧‧Second decryption module

1401‧‧‧ Third Receiver Module

1402‧‧‧ Third Decryption Module

1403‧‧‧Second key generation module

1404‧‧‧Second encryption module

1405‧‧‧First transmission module

1406‧‧‧ third determination module

1407‧‧‧Fourth determination module

1408‧‧‧Second replacement module

1409‧‧‧fourth receiving module

1410‧‧‧ Fourth Decryption Module

1411‧‧‧Response data generation module

1412‧‧‧ Third encryption module

1413‧‧‧second transmission module

1 is a schematic flow chart of a method for generating a key according to an exemplary embodiment of the present invention; FIG. 2 is a schematic flowchart of a method for generating a key according to an exemplary embodiment 2 of the present invention; A flow diagram of a method for generating a key according to an exemplary embodiment 3 of the present invention is shown; FIG. 4 is a flow chart showing a method for generating a key according to an exemplary embodiment 4 of the present invention; A schematic flowchart of a key generation method according to an exemplary embodiment 5 of the present invention; FIG. 6 is a flow chart showing a key generation method according to an exemplary embodiment 6 of the present invention; A schematic flowchart of a method for generating a key of an exemplary embodiment of the present invention; FIG. 8 is a schematic diagram showing signaling of key agreement between a terminal device and a server according to an exemplary embodiment of the present invention; FIG. 9 is a schematic diagram showing signaling for data transmission between a terminal device and a server to which the present invention is applied according to an exemplary embodiment of the present invention; FIG. 10 shows a terminal according to an exemplary embodiment of the present invention. FIG. 11 is a schematic structural diagram of a server according to an exemplary embodiment of the present invention; FIG. 12 is a schematic structural diagram of a key generating apparatus according to an exemplary embodiment of the present invention; 13 is a block diagram showing a structure of a key generating apparatus according to still another exemplary embodiment of the present invention; and FIG. 14 is a block diagram showing a structure of a key generating apparatus according to still another exemplary embodiment of the present invention; A schematic structural diagram of a key generation apparatus according to another exemplary embodiment of the present invention.

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the drawings. When the following description refers to the drawings, the same numerals in the different figures represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with aspects of the present application as detailed in the appended claims.

The terminology used in the present application is for the purpose of describing particular embodiments, and is not intended to be limiting. The singular forms "a", "the" and "the" It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, the first information may also be referred to as second information without departing from the scope of the present application. Similarly, the second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when" or "when" or "in response to a determination."

In order to further explain the present application, the following embodiments are provided: According to an embodiment of the present application, since the first key factor and the second key factor are both subjected to initial key encryption in the forwarding process of the gateway device, the initial key is obtained. a preset key between the first device and the second device, so the gateway device does not know the first key factor and the second key factor; and generates the first through the first key factor and the second key factor The shared key between the device and the second device can implement the final negotiated shared key only for the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, thereby ensuring that the data is in the first A more secure transmission between the device and the second device further reduces the risk of data being illegally intercepted during transmission.

FIG. 1 is a schematic flowchart diagram of a method for generating a key according to an exemplary embodiment of the present invention; in an embodiment, the first device may be a terminal device, and the second device may be a server, or The first device may be a server, and the second device may be a terminal device. The embodiment is exemplified by the application on the terminal device. As shown in FIG. 1 , the key generation method includes the following steps: Step 101: The initial key is used to encrypt the first key factor generated by the first device and sent to the second device through the first secure channel, where the initial key is a preset key between the first device and the second device; 102. Receive, by using the first secure channel, a second key factor that is encrypted by the initial key, where the second key factor is generated by the second device. Step 103: encrypt the initial key received through the first secure channel. The second key factor is decrypted to obtain a second key factor; and in step 104, the shared key of the first device and the second device is generated according to the first key factor and the second key factor.

In step 101, in one embodiment, the initial key K _basic can be put into use before the first device, a second device K _basic previously issued to the first device, can be issued to the first embodiment through hardware write device. In an embodiment, the first device and the second device forward the related data information through the gateway device, wherein the first secure channel may be established by the first device and the gateway device, and transmitted through the first secure channel. Data information, the second secure channel can be established by the server and the gateway device, and the related information is transmitted through the second secure channel. It can be understood by those skilled in the art that the process of establishing the first secure channel and the second secure channel can be referred to the related description of the related art. For example, a Secure Socket Layer (SSL) can be used. The key negotiation mechanism of the Transport Layer Security (TLS).

In an embodiment, when the first device needs to initiate a key negotiation process to the second device, the first key factor is generated by using a pseudo-random function, and the first key factor is encrypted by using the initial key to obtain the first time. The encrypted first key factor uses the first encryption key of the first secure channel to encrypt the first encrypted first key factor to obtain the second encrypted first key factor. By double encryption of the first key factor, the first key factor can be made unknown at the gateway device, avoiding the risk that the first key factor is illegally intercepted on the gateway device side.

