WO2013134927A1

WO2013134927A1 - Transport layer security-based key delivery method, smart meter reading terminal and server

Info

Publication number: WO2013134927A1
Application number: PCT/CN2012/072274
Authority: WO
Inventors: 涂校明
Original assignee: 华为终端有限公司
Priority date: 2012-03-13
Filing date: 2012-03-13
Publication date: 2013-09-19
Also published as: CN102742250A; CN102742250B

Abstract

The embodiments of the present invention relate to the field of smart meter reading, and more particularly to a transport layer security-based key delivery method, a smart meter reading terminal and a server. The method comprises: a smart meter reading terminal receiving a push message from a first server, the push message containing a first ciphertext, the first ciphertext being obtained by encrypting a second ciphertext and a second subkey using a first key, and the second ciphertext being obtained by encrypting the second subkey using the second subkey; using the first key to decrypt the first ciphertext to obtain the second ciphertext and the second subkey, and using the obtained second subkey to decrypt the second ciphertext to obtain a subsidiary second subkey; if the second subkey is the same as the subsidiary second subkey, using the second subkey and a first random number to encrypt a response that the second subkey has been normally received, and sending the response to the first server; and using the second subkey as a pre-shared key in the transport layer security protocol, and establishing a data link between the smart meter reading terminal and the first server.

Description

Key transfer method based on transport layer security, smart meter reading terminal and server

The invention relates to the field of intelligent meter reading, in particular to a key transfer method based on transport layer security, an intelligent meter reading terminal and a server. Background of the invention:

With the development of communication technology and intelligent building concepts, intelligent meter reading systems are being deployed more and more widely, and are called important tools for energy suppliers. In the smart meter reading system, in order to protect the user's information and financial security, it is necessary to encrypt the data transmitted in the system. The existing smart meter reading system mainly uses the mechanism defined by the SSWG (Smart Specification Working Group) to complete the interaction between the smart meter reading terminal and the energy provider's server. The SSWG currently mainly adopts the Transport Layer Security (TLS) protocol as a specification for data link establishment. One of the authentication methods in the TLS protocol uses a Pre-Shared Key as the basis for encryption. However, the pre-shared key in the TLS protocol is preset, which is not conducive to updating and maintenance, and reduces security. Summary of the invention

The embodiment of the invention discloses a key transfer method based on the transport layer security, an intelligent meter reading terminal and a server, so that the pre-shared key of the data encryption system based on the transport layer security protocol is dynamically allocated, thereby improving the overall system. Maintainability and safety.

The embodiment of the invention discloses a key delivery method based on the security of the transport layer, comprising: the smart meter reading terminal receiving the push message from the first server, the push message containing the first ciphertext, the first ciphertext Obtaining, after the second ciphertext and the second seed key are encrypted by using the first key, the second ciphertext is obtained by encrypting the second seed key by using the second seed key, The first key is generated by the first seed key and the first random number, The first seed key and the first random number are preset on the first server, and the second seed key is generated by the first server;

The smart meter reading terminal decrypts the first ciphertext using the first key to obtain the second ciphertext and the second seed key, and decrypts the second secret by using the obtained second seed key Obtaining a second second seed key, where the first key is generated by the first seed key and the first random number, and the first seed key and the first random number are preset in the smart meter reading On the terminal;

If the second seed key is the same as the second second seed key, the second seed key and the first random number are used to encrypt the response normally received by the second seed key, and the response is sent to the First server;

The smart meter reading terminal and the first server use the second seed key as a pre-shared key in a transport layer security protocol, and establish a data link between the smart meter reading terminal and the first server. .

The embodiment of the invention discloses a smart meter reading terminal, which comprises a processing unit, a storage unit and an uplink communication unit, wherein

The storage unit is configured to store a first seed key and a first random number;

The uplink communication unit is configured to communicate with the first server;

The processing unit is configured to receive, by the uplink communications unit, a push message from the first server, where the push message includes a first ciphertext, and the first ciphertext uses a first key pair second secret The second ciphertext is obtained by encrypting the second seed key by using the second seed key, and the first key is obtained by the first Generating the seed key and the first random number, the first seed key and the first random number are preset on the first server, and the second seed key is generated by the first server;

The processing unit is further configured to read the first seed key and the first random number from the storage unit, and generate the first secret by using the first seed key and the first random number Decrypting the first ciphertext using the first key to obtain the second ciphertext and the second seed key, and decrypting the second ciphertext using the obtained second seed key to obtain a secondary cipher Two seed key; The processing unit is further configured to compare the obtained second seed key and the second second seed key, and if they are the same, use the second seed key and the first random number to encrypt the second seed key to receive the response normally. Transmitting the response to the first server by using the uplink communication unit; the processing unit 501 is further configured to store the second seed key in the storage unit, and use the second seed The key is used as a pre-shared key in the transport layer security protocol to establish a data link between the smart meter reading terminal and the first server.

The embodiment of the invention further discloses a key delivery method based on the security of the transport layer, comprising: sending, by the first server, a push message to the smart meter reading terminal, where the push message includes a first ciphertext, the first ciphertext Obtaining, after the second ciphertext and the second seed key are encrypted by using the first key, the second ciphertext is obtained by encrypting the second seed key by using the second seed key, The first key is generated by the first seed key and the first random number, and the first seed key and the first random number are preset on the first server, and the second seed key is Is generated by the first server;

Receiving, by the first server, a response that is received by the second seed key from the smart meter reading terminal, and the second seed key is normally received by using the second seed key and the first random number;

The first server and the smart meter reading terminal use the second seed key as a pre-shared key in a transport layer security protocol, and establish a data link between the smart meter reading terminal and the first server. .

The embodiment of the invention further discloses a server, comprising a processing unit, a storage unit and a first communication unit, wherein

The first communication unit is configured to communicate with a smart meter reading terminal;

The processing unit is configured to generate a second seed key, and send a push message to the smart meter reading terminal by using the first communication unit, where the push message includes a first ciphertext, and the first ciphertext is the The processing unit obtains the second ciphertext and the second seed key by using the first key, and the second ciphertext is obtained by encrypting the second seed key by using the second seed key. The first key is generated by the first seed key and the first random number; the storage unit is configured to store the first seed key and the first random number;

The processing unit is further configured to receive, by using the first communication unit, a response that is received by the second seed key of the smart meter reading terminal, and the second seed key is normally received by using the second seed key. The key and the first random number are encrypted. The processing unit is further configured to establish, by using the first communication unit and the smart meter reading terminal, the second seed key as a pre-shared key in a transport layer security protocol, to establish the smart meter reading terminal and the A data link between the servers.

By applying the key layer transfer method based on the transport layer security, the smart meter reading terminal and the server disclosed in the embodiments of the present invention, the pre-shared key in the TLS protocol can be dynamically allocated in the smart meter reading system, thereby improving the smart meter reading system. Security and maintainability. BRIEF DESCRIPTION OF THE DRAWINGS

The drawings described herein are provided to provide a further understanding of the invention, and are in no way of limitation. In the drawing:

1 is a schematic diagram of a key transfer method based on transport layer security disclosed in an embodiment of the present invention;

2 is a schematic diagram of a method for a server to wake up a smart meter reading terminal according to an embodiment of the present invention;

3 is a schematic diagram of a method for a smart meter reading terminal to wake up a server according to an embodiment of the present invention;

4 is a schematic diagram of a method for updating a seed key according to an embodiment of the present invention; FIG. 5 is a schematic structural diagram of a smart meter reading terminal according to an embodiment of the present invention; FIG. 6 is a server disclosed in an embodiment of the present invention; Schematic diagram of the structure. Mode for carrying out the invention

In order to make the objects, technical solutions and advantages of the present invention more clear, the following is combined with the implementation side. The invention will be further described in detail with reference to the drawings and drawings. The illustrative embodiments of the present invention and the description thereof are intended to explain the present invention, but are not intended to limit the invention.

