WO2011127804A1 - M2m中数据加密传输的方法、设备及系统 - Google Patents

M2m中数据加密传输的方法、设备及系统 Download PDF

Info

Publication number
WO2011127804A1
WO2011127804A1 PCT/CN2011/072616 CN2011072616W WO2011127804A1 WO 2011127804 A1 WO2011127804 A1 WO 2011127804A1 CN 2011072616 W CN2011072616 W CN 2011072616W WO 2011127804 A1 WO2011127804 A1 WO 2011127804A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
platform
key
reported
sending end
Prior art date
Application number
PCT/CN2011/072616
Other languages
English (en)
French (fr)
Inventor
卞永刚
牟伦建
王珏
张永靖
黄成�
丁传锁
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP11768416.7A priority Critical patent/EP2560319B1/en
Publication of WO2011127804A1 publication Critical patent/WO2011127804A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0827—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving distinctive intermediate devices or communication paths
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, device and system for data encryption transmission in M2M.
  • M2M is the abbreviation of Machine to Machine (Machine_to_Machine) communication. In the narrow sense, it is GSM (Global System for Mobile communications) / GPRS (General Packet Radio Service), UMTS (for UMTS (Global System for Mobile Communications)). Universal Mobile Telecommunications System / HSDPA (High Speed Downlink Packet Access) and CDMA (Code Division Multiple Access) / EVD0 modules enable data exchange.
  • the generalized M2M also includes human-to-machine, machine-to-human communication.
  • M2M applications are growing rapidly in the vertical industry. These vertical industries include: smart homes, security surveillance, e-health, retail, logistics monitoring, etc.; but due to the lack of a unified M2M standard, vertical industry M2M applications are usually Vendors provide end-to-end solutions that make the terminals and applications strongly coupled, resulting in high deployment costs. In addition, a large number of deployed vertical applications form individual information islands, which makes it difficult to share information and easily lead to redundant construction. These have a restrictive effect on the further widespread application of vertical M2M applications. Therefore, building a horizontal platform for M2M, shielding the application to the machine, using standard interfaces to connect machines and applications, can form information sharing and reduce M2M deployment. Costs further promote the widespread use of M2M.
  • the information of the terminal can be distributed to multiple applications. Since many information in the M2M application belongs to sensitive data, encrypted transmission is required. To ensure data encryption during transmission Security, currently using session key-based symmetric key encryption technology to encrypt the data that needs to be transmitted.
  • the embodiment of the present invention provides a method, a device, and a system for encrypting and transmitting data in an M2M, which solves the problem that when the amount of data reported by the data transmitting end is relatively large, the M2M platform needs to decrypt the encrypted large amount of reported data and Encryption processing increases the computational cost of the M2M platform and reduces the performance of the M2M platform.
  • a method for encrypting and transmitting data in M2M comprising:
  • the reported data is encrypted by the KEM-DEM method, and the reported message is sent, and the reported message is sent to the M2M platform, where the report is sent.
  • the data encryption mode indication information is used to indicate to the M2M platform that the data transmitting end uses the KEM-DEM method to encrypt the reported data; if it is determined that the data volume of the reported data does not exceed the set threshold, then And the data reported by the data sending end and the M2M platform is encrypted, and the reported data is encrypted, and the reported message is sent to the M2M platform, where the reported message includes the data encryption mode indication information. And indicating to the M2M platform that the data sending end uses a symmetric key manner to encrypt the reported data.
  • a data encryption transmission method in the M2M comprising: receiving a report message sent by a data sending end, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end adopts KEM- DEM mode is still a symmetric key
  • the method encrypts the reported data of the data sending end;
  • the encrypted data key and the encrypted reported data are separated from the reported message, and passed Decrypting the encrypted data key by using a key negotiated by the data sending end and the M2M platform to obtain the data key;
  • the sending message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform uses the KEM-DEM mode to encrypt the reported data of the data sending end;
  • the encrypted data included in the reported message is encrypted by using the key negotiated by the data sending end and the M2M platform.
  • the reported data is decrypted to obtain the reported data;
  • the data encryption mode indication information is used to indicate to the data receiving end that the M2M platform encrypts the reported data of the data sending end by using a symmetric key manner.
  • a method of data encryption transmission comprising:
  • the key negotiated by the M2M platform and the data receiving end is used to add the encrypted content included in the sent message. Decrypting the data key to obtain the data key; And decrypting, by using the data key, the reported data encrypted by using the data key included in the sent message, and obtaining the reported data sent by the data sending end;
  • the encrypted report included in the sent message is sent by the key negotiated by the M2M platform and the data receiving end.
  • the data is decrypted to obtain the reported data sent by the data transmitting end.
  • a data sender includes:
  • a determining unit configured to determine whether the data amount of the reported data exceeds a set threshold
  • a first encryption unit configured to: when the determining unit determines that the data amount of the reported data exceeds a set threshold, encrypt the reported data by using a KEM-DEM method;
  • a first generating unit configured to generate the reported message by using the encrypted report data encrypted by the first encryption unit
  • the first sending unit is configured to send the report message generated by the first generating unit to the M2M platform, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end is used.
  • the KEM-DEM mode encrypts the reported data
  • a second encryption unit configured to: when the determining unit determines that the data volume of the reported data does not exceed a set threshold, encrypt the reported data by using a key negotiated by the data sending end and the M2M platform;
  • a second generating unit configured to generate a report message by using the encrypted report data obtained by the second encryption unit
  • a second sending unit configured to send the report message generated by the second generating unit to the M2M platform, where the upper file includes data encryption mode indication information, and is used to indicate data to the M2M platform.
  • the sending end encrypts the reported data by using a symmetric key.
  • An M2M platform including:
  • a receiving unit configured to receive a report message sent by the data sending end, where the report message includes the number
  • the encryption mode indication information is used to indicate to the M2M platform whether the data sending end uses the KEM-DEM mode or the symmetric key mode to encrypt the reported data of the data sending end;
  • a first decrypting unit configured to: when the data sending end uses the KEM-DEM method to encrypt the reported data of the data sending end, the encrypted data key and the encrypted reported data are sent from the receiving unit Separating the received report message, and decrypting the encrypted data key by using a key negotiated by the data sending end and the M2M platform to obtain the data key; the first encryption unit Encrypting the data key obtained by decrypting the first decryption unit by using a key negotiated by the M2M platform and the data receiving end;
  • a first generating unit configured to generate, by using the encrypted data key obtained by the first encryption unit and the encrypted report data separated by the first decryption unit, a delivered message
  • a first sending unit configured to send the sent message generated by the first generating unit to the data receiving end, where the sent message includes data encryption mode indication information, and is used to send the data to the data
  • the receiving end instructs the M2M platform to use the KEM-DEM mode to encrypt the reported data of the data sending end;
  • a second decrypting unit configured to: when the data sending end uses a symmetric key manner to encrypt the reported data of the data sending end, the receiving the data through the data sending end and the M2M platform, and the receiving Decrypting the encrypted report data included in the report message received by the unit to obtain the report data;
  • a second encryption unit configured to encrypt, by using the key negotiated by the M2M platform and the data receiving end, the reported data obtained by decrypting the second decryption unit
  • a second generating unit configured to generate a sent message by using the encrypted report data obtained by the second encrypting unit
  • a second sending unit configured to send the sent message generated by the second generating unit to the data receiving end, where the sent message includes data encryption mode indication information, and is used to send the data to the data Connect
  • the receiving end instructs the M2M platform to use the symmetric key method to perform strong confidentiality on the reported data of the data sending end.
  • a data receiving end comprising:
  • a receiving unit configured to receive a sent message sent by the M2M platform, where the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end whether the M2M platform adopts a KEM-DEM mode or a symmetric key
  • the method encrypts the reported data of the data sending end
  • a first decrypting unit configured to receive, by the M2M platform and a data receiving end, a key negotiated by the M2M platform and the data receiving end when the M2M platform uses the KEM-DEM mode to encrypt the reported data of the data sending end, Decrypting the encrypted data key included in the delivered message to obtain the data key;
  • a second decryption unit configured to decrypt, by using the first decryption unit, the data key, and the report that is received by the receiving unit and encrypted by using the data key The data is decrypted, and the reported data sent by the data sending end is obtained;
  • a third decrypting unit configured to receive, by the M2M platform and a data receiving end, a key negotiated by the M2M platform and the data receiving end when the M2M platform uses a symmetric key manner to encrypt the reported data of the data sending end
  • the encrypted report data included in the delivered message is decrypted, and the report data sent by the data sending end is obtained.
  • a data encryption transmission system in M2M comprising:
  • a data sending end configured to determine whether the data amount of the reported data exceeds a set threshold; if it is determined that the data amount of the reported data exceeds a set threshold, the reported data is encrypted by a KEM-DEM method Generating a report message, and sending the report message to the M2M platform, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end uses the KEM-DEM mode to report the report The data is encrypted; if it is determined that the data amount of the reported data does not exceed the set threshold, the reported data is forwarded through the key negotiated by the data sending end and the M2M platform.
  • the line is encrypted and generates a report message, and the report message is sent to the M2M platform, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end adopts a symmetric key mode pair.
  • the reported data is encrypted.
  • the M2M platform is configured to receive a report message sent by the data sending end, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform whether the data sending end adopts a KEM-DEM mode or a symmetric key
  • the key method encrypts the reported data of the data sending end; if it is determined that the data sending end uses the KEM-DEM method to encrypt the reported data of the data sending end, the encrypted data key and the encrypted report are encrypted.
  • the data is separated from the reported message, and the encrypted data key is decrypted by using the key negotiated by the data sending end and the M2M platform to obtain the data key; and the M2M platform is adopted.
  • the sending message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform uses the KEM-DEM mode to send the data.
  • the reported data is encrypted; if it is determined that the data transmitting end uses the symmetric key mode to encrypt the reported data of the data sending end, the data is sent by the data sending end and the M2M platform to negotiate the report.
  • the encrypted report data included in the text is decrypted to obtain the report data; the M2M platform and the data negotiation end of the data are used to encrypt the report data and generate a report message, and the report is sent.
  • the file is sent to the data receiving end, and the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform uses a symmetric key manner to report the data sending end.
  • the data is encrypted.
  • the data receiving end is configured to receive the sent message sent by the M2M platform, where the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end whether the M2M platform adopts the KEM-DEM mode or the symmetric key
  • the key mode encrypts the reported data of the data sending end; if it is determined that the M2M platform uses the KEM-DEM mode to encrypt the reported data of the data sending end, the M2M is adopted.
  • a key that is negotiated between the platform and the data receiving end, and the encrypted data key included in the sent message is decrypted to obtain the data key, and the data key is used in the sent message.
  • the reported data that is encrypted by using the data key is decrypted, and the reported data sent by the data sending end is obtained. If it is determined that the M2M platform encrypts the reported data of the data sending end by using a symmetric key manner, The key negotiated between the M2M platform and the data receiving end decrypts the encrypted reported data key included in the delivered message, and obtains the reported data sent by the data sending end.
  • the data sending end After the data transmission end needs to send the reported data to the data receiving end by using the technical solution of the present invention, the data sending end first determines, according to the data size of the reported data, what encryption method is used by the data sending end to report the need to report The data is encrypted. When the amount of reported data sent by the data sending end is relatively large, the reported data is encrypted by the KEM-DEM method. Since the KEM-DEM encryption method has one-time encryption of the reported data at the data transmitting end, the data is received.
  • the end decrypts the encrypted report data, and the M2M platform only encrypts and decrypts the data key for reporting the data encryption, which avoids the process of encrypting and decrypting a large number of reported data by the M2M platform, and significantly reduces the M2M platform forwarding data sending end.
  • the operation cost of decrypting and encrypting the reported data improves the performance of the M2M platform; and when the amount of data reported by the data transmitting end is small, the reported data is encrypted and decrypted by using a simple symmetric key encryption method to enable the terminal to The computational cost is relatively small, increasing the battery life.
  • FIG. 1 is a flowchart of a method for encrypting and transmitting data at a data transmitting end according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of a method for encrypting and transmitting data of an M2M platform according to Embodiment 1 of the present invention
  • FIG. 3 is a data receiving method according to Embodiment 1 of the present invention