In step 103, the double-encrypted second key factor is decrypted by using the first encryption key to obtain the second decrypted second key factor, and the first key is decrypted by the initial key pair. The key factor is decrypted to obtain a second key factor. Since the second key factor has been double-encrypted at the second device, the second key factor is not known at the gateway device, avoiding the risk of the second key factor being illegally intercepted on the gateway device side.

For a detailed description of how to generate the shared key of the first device and the second device according to the first key factor and the second key factor in step 104, refer to the following description, which will not be described in detail herein.

It can be seen from the above description that since the first key factor and the second key factor are encrypted by the initial key during the forwarding process of the gateway device, the initial key is the preset gold between the first device and the second device. Key, therefore, the gateway device does not know the first key factor and the second key factor; and the shared key between the first device and the second device is generated by the first key factor and the second key factor, which can be implemented The final shared key is only known to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, thereby ensuring more secure transmission of data between the first device and the second device, further reducing The risk of data being illegally intercepted during transmission.

FIG. 2 is a schematic flowchart diagram of a method for generating a key according to an exemplary embodiment of the present invention. In this embodiment, how to pass the first key factor and the second in step 105 in the embodiment shown in FIG. As shown in FIG. 2, the key generation method includes the following steps: Step 201: Determine the first device and the second device. The initial key shared by the first device and the device identifier of the first device; in step 202, the initial key, the device identifier, the first key factor, and the second key factor are sequentially connected to obtain a combined string; and step 203, the combined word is The string is divided into two substrings of equal length; in step 204, two substrings are respectively hashed to obtain two hash results; and in step 205, the two hash results are XORed by bits. , obtaining a shared key of the first device and the second device.

After the first device obtains the second key factor through step 104 in the embodiment shown in FIG. 1, the first device has the first key factor p and the second key factor q. The first device may take the first key factor and the second key factor as inputs, and use the shared key generation algorithm to obtain the key K _AC . The key generation algorithm is as follows: K _AC = KeyGenerate (K _basic , "Shared Key", p, q); wherein K _basic is the initial key, the Shared Key is the device identifier of the first device, and the device identifier can be The device serial number of the first device may also be a MAC address, or a combination of the two, or the like, as long as the second device can distinguish the first device from other devices through the device identifier.

In addition, in the process of generating the shared key through the function KeyGenerate, the string corresponding to the first encryption key K _basic , "Shared Key", p, q may be sequentially connected to obtain a combined string, and the combined string utilization function is used. KeyGenerate generates the shared key K _AC .

In an embodiment, the process implemented by the function KeyGenerate may be specifically: dividing the input combined string into two substrings of equal length (if the length of the combined string is an odd number, at the end of the combined string) One bit complements 1), and then hashes the two substrings separately (for example, MD5), and the obtained two calculation results are XORed by bits, and the obtained result is the shared key K _AC .

Taking MD5 as an example for illustration, since MD5 can convert an input of any length into a result of 128-bit length, the length of the shared key K _AC is 128 bits, which simplifies the complexity of shared key calculation. Since the calculation of the shared key K _AC uses MD5, the amount of calculation can be tolerated for the first device with limited computing power.

In this embodiment, the shared key K _{AC is} generated by using the first key factor, the second key factor, the initial key, and the device identifier of the first device, thereby implementing the transmission between the first device and the second device. The shared key K _{AC is} negotiated and shared securely, and the shared key K _{AC is} unknown to the gateway device as the intermediate node, so that it can be ensured that the first device can use the shared key K _AC pair to send to the second device. Data is encrypted to ensure the security of the data during network transmission.

FIG. 3 is a schematic flowchart diagram of a key generation method according to an exemplary embodiment 3 of the present invention. On the basis of the foregoing embodiment, as shown in FIG. 3, the key generation method includes the following steps: Step 301: a replacement key of the shared key of the first device and the second device; step 302, re-determining the first encryption factor and the second encryption factor according to the replacement cycle; and step 303, replacing according to the re-determined first encryption factor and the second encryption factor A shared key of the first device and the second device.

In one embodiment, the first and second devices may agree on a shared key K _AC replacement cycle, when the shared key K _AC using the replacement cycle duration corresponding to relaunch between the first and second devices The process of generating the shared key K _AC can further ensure the security of the shared key K _AC and the data in the network transmission process, and further reduce the possibility that the shared key K _AC is cracked.

FIG. 4 is a schematic flowchart diagram of a method for generating a key according to an exemplary embodiment of the present invention. After the shared key is generated in the embodiment shown in FIG. 1, the first device may be transmitted through the shared key. The data is encrypted and transmitted to the second device. As shown in FIG. 4, the process of encrypting and transmitting the data to be transmitted includes the following steps: Step 401: determining, to the second device, the data to be transmitted sent by the first device; 402. Encrypt the data to be transmitted by using the shared key, and send the data to the second device through the first secure channel. Step 403: Receive the response data generated by the second device by receiving the data to be transmitted, and respond The data has been encrypted by the shared key; in step 404, the response data encrypted by the shared key is decrypted by using the shared key to obtain response data.