First, it should be noted that the smart meter reading terminal described in the embodiments of the present invention includes, but is not limited to, a smart meter reading gateway or a smart meter, such as an intelligent power gateway, a smart meter, a smart water meter or a smart gas meter, etc.; This includes, but is not limited to, the measurement of the measured substance, such as electricity consumption, water consumption, etc., or data including the unit price of the valuation.

Method embodiment:

Referring to FIG. 1, an embodiment of the present invention provides a key transfer method based on transport layer security, including the following steps:

Step 101: The smart meter reading terminal receives the push message from the first server, where the push message includes a first ciphertext, and the first ciphertext uses the first key pair to the second ciphertext and the second seed key. Obtained after the encryption is performed, the second ciphertext is obtained by encrypting the second seed key by using the second seed key, where the first key is a first seed key and a first random number The first seed key and the first random number are preset on the first server, and the second seed key is generated by the first server.

The first server may be a server of an energy provider's Head End System (HES), which is mainly used to manage a smart meter reading terminal under its jurisdiction, for example, a power supplier's HES can be used to manage its jurisdiction. Smart power gateway for customers.

It will be appreciated that the first seed key should be stored in the storage device of the first server. The storage device can be used to store software or data of the first server at the same time, or can be a specific storage device dedicated to storing the first seed key, such as a special seed key storage chip.

Specifically, the generating, by the first seed key and the first random number, the first key may be, for example, arranging characters of the first seed key and the first random number according to a certain regularity Generating the first key, or generating the first key according to an established algorithm by using the first seed key and the first random number, and the predetermined algorithm may be any existing algorithm. Or an algorithm suitable for these two types of parameters in an algorithm developed after the present invention. However, it is required to ensure that the first server and the smart meter reading terminal are simultaneously configured with the algorithm.

It can be understood that, by using the first key to encrypt the second ciphertext and the second seed key, the first ciphertext is obtained, and specifically, the first key may be used, according to an established The algorithm encrypts the second ciphertext and the second seed key. The predetermined algorithm may be an algorithm suitable for both types of parameters in any existing algorithm or algorithm developed later in the present invention, but the key supported by the algorithm should include the first key. As an example, the algorithm can be the AES256 algorithm in the TLS protocol.

It can be understood that the encrypting the second seed key by using the second seed key to obtain the second ciphertext may be performed by using the second seed key according to a predetermined algorithm. The second seed key is encrypted. The predetermined algorithm may be any existing algorithm or an algorithm suitable for this parameter in an algorithm developed after the present invention, but the key supported by the algorithm should include the second seed key. As an example, the algorithm can be the AES256 algorithm in the TLS protocol.

The algorithm for generating the first ciphertext may be the same as or different from the algorithm for generating the second ciphertext, but should be configured on the first server and the smart meter reading terminal.

Step 102: The smart meter reading terminal decrypts the first ciphertext by using the first key to obtain the second ciphertext and the second seed key, and decrypts the second ciphertext by using the second seed key. Obtaining a second second seed key, where the first key is generated by the first seed key and the first random number, where the first seed key and the first random number are preset in the smart meter reading terminal on.

It can be understood that the first seed key should be stored in the storage device of the smart meter reading terminal. The storage device can be used to store software or data of the smart meter reading terminal at the same time, or can be a specific storage device dedicated to storing the first seed key, such as a special seed key storage chip.

Specifically, the generating, by the first seed key and the first random number, the first key may be, for example, arranging the characters of the first seed key and the first random number according to a certain regularity Generating the first key, or generating the first key by using the first seed key and the first random number according to an established algorithm, and the predetermined algorithm may be any existing algorithm Or an algorithm suitable for these two types of parameters in an algorithm developed after the present invention. The first server generates the first key, and the manner in which the smart meter reading terminal generates the first key should be the same.

Step 103: If the second seed key is the same as the second second seed key, encrypt the response normally received by the second seed key by using the second seed key and the first random number, and send the response To the first server.

Step 104: The smart meter reading terminal and the first server use the second seed key as a pre-shared key in the TLS protocol to establish data between the smart meter reading terminal and the first server. link.

By applying the foregoing method, the pre-shared key in the TLS protocol can be dynamically allocated by the first server, and the second seed key in the embodiment of the present invention is used as the pre-shared key, thereby improving the adoption pre-emption in the TLS protocol. The security of the shared key authentication scheme and the flexibility of maintenance.

It can be understood that for the above method, some optional modifications can also be made.

Optionally, before the step 101, the method further includes: the smart meter reading terminal generates a second random number, and the second random number is carried in the device installation request message and sent to the first server, where The device installation request message is sent as a short message. Determining, by the first server, whether the sending number of the short message is legal, for example, is the number of the smart meter reading terminal under the jurisdiction of the first server, and if it is legal, generating a third random number, and the second random number The number and the third random number are sent to the smart meter reading terminal through a short message. The smart meter reading terminal verifies the number of the short message sent by the first server and the legality of the second random number, and if it is legal, generates the second key by using the third random number and the first seed key. And encrypting the terminal identification information of the smart meter reading terminal with the second key, and sending the information to the first server. The first server generates a second key by using the third random number and the first seed key, and decrypts the data sent by the smart meter reading terminal with the second key to obtain a terminal of the smart meter reading terminal. Identification information, and verifying the legitimacy of the terminal identification information, if If it is legal, the second seed key is generated. Optionally, the first server verifies that the number of the short message sent by the smart meter reading terminal is invalid, or the smart table lookup terminal verifies that the first server sends the number of the short message or returns a second random number. If any one is illegal, all information interactions can be terminated.

Alternatively, the method may further include: before the step 101, the smart meter reading terminal generates the first key by using the first random number and the first seed key, using the first key The terminal identification information of the smart meter reading terminal is encrypted and carried in a device installation request message sent to the first server. The first server generates the first key by using the first random number and the first seed key, and decrypts the data sent by the smart meter reading terminal with the first key to obtain the smart copy The terminal identification information of the terminal is verified, and the validity of the terminal identification information is verified. If the terminal is legal, the second seed key is generated.

As an example, the terminal identification information may be IMEI (International Mobile Equipment Identity, International Mobile Equipment Identity) of the terminal, IMSI (International Mobile Subscriber Identification Number , only the second international mobile subscriber code ¹ J) and MAC (Media At least one of the Access Control, Media Access Control) addresses.

Further, if the first server verifies that the terminal identification information of the smart meter reading terminal is invalid, the first key may be used to encrypt the response of the authentication failure and sent to the smart meter reading terminal.

Further, optionally, before the step 104, if the smart meter reading terminal needs to perform information interaction with the first server, the first key may be used for encryption and decryption, and the The second seed key and the first random number generate a third key, and the third key is used for encryption and decryption. Alternatively, if the second random number and the third random number are exchanged between the smart meter reading terminal and the first server before the step 101, the second key may be used for encryption and decryption. Or performing encryption and decryption using the second seed key and the fourth key generated by the second random number, and may also use the second seed key and the fifth key generated by the third random number Performing encryption and decryption, and using the first seed key and the The sixth key generated by the second random number is encrypted and decrypted.

Optionally, in step 102, if the second seed key is different from the secondary second seed key, the smart meter reading terminal may send a second seed key request to the first server. Message to repeat steps 101 and 102. The second seed key request message may be encrypted or decrypted using the first key, or if the second is exchanged between the smart meter reading terminal and the first server before the step 101 The random number and the third random number may also be encrypted and decrypted using the second key or the sixth key. Optionally, the second sub-key request message may limit the maximum number of transmissions, for example, 2 times, to avoid meaningless repetition.

The above-mentioned additions and modifications to the embodiment shown in FIG. 1 actually increase the identity authentication between the smart meter reading terminal and the first server before performing the method shown in FIG. 1 to further Enhancing the security of the second seed key delivery.