  • 4 is a flowchart of a method for encrypting and transmitting data by using a KEM-DEM method according to Embodiment 2 of the present invention
  • FIG. 5 is a flowchart of a method for encrypting and transmitting data by using a symmetric encryption method according to Embodiment 2 of the present invention
  • FIG. 6 is a block diagram of a data transmitting end in Embodiment 3 of the present invention.
  • Figure ⁇ is a block diagram of another data transmitting end in Embodiment 3 of the present invention.
  • FIG. 8 is a block diagram of a composition of an M2M platform in Embodiment 3 of the present invention.
  • Embodiment 9 is a block diagram of a data receiving end in Embodiment 3 of the present invention.
  • FIG. 10 is a block diagram showing the system composition of M2M data encryption transmission in Embodiment 3 of the present invention.
  • An embodiment of the present invention provides a method for encrypting and transmitting data in an M2M, where the data transmitting end encrypts and transmits the reported data. As shown in FIG. 1, the method includes:
  • the data transmitting end determines whether the data amount of the reported data exceeds a set threshold; if it is determined that the data amount of the reported data exceeds a set threshold, performing step 102; if determining the data of the reported data If the quantity does not exceed the set threshold, go to step 103.
  • the setting threshold value may be determined according to the key size and the actual processing capability of the terminal, which is not limited in this embodiment of the present invention.
  • the data sending end encrypts the reported data by using a KEM-DEM method, and generates a report message, and sends the report message to the M2M platform, where the report message includes a data encryption side.
  • the indication information is used to indicate to the M2M platform that the data sending end uses the KEM-DEM method to encrypt the reported data.
  • the method of separately encrypting the data reported by the data sender and other information that needs to be encrypted is called KEM-DEM mode.
  • the sending the reported data to the M2M platform by using the KEM-DEM mode to encrypt the reported data and the method may include:
  • Obtaining a data key for encrypting the reported data encrypting the reported data by using the data key, and performing the data key by using a key negotiated by the data sending end and the M2M platform
  • Encryption Generates a report message by the encrypted report data and the encrypted data key, and sends the report message to the M2M platform.
  • the obtaining the data key for encrypting the data reported by the data sending end may be obtained by the following method, including: randomly generating the data key by using a password random generation mechanism; or manually setting the data
  • the key is not limited in this embodiment of the present invention. As long as the key for encrypting the data that needs to be reported by the data sending end can be obtained, it can be used in the embodiment of the present invention.
  • the key negotiated by the data sending end and the M2M platform is a session key.
  • the data sending end encrypts the reported data by using a key negotiated by the data sending end and the M2M platform, and generates a report message, and sends the report message to the M2M platform, where the report message includes
  • the data encryption mode indication information is used to indicate to the M2M platform that the data sending end uses a symmetric key manner to encrypt the data reported.
  • the key negotiated between the data sending end and the M2M platform is a session key.
  • the embodiment of the present invention further provides a method for encrypting and transmitting data in the M2M.
  • the method is a method for encrypting and transmitting data reported by the data sending end by the M2M platform. As shown in FIG. 2, the method includes:
  • the M2M platform receives the report message sent by the data sending end, where the report message includes the data encryption mode indication information, and is used to indicate to the M2M platform whether the data sending end adopts the KEM-DEM mode or the symmetric key mode.
  • the reported data of the data transmitting end is encrypted.
  • the method of separately encrypting the reported data of the data sending end and other information that needs to be encrypted is called a KEM-DEM mode.
  • the M2M platform determines, according to the data encryption mode indication information, a method for encrypting the reported data used by the data sending end, and if the data sending end determines that the data sending end uses the KEM-DEM mode to encrypt the reported data of the data sending end. Then, step 203 is performed; if it is determined that the data sending end encrypts the reported data of the data sending end by using a symmetric key manner, step 205 is performed.
  • the M2M platform separates the encrypted data key and the encrypted report data from the reported message, and uses the key negotiated by the data sending end and the M2M platform to perform the encrypted
  • the data key is decrypted to obtain the data key.
  • the key negotiated between the data sending end and the M2M platform may be a session key.
  • the M2M platform encrypts the data key by using a key negotiated by the M2M platform and the data receiving end, and generates a delivered message together with the encrypted reported data, and sends the sent message.
  • the file is sent to the data receiving end, and the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform uses the KEM-DEM mode to report data to the data sending end. Encrypt.
  • the key negotiated by the M2M platform and the data receiving end may be a session key.
  • the M2M platform decrypts the encrypted report data included in the report message by using a key negotiated by the data sending end and the M2M platform to obtain the reported data.
  • the key negotiated between the data sending end and the M2M platform may be a session key.
  • the M2M platform encrypts the reported data by using the key negotiated by the M2M platform and the data receiving end, and generates a delivered message, and sends the sent packet to the data receiving end, where
  • the sending message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform encrypts the reported data of the data sending end by using a symmetric key manner.
  • the key negotiated by the M2M platform and the data receiving end may be a session key.
  • An embodiment of the present invention provides a data encryption transmission method, which is a data encryption transmission method of a data receiving end. As shown in FIG. 3, the method includes:
  • the data receiving end receives the delivered message sent by the M2M platform, where the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform is used.
  • the KEM-DEM mode also encrypts the reported data of the data transmitting end in a symmetric key mode.
  • the data receiving end determines, according to the data encryption mode indication information, a manner for encrypting the reported data of the data sending end used by the M2M platform. If the M2M platform is determined to use the KEM-DEM mode, the reported data of the data sending end is performed. Encryption, step 303 is performed; if it is determined that the M2M platform encrypts the reported data of the data sending end by using the symmetric key mode, step 305 is performed.
  • KEM-DEM mode the method of separately encrypting the data reported by the data sender and other information that needs to be encrypted.
  • the data receiving end decrypts the encrypted data key included in the delivered message by using a key negotiated by the M2M platform and the data receiving end to obtain the data key.
  • the key negotiated by the M2M platform and the data receiving end may be a session key.
  • the data receiving end decrypts the reported data encrypted by using the data key included in the sent message by using the data key, and obtains the reported data sent by the data sending end.
  • the data receiving end decrypts the encrypted report data included in the sent message by using a key negotiated by the M2M platform and the data receiving end, and obtains the reported data sent by the data sending end.
  • the key negotiated by the M2M platform and the data receiving end may be a session key.
  • the data sending end when the data sending end needs to send the reported data to the data receiving end, the data sending end first determines, according to the data amount of the reported data, what kind of encryption is used by the data sending end.
  • the method encrypts the data to be reported, and when the amount of reported data sent by the data sending end is relatively large, the reported data is encrypted by using a KEM-DEM method, and the KEM-DEM encryption method has the data to be reported at the data sending end. Once encrypted, the encrypted report data is decrypted at the data receiving end.
  • the M2M platform only encrypts and decrypts the data key encrypted by the reported data, which avoids the process of encrypting and decrypting a large number of reported data by the M2M platform, which is significantly reduced.
  • the M2M platform forwards the operation cost of decrypting and encrypting the data reported by the data transmitting end, and improves the performance of the M2M platform.
  • the reported data is encrypted by using a simple symmetric key encryption method. Encryption and decryption make the terminal's operation consumption smaller and increase the battery life.
  • the present invention provides a method for encrypting and transmitting data in M2M.
  • the embodiment of the present invention takes a photo taken by a data transmitting end in a KEM-DEM manner as an example, and a key negotiated by the data transmitting end and the M2M platform, and M2M.
  • the key negotiated between the platform and the data receiving end is a session key.
  • the method for encrypting data transmission in M2M is specifically described.
  • the photo reported by the terminal is forwarded to the traffic police processing system through the M2M platform. Includes:
  • the session key KTP is negotiated between the 401 terminal and the M2M platform.
  • the process of negotiating the session key KTP between the terminal and the M2M platform may utilize the prior art, which is not limited by the embodiment of the present invention.
  • the session key KAP is negotiated between the traffic police processing system and the M2M platform.
  • the process of the traffic police system and the process of negotiating the session key KAP by the M2M platform may use the prior art, which is not limited by the embodiment of the present invention.
  • the terminal takes a photo at a certain moment. For example, the traffic violation scene needs to upload the photo to the traffic police processing system via the M2M platform. Since the data size of the photo exceeds the preset threshold, it is determined that the terminal adopts KEM- The DEM mode encrypts the photo and reports it; the preset threshold is a data amount threshold, and the set threshold may be determined according to a key size and an actual processing capability of the terminal, and the present invention The embodiment does not limit this; the terminal encrypts the photo by using the KEM-DEM method and reports that the terminal generates a data key KD for encrypting data, encrypts the photo data D with KD, and then encrypts KD and other information I with KTP, The KD-encrypted photo data and the KD and other information I encrypted by KTP constitute an escalation message (E (KTP, KD+I) + E (KD, D)), and the composed report message (E ( KTP, KD+I) +E (
  • the M2M platform After receiving the report message sent by the terminal, the M2M platform determines, according to the data encryption mode indication information in the report message, that the terminal uses the KEM-DEM encryption mode to encrypt the reported data, where the M2M platform is used.
  • the KD encrypted photo data and the KD encrypted KD and other information I are separated from the message, and the KD and other data I are decrypted by KTP, and the photo needs to be sent to the traffic police according to other data.
  • the M2M platform encrypts KD and other information I with KAP, and then combines KD and other information ⁇ and KD encrypted photo data D into a delivery message (E (KAP, KD+ ⁇ ) + E ( KD, D)), and send the delivered message (E (KAP, KD+ ⁇ ) + E (KD, D)) to the traffic police processing system, and include the data encryption method in the delivered message
  • the indication information is used to indicate to the processing system of the traffic police that the M2M platform uses the KEM-DEM mode to encrypt the reported data of the terminal.
  • the traffic police processing system determines, according to the data encryption mode indication information in the message, that the M2M platform uses the KEM-DEM encryption mode to encrypt the reported data of the terminal. Then, the processing system of the traffic police uses the KAP to decrypt the encrypted data key in the delivered message to obtain KD, and then decrypts the encrypted photo data in the delivered message with KD to obtain a final photo.
  • the embodiment of the present invention further provides a method for encrypting and transmitting data in the M2M.
  • the data transmission end encrypts the transmission environment humidity by using a symmetric key encryption method, and the data sending end and the M2M are used.
  • the key negotiated by the platform and the key negotiated by the M2M platform and the data receiving end are the session key.
  • the method for encrypting and transmitting data in the M2M is specifically described.
  • the terminal reports the humidity data and forwards it through the M2M platform.
  • the process to the environmental control system specifically includes:
  • the session key KTP is negotiated between the terminal and the M2M platform.
  • the process of negotiating the session key ⁇ between the terminal and the ,2 ⁇ platform may utilize the prior art, which is not limited by the embodiment of the present invention.
  • the session key is negotiated between the environmental control system and the platform.
  • the process of negotiating the session key ⁇ between the environment control system and the ⁇ 2 ⁇ platform may utilize the existing technology, which is not limited by the embodiment of the present invention.
  • the terminal acquires the humidity data D, and needs to be uploaded to the environment control system via the M2M platform. Since the data volume of the humidity data D is small, the floating point number of 4 bytes does not exceed the preset threshold value, so Determining that the terminal encrypts the humidity data D by using a symmetric key method and reports the threshold value; the preset threshold value is a data volume threshold value, and the set threshold value may be determined according to the key size and the actual processing capability of the terminal, and the present invention The embodiment does not limit this; the terminal encrypts the humidity data D by using a symmetric key method and reports the KTP encryption D and other information I including the terminal, and uses the KTP encryption D and other information I to form the report message E (KTP, I+ D), and the reported message E (KTP, I+D) is sent to the M2M platform, and the data packet encryption mode indication information is included in the report message, and is used to indicate to the M2M platform that the terminal adopts
  • the symmetric encryption method encrypts the reported
  • the M2M platform After receiving the report message sent by the terminal, the M2M platform determines, according to the data encryption mode indication information in the report message, that the terminal uses a symmetric encryption manner to encrypt the reported data, and the M2M platform uses the M2M platform.
  • the KTP encryption D and other information I are decrypted by KTP to obtain D and other information I. According to the other information I, it is determined that the humidity data D needs to be sent to the environmental control system, so the M2M platform encrypts the humidity data D and other information with KAP.
  • the packet includes data encryption mode indication information, and is used to indicate to the environment control system that the M2M platform uses a symmetric encryption mode to encrypt the data reported by the terminal.