In step 401, the data to be transmitted may be the Internet of Things data acquired by the sensor on the first device.

For related descriptions of the first security channel in step 402 and step 403, reference may be made to the related description of the embodiment shown in FIG. 1 above, and details are not described herein again.

In step 404, when receiving the response data encrypted by the shared key through the first secure channel, the response data encrypted by the shared key may be decrypted through the first encryption key of the first secure channel, and then The shared key decrypts the response data a second time to obtain the original response data.

In this embodiment, since the data to be transmitted is encrypted by the shared key during the forwarding process of the gateway device, and the shared key is the key negotiated between the first device and the second device, the gateway device is The shared key cannot be known, so that the data to be transmitted can be transmitted more securely between the first device and the second device, further reducing the risk of the data being illegally intercepted during transmission.

FIG. 5 is a schematic flowchart of a method for generating a key according to an exemplary embodiment 5 of the present invention. In this embodiment, the first device may be a terminal device, and the second device may be a server. On the second device, as shown in FIG. 5, the key generation method includes the following steps: Step 501: Receive, by using a second secure channel, the first key factor encrypted by the initial key from the first device, where the initial key is The key is a preset key between the first device and the second device; step 502, decrypting the first key factor encrypted by the initial key to obtain a first encryption factor; and step 503, according to the first key factor The second key factor generated by the second device generates a shared key of the first device and the second device.

For a description of the second security channel in step 501, refer to the related description of the embodiment shown in FIG. 1 above, and details are not described herein.

In step 502, after receiving the first key factor encrypted by the initial key through the second secure channel, the first key encrypted by the initial key may be first transmitted through the second encryption key of the second secure channel. The factor is decrypted, and then the first key factor is decrypted a second time through the initial key to obtain the original first key factor.

For a detailed description of how to generate the shared key of the first device and the second device according to the first key factor and the second key factor in step 503, refer to the description of the embodiment shown in FIG. 2, which is not described in detail herein.

It can be seen from the above description that since the first key factor and the second key factor are encrypted by the initial key during the forwarding process of the gateway device, the initial key is the preset gold between the first device and the second device. Key, therefore, the gateway device does not know the first key factor and the second key factor; and the shared key between the first device and the second device is generated by the first key factor and the second key factor, which can be implemented The final shared key is only known to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, thereby ensuring more secure transmission of data between the first device and the second device, further reducing The risk of data being illegally intercepted during transmission.

FIG. 6 is a schematic flowchart diagram of a method for generating a key according to an exemplary embodiment 6 of the present invention. As shown in FIG. 6, the method for generating a key includes the following steps: Step 601: generating an initial device by using an initial key The second key factor is encrypted; in step 602, the second key factor encrypted by the initial key is sent to the first device through the second secure channel.

In this embodiment, the second key element encrypted by the initial key is used for the second encryption by using the second encryption key of the second secure channel, so that the gateway can be sent to the first device through the gateway. When the device forwards, the second key factor is unknown to the gateway device, and the risk that the second key factor is illegally intercepted on the gateway device side is avoided.

FIG. 7 is a schematic flowchart diagram of a key generation method according to an exemplary embodiment 7 of the present invention. As shown in FIG. 7, the key generation method includes the following steps: Step 701: Receive the first through the second secure channel. Step 702: decrypting the data to be transmitted by using the shared key; Step 703: After receiving the data to be transmitted, generating response data; Step 704, using the shared key The response data is encrypted; in step 705, the response data encrypted by the shared key is sent to the first device through the second secure channel.

For a description of the second security channel in step 701, refer to the related description of the embodiment shown in FIG. 1 above, which is not described in detail herein.

In step 704, after receiving the data to be transmitted from the first device through the second secure channel, the data to be transmitted through the shared key is decrypted by the shared key to obtain the original data, and the first device needs to be When the response is received, the response data encrypted by the shared key may be encrypted through the second encryption key of the second secure channel, so that the gateway device cannot obtain the original response data during the process of forwarding the response data.

In this embodiment, since the data to be transmitted is encrypted by the shared key during the forwarding process of the gateway device, and the shared key is the key negotiated between the first device and the second device, the gateway device is The shared key cannot be known, so that the data to be transmitted can be transmitted more securely between the first device and the second device, further reducing the risk of the data being illegally intercepted during transmission.

Through the foregoing embodiment, the shared key can be generated in each corresponding local key generation algorithm based on the initial key preset between the first device and the second device, and finally the data to be transmitted is encrypted by using the shared key. Therefore, the gateway device can not view the original data when forwarding the data in the network, thereby achieving the purpose of safely transmitting data.