It can be understood that, in the foregoing embodiment, the first seed key and the first random number are preset in the smart meter reading terminal and the first server. This preset can be done during the production of the smart meter reading terminal.

As an example, the first seed key and the first random number may be obtained by the smart meter reading terminal from a second server and stored in a memory of the smart meter reading terminal. The second server is a server of the manufacturer of the smart meter reading terminal.

It can be understood that the first seed key and the first random number may be generated by the second server, and the smart meter reading terminal acquires the first seed from the second server. The key specificity may be: the smart meter reading terminal reports the terminal identification information to the second server; the smart meter reading terminal receives the first seed key and the first random number from the second server, The first seed key is generated by the terminal identification information. Alternatively, the first seed key and the first random number may be generated by a first key server. In this case, the smart meter reading terminal may obtain the first seed key and the first random number from the second server, where the smart meter reading terminal reports the terminal identity information to the second server. The second server sends the terminal identification information reported by the smart meter reading terminal Forwarding to the first key server, and writing the first seed key and the first random number delivered by the first key server to the smart meter reading terminal, where the smart meter reading terminal The second server receives the first seed key and the first random number. The second random number is generated by the first key server. Alternatively, the first key server may only generate the first seed key, and the second server generates the first random number. Preferably, the first key server may be a server controlled by an energy provider that subscribes to the batch of smart meter reading terminals.

It can be understood that the first seed key and the first random number need to be imported into the first server. If the first seed key and the first random number are directly generated by the second server, or generated by a first key server controlled by a manufacturer of the smart meter reading terminal, The controller of the second server, that is, the manufacturer of the smart meter reading terminal, needs to transmit the first seed key to the manager of the first server, optionally, may also constitute the first seed The terminal identification information of the smart meter reading terminal of the key is also transmitted to the manager of the first server, and the manager of the first server imports the first server. The transmission may be performed by any one of the data transmission methods, and the present invention is not limited thereto. Alternatively, if the first seed key is generated by a dedicated first key server, and the first key server is a server controlled by an energy provider who subscribes to the batch smart meter reading terminal, it can be understood The first key server is the same entity as the administrator of the first server, that is, an energy provider. At this time, the energy provider needs to import the first key from the first key server to the first server. Optionally, the first key server and the first server may also be the same server, but this embodiment does not recommend this practice for security reasons. Alternatively, the terminal identity identification information of the smart meter reading terminal constituting the first seed key may also be imported into the first server.

It can be understood that the process of acquiring the first seed key from the second server by the smart meter reading terminal is completed in the production process of the smart meter reading terminal. Optionally, before the smart meter reading terminal reports the terminal identification information to the second server, the method further includes: sending, by the second server, the smart meter reading terminal to query the smart meter reading terminal Request for terminal identification information. If the first seed key is generated by the first key server, the method may further include: the second server requesting the first key server to deliver the first seed key, The first key server requests the second server to report the terminal identity identification information of the corresponding smart meter reading terminal. Optionally, the second server may further send the first random number to the first key server.

After the smart meter reading terminal receives the first seed key from the second server, the method further includes: sending, by the smart meter reading terminal, the first seed key and the The response of the first random number successfully written.

It can be understood that the foregoing step 104 may specifically be: the smart meter reading terminal interacts with the first server (ServerHdlo) message and the terminal call (ClientHdlo) message to negotiate an algorithm set. In this embodiment, as an example, the algorithm set may be AES256. The smart meter reading terminal uses the second seed key as a preset key, sends a client key exchange (ClientKeyExchange) message to the first server, and uses the second seed key as a preset key The key generates a session key (Session Key) and sends an ExchangClipherSpec message to the first server to notify the first server to start encrypting and decrypting using the session key. The first server changes its own security state to perform symmetric encryption using the session key, and sends an ExchangClipherSpec message to the smart meter reading terminal. Thereafter, the exchanged data is encrypted and decrypted by the first server and the smart meter reading terminal using the session key until the data exchange is completed.

It can be understood that the description of step 104 here is only an example of a single ticket. For details, refer to the "PSK Algorithm for TLS" ("PSK Ciphersuites for TLS", December 2005) published in December 2005. The representation of the PSK key exchange algorithm and related parts. The application of the present invention is not described in detail herein.

In the application scenario of the smart meter reading, the first server and the smart meter reading terminal do not always maintain data links. When communication is needed, one end is needed to wake up the other end. For example, the smart meter reading terminal is awakened by the first server, or by the smart The meter reading terminal wakes up the first server. Two optional wake-up modes are described below. If the smart meter reading terminal is awakened by the first server, reference may be made to FIG. 2.

Step 201: The smart meter reading terminal receives a wake-up message from the first server, where the wake-up message carries a fourth random number. The wake-up message can be sent by means of a short message.

Step 202: The smart meter reading terminal verifies the validity of the sending number of the short message, and if it is legal, encrypts the smart by using one of the third key, the fourth key or the fifth key. The terminal identification information of the meter reading terminal and the fourth random number are sent to the first server as a response to the wake-up message, so that the first server verifies the smart meter reading terminal.

The response can be sent as a push message. The verifying, by the first server, the smart meter reading terminal may be: the first server uses one of the third key, the fourth key, or the fifth key (should be the smart The same one of the encryption keys of the meter reading terminal decrypts the terminal identification information and the fourth random number, and verifies the terminal identification information and the legality of the fourth random number.

Step 203: The smart meter reading terminal receives the wake-up reason code sent by the first server, where the wake-up reason code is used by the first server by using the third key, the fourth key, or the fifth key. One of the encryption.

Step 204: The smart meter reading terminal decrypts using one of the third key, the fourth key or the fifth key (should be the same one as the encryption key of the smart meter reading terminal) Describe the reason code. The wake-up reason code is used to inform the smart meter reading terminal of the demand of the first server.

Optionally, if the verification validity fails in the above process, or the decryption fails, the interaction may be terminated directly.

If the first server is awake by the smart meter reading terminal, reference may be made to FIG.

Step 301: The smart meter reading terminal uses one of the third key, the fourth key, or the fifth key to encrypt the service that needs to be reported, and sends the service to the first server. The first server Decrypting using one of the third key, the fourth key, or the fifth key (which should be the same as the encryption key of the smart meter reading terminal) to obtain the reported service. The reported service may be, for example, the power consumption of the month.

Step 302: The smart meter reading terminal receives a wake-up reason code sent by the first server, where the wake-up reason code is one of the third key, the fourth key, or the fifth key used by the first server. Encrypted.

Step 303: The smart meter reading terminal decrypts using one of the third key, the fourth key or the fifth key (should be the same one as the encryption key of the smart meter reading terminal) The reason code is awakened to confirm that the reported service is correctly received by the first server. The wake reason code is a reason code corresponding to the reported service.

It should be noted that, if the first server wakes up the smart meter reading terminal, the smart meter reading terminal may report the service data to the first server by using a wake-up manner. The reporting may be performed immediately after the first server wakes up the smart meter reading terminal, or may be performed within a predetermined period of time. Optionally, a TLS link can also be established for delivery if needed. The way to establish a TLS link can use the TLS standard protocol for TLS link recovery. The embodiments of the present invention are not described in detail herein.

It can be understood that, in the above wakeup process, one of the third key, the fourth key or the fifth key is always used as the encryption and decryption key. To further increase the security of the system, the keys here can be dynamically transformed. Since the key in the embodiment of the present invention is generated by the seed key and the random number, the encryption and decryption key can be changed for any of the changes. Of course, you can change both.

The process of updating the seed key is described below. It can be understood that in the embodiment of the present invention, the seed key can be updated at any time. The embodiment of the present invention recommends that in the step 103 of the method flow shown in FIG. 1, after the TLS link is established, the seed key is updated. The specific update manner may be that the first server generates a third seed key, and delivers the third seed key to the smart meter reading terminal through a TLS link. The smart meter reading terminal is to the first The server responded successfully that the seed key was received. The TLS link between the first server and the smart meter reading terminal is disconnected, and the TLS link is established again using the third seed key. Optionally, if the third seed key is used to establish a TLS connection, the smart meter reading terminal and the first server may establish a TLS link by using the second seed key, where the smart meter reading terminal The first server requests the third seed key and then retry to establish a TLS link using the third seed key. Optionally, you can set the number of retries, for example 2 times.