  • the environment control system After receiving the sent packet sent by the M2M platform, the environment control system determines, according to the data encryption manner indication information in the packet, that the M2M platform uses a symmetric encryption manner to encrypt the data reported by the terminal, The D and other information I obtained by the environmental control system using KTP decryption are decrypted by KAP, and the humidity data D and other information are obtained, and then the subsequent environmental control is performed, for example, the switch of the humidifier is controlled.
  • the data sending end when the data sending end needs to send the reported data to the data receiving end, the data sending end first determines, according to the data volume size of the reported data, what encryption method is used by the data sending end to report the data to be reported. Encryption is performed. When the amount of reported data sent by the data sending end is relatively large, the reported data is encrypted by using the KEM-DEM method.
  • the KEM-DEM encryption method has one-time encryption of the reported data at the data transmitting end, and is at the data receiving end.
  • the encrypted data is decrypted, and the M2M platform only encrypts and decrypts the data key for reporting the data encryption, which avoids the process of encrypting and decrypting a large number of reported data by the M2M platform, and significantly reduces the reporting of the data transmission end of the M2M platform.
  • the operation cost of the decryption and encryption of the data improves the performance of the M2M platform; and when the amount of data reported by the data transmitting end is small, the encrypted data is encrypted and decrypted by a simple symmetric key encryption method, so that the operation of the terminal is performed. The consumption is relatively small, increasing the battery life.
  • the key negotiated by the data sending end and the M2M platform is a session key
  • the key negotiated by the M2M platform and the data receiving end may be a session key, thereby avoiding the traditional KEM-DEM.
  • the method uses the asymmetric key encryption technology to encrypt the data key to perform higher requirements on the terminal computing capability, and increases the disadvantages of computing consumption, thereby reducing the power consumption of the terminal and increasing the battery usage time.
  • An embodiment of the present invention provides a data sending end.
  • the data sending end includes: The unit 61, the first encryption unit 62, the first generation unit 63, the first transmission unit 66, the second encryption unit 65, the second generation unit 66, and the second transmission unit 67.
  • the determining unit 61 is configured to determine whether the data amount of the reported data exceeds a set threshold, where the set threshold may be determined according to the key size and the actual processing capability of the terminal, which is not performed by the embodiment of the present invention.
  • the first encryption unit 62 is configured to encrypt the data to be reported by the KEM-DEM method when the determining unit 61 determines that the data amount of the reported data exceeds a set threshold;
  • the unit 63 is configured to generate the report message by using the encrypted report data that is encrypted by the first encryption unit 62.
  • the first sending unit 64 is configured to send the report message generated by the first generating unit 63.
  • the M2M platform includes the data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end uses the KEM-DEM mode to encrypt the reported data.
  • the method of separately encrypting the data reported by the data sender and other information to be encrypted is referred to as the KEM-DEM mode.
  • the second encrypting unit 65 is configured to encrypt the reported data by using a key negotiated by the data sending end and the M2M platform.
  • the key pair negotiated by the data sending end and the M2M platform may be a session key;
  • the second generating unit 66 is configured to generate the encrypted report data obtained by the second encrypting unit 65.
  • the second sending unit 67 is configured to send the report message generated by the second generating unit 66 to the M2M platform, where the report message includes data encryption mode indication information, and is used to report the message to the M2M platform.
  • the M2M platform instructs the data sending end to encrypt the reported data by using a symmetric key.
  • the first encryption unit 62 includes: an obtaining module 621 and an encryption module 622.
  • the obtaining module 621 is configured to obtain a data key for encrypting the reported data
  • the encryption module 622 is configured to encrypt the reported data by using the data key, and use the data sending end and the M2M platform
  • the negotiated key encrypts the data key, wherein the data sender and The key pair negotiated by the M2M platform may be a session key
  • the first generating unit 63 is further configured to generate a report message by using the encrypted data encrypted by the encryption module 622 and the encrypted data key.
  • the obtaining module 621 acquires a data key for encrypting the reported data of the data sending end, and may randomly generate the data key by using a password random generating mechanism; or manually setting the data key;
  • the embodiment of the present invention does not limit this, as long as a data key for encrypting the reported data of the data transmitting end can be obtained, which can be used in the embodiment of the present invention.
  • the key negotiated between the data sending end and the M2M platform is a session key.
  • the embodiment of the present invention provides an M2M platform.
  • the platform includes: a first receiving unit 71, a first decrypting unit 72, a first encrypting unit 73, a first generating unit 74, and a first sending unit 75.
  • the first receiving unit 71 is configured to receive a report message sent by the data sending end, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform whether the data sending end adopts a KEM-DEM mode or is symmetric.
  • the key method encrypts the reported data of the data sending end.
  • the first decrypting unit 72 is configured to encrypt the encrypted data key and encrypt the data key.
  • the subsequent reported data is separated from the reported message received by the receiving unit 71, and the encrypted data key is decrypted by the data transmitting end and the key negotiated by the M2M platform to obtain the a data key, wherein the key negotiated by the data sending end and the M2M platform may be a session key; the first encrypting unit 73 is configured to decrypt the first decryption by using a key negotiated by the M2M platform and the data receiving end The unit 72 decrypts the obtained data key for encryption, wherein the key negotiated by the M2M platform and the data receiving end may be a session key, and the first generating unit 74 is configured to obtain the first encryption unit 73.
  • the encrypted data key and the first decryption unit 71 And the separated sent data is sent to the data receiving end, and the first sending unit 75 is configured to send the sent message generated by the first generating unit 74 to the data receiving end, where
  • the data packet includes the data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform uses the KEM-DEM mode to encrypt the reported data of the data sending end.
  • the second decrypting unit 76 is configured to negotiate with the M2M platform by using the data sending end.
  • the key is obtained by decrypting the encrypted report data included in the report message received by the receiving unit to obtain the report data, wherein the key negotiated by the data sending end and the M2M platform may be session secret.
  • a second encryption unit 77 configured to encrypt the reported data decrypted by the second decryption unit 76 by using a key negotiated by the M2M platform and the data receiving end, where the M2M platform and data receiving
  • the terminal-negotiating key may be a session key
  • the second generating unit 78 is configured to generate, by the second cryptographic unit ⁇ , the encrypted report data, the second message sending unit 79,
  • the sent message generated by the second generating unit 78 is sent to the data receiving end, where the sent message includes data encryption mode indication information.
  • Receive an indication to the data for the M2M internet terminal uses the symmetric key way data transmission end report data is encrypted.
  • the embodiment of the present invention provides a data receiving end.
  • the data receiving end includes: a receiving unit 81, a first decrypting unit 82, a second decrypting unit 83, and a third decrypting unit 84.
  • the receiving unit 81 is configured to receive the sent message sent by the M2M platform, where the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end whether the M2M platform adopts the KEM-DEM mode or the symmetric key
  • the key method encrypts the reported data of the data sender.
  • the first decrypting unit 82 is configured to use the M2M platform and the data receiving end to negotiate the encryption when the M2M platform encrypts the reported data of the data sending end by using the KEM-DEM mode according to the data encryption mode indication information.
  • a key in the sent message received by the receiving unit 81 The included encrypted data key is decrypted to obtain the data key;
  • the second decryption unit 83 is configured to, by using the first decryption unit 82, the obtained data key to the receiving unit 81.
  • the received data encrypted by using the data key included in the received message is decrypted, and the reported data sent by the data sending end is obtained.
  • the key negotiated by the M2M platform and the data receiving end may be a session key.
  • the third decrypting unit 84 is configured to negotiate with the data receiving end by using the M2M platform.
  • the key is obtained by decrypting the encrypted report data included in the sent message received by the receiving unit 81, and obtaining the report data sent by the data sending end.
  • the key negotiated by the M2M platform and the data receiving end may be a session key.
  • the embodiment of the present invention provides a system for encrypting and transmitting data in the M2M.
  • the system further includes: a data sending end 91, an M2M platform 92, and a data receiving end 93.
  • the data sending end 91 is configured to determine whether the data quantity of the reported data exceeds a set threshold; if it is determined that the data quantity of the reported data exceeds a set threshold, the reported data is encrypted by a KEM-DEM method. And generating a report message, and sending the report message to the M2M platform 92, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end adopts a KEM-DEM mode pair.
  • the reported data is encrypted; if it is determined that the data amount of the reported data does not exceed the set threshold, the reported data is encrypted and a report message is generated by using a key negotiated by the data sending end and the M2M platform. And sending the report message to the M2M platform 92, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end uses a symmetric key manner to encrypt the reported data. .
  • the M2M platform 92 is configured to receive the report message sent by the data sending end 91, where the report message includes data encryption mode indication information, and is used to indicate to the M2M platform that the data sending end 91 adopts a KEM-DEM mode. Or encrypting the reported data of the data sending end in a symmetric key manner; If it is determined that the data sending end 91 encrypts the reported data of the data sending end by using the KEM-DEM method, the encrypted data key and the encrypted reported data are separated from the reported message, and Decrypting the encrypted data key by using a key negotiated by the data sending end 91 and the M2M platform 92 to obtain the data key; a key pair negotiated by the M2M platform 92 and the data receiving end 93 The data key is encrypted, and the sent message is generated together with the encrypted report data, and the sent message is sent to the data receiving end 93, where the sent message includes data encryption.
  • the mode indication information is used to indicate to the data receiving end that the M2M platform 92 uses the KEM-DEM mode to encrypt the reported data of the data sending end; if it is determined that the data sending end 91 adopts a symmetric key mode pair
  • the data is encrypted, and the encrypted report data included in the report message is decrypted by using the key negotiated by the data sending end 91 and the M2M platform 92 to obtain the reported data;
  • the key negotiated by the M2M platform 92 and the data receiving end 93 encrypts the reported data and generates a sent message, and sends the sent text to the data receiving end 93, where the sent message includes
  • the data encryption mode indication information is used to indicate to the data receiving end that the M2M platform 92 encrypts the reported data of the data sending end by using a symmetric key manner.
  • the data receiving end 93 is configured to receive the sent message sent by the M2M platform 92, where the sent message includes data encryption mode indication information, and is used to indicate to the data receiving end that the M2M platform 92 adopts the KEM-DEM mode.
  • the symmetric data is used to encrypt the reported data of the data sending end. If it is determined that the M2M platform 92 uses the KEM-DEM method to encrypt the reported data of the data sending end, the M2M platform 92 and the data receiving end 93 negotiate. Decrypting the encrypted data key included in the delivered message to obtain the data key; and using the data key to use the data density included in the sent message The key-encrypted data is decrypted to obtain the reported data sent by the data transmitting end.
  • the M2M platform 92 uses the symmetric key method to encrypt the reported data of the data transmitting end, the M2M platform 92 and the data receiving end are adopted. 93.
  • the negotiated key decrypts the encrypted report data included in the delivered message, and obtains the report sent by the data sending end. Data.
  • the data sending end when the data sending end needs to send the reported data to the data receiving end, the data sending end first determines, according to the data volume size of the reported data, what encryption method is used by the data sending end to report the data to be reported. Encryption is performed. When the amount of reported data sent by the data sending end is relatively large, the reported data is encrypted by using the KEM-DEM method.
  • the KEM-DEM encryption method has one-time encryption of the reported data at the data transmitting end, and is at the data receiving end.
  • the encrypted data is decrypted, and the M2M platform only encrypts and decrypts the data key for reporting the data encryption, which avoids the process of encrypting and decrypting a large number of reported data by the M2M platform, and significantly reduces the reporting of the data transmission end of the M2M platform.
  • the operation cost of the decryption and encryption of the data improves the performance of the M2M platform; and when the amount of data reported by the data transmitting end is small, the encrypted data is encrypted and decrypted by a simple symmetric key encryption method, so that the operation of the terminal is performed. The consumption is relatively small, increasing the battery life.
  • the key negotiated by the data sending end and the M2M platform is a session key
  • the key negotiated by the M2M platform and the data receiving end may be a session key, thereby avoiding the traditional KEM-DEM.
  • the method uses the asymmetric key encryption technology to encrypt the data key to perform higher requirements on the terminal computing capability, and increases the disadvantages of computing consumption, thereby reducing the power consumption of the terminal.
  • the present invention can be implemented by means of software plus necessary general hardware, and of course, can also be through hardware, but in many cases, the former is a better implementation. the way.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • a hard disk or optical disk or the like includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