FIG. 8 is a schematic diagram of signaling for key agreement between a terminal device and a server according to an exemplary embodiment of the present invention. The first device is a terminal device, and the second device is a server. The description shows that, before the terminal device is connected to the network, the server needs to issue an initial key (K _basic ) to the terminal device in advance, which can be issued to the terminal device by means of hardware writing, as shown in FIG. The key agreement between the terminal device and the server includes the following steps: Step 801, the terminal device negotiates with the gateway device the first encryption key (K _AB ) of the first secure channel, and establishes a relationship between the terminal device and the gateway device. The first safe passage. For the method of establishing the first secure channel, refer to the related description of the prior art.

Step 802: The gateway device negotiates with the server a second encryption key (K _BC ) of the second secure channel, and establishes a second secure channel. Similar to the foregoing step 801, the process of establishing the second secure channel can be referred to the related description of the prior art, and the key negotiation mechanism of SSL and TLS can also be adopted. It will be understood by those of ordinary skill in the art that the order of steps 801 and 802 can be interchanged, and the order of execution can be set according to actual execution requirements.

Step 803: The terminal device prepares to initiate a key negotiation process with the server, and the terminal device generates a first key factor (p), where the first key factor is used to generate a shared key of the terminal device and the server. At the same time, the first key factor is encrypted by using the initial key (K _basic ) to obtain K _basic (p), and then encrypted by the first encryption key K _{AB to} obtain K _AB [K _basic (p)].

Step 804: The terminal device sends the double-encrypted first key factor K _AB [K _basic (p)] to the gateway device through the first secure channel.

Step 805, after receiving the double-encrypted first key factor K _AB [K _basic (p)], the gateway device adopts the first encryption key K _AB of the first secure channel to the double-encrypted first gold. The key factor K _AB [K _basic (p)] is decrypted to obtain K _basic (p), and then encrypted by the third encryption key K _{BC of the} second secure channel to obtain double-encrypted K _BC [K _basic (p) )].

Step 806: The first key factor K _BC [K _basic (p)] double-encrypted by the initial key and the second encryption key is sent to the server through the second secure channel.

Step 807: After receiving the double-encrypted first key factor, the server decrypts the double-encrypted first key factor by using the second encryption key K _BC of the second secure channel to obtain K _basic (p). Then, K _basic (p) is decrypted using the initial key K _basic to obtain the first key factor p.

Step 808, the server generates a second key factor (q) through the pseudo-random function, and the second key factor q will be used together with the first key factor p as a parameter to generate the shared key K _AC .

Step 809, the server using the initial encryption key K _basic second encryption factor q, to give K _basic (q), and then using a second encryption key K _BC (q) to K _basic encryption, to give K _BC [K _basic (q )].

In step 810, the server sends the double-encrypted second key factor K _BC [K _basic (q)] to the gateway device through the second secure channel.

Step 811, after the gateway device receives the double-encrypted second key factor K _BC [K _basic (q)], the second encryption key K _BC of the second secure channel is used to double-encrypt the second encryption factor. Decrypting to obtain K _basic (q), and then encrypting with the first encryption key K _AB of the first secure channel to obtain K _AB [K _basic (q)], and then passing the double encrypted second encryption factor through A secure channel is sent to the terminal device.

Step 812: After receiving the double-encrypted second encryption factor, the terminal device decrypts the double-encrypted second encryption factor by using the first encryption key K _AB of the first secure channel to obtain K _basic (q). Then, the first decrypted K _basic (q) is secondarily decrypted by the first encryption key K _basic to obtain the second key factor q.

Step 813, the terminal device and the server share the first key factor p and the second key factor q, and the terminal device and the server both use the first key factor and the second key factor as inputs, and generate the key by using a key. The algorithm obtains the shared key K _AC between the terminal device and the server. For a detailed description of the key generation algorithm, refer to the related description of the embodiment shown in FIG. 2, which is not described in detail herein.

In this embodiment, the security negotiation and sharing between the terminal device and the public network server are implemented by the shared key K _AC , and the shared key pair is unknown to the gateway device as the intermediate node, and then the terminal device can utilize The shared key encrypts the Internet of Things data sent to the public network server, thereby ensuring the security of data transmission.

In order to further ensure the security of the shared key and the data transmission, the terminal device can periodically perform a key negotiation process with the server to replace the shared key K _AC , thereby further reducing the possibility that the shared key is cracked.

FIG. 9 is a schematic flowchart diagram of a data transmission method according to an exemplary embodiment of the present invention. After the shared secret key is generated through the embodiment shown in FIG. 8, the terminal device needs to send the Internet of Things data to the server. As shown in FIG. 9, the data transmission method includes the following steps: Step 901: Encrypt the Internet of Things data once by using the shared key K _AC to obtain the ciphertext K _AC (data), and then use the first of the first secure channel. encryption key K _AB secondary encryption, ciphertext _{K AB [K AC (data)} ].