In the case where the second seed key is updated to the third seed key, one of the third key, the fourth key, or the fifth key used in the above-described wakeup process should be replaced with the third seed key. One of the keys generated with the first, second or third random number.

It can be understood that during the use of the smart meter reading terminal, it is also possible to update the seed key. The case where the seed key update may be triggered includes the expiration of the validity period of the second or third seed key, or the cryptosystem upgrade of the smart meter reading system, etc., which is not limited by the embodiment of the present invention.

A method for updating a seed key disclosed in the embodiment of the present invention can refer to FIG. 4. It should be noted that, in this embodiment, the updated seed key is represented by the fourth seed key, and the current seed key of the smart meter reading terminal is represented by the third seed key, but the illustrated update process is not indicated. It must be the first key update of the smart meter reading terminal in use. The seed key update procedure of the embodiment of the present invention can be applied to any update of the seed key. In an embodiment of the invention, the update of the seed key is initiated by the first server. When the first server detects the set conditional achievement of updating the seed key of the smart meter reading terminal, the seed key update process is initiated.

Step 401: The first server requests a second seed key from the second key server, where the request includes the identity identification information of the smart meter reading terminal that needs to use the fourth seed key. The identity identification information may be at least one of an IMEI, an IMSI, and a MAC address of the terminal.

Step 402: The first server receives a fourth seed key delivered by the second key server. The fourth seed key is generated by the terminal identification information. Step 403: The first server wakes up the smart meter reading terminal.

The chronological order of the step 403 and the step 401 and the step 402 may not be limited. When the smart meter reading terminal is woken up, the reason code may be to notify the smart meter reading terminal to perform seed key update.

Step 404: The first server establishes a communication connection with the smart meter reading terminal by using a third seed key.

Step 405: The first server sends the fourth seed key to the smart meter reading terminal. After the smart meter reading terminal acquires the fourth seed key, the fourth seed key is stored.

Step 406: The first server receives a response from the fourth meter key of the smart meter reading terminal.

Step 407: The TLS link between the first server and the smart meter reading terminal is disconnected, and the TLS link is established again by using the fourth seed key.

Optionally, if the TLS connection fails to be established by using the third seed key, the first server may establish a TLS link with the smart meter reading by using the third seed key, and send the TLS link to the smart meter reading terminal. Resending the fourth seed key and then retrying to establish a TLS link using the fourth seed key. Optionally, you can set the number of retries, for example 2 times. Optionally, if the retries limit is reached, the third seed key may continue to be used until the next time the seed key is updated. Alternatively, you can repeat the update process periodically until the update is successful.

It should be noted that the first server may be the same server as the second key server, or may be a different server. If it is the same server, the flow shown in Figure 4 is the internal communication flow of the server. The embodiment of the present invention recommends that the two servers be separated, but all are under the management of an energy provider. It can be understood that the foregoing first key server and the second key server may be different key servers, or may be the same key server.

By applying the method shown in FIG. 4, the seed key of the smart meter reading terminal can be remotely updated. This convenient, energy-controlled seed key update method, and can dynamically update the seed key, is conducive to improving the security of the system. As mentioned above, it is also possible to dynamically change the random number of the encryption and decryption key together with the seed key to provide system security. Specifically, before the TLS link is disconnected, the first server sends a fifth random number to the smart meter reading terminal, and the smart meter reading terminal sends a sixth random number to the first server. In the subsequent wakeup process, one of the third key, the fourth key, or the fifth key used should be replaced with one of the current seed key and the key generated by the fifth or sixth random number. . Of course, optionally, the fifth or sixth random number may be the same random number. If the fifth or sixth random number is different, the message sent by the first server is encrypted by using the current seed key and the key generated by the sixth random number, and the message sent by the smart meter reading terminal is used. Encryption is performed using the current seed key and the key generated by the fifth random number. It can be understood that the first server and the smart meter reading terminal update the fifth and sixth random numbers before the TLS link is disconnected again.

Optionally, as an example, the first, second, third, and fourth seed keys may be 64 bits, and the first, second, third, and fourth random numbers may be 16 bits, the fifth and sixth random numbers, may be 32 bits.

By applying the above method of updating random numbers, the encryption and decryption key of the wake-up process can be dynamically updated, further increasing the security of the system. Device embodiment

The embodiment of the invention also discloses a smart meter reading terminal. The structure of the smart meter reading terminal is shown in Figure 5. The smart meter reading terminal can be used in the foregoing method embodiments, and the functions not described in the device embodiment part can be referred to the method embodiment part. The smart meter reading terminal includes a processing unit 501, a storage unit 502, and an upstream communication unit 503.

The storage unit 502 is configured to store the first seed key and the first random number.

The uplink communication unit 503 is configured to communicate with the first server. The processing unit 501 is configured to receive, by using the uplink communications unit 503, a push message from the first server, where the push message includes a first ciphertext, and the first ciphertext is a first key pair. Two ciphers and Obtained after the second seed key is encrypted, the second ciphertext is obtained by encrypting the second seed key by using the second seed key, where the first key is secreted by the first seed And generating, by the first random number, the first seed key and the first random number are preset on the first server, and the second seed key is generated by the first server. The processing unit 501 is further configured to read the first seed key and the first random number from the storage unit 502, and generate the first number by using the first seed key and the first random number. Decrypting the first ciphertext using the first key to obtain the second ciphertext and the second seed key, and decrypting the second ciphertext using the obtained second seed key Sub-second seed key. The processing unit 501 is further configured to compare the obtained second seed key and the second second seed key, if the same, use the second seed key and the first random number to encrypt the second seed key to be normally received. In response, the response is sent to the first server through the upstream communication unit 503. The processing unit 501 is further configured to store the second seed key in the storage unit 502, and use the second seed key as a pre-shared key in a transport layer security protocol to establish the smart A data link between the meter reading terminal and the first month server.

Optionally, the smart meter reading terminal may verify the identity of the first server before updating the second seed key. The processing unit 501 is further configured to generate a second random number, and the second random number is carried in the device installation request message by the uplink communication unit 503, and sent to the first server, where the device installation request is sent. The message is sent as a short message. The processing unit 501 is further configured to receive, by using the uplink communication unit 503, a short message from the first server, where the short message carries the second random number and a third random number, where the third random number The number is generated by the first server. The processing unit 501 is further configured to verify that the first server sends the number of the short message and the validity of the second random number, and if it is legal, generate the third random number and the first seed key. And a second key, the terminal identification information of the smart meter reading terminal is encrypted by the second key, and sent to the first server by the uplink communication unit 503.

Or the processing unit 501 is further configured to use the first random number and the first seed key Generating the first key, encrypting the terminal identification information of the smart meter reading terminal with the first key, and carrying the information in the device installation request message to the first server by using the uplink communication unit 503 .

Optionally, the smart meter reading terminal is further configured to update the second seed key during the installation process, and the processing unit 501 is further configured to use the uplink communication unit 503 to establish a transmission with the first server. The layer secure link receives a third seed key from the first server, the third seed key being generated by the first server. The processing unit 501 is further configured to respond to the first server by using the uplink communication unit 503 to successfully receive the seed key. The processing unit 501 is further configured to generate a fifth random number, and send the fifth random number to the first server by using the uplink communication unit 503. The processing unit 501 is further configured to receive a sixth random number from the first server by using the uplink communication unit 503, and store the fifth random number and the sixth random number to the storage unit 502.