Description

M2M中数据加密传输的方法、 设备及系统
本申请要求于 2010 年 04 月 16 日提交中国专利局， 申请号为 201010148632.4, 发明名称为 "M2M 中数据加密传输的方法、 设备及系统" 的中国专利申请的优先权， 其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域， 尤其涉及一种 M2M中数据加密传输的方法、设备及 系统。
背景技术
M2M是机器对机器（Machine_to_Machine )通信的简称， 狭义上讲就是机 器与机器之间通过 GSM ( Global System for Mobile communications, 全球 移动通信系统） /GPRS (General Packet Radio Service, 分组无线业务）、 UMTS ( Universal Mobile Telecommunications System ， 通用移动通讯系统) /HSDPA ( High Speed Downlink Packet Access, 高速下行分组接入）和 CDMA (Code Division Multiple Access, 分多址） /EVD0模块实现数据的交换。 广义的 M2M还包含人对机器、 机器对人通信。
M2M的应用在垂直行业市场中快速增长， 这些垂直行业包括： 智能家居、 安防监控、 电子医疗、 零售业、 物流监控等等； 但由于缺乏统一的 M2M标准， 垂直行业的 M2M应用通常是由一个厂商提供端到端的解决方案使终端和应用 强耦合， 造成部署成本偏高； 另外， 大量部署的垂直应用形成了一个个的信息 孤岛， 很难做到信息之间的共享， 容易造成重复建设。 这些都对垂直的 M2M 应用进一步广泛应用有限制作用， 因此， 构建一个 M2M的水平平台， 对应用屏 蔽到机器的通信方式， 利用标准的接口连接机器和应用， 可以形成信息共享， 减少 M2M的部署成本， 进一步推动 M2M的广泛应用。
通过 M2M平台， 终端的信息可以分发到多个应用， 由于 M2M应用中艮多 信息是属于敏感数据， 因此需要进行加密传输。 为保证数据加密传输过程中的 安全性，目前使用基于会话密钥的对称密钥加密技术对需要传输的数据进行加 密。
在实现上述数据加密传输的过程中， 发明人发现现有技术中至少存在如下问 题： 当数据发送端上报数据的数据量比较大时， M2M平台需要对所述加密后的 大量上报数据进行解密以及加密处理，造成 M2M平台的运算消耗增加， 降低了 M2M平台的性能。
发明内容
本发明的实施例提供一种 M2M中数据加密传输的方法、设备及系统，解决 了当数据发送端上报数据的数据量比较大时， M2M平台需要对所述加密后的大 量上报数据进行解密以及加密处理， 造成 M2M平台的运算消耗增加， 降低了 M2M平台的性能的问题。
为达到上述目的， 本发明的实施例采用如下技术方案：
一种 M2M中数据加密传输的方法， 包括：
判断上报数据的数据量是否超过设定门限值；
若判定所述上报数据的数据量超过设定门限值，则通过 KEM-DEM方式对所 述上报数据进行加密并生成上报报文， 将所述上报报文发送到 M2M平台，所述 上报报文中包括数据加密方式指示信息，用于向 M2M平台指示数据发送端采用 了 KEM-DEM方式对所述上报数据进行加密； 若判定所述上报数据的数据量没有超过设定门限值，则通过数据发送端和 M2M平台协商的密钥， 对所述上报数据进行加密并生成上报报文， 将所述上报 报文发送到 M2M平台， 所述上报报文中包括数据加密方式指示信息， 用于向所 述 M2M平台指示数据发送端采用了对称密钥方式对所述上报数据进行加密。
一种 M2M中数据加密传输的方法， 包括： 接收数据发送端发送的上报报文，所述上报报文中包括数据加密方式指示 信息，用于向 M2M平台指示所述数据发送端采用了 KEM-DEM方式还是对称密钥 方式对所述数据发送端的上报数据进行加密；
若确定所述数据发送端采用了 KEM-DEM 方式对所述数据发送端的上报数 据进行加密，则将加密后的数据密钥和加密后的上报数据从所述上报报文中分 离出来， 并通过用所述数据发送端和 M2M平台协商的密钥，对所述加密后的数 据密钥进行解密， 得到所述数据密钥；
通过所述 M2M平台和数据接收端协商的密钥对所述数据密钥进行加密，并 与所述加密后的上报数据一起生成下发报文，将所述下发报文发送给所述数据 接收端， 所述下发报文中包括数据加密方式指示信息，用于向所述数据接收端 指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送端的上报数据进行加 密；
若确定所述数据发送端采用了对称密钥方式对所述数据发送端的上报数 据进行加密， 则通过所述数据发送端和 M2M平台协商的密钥，对所述上报报文 中包含的加密后的上报数据进行解密得到所述上报数据；
通过所述 M2M 平台和数据接收端协商的密钥对所述上报数据进行加密并 生成下发报文，将所述下发报文发送给所述数据接收端， 所述下发报文中包括 数据加密方式指示信息，用于向所述数据接收端指示所述 M2M平台采用了对称 密钥方式对所述数据发送端的上报数据进行加密。
一种数据加密传输的方法， 包括：
接收 M2M平台发送的下发报文，所述下发报文中包括数据加密方式指示信 息，用于向数据接收端指示所述 M2M平台采用了 KEM-DEM方式还是对称密钥方 式对数据发送端的上报数据进行加密；
若确定所述 M2M平台采用了 KEM-DEM方式对数据发送端的上报数据进行加 密， 则通过所述 M2M平台和数据接收端协商的密钥，对所述下发报文中包含的 加后密的数据密钥进行解密， 得到所述数据密钥； 通过所述数据密钥对所述下发报文中包含的采用所述数据密钥加密后的 上报数据进行解密， 得到数据发送端发送的上报数据；
若确定所述 M2M平台采用了对称密钥方式对数据发送端的上报数据进行 加密， 则通过所述 M2M平台和数据接收端协商的密钥，对所述下发报文中包含 的加密后的上报数据进行解密， 得到数据发送端发送的上报数据。
一种数据发送端， 包括：
判断单元， 用于判断上报数据的数据量是否超过设定门限值；
第一加密单元，用于在所述判断单元判定所述上报数据的数据量超过设定 门限值时， 通过 KEM-DEM方式对所述上报数据进行加密；
第一生成单元，用于将所述第一加密单元加密得到的加密后的上报数据生 成上报报文；
第一发送单元， 用于将所述第一生成单元生成的所述上报报文发送到 M2M 平台， 所述上报报文中包括数据加密方式指示信息， 用于向 M2M平台指示数据 发送端采用了 KEM-DEM方式对所述上报数据进行加密；
第二加密单元，用于在所述判断单元判定所述上报数据的数据量没有超过 设定门限值时，通过数据发送端和 M2M平台协商的密钥，对所述上报数据进行 加密；
第二生成单元，用于将所述第二加密单元得到的加密后的上报数据生成上 报报文；
第二发送单元， 用于将所述第二生成单元生成的所述上报报文发送到 M2M 平台， 所述上 4艮"¾文中包括数据加密方式指示信息，用于向所述 M2M平台指示 数据发送端采用了对称密钥方式对所述上报数据进行加密。
一种 M2M平台， 包括：
接收单元， 用于接收数据发送端发送的上报报文， 所述上报报文中包括数 据加密方式指示信息， 用于向 M2M 平台指示所述数据发送端采用了 KEM-DEM 方式还是对称密钥方式对所述数据发送端的上报数据进行加密；
第一解密单元，用于在确定所述数据发送端采用了 KEM-DEM方式对所述数 据发送端的上报数据进行加密时，将加密后的数据密钥和加密后的上报数据从 所述接收单元接收到的所述上报报文中分离出来， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密后的数据密钥进行解密，得到所述数据密钥； 第一加密单元，用于通过所述 M2M平台和数据接收端协商的密钥对所述第 一解密单元解密得到的所述数据密钥进行加密；
第一生成单元，用于将所述第一加密单元得到的加密后的数据密钥和第一 解密单元分离出的加密后的上报数据一起生成下发报文；
第一发送单元，用于将所述第一生成单元生成的所述下发报文发送给所述 数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于向所述数据接 收端指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送端的上报数据进行 加密；
第二解密单元，用于在确定所述数据发送端采用了对称密钥方式对所述数 据发送端的上报数据进行加密时， 通过所述数据发送端和 M2M 平台协商的密 钥，对所述接收单元接收到的所述上报报文中包含的加密后的上报数据进行解 密得到所述上报数据；
第二加密单元，用于通过所述 M2M平台和数据接收端协商的密钥对所述第 二解密单元解密得到的所述上报数据进行加密；
第二生成单元，用于将所述第二加密单元得到的加密后的上报数据生成下 发报文；
第二发送单元，用于将所述第二生成单元生成的所述下发报文发送给所述 数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于向所述数据接 收端指示所述 M2M 平台采用了对称密钥方式对所述数据发送端的上报数据进 行力口密。
一种数据接收端， 包括：
接收单元， 用于接收 M2M平台发送的下发报文， 所述下发报文中包括数据 加密方式指示信息，用于向数据接收端指示所述 M2M平台采用了 KEM-DEM方式 还是对称密钥方式对数据发送端的上报数据进行加密；
第一解密单元，用于在确定所述 M2M平台采用了 KEM-DEM方式对数据发送 端的上报数据进行加密时，通过所述 M2M平台和数据接收端协商的密钥，对所 述接收单元接收到的所述下发报文中包含的加密后的数据密钥进行解密，得到 所述数据密钥；
第二解密单元， 用于用所述第一解密单元解密得到的所述数据密钥，对所 述接收单元接收到的所述下发报文中包含的采用所述数据密钥加密后的上报 数据进行解密， 得到数据发送端发送的上报数据；
第三解密单元，用于在确定所述 M2M平台采用了对称密钥方式对数据发送 端的上报数据进行加密时，通过所述 M2M平台和数据接收端协商的密钥，对所 述接收单元接收到的所述下发报文中包含的加密后的上报数据进行解密，得到 数据发送端发送的上报数据。
一种 M2M中数据加密传输系统， 包括：
数据发送端， 用于判断上报数据的数据量是否超过设定门限值； 若判定所 述上报数据的数据量超过设定门限值，则通过 KEM-DEM方式对所述上报数据进 行加密并生成上报报文， 将所述上报报文发送到 M2M平台， 所述上报报文中包 括数据加密方式指示信息， 用于向所述 M2M 平台指示数据发送端采用了 KEM-DEM方式对所述上报数据进行加密； 若判定所述上报数据的数据量没有超 过设定门限值， 则通过数据发送端和 M2M平台协商的密钥，对所述上报数据进 行加密并生成上报报文， 将所述上报报文发送到 M2M平台， 所述上报报文中包 括数据加密方式指示信息，用于向所述 M2M平台指示数据发送端采用了对称密 钥方式对所述上报数据进行加密。
M2M平台， 用于接收数据发送端发送的上报报文， 所述上报报文中包括数 据加密方式指示信息， 用于向所述 M2M 平台指示所述数据发送端采用了 KEM-DEM方式还是对称密钥方式对所述数据发送端的上报数据进行加密； 若确 定所述数据发送端采用了 KEM-DEM 方式对所述数据发送端的上报数据进行加 密， 则将加密后的数据密钥和加密后的上报数据从所述上报报文中分离出来， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密后的数据密钥进行 解密，得到所述数据密钥； 通过所述 M2M平台和数据接收端协商的密钥对所述 数据密钥进行加密， 并与所述加密后的上报数据一起生成下发报文，将所述下 发报文发送给所述数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于向所述数据接收端指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送 端的上报数据进行加密；若确定所述数据发送端采用了对称密钥方式对所述数 据发送端的上报数据进行加密， 则通过所述数据发送端和 M2M 平台协商的密 钥， 对所述上报报文中包含的加密后的上报数据进行解密得到所述上报数据； 用所述 M2M平台和数据接收端协商的密钥对所述上报数据进行加密并生成下 发报文，将所述下发报文发送给所述数据接收端备， 所述下发报文中包括数据 加密方式指示信息，用于向所述数据接收端指示所述 M2M平台采用了对称密钥 方式对所述数据发送端的上报数据进行加密。
数据接收端， 用于接收 M2M平台发送的下发报文， 所述下发报文中包括数 据加密方式指示信息， 用于向数据接收端指示所述 M2M平台采用了 KEM-DEM 方式还是对称密钥方式对数据发送端的上报数据进行加密； 若确定所述 M2M 平台采用了 KEM-DEM方式对数据发送端的上报数据进行加密， 则通过所述 M2M 平台和数据接收端协商的密钥，对所述下发报文中包含的加密后的数据密钥进 行解密，得到所述数据密钥； 通过所述数据密钥对所述下发报文中包含的采用 所述数据密钥加密后的上报数据进行解密， 得到数据发送端发送的上报数据； 若确定所述 M2M平台采用了对称密钥方式对数据发送端的上报数据进行加密， 则通过所述 M2M平台和数据接收端协商的密钥，对所述下发报文中包含的加密 后的上报数据密钥进行解密， 得到数据发送端发送的上报数据。