Step 902: The terminal device sends the ciphertext K _AB [K _AC (data)] to the gateway device through the first secure channel.

Step 903, after receiving the ciphertext K _AB [K _AC (data)], the gateway device decrypts using the first security key K _{AB to} obtain K _AC (data), and then encrypts using the second encryption key K _BC . Get ciphertext K _BC [K _AC (data)].

In step 904, the gateway device sends the ciphertext K _BC [K _AC (data)] to the server through the second secure channel.

Step 905: After receiving the double-encrypted ciphertext K _BC [K _AC (data)], the server decrypts using the second encryption key K _{BC to} obtain K _AC (data), and then decrypts using the shared key K _AC . Get the original IoT data.

Step 906: After obtaining the original IoT data, the server generates response data (res), encrypts the response data by using the shared key K _AC , obtains ciphertext K _AC (res), and then uses the second encryption key K _BC Perform secondary encryption to get K _BC [K _AC (res)].

In step 907, the server sends the double-encrypted ciphertext K _BC [K _AC (res)] to the gateway device through the second secure channel.

Step 908, after receiving the double-encrypted ciphertext K _BC [K _AC (res)], the gateway device decrypts using the second encryption key K _{BC to} obtain K _AC (res), and then uses the first encryption key K. _AB encrypts to get ciphertext K _AB [K _AC (res)].

Step 909: The gateway device sends the double-encrypted ciphertext K _AB [K _AC (res)] to the terminal device through the first secure channel.

Step 910: After receiving the double-encrypted ciphertext K _AB [K _AC (res], the terminal device decrypts using the first encryption key K _{AB to} obtain K _AC (res), and then decrypts using the shared key K _{AC to} obtain Original response data (res).

In this embodiment, the terminal device implements cross-domain key negotiation and sharing between the gateway device of the intermediate node and the server, and the shared key is unknown to the gateway device, ensuring that the Internet of Things data is in the terminal device and End-to-end secure transmission between servers; in addition, in addition to ensuring secure transmission of data between the terminal device and the gateway device and secure transmission of data between the gateway device and the public network server, the data is in the gateway device on the transmission path The forwarding process is also protected by security. Even if the gateway device is illegally invaded, the IoT data forwarded through the gateway device is still protected by the shared key encryption to prevent the IoT data from being illegally intercepted.

Corresponding to the above-described key generation method, the present application also proposes a schematic structural diagram of the terminal device according to an exemplary embodiment of the present application shown in FIG. Referring to FIG. 10, on the hardware side, the network server includes a processor, an internal bus, a network interface, a memory, and non-volatile memory, and may of course include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to form a key generation device on a logical level. Of course, in addition to the software implementation, the present application does not exclude other implementation manners, such as a logical device or a combination of software and hardware, etc., that is, the execution body of the following processing flow is not limited to each logical unit, and may also be It is a hardware or logic device.

Corresponding to the above-described key generation method, the present application also proposes a schematic configuration diagram of the server according to an exemplary embodiment of the present application shown in FIG. Referring to FIG. 11, on the hardware side, the network server includes a processor, an internal bus, a network interface, a memory, and non-volatile memory, and may of course include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to form a key generation device on a logical level. Of course, in addition to the software implementation, the present application does not exclude other implementation manners, such as a logical device or a combination of software and hardware, etc., that is, the execution body of the following processing flow is not limited to each logical unit, and may also be It is a hardware or logic device.

FIG. 12 is a schematic structural diagram of a key generation apparatus according to an exemplary embodiment of the present invention; as shown in FIG. 12, the key generation apparatus may include: a first encryption module 1201, and a first receiving module 1202. The first decryption module 1203 and the first key generation module 1204. The first encryption module 1201 is configured to encrypt the first key factor generated by the first device by using the initial key, and send the first key element to the second device by using the first secure channel, where the initial key is the first device and a preset key between the second devices; the first receiving module 1202 is configured to receive, by using the first secure channel, a second key factor encrypted by the initial key, where the second key factor is generated by the second device The first decryption module 1203 is configured to decrypt the second key factor that is received by the first receiving module 1202 through the first secure channel and is encrypted by the initial key to obtain a second key factor; The key generation module 1204 is configured to generate a shared key of the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module 1203.

FIG. 13 is a schematic structural diagram of a key generation apparatus according to still another exemplary embodiment of the present invention; as shown in FIG. 13, on the basis of the embodiment shown in FIG. 12, the first encryption module 1201 may include a first factor generating unit 12011, configured to generate a first key factor through a pseudo-random function when the first device needs to initiate a key negotiation process to the second device; the first encrypting unit 12012 is configured to adopt an initial key pair The first key factor generated by the first factor generating unit 12011 is encrypted to obtain the first key factor after the first encryption; the second encrypting unit 12013 is configured to use the first encryption key pair of the first secure channel. The first key factor encrypted by the first encryption unit 12012 is encrypted to obtain the first key factor after the second encryption.

In an embodiment, the first decryption module 1203 includes: a first decryption unit 12031, configured to decrypt the double-encrypted second key factor by using the first encryption key, to obtain a second decrypted second key The second encryption unit 12032 is configured to decrypt the second key factor decrypted by the first decryption unit 12031 by using the initial key to obtain a second key factor.

In an embodiment, the first key generation module 1204 may include: a first determining unit 12041, configured to determine a first encryption key shared between the first device and the second device, and a device identifier of the first device; The first factor generating unit 12042 is configured to generate the first device according to the first encryption key, the device identifier determined by the first determining unit 12041, the first key factor, and the second key factor obtained by the first decryption module 1203. The shared key of the second device.

In an embodiment, the first factor generating unit is specifically configured to: sequentially connect the first encryption key, the device identifier, the first key factor, and the second key factor to obtain a combined string; and divide the combined string into Two substrings of equal length; respectively hashing the two substrings to obtain two hash results; and performing an exclusive OR operation on the two hash results to obtain the first device and the second device Shared key.

In an embodiment, the device may further include: a first determining module 1205, configured to determine a replacement period of the shared key of the first device and the second device; and a second determining module 1206, configured to determine, according to the first determining mode The replacement period determined by the group 1205 re-determines the first encryption factor and the second encryption factor; the first replacement module 1207 is configured to replace the first device according to the first encryption factor and the second encryption factor re-determined by the second determination module 1206. The shared key with the second device.

In an embodiment, the device may further include: a third determining module 1208, configured to determine that the first device needs to send the data to be transmitted to the second device; and a data encryption module 1209, configured to use the shared key pair The data to be transmitted determined by the third determining module 1208 is encrypted and sent to the second device through the first secure channel.

In an embodiment, the device may further include: a second receiving module 1210, configured to receive, by using the first security, the response data generated by the second device after receiving the data to be transmitted, and the response data has been encrypted by the shared key; The second decryption module 1211 is configured to decrypt the response data encrypted by the shared key by using the shared key to obtain response data.

FIG. 14 is a schematic structural diagram of a key generation apparatus according to still another exemplary embodiment of the present invention; as shown in FIG. 14, the key generation apparatus may include: a third receiving module 1401, and a third decryption module. 1402. The second key generation module 1403. The third receiving module 1401 is configured to receive, by using the second secure channel, the first key factor that is encrypted by the initial key from the first device, where the initial key is between the first device and the second device. The third decryption module 1402 is configured to decrypt the first key factor encrypted by the initial key to obtain a first encryption factor, and the second key generation module 1403 is configured to use the first key The key factor and the second key factor generated by the second device generate a shared key of the first device and the second device.

FIG. 15 is a schematic structural diagram of a key generation apparatus according to another exemplary embodiment of the present invention; as shown in FIG. 15, on the basis of the embodiment shown in FIG. 14, the second key generation module 1403 Specifically, the first encryption key, the device identifier of the first device, the first key factor, and the second key factor are sequentially connected to obtain a combined string; the combined string is divided into two equal lengths. a string; respectively, performing hash operations on the two substrings to obtain two hash results; and performing an exclusive OR operation on the two hash results in bits to obtain a shared key of the first device and the second device.

In an embodiment, the device may further include: a second encryption module 1404, configured to encrypt the second key factor generated by the second device by using the initial key; the first sending module 1405, configured to transmit the second key The secure channel sends the second key factor encrypted by the initial key to the first device.

In an embodiment, the device may further include: a third determining module 1406, configured to determine a replacement period of the shared key of the first device and the second device; and a fourth determining module 1407, configured to re-determine according to the replacement cycle The first encryption factor and the second encryption factor; the second replacement module 1408 is configured to replace the shared key of the first device and the second device according to the re-determined first encryption factor and the second encryption factor.

In an embodiment, the device may further include: a fourth receiving module 1409, configured to receive, by the second secure channel, the data to be transmitted encrypted by the shared key from the first device; and the fourth decrypting module 1410, Decrypt the data to be transmitted using the shared key.

In an embodiment, the device may further include: a response data generating module 1411, configured to generate response data after receiving the data to be transmitted; and a third encryption module 1412, configured to perform the response data by using the shared key The second sending module 1413 is configured to send the response data encrypted by the shared key to the first device through the second secure channel.

The above embodiment can be seen that the first key factor and the second key factor are encrypted by the initial key during the forwarding process of the gateway device, and the initial key is the preset gold between the first device and the second device. Key, therefore, the gateway device does not know the first key factor and the second key factor; and the shared key between the first device and the second device is generated by the first key factor and the second key factor, which can be implemented The final shared key is only known to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, thereby ensuring more secure transmission of data between the first device and the second device, further reducing The risk of data being illegally intercepted during transmission.

Other embodiments of the present application will be readily apparent to those of ordinary skill in the art in view of this disclosure. The present application is intended to cover any variations, uses, or adaptations of the application, which are in accordance with the general principles of the application and include the general knowledge or conventional technical means in the technical field not disclosed herein. . The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the application

It is also to be understood that the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, Other elements not explicitly listed, or elements that are inherent to such a process, method, commodity, or equipment. An element defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device including the element.

The above is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc., which are made within the spirit and principles of the present application, should be included in the present application. Within the scope of protection.

Claims (28)

 A method for generating a key is applied to a first device, where the method includes: encrypting, by using an initial key, a first key factor generated by the first device, and transmitting the first key element to the second device by using a first secure channel, where The initial key is a preset key between the first device and the second device; and the second key factor encrypted by the initial key is received through the first secure channel, where The second key factor is generated by the second device; decrypting the second key factor received through the first secure channel and encrypted by the initial key to obtain the second gold a key factor; generating a shared key of the first device and the second device according to the first key factor and the second key factor.    The method of claim 1, wherein the encrypting the first key factor generated by the first device by using an initial key comprises: initiating that the first device needs to initiate to a second device During the key negotiation process, the first key factor is generated by using a pseudo-random function; the first key factor is encrypted by using the initial key to obtain the first key factor after the first encryption; The first encryption key of the secure channel encrypts the first encrypted key element to obtain the first encrypted key element after the second encryption.    The method of claim 1, wherein the decrypting the second key factor received through the first secure channel and encrypted by the first encryption key comprises: adopting Decrypting the double-encrypted second key factor by the first encryption key to obtain the second decrypted first key factor; using the initial key to decrypt the first key The latter second key factor is decrypted to obtain the second key factor.    The method of claim 1, wherein the generating the shared key of the first device and the second device according to the first key factor and the second key factor comprises: determining An initial key shared between the first device and the second device and a device identifier of the first device; according to the initial key, the device identifier, the first key factor, The second key factor generates a shared key of the first device and the second device.    The method of claim 4, wherein the generating the first according to the device identifier, the first encryption key, the first key factor, and the second key factor The shared key of the device and the second device includes: sequentially connecting the first encryption key, the device identifier, the first key factor, and the second key factor to obtain a combined string; The combined word string is divided into two sub-strings of equal length; respectively hashing the two sub-strings to obtain two hash results; and the two hash results are different in bits Or computing, obtaining a shared key of the first device and the second device.    The method of claim 1, wherein the method further comprises: determining a replacement period of the shared key of the first device and the second device; and redetermining the first according to the replacement cycle An encryption factor and the second encryption factor; replacing the shared key of the first device and the second device according to the re-determined first encryption factor and the second encryption factor.    The method of any one of the preceding claims, wherein the method further comprises: determining that the first device needs to send the data to be transmitted to the second device; The key encrypts the data to be transmitted and sends the data to the second device through the first secure channel.    The method of claim 7, wherein the method further comprises: receiving, by the first security, a response data generated by the second device upon receiving the data to be transmitted, the response The data has been encrypted by the shared key; the response data encrypted by the shared key is decrypted by using the shared key to obtain the response data.    A key generation method is applied to a second device, the method comprising: receiving, by using a second secure channel, a first key factor encrypted by an initial key from a first device, wherein the initial key is a preset key between the first device and the second device; decrypting the first key factor encrypted by the initial key to obtain the first encryption factor; according to the first The key factor and the second key factor generated by the second device generate a shared key of the first device and the second device.    The method of claim 9, wherein the generating a shared gold of the first device and the second device according to the first key factor and the second key factor generated by the second device The key includes: sequentially connecting the first encryption key, the device identifier of the first device, the first key factor, and the second key factor to obtain a combined string; The string is divided into two sub-strings of equal length; the two sub-strings are respectively hashed to obtain two hash results; and the two hash results are XORed by bits to obtain a shared key of the first device and the second device.    The method of claim 9, wherein the method further comprises: encrypting a second key factor generated by the second device by using the initial key; and transmitting, by using the second secure channel The second key factor encrypted by the initial key is sent to the first device.    The method of claim 9, wherein the method further comprises: determining a replacement period of the shared key of the first device and the second device; and redetermining the first according to the replacement cycle An encryption factor and the second encryption factor; replacing the shared key of the first device and the second device according to the re-determined first encryption factor and the second encryption factor.    The method of any one of clauses 9 to 12, wherein the method further comprises: receiving, by the second secure channel, the shared key encrypted by the shared device to be transmitted Data; decrypting the data to be transmitted by using the shared key.    The method of claim 13, wherein the method further comprises: after receiving the data to be transmitted, generating response data; encrypting the response data by using the shared key; The second secure channel sends the response data encrypted by the shared key to the first device.    A key generation device is applied to a first device, where the device includes: a first encryption module, configured to encrypt, by using an initial key, a first key factor generated by the first device, and transmit the first security The channel is sent to the second device, where the initial key is a preset key between the first device and the second device; the first receiving module is configured to receive through the first secure channel a second key factor that is encrypted by the initial key, wherein the second key factor is generated by the second device; and the first decryption module is configured to transmit through the first receiving module The second key factor obtained by the first security channel is decrypted by the second key factor encrypted by the initial key to obtain the second key factor; the first key generation module is configured to be according to the first The key factor and the second key factor obtained by decrypting the first decryption module generate a shared key of the first device and the second device.    The device of claim 15, wherein the first encryption module comprises: a first factor generating unit, configured to: when the first device needs to initiate a key negotiation process to the second device, The pseudo-random function generates a first key factor; the first encryption unit is configured to encrypt the first key factor generated by the first factor generating unit by using an initial key, to obtain the first encrypted a first key unit, configured to encrypt, by using a first encryption key of the first secure channel, the first key factor encrypted by the first encryption unit for the first time to obtain a second key factor The first key factor after the secondary encryption.    The device of claim 15, wherein the first decryption module comprises: a first decryption unit, configured to use the first encryption key pair to double-encrypt the second key factor Decrypting to obtain the second key factor after the first decryption; a second encryption unit, configured to use the initial key to decrypt the second key after decrypting the first decryption unit for the first time The factor is decrypted to obtain the second key factor.    The device of claim 15, wherein the first key generation module comprises: a first determining unit, configured to determine a first shared between the first device and the second device An encryption key and a device identifier of the first device; a first factor generating unit, configured to determine, according to the first encryption key, the device identifier determined by the first determining unit, the first key factor The second key factor obtained by the first decryption module generates a shared key of the first device and the second device.    The device according to claim 18, wherein the first factor generating unit is specifically configured to: use the first encryption key, the device identifier, the first key factor, the first The two key factors are sequentially connected to obtain a combined string; the combined string is divided into two substrings of equal length; and the two substrings are respectively hashed to obtain two hash results. And performing an exclusive OR operation on the two hash results in bits to obtain a shared key of the first device and the second device.    The device of claim 15, wherein the device further comprises: a first determining module, configured to determine a replacement period of the shared key of the first device and the second device; a determining module, configured to re-determine the first encryption factor and the second encryption factor according to the replacement period determined by the first determining module; and the first replacement module is configured to determine according to the second The first encryption factor and the second encryption factor that are re-determined by the module replace the shared key of the first device and the second device.    The device according to any one of claims 15 to 20, wherein the device further comprises: a third determining module, configured to determine that the first device needs to send to the second device a data encryption module, configured to encrypt the data to be transmitted determined by the third determining module by using the shared key, and send the data to the second through the first secure channel device.    The device of claim 21, wherein the device further comprises: a second receiving module, configured to receive the data to be transmitted through the first secure pass receiving the second device The generated response data, the response data has been encrypted by the shared key; the second decryption module is configured to decrypt the response data encrypted by the shared key by using the shared key, The response data is obtained.    A key generating apparatus is applied to the second device, the device comprising: a third receiving module, configured to receive, by using the second secure channel, the first key factor encrypted by the initial key from the first device, where The initial key is a preset key between the first device and the second device, and the third decryption module is configured to encrypt the first key factor that is encrypted by the initial key. Decrypting to obtain the first encryption factor, and a second key generation module, configured to generate the first device and the first key according to the first key factor and a second key factor generated by the second device The shared key of the second device.    The device of claim 23, wherein the second key generation module is specifically configured to: use the first encryption key, a device identifier of the first device, the first gold The key factor and the second key factor are sequentially connected to obtain a combined string; the combined string is divided into two substrings of equal length; and the two substrings are respectively hashed. Obtaining two hash results; performing an exclusive OR operation on the two hash results in bits to obtain a shared key of the first device and the second device.    The device of claim 24, wherein the device further comprises: a second encryption module, configured to encrypt the second key factor generated by the second device by using the initial key; a first sending module, configured to send, by using the second secure channel, the second key factor encrypted by the initial key to the first device.    The device of claim 25, wherein the device further comprises: a third determining module, configured to determine a replacement period of the shared key of the first device and the second device; a determining module, configured to re-determine the first encryption factor and the second encryption factor according to the replacement cycle; and a second replacement module, configured to determine, according to the re-determined first encryption factor and the second The encryption factor replaces the shared key of the first device and the second device.    The device of any one of claims 23 to 26, wherein the device further comprises: a fourth receiving module, configured to receive the passed from the first device through the second secure channel The data to be transmitted is encrypted by the shared key; the fourth decryption module is configured to decrypt the data to be transmitted by using the shared key.    The device of claim 27, wherein the device further comprises: a response data generating module, configured to generate response data after receiving the data to be transmitted; The response data is encrypted by using the shared key; and the second sending module is configured to send the response data encrypted by the shared key to the first device by using the second secure channel.