The processing unit 501 is further configured to establish, by using the third seed key, a transport layer secure link between the smart meter reading terminal and the first server by using the uplink communication unit 503, if successful, Before the transport layer secure link is opened, the fifth random number is updated, and the updated fifth random number is sent to the first server by using the uplink communication unit 503. The processing unit 501 is further configured to receive, by the uplink communication unit 503, an updated sixth random number from the first server, and the third seed key and the updated fifth random number, the sixth random number. The number is stored in the storage unit 502.

Optionally, the smart meter reading terminal is further configured to wake up the first server, and the processing unit 501 is further configured to use the third seed key and the key generated by the fifth random number to encrypt the report that needs to be reported. The service is sent to the first server by the uplink communication unit 503. The processing unit 501 is further configured to receive, by using the uplink communication unit 503, a wake-up reason code sent by the first server, where the wake-up reason code is that the first server uses the third seed key and the first Six random numbers generated by the key are encrypted. The processing unit 501 is further configured to obtain, by using the third seed key and the key generated by the sixth random number, the wake-up reason code, where the wake-up original is obtained. The code is the reason code with the reported service response.

Optionally, the smart meter reading terminal is further awake by the first server, and the processing unit 501 is further configured to receive, by using the uplink communication unit 503, a wakeup message from the first server, where the wakeup The message carries a fourth random number, and the wake-up message is sent by means of a short message. The processing unit 501 is further configured to verify validity of the sending number of the short message, and if valid, encrypt the smart meter reading terminal by using the third seed key and the key generated by the fifth random number. The terminal identification information and the fourth random number are sent to the first server by the uplink communication unit 503 as a response to the wake-up message. The processing unit 501 is further configured to receive, by using the uplink communication unit 503, a wake-up reason code sent by the first server, where the wake-up reason code is that the first server uses the third seed key and the first Six random numbers generated by the key are encrypted. The processing unit 501 is further configured to obtain the wake-up reason code by using the third seed key and the key generated by the sixth random number.

Optionally, the smart meter reading terminal may further update the seed key during use. Then, if the wake-up reason code is a seed key update notification, the processing unit 501 is further configured to establish, by using the uplink communication unit 503, the transport layer security link with the first server by using the third seed key. The processing unit 501 is further configured to receive a fourth seed key from the first server by using the uplink communication unit 503, and send a fourth seed key to the first server by using the uplink communication unit 503. In response to the success, the fourth seed key is generated by the terminal identification information.

The processing unit 501 is further configured to establish, by using the fourth seed key, a transport layer secure link between the smart meter reading terminal and the first server by using the uplink communication unit 503, if successful, Before the transport layer secure link is disconnected, the fifth random number is updated, and the updated fifth random number is sent to the first server by the uplink communication unit 503. The processing unit 501 is further configured to receive, by the uplink communication unit 503, an updated sixth random number from the first server, and send the fourth seed key and the updated fifth random number, the sixth random number. The number is stored in the storage unit 502. It can be understood that the smart meter reading terminal can be a power gateway.

By applying the smart meter reading terminal disclosed above, the seed key and the random number can be dynamically allocated, thereby effectively improving the security of the system. The embodiment of the invention also discloses a server. The structure of the server is shown in Figure 6. The server includes a processing unit 601, a storage unit 602, and a first communication unit 603. The first communication unit 603 is for communicating with a smart meter reading terminal. The processing unit 601 is configured to generate a second seed key, and send a push message to the smart meter reading terminal by using the first communication unit 603, where the push message includes a first ciphertext, and the first ciphertext is The processing unit 601 obtains the second ciphertext and the second seed key by using the first key, and the second ciphertext is to use the second seed key to the second seed key. Obtained, the first key is generated by the first seed key and the first random number. The storage unit 602 is configured to store the first seed key and the first random number. The processing unit 601 is further configured to receive, by using the first communication unit 603, a response that is received by the second seed key of the smart meter reading terminal, and the second seed key receives the response normally by using the second The seed key and the first random number are encrypted. The processing unit 601 is further configured to establish, by using the first communication unit 603 and the smart meter reading terminal, the second seed key as a pre-shared key in a transport layer security protocol, to establish the smart meter reading terminal. A data link with the server.

Optionally, the legality of the smart meter reading terminal may also be verified before the second seed key is allocated. The processing unit 601 is further configured to receive, by using the first communication unit 603, a device installation request message from the smart meter reading terminal, where the device installation request message includes a second random number, and the device installation request message is As the short message is sent, the second random number is generated by the smart meter reading terminal. The processing unit 601 verifies whether the sending number of the short message is legal. If it is legal, generates a third random number, and passes the second random number and the third random number to the first communication unit 603. The short message is sent to the smart meter reading terminal. The processing unit 601 receives, by the first communication unit 603, the smart meter reading terminal End terminal identification information, the terminal identification information is encrypted by using the third random number and the second key generated by the first seed key. The processing unit 601 generates a second key by using the third random number and the first seed key, and decrypts the data sent by the smart meter reading terminal with the second key to obtain the terminal of the smart meter reading terminal. And identifying the legality of the terminal identification information, and if so, generating the second seed key.

Alternatively, the processing unit 601 receives, by the first communication unit 603, a device installation request message from the smart meter reading terminal, where the device installation request message carries terminal identity identification information, and the terminal identity identification information Encrypted using the first key generated by the first random number and the first seed key. The processing unit 601 generates the first key by using the first random number and the first seed key, and decrypts the data sent by the smart meter reading terminal with the first key to obtain the smart copy The terminal identification information of the terminal is verified, and the validity of the terminal identification information is verified. If the terminal is legal, the second seed key is generated.

Optionally, the server may deliver a new seed key during the installation of the smart meter reading terminal. After the processing unit 601 establishes a secure link through the transport layer between the first communication unit 603 and the smart meter reading terminal, the processing unit 601 generates a third seed key, and passes the first communication. The unit 603 sends the third seed key to the smart meter reading terminal. The processing unit 601 receives a seed key receiving success response from the smart meter reading terminal; before the transport layer secure link is disconnected, the processing unit 601 generates a fifth random number, and passes the first communication The unit 603 sends the fifth random number to the smart meter reading terminal, and the processing unit 601 further passes the first communication unit 603 and receives a sixth random number from the smart meter reading terminal, where the processing unit The 601 is further configured to store the fifth random number and the sixth random number into the storage unit 602.

The processing unit 601 is further configured to establish, by using the third seed key, a transport layer secure link with the server by using the first communication unit 603, and if successful, disconnecting the transport layer secure link The processing unit 601 generates an updated fifth random number, and sends the updated fifth random number to the smart meter reading terminal by using the first communication unit 603, where the processing is performed. The unit 601 also passes the first communication unit 603 and receives an updated sixth random number from the smart meter reading terminal, and the processing unit 601 is further configured to use the third seed key and the updated The five random numbers and the updated sixth random number are stored in the storage unit 602.

Optionally, the server may further wake up the smart meter reading terminal, and the processing unit 601 is further configured to send, by using the first communication unit 603, a wakeup message to the smart meter reading terminal, where the wakeup message carries There is a fourth random number, the wake-up message is sent by means of a short message; the processing unit 601 is further configured to receive, by the first communication unit 603, a wake-up message response from the smart meter reading terminal, the wake-up message The response is that the smart meter reading terminal encrypts the terminal identification information of the smart meter reading terminal and the fourth random number by using the third seed key and the key generated by the fifth random number;

The processing unit 601 is further configured to decrypt the wake-up message response by using the third seed key and the key generated by the fifth random number, and perform the terminal identification information and the fourth random number. If the card passes, generating a wake-up reason code, and sending, by the first communication unit 603, a wake-up reason code to the smart meter reading terminal, where the wake-up reason code is that the processing unit 601 uses the third The seed key and the key generated by the sixth random number are encrypted.