采用本发明技术方案后，当数据发送端需要将上报数据发送到数据接收端 时，数据发送端首先根据上报数据的数据量大小， 确定所述数据发送端采用何 种加密方式对所述需要上报数据进行加密，当数据发送端发送的上报数据量比 较大时， 采用 KEM-DEM方式对所述上报数据进行加密， 由于 KEM-DEM加密方式 具有对上报数据在数据发送端一次加密，在数据接收端才对该加密后的上报数 据进行解密， M2M平台仅对上报数据加密的数据密钥进行加密解密，避免了 M2M 平台对大量上报数据多次加密解密的过程，显著减少 M2M平台转发数据发送端 上报数据的解密加密的运算开销，提高了 M2M平台的性能； 并且在数据发送端 上报的数据量较小时，采用运算简单的对称密钥的加密方式对所述上报数据进 行加密解密， 使终端的运算消耗比较小， 增加电池的使用时间。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施 例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地， 下面描述 中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲， 在不付 出创造性劳动的前提下， 还可以根据这些附图获得其他的附图。
图 1为本发明实施例 1中数据发送端数据加密传输的方法流程图； 图 2为本发明实施例 1中 M2M平台数据加密传输的方法流程图； 图 3为本发明实施例 1中数据接收端数据加密传输的方法流程图； 图 4为本发明实施例 2 中采用 KEM-DEM方式对数据加密传输的方法流程 图；
图 5 为本发明实施例 2 中采用对称加密方式对数据加密传输的方法流程 图；
图 6为本发明实施例 3中一种数据发送端组成框图；
图 Ί为本发明实施例 3中另一种数据发送端组成框图；
图 8为本发明实施例 3中 M2M平台组成框图；
图 9为本发明实施例 3中数据接收端组成框图；
图 1 0为本发明实施例 3中 M2M数据加密传输的系统组成框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清 楚、 完整地描述， 显然， 所描述的实施例仅仅是本发明一部分实施例， 而不是 全部的实施例。基于本发明中的实施例， 本领域普通技术人员在没有作出创造 性劳动前提下所获得的所有其他实施例， 都属于本发明保护的范围。
实施例 1
本发明实施例提供一种 M2M中数据加密传输的方法，该方法为数据发送端 对上报数据进行加密传输方法， 如图 1所示， 该方法包括：
1 01、 数据发送端判断上报数据的数据量是否超过设定门限值； 若判定所 述上报数据的数据量超过设定门限值， 则执行步骤 1 02 ; 若判定所述上报数据 的数据量没有超过设定门限值， 则执行步骤 1 03。
其中， 所述设定门限值可以为根据密钥大小和终端实际处理能力决定， 本 发明实施例对此不进行限制。
1 02、 所述数据发送端通过 KEM-DEM方式对所述上报数据进行加密并生成 上报报文， 将所述上报报文发送到 M2M平台， 所述上报报文中包括数据加密方 式指示信息，用于向 M2M平台指示数据发送端采用了 KEM-DEM方式对所述上报 数据进行加密。
其中，将数据发送端上报数据和其他需要加密的信息分开加密的方式称为 KEM-DEM方式。 所述通过 KEM-DEM方式对所述上报数据进行加密并生成上报报 文， 将所述上报报文发送到 M2M平台， 可以包括：
获取用于对所述上报数据进行加密的数据密钥；利用所述数据密钥对所述 上报数据进行加密，并利用所述数据发送端和 M2M平台协商的密钥对所述数据 密钥进行加密； 将加密后的上报数据和加密后的数据密钥生成上报报文， 并将 所述上报报文发送到 M2M平台。
其中，所述获取用于对所述数据发送端上报数据进行加密的数据密钥可以 通过以下方法获取， 包括： 通过密码随机生成机制随机生成所述数据密钥； 或 者通过人为设定所述数据密钥； 本发明实施例对此不进行限制， 只要可以得到 用于对所述数据发送端需要上报的数据加密的密钥， 都可以用于本发明实施 例。 并且所述数据发送端和 M2M平台协商的密钥为会话密钥。
103、 所述数据发送端通过数据发送端和 M2M平台协商的密钥， 对所述上 报数据进行加密并生成上报报文，将所述上报报文发送到 M2M平台， 所述上报 报文中包括数据加密方式指示信息，用于向所述 M2M平台指示数据发送端采用 了对称密钥方式对数据所述上报数据进行加密。
其中， 所述数据发送端和 M2M平台协商的密钥为会话密钥。
本发明实施例还提供一种 M2M中数据加密传输的方法，该方法为 M2M平台 对数据发送端上报的数据进行加密传输的方法， 如图 2所示， 该方法包括：
201、 M2M 平台接收数据发送端发送的上报报文， 所述上报报文中包括数 据加密方式指示信息， 用于向 M2M 平台指示所述数据发送端采用了 KEM-DEM 方式还是对称密钥方式对所述数据发送端的上报数据进行加密。 其中，将数据发送端的上报数据和其他需要加密的信息分开加密的方式称 为 KEM-DEM方式。
202、 所述 M2M平台根据所述数据加密方式指示信息确定数据发送端数据 采用的对上报数据加密方式；若确定所述数据发送端采用了 KEM-DEM方式对所 述数据发送端的上报数据进行加密， 则执行步骤 203; 若确定所述数据发送端 采用了对称密钥方式对所述数据发送端的上报数据进行加密， 则执行步骤 205。
203、 所述 M2M平台将加密后的数据密钥和加密后的上报数据从所述上报 报文中分离出来， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密 后的数据密钥进行解密得到所述数据密钥。
其中， 所述数据发送端和 M2M平台协商的密钥可以为会话密钥。
204、 所述 M2M平台通过所述 M2M平台和数据接收端协商的密钥对所述数 据密钥进行加密， 并与所述加密后的上报数据一起生成下发报文，将所述下发 报文发送给所述数据接收端， 所述下发报文中包括数据加密方式指示信息， 用 于向所述数据接收端指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送端 的上报数据进行加密。
其中， 所述 M2M平台和数据接收端协商的密钥可以为会话密钥。
205、 所述 M2M平台通过所述数据发送端和 M2M平台协商的密钥， 对所述 上报报文中包含的加密后的上报数据进行解密得到所述上报数据。
其中， 所述数据发送端和 M2M平台协商的密钥可以为会话密钥
206、 所述 M2M平台通过所述 M2M平台和数据接收端协商的密钥对所述上 报数据进行加密并生成下发报文，将所述下发报文发送给所述数据接收端， 所 述下发报文中包括数据加密方式指示信息， 用于向所述数据接收端指示所述 M2M平台采用了对称密钥方式对所述数据发送端的上报数据进行加密。 其中， 所述 M2M平台和数据接收端协商的密钥可以为会话密钥。 本发明实施例提供一种数据加密传输的方法，该方法为数据接收端的数据 加密传输的方法， 如图 3所示， 该方法包括：
301、 数据接收端接收 M2M平台发送的下发报文， 所述下发报文中包括数 据加密方式指示信息， 用于向所述数据接收端指示所述 M2M 平台采用了
KEM-DEM方式还是对称密钥方式对数据发送端的上报数据进行加密。
302、 所述数据接收端根据所述数据加密方式指示信息确定 M2M平台采用 的对数据发送端的上报数据进行加密的方式； 若确定所述 M2M 平台采用了 KEM-DEM方式对数据发送端的上报数据进行加密， 则执行步骤 303; 若确定所 述 M2M平台采用了对称密钥方式对数据发送端的上报数据进行加密，则执行步 骤 305。
其中，将数据发送端上报数据和其他需要加密的信息分开加密的方式称为 KEM-DEM方式。
303、 所述数据接收端通过所述 M2M平台和数据接收端协商的密钥， 对所 述下发报文中包含的加密后的数据密钥进行解密， 得到所述数据密钥。
其中， 所述 M2M平台和数据接收端协商的密钥可以为会话密钥。
304、 所述数据接收端通过所述数据密钥对所述下发报文中包含的采用所 述数据密钥加密后的上报数据进行解密， 得到数据发送端发送的上报数据。
305、 所述数据接收端通过所述 M2M平台和数据接收端协商的密钥， 对所 述下发报文中包含的加密后的上报数据进行解密，得到数据发送端发送的上报 数据。
其中， 所述 M2M平台和数据接收端协商的密钥可以为会话密钥。
本发明实施例中， 当数据发送端需要将上报数据发送到数据接收端时，数 据发送端首先根据上报数据的数据量大小，确定所述数据发送端采用何种加密 方式对所述需要上报数据进行加密， 当数据发送端发送的上报数据量比较大 时， 采用 KEM-DEM方式对所述上报数据进行加密， 由于 KEM-DEM加密方式具有 对上报数据在数据发送端一次加密，在数据接收端才对该加密后的上报数据进 行解密， M2M平台仅对上报数据加密的数据密钥进行加密解密， 避免了 M2M平 台对大量上报数据多次加密解密的过程，显著减少 M2M平台转发数据发送端上 报数据的解密加密的运算开销，提高了 M2M平台的性能； 并且在数据发送端上 报的数据量较小时，采用运算简单的对称密钥的加密方式对所述上报数据进行 加密解密， 使终端的运算消耗比较小， 增加电池的使用时间。
实施例 2
本发明实施提供一种 M2M中数据加密传输的方法，本发明实施例以数据发 送端采用 KEM-DEM 方式加密传输拍摄的照片为例， 并且以数据发送端和 M2M 平台协商的密钥， 以及 M2M平台和数据接收端协商的密钥为会话密钥为例， 具 体阐述 M2M中数据加密传输的方法， 如图 4所示， 终端上报拍摄的照片， 经过 M2M平台的转发到交警处理系统的过程具体包括：
401终端和 M2M平台之间协商会话密钥 KTP。
其中， 终端和 M2M平台协商会话密钥 KTP的过程， 可以利用现有技术， 本 发明实施例对此不进行限制。
402、 交警的处理系统和 M2M平台之间协商会话密钥 KAP。
其中， 交警的处理系统和 M2M平台协商会话密钥 KAP的过程， 可以利用现 有技术， 本发明实施例对此不进行限制。
403、终端在某一时刻拍摄了照片， 例如交通违章现场， 需要将照片经 M2M 平台上传到交警的处理系统， 由于照片的数据量大小超过了预设的门限值， 因 此确定终端采用 KEM-DEM方式加密该照片并上报；该预设的门限值为数据量门 限值， 所述设定门限值可以为根据密钥大小和终端实际处理能力决定， 本发明 实施例对此不进行限制；终端采用 KEM-DEM方式加密该照片并上报为终端产生 用于加密数据的数据密钥 KD， 用 KD加密照片数据 D, 然后用 KTP加密 KD和其 他信息 I， 将用 KD加密后的照片数据和用 KTP加密后的 KD、 其他信息 I组成 上 报 报 文 （ E (KTP，KD+I) +E (KD，D) ) ， 并 将 组 成 的 上 报 报 文 ( E (KTP, KD+I) +E (KD, D) )发送给 M2M平台， 并在所述上报报文中包含数据加 密方式指示信息，用于向 M2M平台指示所述终端采用了 KEM-DEM方式对所述上 报数据进行加密。
404、 所述 M2M平台接收到终端发送的上报报文后， 根据所述上报报文中 的数据加密方式指示信息，确定终端采用了 KEM-DEM加密方式对上报数据进行 加密， 则所述 M2M平台将用 KD加密后的照片数据和用 KTP加密后的 KD、 其他 信息 I从所述报文中分离出来， 并用 KTP解密得到 KD和其他数据 I， 根据其 他数据确定需要将照片发到交警的处理系统， 因此所述 M2M平台用 KAP加密 KD和其他信息 I， 然后将用 KAP加密 KD和其他信息 Γ 和 KD加密的照片数据 D组合成下发报文（ E (KAP, KD+ Γ ) +E (KD, D) )， 并将所述下发报文（ E (KAP, KD+ Γ ) +E (KD, D) )发送给交警的处理系统， 并在所述下发报文中包含数据加密方 式指示信息，用于向交警的处理系统指示所述 M2M平台采用了 KEM-DEM方式对 终端的上报数据进行加密。
405、 交警的处理系统接收到 M2M平台发送的下发报文后， 根据所述报文 中的数据加密方式指示信息，确定所述 M2M平台采用了 KEM-DEM加密方式对终 端的上报数据进行加密，则所述交警的处理系统用 KAP解密所述下发报文中加 密后的数据密钥，得到 KD，然后用 KD解密所述下发报文中加密后的照片数据， 得到最终的照片。
本发明实施还提供一种 M2M中数据加密传输的方法，本实施例以数据发送 端采用对称密钥的加密方式加密传输环境湿度为例， 并且以数据发送端和 M2M 平台协商的密钥， 以及 M2M平台和数据接收端协商的密钥为会话密钥为例， 具 体阐述 M2M 中数据加密传输的方法， 如图 5所示， 终端上报湿度数据， 经过 M2M平台的转发到环境控制系统的过程具体包括：
501、 终端和 M2M平台之间协商会话密钥 KTP。
其中， 终端和 Μ2Μ平台协商会话密钥 ΚΤΡ的过程， 可以利用现有技术， 本 发明实施例对此不进行限制。
502、 环境控制系统和 Μ2Μ平台之间协商会话密钥 ΚΑΡ。
其中， 环境控制系统和 Μ2Μ平台协商会话密钥 ΚΑΡ的过程， 可以利用现有 技术， 本发明实施例对此不进行限制。
503、 终端在某一获取了湿度数据 D， 需要经 M2M平台上传到环境控制系 统， 由于湿度数据 D的数据量很小， 为 4字节的浮点数， 没有超过预设的门限 值， 因此确定终端采用对称密钥方式加密湿度数据 D并上报； 该预设的门限值 为数据量门限值，所述设定门限值可以为根据密钥大小和终端实际处理能力决 定， 本发明实施例对此不进行限制； 终端采用对称密钥方式加密湿度数据 D 并上报包括终端用 KTP加密 D和其他信息 I， 将用 KTP加密 D和其他信息 I组 成上报报文 E (KTP， I+D )， 并将所述组成的上报报文 E (KTP， I+D )发送给 M2M 平台，并在所述上报报文中包含数据加密方式指示信息， 用于向 M2M平台指示 所述终端采用了对称加密方式对所述上报数据进行加密。
504、 所述 M2M平台接收到终端发送的上报报文后， 根据所述上报报文中 的数据加密方式指示信息， 确定终端采用了对称加密方式对上报数据进行加 密，则所述 M2M平台将用 KTP加密 D和其他信息 I用 KTP解密得到 D和其他信 息 I， 根据所述其他信息 I确定需要将湿度数据 D发到环境控制系统， 因此所 述 M2M平台用 KAP加密湿度数据 D和其他信息 Γ 并组成下发报文 E (ΚΤΡ, Γ +D ), 然后将所述下发报文 Ε (ΚΤΡ， Γ +D )发给环境控制系统， 并在所述上报 报文中包含数据加密方式指示信息，用于向环境控制系统指示所述 M2M平台采 用了对称加密方式对终端上报数据进行加密。
505、 所述环境控制系统接收到 M2M平台发送的下发报文后， 根据所述报 文中的数据加密方式指示信息，确定所述 M2M平台采用了对称加密方式对终端 上报数据进行加密， 则所述环境控制系统用 KTP解密得到的 D和其他信息 I 用 KAP解密， 得到湿度数据 D和其他信息 Γ， 然后进行后续的环境控制， 例 如控制加湿器的开关。
本发明实施例中， 当数据发送端需要将上报数据发送到数据接收端时，数 据发送端首先根据上报数据的数据量大小，确定所述数据发送端采用何种加密 方式对所述需要上报数据进行加密， 当数据发送端发送的上报数据量比较大 时， 采用 KEM-DEM方式对所述上报数据进行加密， 由于 KEM-DEM加密方式具有 对上报数据在数据发送端一次加密，在数据接收端才对该加密后的上报数据进 行解密， M2M平台仅对上报数据加密的数据密钥进行加密解密， 避免了 M2M平 台对大量上报数据多次加密解密的过程，显著减少 M2M平台转发数据发送端上 报数据的解密加密的运算开销，提高了 M2M平台的性能； 并且在数据发送端上 报的数据量较小时，采用运算简单的对称密钥的加密方式对所述上报数据进行 加密解密， 使终端的运算消耗比较小， 增加电池的使用时间。
并且， 本发明实施例中， 数据发送端和 M2M平台协商的密钥为会话密钥， 以及所述 M2M平台和数据接收端协商的密钥可以为会话密钥，从而避免了传统 的 KEM-DEM 方法对数据密钥的加密采用非对称密钥加密技术进行对终端运算 能力要求较高， 以及增加运算消耗的弊端， 从而减少终端的能耗， 增加电池的 使用时间。
实施例 3
本发明实施例提供一种数据发送端， 如图 6所示， 该数据发送端包括： 判 断单元 61、 第一加密单元 62、 第一生成单元 63、 第一发送单元 66、 第二加密 单元 65、 第二生成单元 66和第二发送单元 67。
判断单元 61， 用于判断上报数据的数据量是否超过设定门限值， 其中， 所述设定门限值可以为根据密钥大小和终端实际处理能力决定，本发明实施例 对此不进行限制； 在所述判断单元 61判定所述上报数据的数据量超过设定门 限值时， 第一加密单元 62， 用于通过 KEM-DEM方式对所述需要上报的数据进 行加密； 第一生成单元 63， 用于将所述第一加密单元 62加密得到的加密后的 上报数据生成上报报文； 第一发送单元 64， 用于将所述第一生成单元 63生成 的所述上报报文发送到 M2M平台， 所述上报报文中包括数据加密方式指示信 息，用于向 M2M平台指示数据发送端采用了 KEM-DEM方式对所述上报数据进行 加密。其中， 将数据发送端上报数据和其他需要加密的信息分开加密的方式称 为 KEM-DEM方式。
在所述判断单元 61判定所述上报数据的数据量没有超过设定门限值时， 第二加密单元 65， 用于通过数据发送端和 M2M平台协商的密钥， 对所述上报 数据进行加密，其中所述数据发送端和 M2M平台协商的密钥对所述数据密钥可 以为会话密钥； 第二生成单元 66， 用于将所述第二加密单元 65得到的加密后 的上报数据生成上报报文； 第二发送单元 67， 用于将所述第二生成单元 66生 成的所述上报报文发送到 M2M平台，所述上报报文中包括数据加密方式指示信 息，用于向所述 M2M平台指示数据发送端采用了对称密钥方式对所述上报数据 进行加密。
如图 Ί所示， 所述第一加密单元 62包括： 获取模块 621和加密模块 622。 获取模块 621， 用于获取用于对所述上报数据进行加密的数据密钥； 加密 模块 622， 用于利用所述数据密钥对所述上报数据进行加密， 并用所述数据发 送端和 M2M平台协商的密钥对所述数据密钥进行加密，其中所述数据发送端和 M2M平台协商的密钥对所述数据密钥可以为会话密钥； 所述第一生成单元 63 还用于将所述加密模块 622 加密后的上报数据和加密后的数据密钥生成上报 报文。
其中，所述获取模块 621获取用于对所述数据发送端的上报数据进行加密 的数据密钥， 可以通过密码随机生成机制随机生成所述数据密钥； 或者通过人 为设定所述数据密钥； 本发明实施例对此不进行限制， 只要可以得到用于对所 述数据发送端的上报数据进行加密的数据密钥，都可以用于本发明实施例。 并 且所述数据发送端和 M2M平台协商的密钥为会话密钥。
本发明实施例提供一种 M2M平台， 如图 8所示， 该平台包括： 第一接收单 元 71、 第一解密单元 72、 第一加密单元 73、 第一生成单元 74、 第一发送单元 75、 第二解密单元 76、 第二加密单元 77、 第二生成单元 78和第二发送单元 79。
第一接收单元 71， 用于接收数据发送端发送的上报报文， 所述上报报文 中包括数据加密方式指示信息， 用于向 M2M平台指示所述数据发送端采用了 KEM-DEM方式还是对称密钥方式对所述数据发送端的上报数据进行加密。
在根据所述数据加密方式指示信息确定所述数据发送端采用了 KEM-DEM 方式对所述数据发送端的上报数据进行加密时， 第一解密单元 72， 用于将加 密后的数据密钥和加密后的上报数据从所述接收单元 71接收到的所述上报报 文中分离出， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密的数 据密钥进行解密得到所述数据密钥，其中所述数据发送端和 M2M平台协商的密 钥可以为会话密钥； 第一加密单元 73， 用于通过所述 M2M平台和数据接收端 协商的密钥对所述第一解密单元 72解密得到的所述数据密钥进行加密， 其中 所述 M2M平台和数据接收端协商的密钥可以为会话密钥； 第一生成单元 74， 用于将所述第一加密单元 73得到的加密后的数据密钥与所述第一解密单元 71 分离出的所述加密后的上报数据一起生成下发报文； 第一发送单元 75， 用于 将所述第一生成单元 74生成的所述下发报文发送给所述数据接收端， 所述下 发报文中包括数据加密方式指示信息， 用于向所述数据接收端指示所述 M2M 平台采用了 KEM-DEM方式对所述数据发送端的上报数据进行加密。
在所述数据加密方式指示信息确定所述数据发送端采用了对称密钥方式 对所述数据发送端的上报数据进行加密时， 第二解密单元 76， 用于通过所述 数据发送端和 M2M平台协商的密钥，对所述接收单元接收到的所述上报报文中 包含的加密后的上报数据进行解密得到所述上报数据，其中所述数据发送端和 M2M平台协商的密钥可以为会话密钥； 第二加密单元 77， 用于通过所述 M2M 平台和数据接收端协商的密钥， 对所述第二解密单元 76解密得到的所述上报 数据进行加密， 其中所述 M2M平台和数据接收端协商的密钥可以为会话密钥； 第二生成单元 78， 用于将所述第二加密单元 ΊΊ得到的加密后的上报数据生成 下发报文； 第二发送单元 79， 用于将所述第二生成单元 78生成的所述下发报 文发送给所述数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于 向所述数据接收端指示所述 M2M平台采用了对称密钥方式对所述数据发送端 的上报数据进行加密。
本发明实施例提供一种数据接收端， 如图 9所示， 所述数据接收端包括： 接收单元 81、 第一解密单元 82、 第二解密单元 83和第三解密单元 84。
接收单元 81， 用于接收 M2M平台发送的下发报文， 所述下发报文中包括 数据加密方式指示信息， 用于向数据接收端指示所述 M2M平台采用了 KEM-DEM 方式还是对称密钥方式对数据发送端的上报数据进行加密。
在根据所述数据加密方式指示信息确定所述 M2M平台采用了 KEM-DEM方式 对数据发送端的上报数据进行加密时， 第一解密单元 82， 用于通过所述 M2M 平台和数据接收端协商的密钥， 对所述接收单元 81接收到的所述下发报文中 包含的加密后的数据密钥进行解密， 得到所述数据密钥； 第二解密单元 83， 用于通过用所述第一解密单元 82解密得到的所述数据密钥， 对所述接收单元 81 接收到的所述下发报文中包含的采用所述数据密钥加密后的数据进行解 密， 得到数据发送端发送的上报数据。 其中， 所述 M2M平台和数据接收端协商 的密钥可以为会话密钥。
在根据所述数据加密方式指示信息确定所述 M2M 平台采用了对称密钥方 式对所述数据发送端的上报数据进行加密时， 第三解密单元 84， 用于通过所 述 M2M平台和数据接收端协商的密钥， 对所述接收单元 81接收到的所述下发 报文中包含的加密后的上报数据进行解密， 得到数据发送端发送的上报数据。 其中， 所述 M2M平台和数据接收端协商的密钥可以为会话密钥。
本发明实施例提供一种 M2M中数据加密传输的系统， 如图 10所示， 还系 统包括： 数据发送端 91、 M2M平台 92和数据接收端 93。
数据发送端 91， 用于判断上报数据的数据量是否超过设定门限值； 若判 定所述上报数据的数据量超过设定门限值，则通过 KEM-DEM方式对所述上报数 据进行加密并生成上报报文， 并将所述上报报文发送到 M2M平台 92， 所述上 报报文中包括数据加密方式指示信息，用于向所述 M2M平台指示数据发送端采 用了 KEM-DEM方式对所述上报数据进行加密；若判定所述上报数据的数据量没 有超过设定门限值， 则通过数据发送端和 M2M平台协商的密钥，对所述上报数 据进行加密并生成上报报文， 并将所述上报报文发送到 M2M平台 92， 所述上 报报文中包括数据加密方式指示信息，用于向所述 M2M平台指示数据发送端采 用了对称密钥方式对所述上报数据进行加密。
M2M平台 92， 用于接收数据发送端 91发送的上报报文， 所述上报报文中 包括数据加密方式指示信息， 用于向所述 M2M平台指示所述数据发送端 91采 用了 KEM-DEM方式还是对称密钥方式对所述数据发送端的上报数据进行加密； 若确定所述数据发送端 91采用了 KEM-DEM方式对所述数据发送端的上报数据 进行加密，则将加密后的数据密钥和加密后的上报数据从所述上报报文中分离 出来， 并通过所述数据发送端 91和 M2M平台 92协商的密钥，对所述加密的数 据密钥进行解密得到所述数据密钥； 通过所述 M2M平台 92 和数据接收端 93 协商的密钥对所述数据密钥进行加密，并与所述加密后的上报数据一起生成下 发报文， 并将所述下发报文发送给所述数据接收端 93， 所述下发报文中包括 数据加密方式指示信息， 用于向所述数据接收端指示所述 M2M平台 92采用了 KEM-DEM方式对所述数据发送端的上报数据进行加密； 若确定所述数据发送端 91采用了对称密钥方式对数据进行加密， 则通过所述数据发送端 91和 M2M平 台 92协商的密钥， 对所述上报报文中包含的加密后的上报数据进行解密得到 所述上报数据；用所述 M2M平台 92和数据接收端 93协商的密钥对所述上报数 据进行加密并生成下发报文， 将所述下发本文发送给所述数据接收端 93， 所 述下发报文中包括数据加密方式指示信息， 用于向所述数据接收端指示所述 M2M平台 92采用了对称密钥方式对所述数据发送端的上报数据进行加密。
数据接收端 93， 用于接收 M2M平台 92发送的下发报文， 所述下发报文中 包括数据加密方式指示信息， 用于向数据接收端指示所述 M2M平台 92采用了 KEM-DEM方式还是对称密钥方式对数据发送端的上报数据进行加密； 若确定所 述 M2M平台 92采用了 KEM-DEM方式对数据发送端的上报数据进行加密， 则通 过所述 M2M平台 92和数据接收端 93协商的密钥，对所述下发报文中包含的加 密后的数据密钥进行解密，得到所述数据密钥； 通过所述数据密钥对所述下发 报文中包含的采用所述数据密钥加密后的数据进行解密，得到数据发送端发送 的上报数据； 若确定所述 M2M平台 92采用了对称密钥方式对数据发送端的上 报数据进行加密， 则通过所述 M2M平台 92和数据接收端 93协商的密钥，对所 述下发报文中包含的加密后的上报数据进行解密，得到数据发送端发送的上报 数据。
本发明实施例中， 当数据发送端需要将上报数据发送到数据接收端时，数 据发送端首先根据上报数据的数据量大小，确定所述数据发送端采用何种加密 方式对所述需要上报数据进行加密， 当数据发送端发送的上报数据量比较大 时， 采用 KEM-DEM方式对所述上报数据进行加密， 由于 KEM-DEM加密方式具有 对上报数据在数据发送端一次加密，在数据接收端才对该加密后的上报数据进 行解密， M2M平台仅对上报数据加密的数据密钥进行加密解密， 避免了 M2M平 台对大量上报数据多次加密解密的过程，显著减少 M2M平台转发数据发送端上 报数据的解密加密的运算开销，提高了 M2M平台的性能； 并且在数据发送端上 报的数据量较小时，采用运算简单的对称密钥的加密方式对所述上报数据进行 加密解密， 使终端的运算消耗比较小， 增加电池的使用时间。
并且， 本发明实施例中， 数据发送端和 M2M平台协商的密钥为会话密钥， 以及所述 M2M平台和数据接收端协商的密钥可以为会话密钥，从而避免了传统 的 KEM-DEM 方法对数据密钥的加密采用非对称密钥加密技术进行对终端运算 能力要求较高， 以及增加运算消耗的弊端， 从而减少终端的能耗。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发 明可借助软件加必需的通用硬件的方式来实现， 当然也可以通过硬件，但艮多 情况下前者是更佳的实施方式。基于这样的理解， 本发明的技术方案本质上或 者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软 件产品存储在可读取的存储介质中， 如计算机的软盘， 硬盘或光盘等， 包括若 干指令用以使得一台计算机设备（可以是个人计算机， 服务器， 或者网络设备 等）执行本发明各个实施例所述的方法。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于 此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内， 可轻易想到 变化或替换， 都应涵盖在本发明的保护范围之内。 因此， 本发明的保护范围应 以所述权利要求的保护范围为准。