Optionally, the server may update the seed key of the smart meter reading terminal by using a wake-up manner, and the wake-up reason code is a seed key update notification. The processing unit 601 establishes a transport layer secure link with the smart meter reading terminal by using the third seed key by the first communication unit 603; the processing unit 601 generates a fourth seed key, and passes the The first communication unit 603 sends the fourth seed key to the smart meter reading terminal, where the fourth seed key is generated by the terminal identity identification information; the processing unit 601 passes the first communication Unit 603 receives a response from the smart meter reading terminal that the fourth seed key was successfully received.

The processing unit 601 is further configured to establish, by using the fourth seed key, the transport layer secure link between the smart meter reading terminal and the smart meter reading terminal, and if successful, disconnect Before the transport layer secure link, the processing unit 601 generates an updated fifth random number, and sends the updated fifth random to the smart meter reading terminal by using the first communication unit 603. The processing unit 601 further passes the first communication unit 603 and receives an updated sixth random number from the smart meter reading terminal, and the processing unit 601 is further configured to use the fourth seed key and The updated fifth random number and the updated sixth random number are stored in the storage unit 602.

Optionally, if the server does not generate the fourth seed key by itself, the second communication unit 604 may be further included to communicate with the second key server. The processing unit 601 is further configured to request, by the second communication unit 604, a fourth seed key to the second key server, where the request includes the identity of the smart meter reading terminal that needs to use the fourth seed key. The processing unit 601 is further configured to receive, by using the second communication unit 604, a fourth seed key that is sent by the second key server.

Optionally, the server is further awake by the smart meter reading terminal, and the processing unit 601 is further configured to receive the reported service from the smart meter reading terminal, where the reported service uses a third seed. The key and the key generated by the fifth random number are encrypted; the processing unit 601 is further configured to decrypt the reported service by using a third seed key and a key generated by the fifth random number, and generate Wake up the reason code, send, by the first communication unit 603, a wake-up reason code to the smart meter reading terminal, where the wake-up reason code is that the first server uses the third seed key and the sixth random number The generated key is encrypted.

By applying the above server, the seed key and the random number can be dynamically allocated to the smart meter reading terminal, thereby effectively improving the security of the system. It can be understood that the first communication unit 603 can be a wireless communication unit, such as a GPRS unit, or a 3G or 4G communication unit, and its communication mode should correspond to the uplink communication unit 303 of the smart meter reading terminal. The second communication unit 604 can be a wired or wireless communication unit. The server is the first server referred to in the above method and apparatus embodiment, which may be, for example, an energy provider's HES server. Through the description of the above embodiments, those skilled in the art can clearly understand The invention can be implemented by means of software plus a necessary general hardware platform, and of course also by hardware, but in many cases the former is a better implementation. Based on the understanding of the present invention, the computer software product is stored in a readable storage medium, such as a floppy disk, a hard disk or an optical disk of a computer, and includes a plurality of instructions for causing a computer device (which may be a personal computer) The server, or network device, etc.) performs the methods described in various embodiments of the present invention.

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that The technical solutions are modified, or some of the technical features are replaced by equivalents; and the modifications or substitutions do not deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A method for transmitting a key based on a transport layer security, comprising: a smart meter reading terminal receiving a push message from a first server, wherein the push message includes a first ciphertext, the first ciphertext Obtaining, after the second ciphertext and the second seed key are encrypted by using the first key, the second ciphertext is obtained by encrypting the second seed key by using the second seed key, The first key is generated by the first seed key and the first random number, and the first seed key and the first random number are preset on the first server, and the second seed key is Is generated by the first server;

2. The method according to claim 1, wherein the first key is generated by the first seed key and the first random number, specifically, the first seed key and the The characters of the first random number are arranged according to a certain regularity to generate the first key, or the first seed key and the first random number are generated according to a predetermined algorithm.

The method according to claim 1 or 2, wherein the method further comprises: the smart meter reading terminal generating a second random number, and carrying the second random number in a device installation request message Transmitting to the first server, the device installation request message is sent as a short message; The smart meter reading terminal receives a short message from the first server, where the short message carries the second random number and a third random number, where the third random number is generated by the first server ;

The smart meter reading terminal verifies the first server to send the number of the short message and the legality of the second random number, and if it is legal, use the third random number and the first seed key to generate a second a key, the terminal identification information of the smart meter reading terminal is encrypted by the second key, and sent to the first server, so that the first server uses the third random number and the first seed Generating a second key, decrypting data sent by the smart meter reading terminal with the second key to obtain terminal identification information of the smart meter reading terminal, and verifying legality of the terminal identification information, If legal, the second seed key is generated.

The method according to claim 1 or 2, wherein the method further comprises: the smart meter reading terminal generating the first key by using the first random number and the first seed key Encrypting the terminal identification information of the smart meter reading terminal with the first key, and carrying the device in the device installation request message sent to the first server, so that the first server uses the first Generating the first key with the first seed key by the random number, decrypting the data sent by the smart meter reading terminal with the first key, obtaining the terminal identification information of the smart meter reading terminal, and verifying If the legality of the terminal identification information is legal, the second seed key is generated.

The method according to claim 3 or 4, wherein the terminal identity identification information is at least one of an international mobile device identity code, an international mobile subscriber identity, and a media access control address of the terminal.

6. The method according to any one of claims 1 to 5, wherein, if the second seed key is different from the secondary second seed key, the smart meter reading terminal may A server sends a second seed key request message, and the second seed key request message is encrypted and decrypted using the first key.

7. The method according to any one of claims 1 to 3 or 5, wherein if said second The smart card reading terminal may send a second seed key request message to the first server, where the second seed key request message is used. The second key or the first seed key is encrypted and decrypted with the sixth key generated by the second random number.

8. The method according to any one of claims 1 to 7, wherein the first seed key is generated by the terminal identification information.

9. The method according to any one of claims 1 to 8, wherein the method further comprises: after the transport layer secure link between the smart meter reading terminal and the first server is established, The smart meter reading terminal receives a third seed key from the first server, and the third seed key is generated by the first server;

Receiving, by the smart meter reading terminal, the seed key is successfully received in response to the first server; before the transport layer security link is disconnected, the smart meter reading terminal receives a fifth random number from the first server, where The smart meter reading terminal sends a sixth random number to the first server.

The method according to claim 9, wherein the method further comprises: establishing, by using the third seed key, a transport layer secure link between the smart meter reading terminal and the first server, If successful, updating the fifth random number and the sixth random number before disconnecting the transport layer secure link, and replacing the saved second seed key with the third seed key.

The method according to claim 10, wherein the method further comprises: if the third seed key is used to establish a transport layer secure link between the smart meter reading terminal and the first server If the failure occurs, the second seed key is used to establish a transport layer secure link between the smart meter reading terminal and the first server, and the third seed key is re-issued.

12. The method of any one of claims 1 to 10, wherein the method further comprises:

The smart meter reading terminal receives a wakeup message from the first server, and the wakeup cancellation The information carries a fourth random number, and the wake-up message is sent by means of a short message; the smart meter reading terminal verifies the validity of the sending number of the short message, and if it is legal, the third seed key is used. The key generated by the fifth random number encrypts the terminal identification information of the smart meter reading terminal and the fourth random number, and sends the fourth random number to the first server as a response to the wakeup message, so that the Determining, by the first server, the smart meter reading terminal;

The smart meter reading terminal receives a wake-up reason code from the first server, where the wake-up reason code is encrypted by the first server using the third seed key and the key generated by the sixth random number. ;

The smart meter reading terminal decrypts using the third seed key and the key generated by the sixth random number to obtain the wake-up reason code.

13. The method according to any one of claims 1 to 10 or 12, wherein the method further comprises:

The smart meter reading terminal encrypts the service to be reported using the third seed key and the key generated by the fifth random number, and sends the service to the first server;

The smart meter reading terminal decrypts using the third seed key and the key generated by the sixth random number to obtain the wake-up reason code, and the wake-up reason code is a reason code corresponding to the upper service response.

The method according to claim 12, wherein the method further comprises: the wake-up reason code is a seed key update notification;

The smart meter reading terminal establishes a transport layer secure link with the first server by using the third seed key;

The smart meter reading terminal receives a fourth seed key from the first server, and The first server sends a response that the fourth seed key is successfully received, and the fourth seed key is generated by the terminal identity information.

The method according to claim 14, wherein the method further comprises: establishing, by using the fourth seed key, a transport layer secure link between the smart meter reading terminal and the first server, If successful, updating the fifth random number and the sixth random number before disconnecting the transport layer secure link, and replacing the saved third seed key with the fourth seed key.

16. The method of any of claims 1 to 15, wherein the first server is a headend system server of an energy provider.

17. A smart meter reading terminal, comprising: a processing unit, a storage unit, and a communication unit, wherein

The processing unit is further configured to read the first seed key and the first random number from the storage unit, and generate the first secret by using the first seed key and the first random number Decrypting the first ciphertext using the first key to obtain the second ciphertext and the second seed key, and decrypting the second ciphertext using the obtained second seed key to obtain a secondary cipher a second seed key; the processing unit is further configured to compare the obtained second seed key and the second second seed key, if the same, encrypt the second seed key by using the second seed key and the first random number The response received by the key normally, and the response is sent to the first server by the uplink communication unit; The processing unit 501 is further configured to store the second seed key in the storage unit, and use the second seed key as a pre-shared key in a transport layer security protocol to establish the smart copy A data link between the table terminal and the first server.

18. The smart meter reading terminal of claim 17, wherein:

The processing unit is further configured to generate a second random number, and send the second random number in the device installation request message to the first server by using the uplink communication unit, where the device installation request message is Short message sent;

The processing unit is further configured to receive, by the uplink communications unit, a short message from the first server, where the short message carries the second random number and a third random number, where the third random number is Generated by the first server;

The processing unit is further configured to verify that the first server sends the number of the short message and the validity of the second random number, and if the data is legal, use the third random number and the first seed key to generate the first The second key is used to encrypt the terminal identification information of the smart meter reading terminal by using the second key, and send the information to the first server by using the uplink communication unit.

The smart meter reading terminal according to claim 17, wherein the processing unit is further configured to generate the first key by using the first random number and the first seed key, A key is used to encrypt the terminal identification information of the smart meter reading terminal, and is carried in the device installation request message and sent to the first server by using the uplink communication unit.

The smart meter reading terminal according to any one of claims 17-19, wherein the processing unit is further configured to receive, by using the transport layer secure link established by the uplink communication unit and the first server, a third seed key of the first server, where the third seed key is generated by the first server;

The processing unit is further configured to respond to the first server by the uplink communication unit to receive the seed key successfully;

The processing unit is further configured to generate a fifth random number, and send the fifth random number to the first server by using the uplink communication unit; The processing unit is further configured to receive, by the uplink communications unit, a sixth random number from the first server, and store the fifth random number and the sixth random number to a storage unit.

21. The smart meter reading terminal of claim 20, wherein:

The processing unit is further configured to establish, by using the third seed key, a transport layer secure link between the smart meter reading terminal and the first server by using the uplink communication unit, and if successful, disconnecting Before the transport layer secure link, update the fifth random number, and send the updated fifth random number to the first server by using the uplink communication unit;

The processing unit is further configured to receive, by the uplink communications unit, an updated sixth random number from the first server, and store the third seed key and the updated fifth random number and the sixth random number. Go to the storage unit.

22. The smart meter reading terminal of claim 21, wherein:

The processing unit is further configured to use a third seed key and a key generated by the fifth random number to encrypt a service that needs to be reported, and send the service to the first server by using the uplink communication unit; Receiving, by the uplink communication unit, a wake-up reason code sent by the first server, where the wake-up reason code is a key encrypted by the first server by using the third seed key and the sixth random number of;

The processing unit is further configured to obtain the wake-up reason code by using the third seed key and the key generated by the sixth random number, where the wake-up reason code is a reason code of the reported service response .

23. The smart meter reading terminal of claim 20, wherein:

The processing unit is further configured to receive, by using the uplink communication unit, a wakeup message from the first server, where the wakeup message carries a fourth random number, where the wakeup message is sent by using a short message;

The processing unit is further configured to verify validity of the sending number of the short message, and if it is legal, encrypt the smart meter reading terminal by using the third seed key and the key generated by the fifth random number Terminal identification information and the fourth random number, and through the uplink communication unit Sent to the first server as a response to the wake up message;

The processing unit is further configured to receive, by using the uplink communications unit, a wake-up reason code sent by the first server, where the wake-up reason code is that the first server uses the third seed key and the sixth random The generated key is encrypted;

The processing unit is further configured to decrypt the obtained wake-up reason code by using the third seed key and the key generated by the sixth random number.

24. The smart meter reading terminal of claim 23, wherein

If the wake-up reason code is a seed key update notification, the processing unit is further configured to establish, by using the third seed key, the transport layer security link by using the third communication key by the uplink communication unit;

The processing unit is further configured to receive, by the uplink communications unit, a fourth seed key from the first server, and send a fourth seed key to the first server by using the uplink communications unit to receive a successful response. The fourth seed key is generated by the terminal identity information.

25. The smart meter reading terminal of claim 24, wherein

The processing unit is further configured to establish, by using the fourth seed key, a transport layer secure link between the smart meter reading terminal and the first server by using the uplink communication unit, and if successful, disconnecting Before the transport layer securely links, updating the fifth random number, and sending, by the uplink communication unit, the updated fifth random number to the first server;

The processing unit is further configured to receive, by the uplink communications unit, an updated sixth random number from the first server, and store the fourth seed key and the updated fifth random number and the sixth random number. Go to the storage unit.

A method for transmitting a key based on a transport layer security, comprising: sending, by a first server, a push message to a smart meter reading terminal, wherein the push message includes a first ciphertext, and the first ciphertext is Obtaining the second ciphertext and the second seed key by using the first key, the second ciphertext is to add the second seed key by using the second seed key Obtained, the first key is generated by the first seed key and the first random number, and the first seed key and the first random number are preset on the first server, where the The second seed key is generated by the first server;

The method according to claim 26, further comprising: the first server receiving a device installation request message from the smart meter reading terminal, where the device installation request message includes a second random number, The device installation request message is sent as a short message, and the second random number is generated by the smart meter reading terminal;

Determining, by the first server, whether the sending number of the short message is legal, if it is legal, generating a third random number, and sending the second random number and the third random number to the smart copy by using a short message Table terminal

The first server receives terminal identification information from the smart meter reading terminal, and the terminal identity identification information is encrypted by using the third random number and the second key generated by the first seed key;

The first server generates a second key by using the third random number and the first seed key, and decrypts the data sent by the smart meter reading terminal with the second key to obtain a terminal of the smart meter reading terminal. And identifying the legality of the terminal identification information, and if so, generating the second seed key.

The method of claim 26, further comprising: the first server receiving a device installation request message from the smart meter reading terminal, wherein the device installation request message carries the terminal identity Identification information, the terminal identification letter The information is encrypted using the first key generated by the first random number and the first seed key; the first server generates the first number by using the first random number and the first seed key Decrypting the data sent by the smart meter reading terminal with the first key to obtain terminal identification information of the smart meter reading terminal, and verifying the legality of the terminal identity information, if legal, Generating the second seed key.

The method of any one of claims 26 to 28, further comprising: after the transport layer secure link between the first server and the smart meter reading terminal is established, the first server Sending a third seed key to the smart meter reading terminal, where the third seed key is generated by the first server;

Receiving, by the first server, a seed key receiving success response from the smart meter reading terminal;

Before the transport layer secure link is disconnected, the first server sends a fifth random number to the smart meter reading terminal, and receives a sixth random number from the smart meter reading terminal.

30. The method of claim 29, further comprising

Establishing a transport layer secure link between the smart meter reading terminal and the first server by using the third seed key, and if successful, updating the fifth random number before disconnecting the transport layer secure link And the sixth random number, replacing the saved second seed key with the third seed key.

31. The method of claim 30, further comprising

The first server sends a wake-up message to the smart meter reading terminal, where the wake-up message carries a fourth random number, and the wake-up message is sent by using a short message;

Receiving a wakeup message response from the smart meter reading terminal, the wakeup message response is that the smart meter reading terminal encrypts the smart meter reading by using the third seed key and the key generated by the fifth random number Terminal identification information of the terminal and the fourth random number generated;

The first server decrypts the wake-up message response by using the third seed key and the key generated by the fifth random number, and the terminal identification information and the fourth random number are entered. If the verification is passed, sending a wake-up reason code to the smart meter reading terminal, where the wake-up reason code is a key generated by the first server using the third seed key and the sixth random number Encrypted.

The method according to claim 30 or 31, further comprising: the first server receiving the reported service from the smart meter reading terminal, wherein the reported service is using a third seed key And the key generated by the fifth random number is encrypted;

The first server decrypts the reported service by using a third seed key and a key generated by the fifth random number, and sends a wake-up reason code to the smart meter reading terminal, where the wake-up reason code is The first server encrypts using the third seed key and the key generated by the sixth random number.

The method according to claim 31, wherein the method further comprises: the wake-up reason code is a seed key update notification;

The first server and the smart meter reading terminal establish a transport layer secure link by using the third seed key;

The first server generates a fourth seed key, and sends the fourth seed key to the smart meter reading terminal, where the fourth seed key is generated by the terminal identity identification information; The fourth seed key of the smart meter reading terminal receives a successful response.

The method according to claim 33, wherein the method further comprises: establishing, by using the fourth seed key, a transport layer secure link between the first server and the smart meter reading terminal, If successful, updating the fifth random number and the sixth random number before disconnecting the transport layer secure link, and replacing the saved third seed key with the fourth seed key.

The method of claim 33, wherein the method further comprises: the first server requesting a fourth seed key from the second key server, where the request includes using the fourth seed The identification information of the smart meter reading terminal of the key;

The first server receives the fourth seed key delivered by the second key server.

36. A server, comprising: a processing unit, a storage unit, and a first communication unit, wherein

The processing unit is configured to generate a second seed key, and send a push message to the smart meter reading terminal by using the first communication unit, where the push message includes a first ciphertext, and the first ciphertext is the Obtaining, after the processing unit encrypts the second ciphertext and the second seed key by using the first key, the second ciphertext is obtained by encrypting the second seed key by using the second seed key. The first key is generated by the first seed key and the first random number;

The storage unit is configured to store the first seed key and a first random number;

The server according to claim 36, wherein the server further comprises: the processing unit further configured to receive, by the first communication unit, a device installation request message from the smart meter reading terminal, where The device installation request message includes a second random number, the device installation request message is sent as a short message, and the second random number is generated by the smart meter reading terminal;

The processing unit verifies whether the sending number of the short message is legal, and if so, generates a third random number, and passes the second random number and the third random number to the short message by using the first communication unit. The method is sent to the smart meter reading terminal;

The processing unit receives terminal identification information from the smart meter reading terminal by using the first communication unit, where the terminal identity identification information is a second secret generated by using the third random number and the first seed key. Key encryption

The processing unit generates a second key by using the third random number and the first seed key, Decrypting the data sent by the smart meter reading terminal to obtain the terminal identification information of the smart meter reading terminal, and verifying the legality of the terminal identity information, and if so, generating the second Seed key.

The server according to claim 36, wherein the server further comprises: the processing unit receiving, by the first communication unit, a device installation request message from the smart meter reading terminal, the device The installation request message carries the terminal identification information, where the terminal identification information is encrypted by using the first key generated by the first random number and the first seed key;

The processing unit generates the first key by using the first random number and the first seed key, and decrypts the data sent by the smart meter reading terminal with the first key to obtain the smart meter reading The terminal identification information of the terminal is verified, and the validity of the terminal identification information is verified. If the terminal is legal, the second seed key is generated.

39. The server according to any one of claims 36 to 38, wherein the server further comprises:

After the processing unit establishes a transport layer secure link between the first communication unit and the smart meter reading terminal, the processing unit generates a third seed key, and sends the third seed unit to the The smart meter reading terminal sends the third seed key;

Receiving, by the processing unit, a seed key receiving success response from the smart meter reading terminal; before the transport layer safety link is disconnected, the processing unit generates a fifth random number, and through the first communication unit The smart meter reading terminal sends the fifth random number, the processing unit further passes the first communication unit and receives a sixth random number from the smart meter reading terminal, and the processing unit is further configured to use the The fifth random number and the sixth random number are stored in the storage unit.

The server according to claim 39, wherein the server further comprises: the processing unit is further configured to establish, by the first communication unit, between the server and the server by using the third seed key Transport layer secure link, if successful, disconnect the transport layer Before the full link, the processing unit generates an updated fifth random number, and sends the updated fifth random number to the smart meter reading terminal by using the first communication unit, and the processing unit further passes the a communication unit and receiving an updated sixth random number from the smart meter reading terminal, the processing unit further configured to use the third seed key and the updated fifth random number and the updated number Six random numbers are stored in the storage unit.

The server according to claim 40, wherein the server further comprises: the processing unit further configured to receive, by the first communication unit, a wake-up message response from the smart meter reading terminal, The wakeup message response is that the smart meter reading terminal encrypts the terminal identification information of the smart meter reading terminal and the fourth random number generated by using the third seed key and the key generated by the fifth random number. ;

The processing unit is further configured to decrypt the wake-up message response by using the third seed key and the key generated by the fifth random number, and verify the terminal identification information and the fourth random number; If the verification is passed, generating a wake-up reason code, and sending, by the first communication unit, a wake-up reason code to the smart meter reading terminal, where the wake-up reason code is that the processing unit uses the third seed key and the The key generated by the sixth random number is encrypted.

The server according to claim 41, wherein the server further comprises: the wake-up reason code is a seed key update notification;

The processing unit establishes a transport layer secure link by using the third seed key by the first communication unit and the smart meter reading terminal;

The processing unit generates a fourth seed key, and sends the fourth seed key to the smart meter reading terminal by using the first communication unit, where the fourth seed key is identified by the terminal identity information Generated;

The processing unit receives, by the first communication unit, a response that the fourth seed key from the smart meter reading terminal receives a success.

The server according to claim 42, wherein the server further comprises: the processing unit is further configured to use the first communication key to build through the first communication unit Establishing a transport layer secure link between the smart meter reading terminal and the smart meter reading terminal. If successful, the processing unit generates an updated fifth random number before disconnecting the transport layer secure link, and passes the Transmitting, by the communication unit, the updated fifth random number to the smart meter reading terminal, the processing unit further receiving, by the first communication unit, an updated sixth random number from the smart meter reading terminal, The processing unit is further configured to store the fourth seed key and the updated fifth random number and the updated sixth random number into a storage unit.

44. The server of claim 42 or 43, wherein the server further comprises: a second communication unit, configured to communicate with the second key server;

The processing unit is further configured to request, by the second communication unit, a fourth seed key to the second key server, where the request includes the identity identification information of the smart meter reading terminal that needs to use the fourth seed key;

The processing unit is further configured to receive, by using the second communications unit, a fourth seed key that is sent by the second key server.

The server according to claim 40, wherein the server further comprises: the processing unit is further configured to receive the reported service from the smart meter reading terminal, and the reported service is using the third The seed key and the key generated by the fifth random number are encrypted; the processing unit is further configured to decrypt the reported service by using a third seed key and a key generated by the fifth random number, and generate Awakening the reason code, sending, by the first communication unit, a wake-up reason code to the smart meter reading terminal, where the wake-up reason code is generated by the first server by using the third seed key and the sixth random number The key is encrypted.