Claims

权 利 要 求
1、 一种 M2M中数据加密传输的方法， 其特征在于， 包括：
判断上报数据的数据量是否超过设定门限值；
若判定所述上报数据的数据量超过设定门限值，则通过 KEM-DEM方式对所 述上报数据进行加密并生成上报报文， 将所述上报报文发送到 M2M平台，所述 上报报文中包括数据加密方式指示信息，用于向 M2M平台指示数据发送端采用 了 KEM-DEM方式对所述上报数据进行加密；
若判定所述上报数据的数据量没有超过设定门限值，则通过数据发送端和 M2M平台协商的密钥， 对所述上报数据进行加密并生成上报报文， 将所述上报 报文发送到 M2M平台， 所述上报报文中包括数据加密方式指示信息， 用于向所 述 M2M平台指示数据发送端采用了对称密钥方式对所述上报数据进行加密。
2、 根据权利要求 1所述的方法， 其特征在于， 所述通过 KEM-DEM方式对 所述上报数据进行加密并生成上报报文， 将所述上报报文发送到 M2M平台包 括：
获取用于对所述上报数据进行加密的数据密钥；
利用所述数据密钥对所述上报数据进行加密， 并利用所述数据发送端和 M2M平台协商的密钥对所述数据密钥进行加密；
将加密后的上报数据和加密后的数据密钥生成上报报文，并将所述上报报 文发送到 M2M平台。
3、根据权利要求 1或 2所述的方法，其特征在于， 所述数据发送端和 M2M 平台协商的密钥为会话密钥。
4、 一种 M2M中数据加密传输的方法， 其特征在于， 包括：
接收数据发送端发送的上报报文，所述上报报文中包括数据加密方式指示 信息，用于向 M2M平台指示所述数据发送端采用了 KEM-DEM方式还是对称密钥 方式对所述数据发送端的上报数据进行加密；
若确定所述数据发送端采用了 KEM-DEM 方式对所述数据发送端的上报数 据进行加密，则将加密后的数据密钥和加密后的上报数据从所述上报报文中分 离出来， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密后的数据 密钥进行解密得到所述数据密钥；
通过所述 M2M平台和数据接收端协商的密钥对所述数据密钥进行加密，并 与所述加密后的上报数据一起生成下发报文，将所述下发报文发送给所述数据 接收端， 所述下发报文中包括数据加密方式指示信息，用于向所述数据接收端 指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送端的上报数据进行加 密；
若确定所述数据发送端采用了对称密钥方式对所述数据发送端的上报数 据进行加密， 则通过所述数据发送端和 M2M平台协商的密钥，对所述上报报文 中包含的加密后的上报数据进行解密得到所述上报数据；
通过所述 M2M 平台和数据接收端协商的密钥对所述上报数据进行加密并 生成下发报文，将所述下发报文发送给所述数据接收端， 所述下发报文中包括 数据加密方式指示信息，用于向所述数据接收端指示所述 M2M平台采用了对称 密钥方式对所述数据发送端的上报数据进行加密。
5、 根据权利要求 4所述的方法， 其特征在于，
所述数据发送端和 M2M平台协商的密钥为会话密钥；
所述 M2M平台和数据接收端协商的密钥为会话密钥。
6、 一种数据加密传输的方法， 其特征在于， 包括：
接收 M2M平台发送的下发报文，所述下发报文中包括数据加密方式指示信 息，用于向数据接收端指示所述 M2M平台采用了 KEM-DEM方式还是对称密钥方 式对数据发送端的上报数据进行加密； 若确定所述 M2M平台采用了 KEM-DEM方式对数据发送端的上报数据进行加 密， 则通过所述 M2M平台和数据接收端协商的密钥，对所述下发报文中包含的 加密后的数据密钥进行解密， 得到所述数据密钥；
通过所述数据密钥对所述下发报文中包含的采用所述数据密钥加密后的 上报数据进行解密， 得到数据发送端发送的上报数据；
若确定所述 M2M平台采用了对称密钥方式对数据发送端的上报数据进行 加密， 则通过所述 M2M平台和数据接收端协商的密钥，对所述下发报文中包含 的加密后的上报数据进行解密， 得到数据发送端发送的上报数据。
7、 根据权利要求 6所述的方法， 其特征在于， 所述 M2M平台和数据接收 端协商的密钥为会话密钥。
8、 一种数据发送端， 其特征在于， 包括：
判断单元， 用于判断上报数据的数据量是否超过设定门限值；
第一加密单元，用于在所述判断单元判定所述上报数据的数据量超过设定 门限值时， 通过 KEM-DEM方式对所述上报数据进行加密；
第一生成单元，用于将所述第一加密单元加密得到的加密后的上报数据生 成上报报文；
第一发送单元， 用于将所述第一生成单元生成的所述上报报文发送到 M2M 平台， 所述上报报文中包括数据加密方式指示信息，用于向 M2M平台指示数据 发送端采用了 KEM-DEM方式对所述上报数据进行加密；
第二加密单元，用于在所述判断单元判定所述上报数据的数据量没有超过 设定门限值时，通过数据发送端和 M2M平台协商的密钥，对所述上报数据进行 加密；
第二生成单元，用于将所述第二加密单元得到的加密后的上报数据生成上 报报文； 第二发送单元， 用于将所述第二生成单元生成的所述上报报文发送到 M2M 平台， 所述上 4艮"¾文中包括数据加密方式指示信息，用于向所述 M2M平台指示 数据发送端采用了对称密钥方式对所述上报数据进行加密。
9、 根据权利要求 8所述的数据发送端， 其特征在于， 所述第一加密单元 包括：
获取模块， 用于获取用于对所述上报数据进行加密的数据密钥； 加密模块，用于利用所述获取模块获取的所述数据密钥对所述上报数据进 行加密，并利用所述数据发送端和 M2M平台协商的密钥对所述数据密钥进行加 密。
10、 一种 M2M平台， 其特征在于， 包括：
接收单元， 用于接收数据发送端发送的上报报文， 所述上报报文中包括数 据加密方式指示信息， 用于向 M2M 平台指示所述数据发送端采用了 KEM-DEM 方式还是对称密钥方式对所述数据发送端的上报数据进行加密；
第一解密单元，用于在确定所述数据发送端采用了 KEM-DEM方式对所述数 据发送端的上报数据进行加密时，将加密后的数据密钥和加密后的上报数据从 所述接收单元接收到的所述上报报文中分离出来， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密后的数据密钥进行解密，得到所述数据密钥； 第一加密单元，用于通过用所述 M2M平台和数据接收端协商的密钥对所述 第一解密单元解密得到的所述数据密钥进行加密；
第一生成单元，用于将所述第一加密单元得到的加密后的数据密钥和第一 解密单元分离出的加密后的上报数据一起生成下发报文；
第一发送单元，用于将所述第一生成单元生成的所述下发报文发送给所述 数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于向所述数据接 收端指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送端的上报数据进行 加密；
第二解密单元，用于在确定所述数据发送端采用了对称密钥方式对所述数 据发送端的上报数据进行加密时， 通过所述数据发送端和 M2M 平台协商的密 钥，对所述接收单元接收到的所述上报报文中包含的加密后的上报数据进行解 密得到所述上报数据；
第二加密单元，用于通过所述 M2M平台和数据接收端协商的密钥对所述第 二解密单元解密得到的所述上报数据进行加密；
第二生成单元，用于将所述第二加密单元得到的加密后的上报数据生成下 发报文；
第二发送单元，用于将所述第二生成单元生成的所述下发报文发送给所述 数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于向所述数据接 收端指示所述 M2M 平台采用了对称密钥方式对所述数据发送端的上报数据进 行力口密。
11、 一种数据接收端， 其特征在于， 包括：
接收单元， 用于接收 M2M平台发送的下发报文， 所述下发报文中包括数据 加密方式指示信息，用于向数据接收端指示所述 M2M平台采用了 KEM-DEM方式 还是对称密钥方式对数据发送端的上报数据进行加密；
第一解密单元，用于在确定所述 M2M平台采用了 KEM-DEM方式对数据发送 端的上报数据进行加密时，通过所述 M2M平台和数据接收端协商的密钥，对所 述接收单元接收到的所述下发报文中包含的加密后的数据密钥进行解密，得到 所述数据密钥；
第二解密单元， 用于通过所述第一解密单元解密得到的所述数据密钥，对 所述接收单元接收到的所述下发报文中包含的采用所述数据密钥加密后的上 报数据进行解密， 得到数据发送端发送的上报数据； 第三解密单元，用于在确定所述 M2M平台采用了对称密钥方式对数据发送 端的上报数据进行加密时，通过所述 M2M平台和数据接收端协商的密钥，对所 述接收单元接收到的所述下发报文中包含的加密后的上报数据进行解密，得到 数据发送端发送的上报数据。
12、 一种 M2M中数据加密传输系统， 其特征在于， 包括：
数据发送端， 用于判断上报数据的数据量是否超过设定门限值； 若判定所 述上报数据的数据量超过设定门限值，则通过 KEM-DEM方式对所述上报数据进 行加密并生成上报报文， 将所述上报报文发送到 M2M平台， 所述上报报文中包 括数据加密方式指示信息， 用于向所述 M2M 平台指示数据发送端采用了 KEM-DEM方式对所述上报数据进行加密； 若判定所述上报数据的数据量没有超 过设定门限值， 则通过数据发送端和 M2M平台协商的密钥，对所述上报数据进 行加密并生成上报报文， 将所述上报报文发送到 M2M平台， 所述上报报文中包 括数据加密方式指示信息，用于向所述 M2M平台指示数据发送端采用了对称密 钥方式对所述上报数据进行加密。
M2M平台， 用于接收数据发送端发送的上报报文， 所述上报报文中包括数 据加密方式指示信息， 用于向所述 M2M 平台指示所述数据发送端采用了 KEM-DEM方式还是对称密钥方式对所述数据发送端的上报数据进行加密； 若确 定所述数据发送端采用了 KEM-DEM 方式对所述数据发送端的上报数据进行加 密， 则将加密后的数据密钥和加密后的上报数据从所述上报报文中分离出来， 并通过所述数据发送端和 M2M平台协商的密钥，对所述加密后的数据密钥进行 解密，得到所述数据密钥； 通过所述 M2M平台和数据接收端协商的密钥对所述 数据密钥进行加密， 并与所述加密后的上报数据一起生成下发报文，将所述下 发报文发送给所述数据接收端， 所述下发报文中包括数据加密方式指示信息， 用于向所述数据接收端指示所述 M2M平台采用了 KEM-DEM方式对所述数据发送 端的上报数据进行加密；若确定所述数据发送端采用了对称密钥方式对所述数 据发送端的上报数据进行加密， 则通过所述数据发送端和 M2M 平台协商的密 钥， 对所述上报报文中包含的加密后的上报数据进行解密得到所述上报数据； 用所述 M2M平台和数据接收端协商的密钥对所述上报数据进行加密并生成下 发报文，将所述下发报文发送给所述数据接收端， 所述下发报文中包括数据加 密方式指示信息，用于向所述数据接收端指示所述 M2M平台采用了对称密钥方 式对所述数据发送端的上报数据进行加密。
数据接收端， 用于接收 M2M平台发送的下发报文， 所述下发报文中包括数 据加密方式指示信息， 用于向数据接收端指示所述 M2M平台采用了 KEM-DEM 方式还是对称密钥方式对数据发送端的上报数据进行加密； 若确定所述 M2M 平台采用了 KEM-DEM方式对数据发送端的上报数据进行加密， 则通过所述 M2M 平台和数据接收端协商的密钥，对所述下发报文中包含的加密后的数据密钥进 行解密，得到所述数据密钥； 通过所述数据密钥对所述下发报文中包含的采用 所述数据密钥加密后的上报数据进行解密， 得到数据发送端发送的上报数据； 若确定所述 M2M平台采用了对称密钥方式对数据发送端的上报数据进行加密， 则通过所述 M2M平台和数据接收端协商的密钥，对所述下发报文中包含的加密 后的上报数据进行解密， 得到数据发送端发送的上报数据。
PCT/CN2011/072616 2010-04-16 2011-04-11 M2m中数据加密传输的方法、设备及系统 WO2011127804A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP11768416.7A EP2560319B1 (en) 2010-04-16 2011-04-11 Method, apparatus and system for data encryption transmission in m2m

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010148632.4A CN102223631B (zh) 2010-04-16 2010-04-16 M2m中数据加密传输的方法、设备及系统
CN201010148632.4 2010-04-16

Publications (1)

Publication Number Publication Date
WO2011127804A1 true WO2011127804A1 (zh) 2011-10-20

Family

ID=44780030

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/072616 WO2011127804A1 (zh) 2010-04-16 2011-04-11 M2m中数据加密传输的方法、设备及系统

Country Status (3)

Country Link
EP (1) EP2560319B1 (zh)
CN (1) CN102223631B (zh)
WO (1) WO2011127804A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103096308A (zh) * 2011-11-01 2013-05-08 华为技术有限公司 生成组密钥的方法和相关设备
CN104994112A (zh) * 2015-07-23 2015-10-21 陈昊 一种无人机与地面站通信数据链加密的方法

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102546614A (zh) * 2011-12-28 2012-07-04 畅捷通信息技术股份有限公司 数据互导系统和数据互导方法
CN103888411A (zh) * 2012-12-19 2014-06-25 杭州智为科技有限公司 一种报文处理装置
CN103490889B (zh) * 2013-08-07 2017-03-15 金子光 一种无限长密钥互联网通信加密方法
TWI543014B (zh) * 2015-01-20 2016-07-21 動信科技股份有限公司 快速佈署可信任執行環境應用的系統與方法
CN107040918B (zh) * 2016-02-03 2021-03-09 上海方付通商务服务有限公司 一种应用安全的增强方法、系统、及具有该系统的客户端
CN114726526B (zh) * 2022-03-04 2023-01-10 慧之安信息技术股份有限公司 基于物联网平台的终端传感器数据加密方法和系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1246940A (zh) * 1997-12-10 2000-03-08 精工爱普生株式会社 信息处理系统、加密/解密系统、系统lsi与电子设备
CN1972278A (zh) * 2005-11-21 2007-05-30 西安大唐电信有限公司 一种实现安全的远程视频监控的方法
US20070194507A1 (en) * 2006-02-21 2007-08-23 Tokai Rubber Industries, Ltd. Spring seat of suspension for automotive vehicle
CN101416467A (zh) * 2006-02-02 2009-04-22 艾登特姆有限公司 Kem-dem加密电子数据通信系统
CN101482909A (zh) * 2008-12-29 2009-07-15 苏州国芯科技有限公司 加密算法模块加速器及其数据高速加解密方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH10178421A (ja) * 1996-10-18 1998-06-30 Toshiba Corp パケット処理装置、移動計算機装置、パケット転送方法及びパケット処理方法
US7292690B2 (en) * 2002-01-02 2007-11-06 Sony Corporation Video scene change detection
US7089089B2 (en) * 2003-03-31 2006-08-08 Power Measurement Ltd. Methods and apparatus for retrieving energy readings from an energy monitoring device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1246940A (zh) * 1997-12-10 2000-03-08 精工爱普生株式会社 信息处理系统、加密/解密系统、系统lsi与电子设备
CN1972278A (zh) * 2005-11-21 2007-05-30 西安大唐电信有限公司 一种实现安全的远程视频监控的方法
CN101416467A (zh) * 2006-02-02 2009-04-22 艾登特姆有限公司 Kem-dem加密电子数据通信系统
US20070194507A1 (en) * 2006-02-21 2007-08-23 Tokai Rubber Industries, Ltd. Spring seat of suspension for automotive vehicle
CN101482909A (zh) * 2008-12-29 2009-07-15 苏州国芯科技有限公司 加密算法模块加速器及其数据高速加解密方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2560319A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103096308A (zh) * 2011-11-01 2013-05-08 华为技术有限公司 生成组密钥的方法和相关设备
WO2013064041A1 (zh) * 2011-11-01 2013-05-10 华为技术有限公司 生成组密钥的方法和相关设备
CN104994112A (zh) * 2015-07-23 2015-10-21 陈昊 一种无人机与地面站通信数据链加密的方法

Also Published As

Publication number Publication date
CN102223631B (zh) 2014-06-04
EP2560319A4 (en) 2014-12-31
EP2560319A1 (en) 2013-02-20
CN102223631A (zh) 2011-10-19
EP2560319B1 (en) 2016-10-12

Similar Documents

Publication Publication Date Title
US20240064003A1 (en) Encryption Method, Decryption Method, and Related Apparatus
WO2011127804A1 (zh) M2m中数据加密传输的方法、设备及系统
TWI642288B (zh) Instant communication method and system
CN101583083B (zh) 一种实时数据业务的实现方法和实时数据业务系统
US20200228977A1 (en) Parameter Protection Method And Device, And System
WO2016172035A1 (en) Scalable intermediate network device leveraging ssl session ticket extension
CN102333093A (zh) 一种数据加密传输方法及系统
CN103338437A (zh) 一种移动即时消息的加密方法及系统
CN101707767B (zh) 一种数据传输方法及设备
CN109104273B (zh) 报文处理方法以及接收端服务器
WO2019019853A1 (zh) 处理数据的方法、终端设备和网络设备
CN111082929A (zh) 一种加密即时通讯的实现方法
WO2013185680A1 (zh) 一种短消息加解密的方法及装置
TWI469610B (zh) 用於傳送和接收安全和非安全資料的方法和裝置
CN105959281A (zh) 文件加密传输方法和装置
EP2992646B1 (en) Handling of performance monitoring data
WO2014094251A1 (zh) 通信安全处理方法及装置
EP2713576B1 (en) Method and device for processing streaming media content
CN101729535B (zh) 一种媒体点播业务的实现方法
CN110855628A (zh) 一种数据传输方法及系统
WO2017114156A1 (zh) 一种数据加密传输方法、基站及pdt终端
CN104159320A (zh) 一种局域异构网络的数据交换方法
CN109257630B (zh) 视频点播中的数据传输系统、方法、装置及存储介质
WO2023066215A1 (zh) 一种数字货币钱包管理方法及远程控制方法、装置和系统
WO2023223115A1 (en) Forward secure communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11768416

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2011768416

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2011768416

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE