WO2018053895A1 - 物联网接入点基于类型的上行数据加密控制方法及装置 - Google Patents

物联网接入点基于类型的上行数据加密控制方法及装置 Download PDF

Info

Publication number
WO2018053895A1
WO2018053895A1 PCT/CN2016/103371 CN2016103371W WO2018053895A1 WO 2018053895 A1 WO2018053895 A1 WO 2018053895A1 CN 2016103371 W CN2016103371 W CN 2016103371W WO 2018053895 A1 WO2018053895 A1 WO 2018053895A1
Authority
WO
WIPO (PCT)
Prior art keywords
internet
type
encryption
data packet
access point
Prior art date
Application number
PCT/CN2016/103371
Other languages
English (en)
French (fr)
Inventor
杜光东
Original Assignee
深圳市盈广现代网络设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市盈广现代网络设备有限公司 filed Critical 深圳市盈广现代网络设备有限公司
Publication of WO2018053895A1 publication Critical patent/WO2018053895A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/80—Arrangements enabling lawful interception [LI]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery

Definitions

  • the present application relates to the field of communications, and in particular, to an IoT AP type-based uplink data encryption control method and apparatus.
  • the Internet of Things is an important part of the new generation of information technology and an important stage of development in the era of "informatization.” Its English name is: “Internet of things (IoT)". As the name suggests, the Internet of Things is the Internet that connects things. This has two meanings: First, the core and foundation of the Internet of Things is still the Internet, which is an extended and extended network based on the Internet; Second, its client extends and extends to any item and item for information. Exchange and communication, that is, things and things. The Internet of Things is widely used in the convergence of networks through communication-aware technologies such as intelligent sensing, identification technology and pervasive computing. It is also called the third wave of the development of the world information industry after computers and the Internet. The Internet of Things is the application expansion of the Internet. It is not so much that the Internet of Things is a network, but the Internet of Things is a business and application. Therefore, application innovation is the core of the development of the Internet of Things. Innovation 2.0 with user experience as the core is the soul of the development of the Internet of Things
  • the Internet of Things solves the interconnection between objects and the exchange of data between objects.
  • the existing Internet of Things is connected to the Internet based on IoT access points (APs).
  • APs IoT access points
  • the data security is low, so the user experience is low.
  • the application provides an IoT AP type-based uplink data encryption control method. It can improve the security of IoT data and improve the user experience.
  • an uplink data encryption control method based on a type of an Internet of Things access point includes the following steps:
  • the IoT access point identifies the type of the Internet of Things terminal, and queries the first encryption unit corresponding to the type in the pre-configured type and the encryption unit mapping table according to the type;
  • the IoT access point invokes the first encryption unit to perform encryption processing on the data packet
  • the IoT access point sends the encrypted data packet to the wireless access controller.
  • the IoT access point identifies the type of the Internet of Things terminal, including:
  • the IoT access point identifies the type of the Internet of Things terminal by the identifier of the Internet of Things terminal.
  • the IoT access point identifies the type of the Internet of Things terminal, including:
  • the Internet of Things access point sends an IoT terminal type table to the Internet of Things terminal,
  • the Internet of Things access point receives the type of the Internet of Things terminal that is sent by the Internet of Things terminal and matches the Internet of Things terminal type table according to the Internet of Things terminal type.
  • the IoT access point invokes the first encryption unit to perform encryption processing on the data packet, including:
  • the IoT access point invokes the first encryption unit to perform encryption processing on the data packet. If the encryption is successful, the subsequent steps are performed. If the encryption is unsuccessful, the IoT access point invokes the standby of the first encryption unit. The encryption unit encrypts the data packet, and adds the alternate encryption unit identifier to the header extension field of the encrypted data packet.
  • the method further includes:
  • the IoT access point generates a key pair, the key pair includes: a public key and a private key, and the IoT access point encrypts the data packet by using the public key through the first encryption unit, and encrypts the data packet The subsequent data packet is sent through the first path, and the private key is sent through the second path.
  • a second aspect provides an IoT access point type-based uplink data encryption control apparatus, where the apparatus includes:
  • a receiving unit configured to receive a data packet sent by the Internet of Things terminal
  • An identification unit configured to identify a type of the Internet of Things terminal
  • a searching unit configured to query, according to the type, a first encryption unit corresponding to the type in a pre-configured type and an encryption unit mapping table;
  • An encryption unit configured to invoke the first encryption unit to perform encryption processing on the data packet
  • a sending unit configured to send the encrypted data packet to the wireless access controller.
  • the identifying unit is specifically configured to identify, by using an identifier of the Internet of Things terminal, a type of the Internet of Things terminal.
  • the identifying unit is configured to send an IoT terminal type table to the Internet of Things terminal, and receive, by the IoT terminal, the IoT terminal type that matches the IoT terminal type table according to the IoT terminal type table.
  • the encryption unit is configured to invoke the first encryption unit to perform encryption processing on the data packet. If the encryption is successful, perform subsequent steps. If the encryption is unsuccessful, the backup encryption unit of the first encryption unit is invoked. The data packet is encrypted, and the alternate encryption unit identifier is added to the header extension field of the encrypted data packet.
  • the encryption unit is specifically configured to generate a key pair, where the key pair includes: a public key and a private key, and the data packet is encrypted by the first encryption unit by using a public key, where the sending unit is configured to: The method is configured to send the encrypted data packet through the first path, and send the private key through the second path.
  • the AP After the Internet of Things terminal of the technical solution provided by the present invention sends the data packet to the AP, the AP queries the corresponding encryption unit according to the type of the Internet of Things terminal, and encrypts the data through the encryption unit.
  • the networked terminal does not need to be configured for encryption, and all encryption settings are in the AP.
  • This method can effectively reduce the cost of the Internet of Things terminal, and for the entire Internet of Things, because one AP can connect to many IoT terminals, only The configuration of the AP can also reduce the overall cost of the Internet of Things.
  • the computing power of the AP is generally stronger than that of the Internet of Things terminals, so that the delay of data transmission can be reduced when the encryption unit is operated, and the delay of the network can be reduced. User experience.
  • 1 is a schematic flow chart of a repeater-based data routing method
  • FIG. 2 is a flow chart of a method for an Internet of Things terminal to send a data packet to a gateway;
  • FIG. 3 is a flowchart of an uplink data sending method of an Internet of Things AP
  • FIG. 4 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an encryption unit mapping table according to an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a method for an Internet of Things terminal to send a data packet to a gateway according to another embodiment of the present application;
  • FIG. 7 is a schematic diagram of an information interaction process provided by the present application.
  • FIG. 8 is a schematic structural diagram of an uplink data encryption control apparatus of an Internet of Things access point based on the type provided by the present application;
  • FIG. 9 is a schematic structural diagram of hardware of an Internet of Things access point provided by the present application.
  • Computer device also referred to as “computer” in the context, is meant an intelligent electronic device that can perform predetermined processing, such as numerical calculations and/or logical calculations, by running a predetermined program or instruction, which can include a processor and The memory is executed by the processor to execute a predetermined process pre-stored in the memory to execute a predetermined process, or is executed by hardware such as an ASIC, an FPGA, a DSP, or the like, or a combination of the two.
  • Computer devices include, but are not limited to, servers, personal computers, notebook computers, tablets, smart phones, and the like.
  • an uplink data transmission method of an Internet of Things AP is provided.
  • the method is applied to the object network shown in FIG. 1.
  • the object network includes: an Internet of Things terminal 10, an Internet of Things access point AP20, and a wireless access controller 30.
  • the networked terminal may have different manifestations according to different situations.
  • the Internet of Things terminal may specifically be: a mobile phone, a tablet computer, a computer, etc., of course, it may also include other devices with networking functions, such as a smart TV, a smart air conditioner.
  • the smart water bottle or some intelligent devices of the Internet of Things, the above-mentioned Internet of Things terminal 10 is connected to the AP 20 in a wireless manner, and the AP 20 accesses the Internet through the gateway 12 by another means (that is, a connection mode different from the wireless mode), and the wireless method includes However, it is not limited to: Bluetooth, WIFI, etc., and the other method may be LTE or wired.
  • the wired mode is taken as an example, and for convenience of representation, only one solid line is shown here.
  • the above wireless access controller 30 can be a personal computer according to the size of the Internet of Things (English: Personal computer, PC), of course, in practical applications, may also be multiple PCs or servers.
  • PC Internet of Things
  • the specific embodiment of the present invention does not limit the specific manifestation of the above wireless access controller.
  • FIG. 2 is a transmission flowchart of uplink data transmission of an Internet of Things AP, as shown in FIG. 2, the process includes:
  • Step S201 the Internet of Things terminal 10 sends the data packet to be sent to the AP20 by wireless;
  • Step S202 AP20 forwards the data packet to the radio access controller 30;
  • Step S203 the radio access controller 30 transmits the data packet to the Internet.
  • FIG. 3 is a schematic diagram of an IoT AP type-based uplink data encryption control method according to the present invention.
  • the method is implemented in the network architecture shown in FIG. 4, as shown in FIG. 4, an AP20 can be connected.
  • the AP may be a relay station.
  • it may also be a router or other network device having a wireless connection and a data forwarding function, such as a mobile phone that opens a hotspot, a personal computer that provides a wireless connection, and the like.
  • the method is as shown in FIG. 3 and includes the following steps:
  • Step S301 The Internet of Things terminal sends a data packet to the AP20.
  • the object-to-network terminal in the above step S301 may specifically be: a mobile phone, a tablet computer, a computer, etc., of course, it may also include other devices with networking functions, such as a smart TV, a smart air conditioner, a smart water bottle, a smart light, a smart switch, or Some IoT smart devices.
  • the manner in which the Internet of Things terminal sends a data packet to the AP 20 may be a method of sending a data packet by using a wireless connection, including but not limited to: Bluetooth, Wireless Fidelity (WIFI), or Zigbee.
  • a wireless connection including but not limited to: Bluetooth, Wireless Fidelity (WIFI), or Zigbee.
  • WIFI Wireless Fidelity
  • Zigbee Zigbee
  • the Internet of Things and APs here are only for wireless APs, because for the Internet of Things, the number of devices accessed by them is large.
  • the connection is through a wired connection, the number of APs to access first will be The limitation is, and for the family, the wired connection is unimaginable for the wiring of the home user, and the cost of the cable is also very high, so the technique of the present invention
  • the connection between the Internet of Things terminal and the AP in the solution is limited to wireless connection.
  • Step S302 The AP20 identifies the type of the Internet of Things terminal, and queries the first encryption unit corresponding to the type in the pre-configured type and the encryption unit mapping table according to the type.
  • the types of the Internet of Things terminals in the above step S302 can be set according to the situation of the device.
  • the types of the Internet of Things terminals can include: smart lights, smart TVs, smart cleaning devices, smart sleep devices, intelligent monitoring devices, etc.
  • the form of performance can be varied.
  • the smart electric light includes, but is not limited to, a smart table lamp, a smart ceiling lamp, a smart wall lamp, etc.
  • a smart TV it can be a Samsung smart TV.
  • it can also be a Sharp smart TV.
  • a smart cleaning device it can be a smart sweeping robot.
  • a smart vacuum cleaner for example, for a smart sleep device
  • It can be: a smart mattress, a smart sofa, etc., for example, for an intelligent monitoring device, or it can be an intelligent blood pressure meter, a smart thermometer, etc., the specific types and types of the above-mentioned Internet of Things terminals of the present invention. Not limited.
  • the type and encryption unit mapping table in the above steps are as shown in FIG. 5, and the foregoing mapping may be a one-to-one mapping, and may of course be a one-to-many mapping.
  • the encryption unit in the foregoing step S302 may be specifically a hardware encryption unit that is configured in the AP, and includes an encryption algorithm preset by the manufacturer.
  • the encryption unit may also be a software encryption unit configured in the AP. The invention does not limit the specific expression of the above encryption unit.
  • the foregoing encryption algorithm includes, but is not limited to, an encryption algorithm such as 3DES, MD5 or RSA, and the present invention is not limited to a specific encryption algorithm.
  • Step S303 The AP20 invokes the first encryption unit to perform encryption processing on the data packet.
  • the implementation method of the foregoing step S303 may specifically be:
  • the AP 20 invokes the 3DES encryption unit to perform 3DES encryption processing on the data packet.
  • the AP 20 invokes the RAS encryption unit to perform RAS encryption processing on the data packet.
  • the AP 20 invokes the MD5 encryption unit to perform MD5 encryption processing on the data packet.
  • the key for invoking the first encryption unit to perform the encryption process may obtain the MAC address of the AP 20 and obtain the secret key according to the MAC address of the AP 20 by using a setting algorithm.
  • the setting algorithm may be: intercepting a part of the MAC address, for example, intercepting 20th to 40th of the MAC address, Then convert the 20th to 40th digits into a decimal number, using the decimal number as the encrypted key.
  • the 20th to 40th fields of the screenshot are because for the MAC address, it is 48 bits (6 bytes).
  • the hexadecimal format consists of numbers, where 0-23 bits are assigned by the manufacturer itself; 24-47 bits, called Organizationally Unique Identifier (OUI), are assigned by the IEEE organization, so the global MAC of the terminal NIC The address is unique. This avoids duplication of interception and improves encryption performance.
  • OMI Organizationally Unique Identifier
  • the implementation method of the foregoing step S303 may specifically be:
  • the AP20 invokes the first encryption unit to perform encryption processing on the data packet. If the encryption succeeds, the subsequent step S304 is performed. If the encryption is unsuccessful, the standby encryption unit of the first encryption unit is invoked to encrypt the data packet, and the standby encryption is used. The unit ID is added to the header extension field of the encrypted packet.
  • Step S304 The AP20 sends the encrypted data packet to the radio access controller.
  • the implementation method of the above step S304 can be:
  • the encrypted data packet is sent to the wireless access controller in another manner.
  • the Internet of Things terminal is connected to the AP through the WIFI, and then the AP20 can send the data packet to the wireless access controller by wire, of course, in practice.
  • the AP20 can also send the encrypted data packet to the radio access controller through Long Term Evolution (LTE).
  • LTE Long Term Evolution
  • the foregoing LTE or limited mode and the manner in which the Internet of Things terminal is connected to the AP through the WIFI are merely for illustrative purposes, and the present invention does not limit the specific manner of the foregoing connection.
  • the AP queries the corresponding encryption unit according to the type of the Internet of Things terminal, and encrypts the data through the encryption unit.
  • the Internet of Things terminal does not need to configure the encryption. All the encryption settings are in the AP.
  • This method can effectively reduce the cost of the Internet of Things terminal.
  • For the entire Internet of Things because there are many IoT terminals connected to one AP, The configuration of the AP alone can also reduce the overall cost of the Internet of Things.
  • the computing power of the AP is generally stronger than that of the Internet of Things terminals, so that the delay of data transmission can be reduced when the encryption unit is operated, and the network delay is reduced. Improve the user experience.
  • FIG. 6 is a method for controlling uplink data encryption of an Internet of Things AP based on type according to the present invention.
  • the method is implemented in a network architecture as shown in FIG. 4, as shown in FIG. 4, an AP20 can be connected.
  • the AP may be a relay station.
  • it may also be a router or other network device having a wireless connection and a data forwarding function, such as a mobile phone that opens a hotspot, a personal computer that provides a wireless connection, and the like.
  • the method is as shown in FIG. 6, and includes the following steps:
  • Step S601 The Internet of Things terminal sends a data packet to the AP20.
  • the IoT terminal in the above step S601 may specifically be: a mobile phone, a tablet computer, a computer, etc., of course, it may also include other devices with networking functions, such as a smart TV, a smart air conditioner, a smart water bottle, a smart light, a smart switch, or Some IoT smart devices.
  • the manner in which the Internet of Things terminal sends a data packet to the AP20 may be a method of sending a data packet by using a wireless connection, including but not limited to: Bluetooth, Wireless Fidelity (WIFI), or Zigbee.
  • a wireless connection including but not limited to: Bluetooth, Wireless Fidelity (WIFI), or Zigbee.
  • WIFI Wireless Fidelity
  • Zigbee Zigbee
  • the Internet of Things and APs here are only for wireless APs, because for the Internet of Things, the number of devices accessed by them is large.
  • the connection is through a wired connection, the number of APs to access first will be The limitation is, and for the family, the wired connection is unimaginable for the wiring of the home user, and the cost of the cable is also very high, so the Internet of Things terminal and the AP in the technical solution of the present invention The connection between them is limited to wireless connections.
  • Step S602 The AP20 identifies the type of the Internet of Things terminal, and queries the first encryption unit corresponding to the type in the pre-configured type and the encryption unit mapping table according to the type;
  • the types of the Internet of Things terminals in the above step S602 can be set according to the situation of the device.
  • the types of the Internet of Things terminals can include: smart lights, smart TVs, smart cleaning devices, smart sleep devices, intelligent monitoring devices, etc.
  • the form of performance can be varied.
  • the smart electric light includes, but is not limited to, a smart table lamp, a smart ceiling lamp, a smart wall lamp, etc.
  • a smart TV it can be a Samsung smart TV.
  • it can also be a Sharp smart TV.
  • a smart cleaning device it can be a smart sweeping robot.
  • a smart vacuum cleaner for example, for a smart sleep device
  • It can be: smart mattresses, smart sofas, etc., for example, for intelligent monitoring equipment.
  • it may be, an intelligent sphygmomanometer, a smart thermometer, etc., and the present invention does not limit the specific types and types of the above-mentioned Internet of Things terminals.
  • the specific implementation method of the AP20 identifying the type of the Internet of Things terminal in the above step S602 may be:
  • the AP 20 identifies the type of the Internet of Things terminal through the identifier of the Internet of Things terminal, including but not limited to: the media access address (English: Media Access Control, MAC) of the Internet of Things terminal, the IP address or the name of the Internet of Things terminal, and the like.
  • the AP20 and the Internet of Things terminal can also determine the type of the Internet of Things terminal through information interaction. As shown in FIG. 7, the flow of the information interaction may be:
  • Step S701 The Internet of Things terminal sends a connection request to the AP20,
  • Step S702 The AP20 returns a connection response to the Internet of Things terminal, and establishes a wireless connection with the Internet of Things terminal.
  • Step S703 the AP20 sends the IoT terminal type table in the AP20 to the Internet of Things terminal through the wireless connection;
  • Step S704 The Internet of Things terminal searches for the type of the Internet of Things terminal that matches the self of the Internet of Things terminal type table;
  • Step S705 The Internet of Things terminal reports the type of the Internet of Things terminal to the AP 20.
  • the type and encryption unit mapping table in the above steps are as shown in FIG. 5, and the foregoing mapping may be a one-to-one mapping, and may of course be a one-to-many mapping.
  • the cryptographic unit in the foregoing step S602 may be a hardware cryptographic unit that is configured in the AP, and includes an encryption algorithm preset by the manufacturer.
  • the cryptographic unit may also be a software cryptographic unit configured in the AP. The invention does not limit the specific expression of the above encryption unit.
  • the foregoing encryption algorithm includes, but is not limited to, an encryption algorithm such as 3DES, MD5 or RSA, and the present invention is not limited to a specific encryption algorithm.
  • Step S603 The AP 20 generates a key pair, where the secret key pair includes a private key and a public key, and the AP 20 encrypts the data packet according to the first encryption unit by using a public key;
  • the implementation method of the foregoing step S603 may specifically be:
  • the AP 20 invokes the 3DES encryption unit to perform 3DES encryption processing on the data packet.
  • the AP 20 invokes the RAS encryption unit to perform RAS encryption processing on the data packet.
  • the first encryption unit is MD5.
  • the AP 20 invokes the MD5 encryption unit to perform MD5 encryption processing on the data packet.
  • Step S604 The AP20 sends the encrypted data packet to the radio access controller through the first path, and the AP20 sends the private key to the radio access controller by using the second path.
  • the implementation method of the above step S604 can be:
  • the encrypted data packet is sent to the wireless access controller in another manner.
  • the Internet of Things terminal is connected to the AP through the WIFI, and then the AP20 can send the data packet to the wireless access controller by wire, of course, in practice.
  • the AP20 can also send the encrypted data packet to the radio access controller through Long Term Evolution (LTE).
  • LTE Long Term Evolution
  • the foregoing LTE or limited mode and the manner in which the Internet of Things terminal is connected to the AP through the WIFI are merely for illustrative purposes, and the present invention does not limit the specific manner of the foregoing connection.
  • the first path and the second path are different paths, and the first path may be calculated by using a different path algorithm, including but not limited to: a shortest path first algorithm or a shortest time delay first algorithm, of course, the first path And the second path may also be calculated by using different path algorithms.
  • the first path may be calculated by using a shortest path first algorithm
  • the second path may be calculated by a shortest delay first algorithm.
  • the AP queries the corresponding encryption unit according to the type of the Internet of Things terminal, and encrypts the data through the encryption unit.
  • the Internet of Things terminal does not need to configure the encryption. All the encryption settings are in the AP.
  • This method can effectively reduce the cost of the Internet of Things terminal.
  • For the entire Internet of Things because there are many IoT terminals connected to one AP, The configuration of the AP alone can also reduce the overall cost of the Internet of Things.
  • the computing power of the AP is generally stronger than that of the Internet of Things terminals, so that the delay of data transmission can be reduced when the encryption unit is operated, and the network delay is reduced. Improve the user experience.
  • the method shown in FIG. 6 uses different paths when transmitting encrypted data packets and private keys, which increases the difficulty of information interception, which can further improve data security.
  • FIG. 8 is a type-based uplink data encryption control apparatus 800 for an Internet of Things access point according to the present invention.
  • the apparatus includes:
  • the receiving unit 801 is configured to receive a data packet sent by the Internet of Things terminal;
  • the identifying unit 802 is configured to identify a type of the Internet of Things terminal
  • the searching unit 803 is configured to query, according to the type, the first encryption unit corresponding to the type in the pre-configured type and the encryption unit mapping table;
  • the encryption unit 804 is configured to invoke the first encryption unit to perform encryption processing on the data packet.
  • the sending unit 805 is configured to send the encrypted data packet to the radio access controller.
  • the identifying unit 802 is specifically configured to identify, by using the identifier of the Internet of Things terminal, a type of the Internet of Things terminal.
  • the identifying unit 805 is specifically configured to send the IoT terminal type table to the Internet of Things terminal, and receive the IoT terminal type that is matched by the IoT terminal according to the IoT terminal type table.
  • the encryption unit 804 is specifically configured to invoke the first encryption unit to perform encryption processing on the data packet. If the encryption is successful, perform subsequent steps. If the encryption is unsuccessful, the standby encryption unit pair of the first encryption unit is invoked. The data packet is subjected to an encryption process, and the alternate encryption unit identifier is added to the header extension field of the encrypted data packet.
  • the encryption unit 804 is specifically configured to generate a key pair, where the key pair includes: a public key and a private key, and the data packet is encrypted by the first encryption unit by using a public key, where the sending unit uses The encrypted data packet is sent through the first path, and the private key is sent through the second path.
  • FIG. 9 is an IoT access point 900 provided by the present invention.
  • the IoT access point may be a node deployed in an Internet system, and the Internet system may further include: an Internet of Things terminal and wireless access.
  • the IoT access point 900 includes, but is not limited to, a computer, a server, and the like.
  • the IoT access point 900 includes a processor 901, a memory 902, a transceiver 903, and a bus 904.
  • the transceiver 903 is configured to transmit and receive data with an external device (eg, other devices in the interconnection system, including but not limited to: a repeater, a core network device, etc.).
  • an external device eg, other devices in the interconnection system, including but not limited to: a repeater, a core network device, etc.
  • the number of processors 901 in the Internet of Things access point 900 can be one or more.
  • processor 901, memory 902, and transceiver 903 may be connected by a bus system or other means.
  • bus system or other means.
  • the program code can be stored in the memory 902.
  • the processor 901 is configured to call the program code stored in the memory 902, and is configured to perform the following operations:
  • the transceiver 903 is configured to receive a data packet sent by the Internet of Things terminal;
  • the processor 901 is configured to identify the type of the Internet of Things terminal, query the first encryption unit corresponding to the type in the pre-configured type and the encryption unit mapping table according to the type, and invoke the first encryption unit pair.
  • the data packet is encrypted.
  • the transceiver 903 is further configured to send the encrypted data packet to the wireless access controller.
  • processor 901 and the transceiver 903 can also be used to perform the refinement and the steps of the steps and steps in the embodiment shown in FIG. 3 or FIG. 6.
  • the processor 901 herein may be a processing component or a general term of multiple processing components.
  • the processing component may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • DSPs digital singal processors
  • FPGAs Field Programmable Gate Arrays
  • the memory 903 may be a storage device or a collective name of a plurality of storage elements, and is used to store executable program code or parameters, data, and the like required for the application running device to operate. And the memory 903 may include random access memory (RAM), and may also include non-volatile memory such as a magnetic disk memory, a flash memory, or the like.
  • RAM random access memory
  • non-volatile memory such as a magnetic disk memory, a flash memory, or the like.
  • the bus 904 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 9, but it does not mean that there is only one bus or one type of bus.
  • the user equipment may also include input and output means coupled to bus 904 for connection to other portions, such as processor 901, via a bus.
  • the input/output device can provide an input interface for the operator, so that the operator can select the control item through the input interface, and can also be other interfaces through which other devices can be externally connected.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Flash disk, read-only memory (English: Read-Only Memory, referred to as: ROM), random accessor (English: Random Access Memory, referred to as: RAM), disk or optical disk.
  • ROM Read-Only Memory
  • RAM Random Access Memory

Abstract

本申请公开了一种物联网接入点基于类型的上行数据加密控制方法，所述方法包括如下步骤：所述物联网接入点接收物联网终端发送的数据包；所述物联网接入点识别所述物联网终端的类型，依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元；所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理；所述物联网接入点将加密处理后的数据包发送至无线接入控制器。本申请具有用户体验度高的优点。

Description

物联网接入点基于类型的上行数据加密控制方法及装置
本申请要求于2016年9月20日提交中国专利局、申请号为201610834313.6、发明名称为“物联网接入点基于类型的上行数据加密控制方法及装置”的中国专利申请的优先权，上述在先申请的内容以引入的方式并入本文本中。
技术领域
本申请涉及通信领域，尤其涉及一种物联网AP基于类型的上行数据加密控制方法及装置。
背景技术
物联网是新一代信息技术的重要组成部分，也是“信息化”时代的重要发展阶段。其英文名称是：“Internet of things(IoT)”。顾名思义，物联网就是物物相连的互联网。这有两层意思：其一，物联网的核心和基础仍然是互联网，是在互联网基础上的延伸和扩展的网络；其二，其用户端延伸和扩展到了任何物品与物品之间，进行信息交换和通信，也就是物物相息。物联网通过智能感知、识别技术与普适计算等通信感知技术，广泛应用于网络的融合中，也因此被称为继计算机、互联网之后世界信息产业发展的第三次浪潮。物联网是互联网的应用拓展，与其说物联网是网络，不如说物联网是业务和应用。因此，应用创新是物联网发展的核心，以用户体验为核心的创新2.0是物联网发展的灵魂。
物联网解决的是物物之间的互联以及物物之间的数据交换，现有的物联网在联网时均基于物联网接入点(英文：access point，AP)来接入互联网，物联网的数据安全性较低，所以用户体验度低。
发明内容
本申请提供一种物联网AP基于类型的上行数据加密控制方法。可以提高物联网数据的安全性，提高用户体验。
第一方面，提供一种物联网接入点基于类型的上行数据加密控制方法，所 述方法包括如下步骤：
所述物联网接入点接收物联网终端发送的数据包；
所述物联网接入点识别所述物联网终端的类型，依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元；
所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理；
所述物联网接入点将加密处理后的数据包发送至无线接入控制器。
可选的，所述物联网接入点识别所述物联网终端的类型具体，包括：
所述物联网接入点通过所述物联网终端的标识来识别物联网终端的类型。
可选的，所述物联网接入点识别所述物联网终端的类型具体，包括：
所述物联网接入点向物联网终端发送物联网终端类型表，
所述物联网接入点接收物联网终端发送的依据所述物联网终端类型表查找出与自身匹配的物联网终端类型。
可选的，所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理具体，包括：
所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理，如加密成功，进行后续步骤，如加密不成功，所述物联网接入点调用第一加密单元的备用加密单元对所述数据包进行加密处理，将采用备用加密单元标识添加到加密处理后的数据包的包头扩展字段。
可选的，所述方法还包括：
所述物联网接入点生成密钥对，所述密钥对包括：公钥和私钥，所述物联网接入点采用公钥通过第一加密单元对数据包进行加密处理，将加密处理后的数据包通过第一路径发送，将私钥通过第二路径发送。
第二方面，提供一种物联网接入点基于类型的上行数据加密控制装置，所述装置包括：
接收单元，用于接收物联网终端发送的数据包；
识别单元，用于识别所述物联网终端的类型；
查找单元，用于依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元；
加密单元，用于调用所述第一加密单元对所述数据包进行加密处理；
发送单元，用于将加密处理后的数据包发送至无线接入控制器。
可选的，所述识别单元具体，用于通过所述物联网终端的标识来识别物联网终端的类型。
可选的，所述识别单元具体，用于向物联网终端发送物联网终端类型表，接收物联网终端发送的依据所述物联网终端类型表查找出与自身匹配的物联网终端类型。
可选的，所述加密单元具体，用于调用所述第一加密单元对所述数据包进行加密处理，如加密成功，进行后续步骤，如加密不成功，调用第一加密单元的备用加密单元对所述数据包进行加密处理，将采用备用加密单元标识添加到加密处理后的数据包的包头扩展字段。
可选的，所述加密单元具体，用于生成密钥对，所述密钥对包括：公钥和私钥，采用公钥通过第一加密单元对数据包进行加密处理，所述发送单元，用于将加密处理后的数据包通过第一路径发送，将私钥通过第二路径发送。
本发明提供的技术方案的物联网终端将数据包发送至AP以后，AP依据物联网终端的类型查询出该类型对应的加密单元，通过该加密单元对数据进行加密，对于物联网来说，物联网终端无需对加密进行配置，所有的加密设置均在AP，此方式能够有效的降低物联网终端的成本，并且对于整个物联网来说，由于其一个AP下面可以连接众多的物联网终端，仅仅对AP配置也可以降低物联网整体的成本，另外，对于AP来说其计算的能力一般强于物联网终端，那么对运行加密单元时能够减少数据发送的延时，减少网络的时延，提高用户的体验。
。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是一种基于中继器的数据路由方法的流程示意图；
图2是一种物联网终端向网关发送数据包的方法流程图；
图3为物联网AP的上行数据发送方法流程图
图4是本申请一实施例提供的网络构架示意图；
图5是本申请一实施例的提供的加密单元映射表示意图；
图6是本申请另一实施例提供的物联网终端向网关发送数据包的方法的流程示意图；
图7是本申请提供的一种信息交互流程示意图；
图8是本申请提供的一种物联网接入点基于类型的上行数据加密控制装置的结构示意图；
图9为本申请提供的一种物联网接入点的硬件结构示意图。
具体实施方式
在更加详细地讨论示例性实施例之前应当提到的是，一些示例性实施例被描述成作为流程图描绘的处理或方法。虽然流程图将各项操作描述成顺序的处理，但是其中的许多操作可以被并行地、并发地或者同时实施。此外，各项操作的顺序可以被重新安排。当其操作完成时所述处理可以被终止，但是还可以具有未包括在附图中的附加步骤。所述处理可以对应于方法、函数、规程、子例程、子程序等等。
在上下文中所称“计算机设备”，也称为“电脑”，是指可以通过运行预定程序或指令来执行数值计算和/或逻辑计算等预定处理过程的智能电子设备，其可以包括处理器与存储器，由处理器执行在存储器中预存的存续指令来执行预定处理过程，或是由ASIC、FPGA、DSP等硬件执行预定处理过程，或是由上述二者组合来实现。计算机设备包括但不限于服务器、个人电脑、笔记本电脑、平板电脑、智能手机等。
后面所讨论的方法(其中一些通过流程图示出)可以通过硬件、软件、固件、中间件、微代码、硬件描述语言或者其任意组合来实施。当用软件、固件、中间件或微代码来实施时，用以实施必要任务的程序代码或代码段可以被存储在机器或计算机可读介质(比如存储介质)中。(一个或多个)处理器可以实施必要的任务。
这里所公开的具体结构和功能细节仅仅是代表性的，并且是用于描述本发 明的示例性实施例的目的。但是本发明可以通过许多替换形式来具体实现，并且不应当被解释成仅仅受限于这里所阐述的实施例。
应当理解的是，虽然在这里可能使用了术语“第一”、“第二”等等来描述各个单元，但是这些单元不应当受这些术语限制。使用这些术语仅仅是为了将一个单元与另一个单元进行区分。举例来说，在不背离示例性实施例的范围的情况下，第一单元可以被称为第二单元，并且类似地第二单元可以被称为第一单元。这里所使用的术语“和/或”包括其中一个或更多所列出的相关联项目的任意和所有组合。
这里所使用的术语仅仅是为了描述具体实施例而不意图限制示例性实施例。除非上下文明确地另有所指，否则这里所使用的单数形式“一个”、“一项”还意图包括复数。还应当理解的是，这里所使用的术语“包括”和/或“包含”规定所陈述的特征、整数、步骤、操作、单元和/或组件的存在，而不排除存在或添加一个或更多其他特征、整数、步骤、操作、单元、组件和/或其组合。
还应当提到的是，在一些替换实现方式中，所提到的功能/动作可以按照不同于附图中标示的顺序发生。举例来说，取决于所涉及的功能/动作，相继示出的两幅图实际上可以基本上同时执行或者有时可以按照相反的顺序来执行。
下面结合附图对本发明作进一步详细描述。
根据本发明的一个方面，提供了一种物联网AP的上行数据发送方法。其中，该方法应用在如图1所示的物联网络中，如图1所示，该物联网络包括：物联网终端10、物联网接入点AP20以及无线接入控制器30，上述物联网终端根据不同的情况可以具有不同的表现形式，例如该物联网终端具体可以为：手机、平板电脑、计算机等设备，当然其也可以包含带有联网功能的其他设备，例如智能电视、智能空调、智能水壶或一些物联网的智能设备，上述物联网终端10通过无线方式与AP20连接，AP20通过另一种方式(即与无线方式不同的连接方式)与网关12接入互联网，上述无线方式包括但不限于：蓝牙、WIFI等方式，上述另一种方式可以为，LTE或有线方式。图1中以有线方式为示例，为了方便表示，这里仅以一根实线表示。
上述无线接入控制器30根据物联网的大小可以是一台个人电脑(英文： Personal computer，PC)，当然在实际应用中，也可以是多台PC或服务器，本发明具体实施方式并不局限上述无线接入控制器的具体表现形式。
参阅图2，图2为物联网AP的上行数据发送的传输流程图，如图2所示，该流程包括：
步骤S201、物联网终端10将需要发送的数据包通过无线方式发送至AP20；
步骤S202、AP20将该数据包转发给无线接入控制器30；
步骤S203、无线接入控制器30将数据包传输至互联网。
通过上述图1和图2的表示，在数据包的实际传输中，如果AP20与无线接入控制器30之间出现泄密，那么对于发送的数据包由于没有经过相应的加密处理，所以很容易导致数据的泄漏，容易出现安全性问题。
参阅图3，图3为本发明提供的一种物联网AP基于类型的上行数据加密控制方法，该方法在如图4所示的网络构架下实现，如图4所示，一个AP20下可以连接多个物联网终端，该AP具体可以为中继站，当然在实际应用中也可以为路由器或其他的具有无线连接以及数据转发功能的网络设备，例如开通热点的手机、提供无线连接的个人电脑等设备，该方法如图3所示，包括如下步骤：
步骤S301、物联网终端向AP20发送数据包；
上述步骤S301中的物联网终端具体可以为：手机、平板电脑、计算机等设备，当然其也可以包含带有联网功能的其他设备，例如智能电视、智能空调、智能水壶、智能灯、智能开关或一些物联网的智能设备。
上述步骤S301中物联网终端向AP20发送数据包的方式可以为通过无线连接的方式发送数据包，该无线方式包括但不限于：蓝牙、无线保真(英文：Wireless Fidelity，WIFI)或Zigbee等无线方式，其中，上述WIFI需要遵守IEEE802.11b的标准。
需要说明的是，这里的物联网以及AP仅仅只是针对无线AP，因为对于物联网来说，其接入的设备数量众多，对于AP来说，如果通过有线连接，首先AP的接入数量会有所限制，并且对于家庭来说，均用有线连接，对于家庭用户的布线来说是无法想象的，另外此有线的成本也非常高，所以本发明的技 术方案中的中物联网终端与AP之间的连接仅限无线连接。
步骤S302、AP20识别该物联网终端的类型，依据该类型在预先配置的类型与加密单元映射表中查询出该类型对应的第一加密单元。
上述步骤S302中的物联网终端的类型各个厂家可以根据自行的情况进行设置，例如，该物联网终端的类型具体可以包括：智能电灯、智能电视、智能清扫设备、智能睡眠设备，智能监控设备等，其表现的形式可以为多种多样，例如对于智能电灯，该智能电灯包括但不限于：智能台灯，智能吸顶灯，智能壁灯等设备，例如对于智能电视来说，其可以为三星牌智能电视，当然其也可以为夏普牌智能电视，例如对于智能清扫设备来说，其可以为，智能扫地机器人，当然其还可以包括智能吸尘器、智能垃圾处理器等设备，例如对于智能睡眠设备来说，其可以为：智能床垫、智能沙发等设备，例如对智能监控设备来说或，其可以为，智能血压计，智能温度计等，本发明对上述物联网终端的具体类型以及类型的数量或种类并不限定。
上述步骤中的类型与加密单元映射表如图5所示，上述映射可以为一一映射，当然也可以为一对多映射等方式。
上述步骤S302中的加密单元具体可以为设置在AP的硬件加密单元，其包含厂家预设设置的加密算法，当然在实际应用中，上述加密单元还可以为配置在AP内的软件加密单元，本发明并不限制上述加密单元的具体表现形式。
上述加密算法包括但不限于：3DES、MD5或RSA等加密算法，本发明并不局限具体的加密算法。
步骤S303、AP20调用第一加密单元对该数据包进行加密处理；
上述步骤S303的实现方法具体可以为：
例如，第一加密单元为3DES加密单元，则AP20调用3DES加密单元对数据包进行3DES加密处理。例如第一加密单元为RAS加密单元，则AP20调用RAS加密单元对数据包进行RAS加密处理。例如第一加密单元为MD5加密单元，则AP20调用MD5加密单元对数据包进行MD5加密处理。
上述调用第一加密单元进行加密处理的秘钥可以通过获取AP20的MAC地址，依据AP20的MAC地址通过设定算法得到秘钥，该设定算法可以为，截取MAC地址的部分字段，例如，截取该MAC地址的第20位到第40位， 然后将第20位到第40位转换成十进制数，以该十进制数作为加密的秘钥，这里截图第20到第40个字段是因为对于MAC地址来说，它由48位(6字节)的十六进制格式的数字组成，其中0-23位是由厂家自己分配；24-47位，叫做组织唯一标志符(Organizationally Unique Identifier，OUI)，由IEEE组织分配，因此终端网卡的全球MAC地址具备唯一性。这样可以避免截取的重复，并且提高了加密性能。
上述加密处理的具体方式可以参见3DES、RSA以及MD5的相关描述，这里不再赘述。
上述步骤S303的实现方法具体可以为：
AP20调用第一加密单元对该数据包进行加密处理，如加密成功，进行后续步骤S304，如加密不成功，则调用第一加密单元的备用加密单元对该数据包进行加密处理，将采用备用加密单元标识添加到加密处理后的数据包的包头扩展字段。
步骤S304、AP20将该加密处理后的数据包发送至无线接入控制器。
上述步骤S304的实现方法可以为：
通过另一种方式将加密处理的数据包发送至无线接入控制器，例如，物联网终端通过WIFI与AP连接，那么AP20可以通过有线方式将数据包发送至无线接入控制器，当然在实际应用中，AP20也可以通过长期演进(英文：Long Term Evolution，LTE)将加密处理后的数据包发送至无线接入控制器。当然上述LTE或有限方式以及物联网终端通过WIFI与AP连接的方式仅仅为了举例说明，本发明并不局限上述连接的具体方式。
依据如图3提供的方法，物联网终端将数据包发送至AP以后，AP依据物联网终端的类型查询出该类型对应的加密单元，通过该加密单元对数据进行加密，对于物联网来说，物联网终端无需对加密进行配置，所有的加密设置均在AP，此方式能够有效的降低物联网终端的成本，并且对于整个物联网来说，由于其一个AP下面可以连接众多的物联网终端，仅仅对AP配置也可以降低物联网整体的成本，另外，对于AP来说其计算的能力一般强于物联网终端，那么对运行加密单元时能够减少数据发送的延时，减少网络的时延，提高用户的体验。
参阅图6，图6为本发明提供的一种物联网AP基于类型的上行数据加密控制方法，该方法在如图4所示的网络构架下实现，如图4所示，一个AP20下可以连接多个物联网终端，该AP具体可以为中继站，当然在实际应用中也可以为路由器或其他的具有无线连接以及数据转发功能的网络设备，例如开通热点的手机、提供无线连接的个人电脑等设备，该方法如图6所示，包括如下步骤：
步骤S601、物联网终端向AP20发送数据包；
上述步骤S601中的物联网终端具体可以为：手机、平板电脑、计算机等设备，当然其也可以包含带有联网功能的其他设备，例如智能电视、智能空调、智能水壶、智能灯、智能开关或一些物联网的智能设备。
上述步骤S601中物联网终端向AP20发送数据包的方式可以为通过无线连接的方式发送数据包，该无线方式包括但不限于：蓝牙、无线保真(英文：Wireless Fidelity，WIFI)或Zigbee等无线方式，其中，上述WIFI需要遵守IEEE802.11b的标准。
需要说明的是，这里的物联网以及AP仅仅只是针对无线AP，因为对于物联网来说，其接入的设备数量众多，对于AP来说，如果通过有线连接，首先AP的接入数量会有所限制，并且对于家庭来说，均用有线连接，对于家庭用户的布线来说是无法想象的，另外此有线的成本也非常高，所以本发明的技术方案中的中物联网终端与AP之间的连接仅限无线连接。
步骤S602、AP20识别该物联网终端的类型，依据该类型在预先配置的类型与加密单元映射表中查询出该类型对应的第一加密单元；
上述步骤S602中的物联网终端的类型各个厂家可以根据自行的情况进行设置，例如，该物联网终端的类型具体可以包括：智能电灯、智能电视、智能清扫设备、智能睡眠设备，智能监控设备等，其表现的形式可以为多种多样，例如对于智能电灯，该智能电灯包括但不限于：智能台灯，智能吸顶灯，智能壁灯等设备，例如对于智能电视来说，其可以为三星牌智能电视，当然其也可以为夏普牌智能电视，例如对于智能清扫设备来说，其可以为，智能扫地机器人，当然其还可以包括智能吸尘器、智能垃圾处理器等设备，例如对于智能睡眠设备来说，其可以为：智能床垫、智能沙发等设备，例如对智能监控设备来 说或，其可以为，智能血压计，智能温度计等，本发明对上述物联网终端的具体类型以及类型的数量或种类并不限定。
上述步骤S602中AP20识别该物联网终端的类型的具体实现方法可以为：
AP20通过物联网终端的标识来识别物联网终端的类型，该标识包括但不限于：物联网终端的媒体访问地址(英文：Media Access Control，MAC)、IP地址或物联网终端的名称等等，当然在实际应用中，AP20和物联网终端之间也可以通过信息交互来确定上述物联网终端的类型，如图7所示，该信息交互的流程具体可以为：
步骤S701、物联网终端向AP20发送连接请求，
步骤S702、AP20向物联网终端返回连接响应，建立与物联网终端的无线连接；
步骤S703、AP20通过该无线连接将AP20内的物联网终端类型表下发给物联网终端；
步骤S704、物联网终端从该物联网终端类型表中查找出与自身匹配的物联网终端类型；
步骤S705、物联网终端将该物联网终端类型上报给AP20。
上述步骤中的类型与加密单元映射表如图5所示，上述映射可以为一一映射，当然也可以为一对多映射等方式。
上述步骤S602中的加密单元具体可以为设置在AP的硬件加密单元，其包含厂家预设设置的加密算法，当然在实际应用中，上述加密单元还可以为配置在AP内的软件加密单元，本发明并不限制上述加密单元的具体表现形式。
上述加密算法包括但不限于：3DES、MD5或RSA等加密算法，本发明并不局限具体的加密算法。
步骤S603、AP20生成密钥对，该秘钥对包含私钥和公钥，AP20采用公钥依据第一加密单元对该数据包进行加密处理；
上述步骤S603的实现方法具体可以为：
例如，第一加密单元为3DES加密单元，则AP20调用3DES加密单元对数据包进行3DES加密处理。例如第一加密单元为RAS加密单元，则AP20调用RAS加密单元对数据包进行RAS加密处理。例如第一加密单元为MD5 加密单元，则AP20调用MD5加密单元对数据包进行MD5加密处理。
上述加密处理的具体方式可以参见3DES、RSA以及MD5的相关描述，这里不再赘述。
步骤S604、AP20将该加密处理后的数据包通过第一路径发送至无线接入控制器，AP20将私钥通过第二路径发送至无线接入控制器。
上述步骤S604的实现方法可以为：
通过另一种方式将加密处理的数据包发送至无线接入控制器，例如，物联网终端通过WIFI与AP连接，那么AP20可以通过有线方式将数据包发送至无线接入控制器，当然在实际应用中，AP20也可以通过长期演进(英文：Long Term Evolution，LTE)将加密处理后的数据包发送至无线接入控制器。当然上述LTE或有限方式以及物联网终端通过WIFI与AP连接的方式仅仅为了举例说明，本发明并不局限上述连接的具体方式。
上述第一路径和第二路径为不同的路径，上述第一路径可以通过不同的路径算法计算出来，该路径算法包括但不限于：最短路径优先算法或最短时延优先算法，当然上述第一路径以及第二路径也可以通过不同的路径算法计算处理，例如，第一路径可以采用最短路径优先算法计算出来，第二路径可以通过最短时延优先算法计算出来。
依据如图6提供的方法，物联网终端将数据包发送至AP以后，AP依据物联网终端的类型查询出该类型对应的加密单元，通过该加密单元对数据进行加密，对于物联网来说，物联网终端无需对加密进行配置，所有的加密设置均在AP，此方式能够有效的降低物联网终端的成本，并且对于整个物联网来说，由于其一个AP下面可以连接众多的物联网终端，仅仅对AP配置也可以降低物联网整体的成本，另外，对于AP来说其计算的能力一般强于物联网终端，那么对运行加密单元时能够减少数据发送的延时，减少网络的时延，提高用户的体验。如图6所示的方法在发送加密数据包和私钥时采用不同的路径发送，这样增加了信息拦截的难度，这样能够进一步提高数据的安全性。
参阅图8，图8为本发明提供的一种物联网接入点基于类型的上行数据加密控制装置800，所述装置包括：
接收单元801，用于接收物联网终端发送的数据包；
识别单元802，用于识别所述物联网终端的类型；
查找单元803，用于依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元；
加密单元804，用于调用所述第一加密单元对所述数据包进行加密处理；
发送单元805，用于将加密处理后的数据包发送至无线接入控制器。
可选的，识别单元802具体，用于通过所述物联网终端的标识来识别物联网终端的类型。
可选的，识别单元805具体，用于向物联网终端发送物联网终端类型表，接收物联网终端发送的依据所述物联网终端类型表查找出与自身匹配的物联网终端类型。
可选的，加密单元804具体，用于调用所述第一加密单元对所述数据包进行加密处理，如加密成功，进行后续步骤，如加密不成功，调用第一加密单元的备用加密单元对所述数据包进行加密处理，将采用备用加密单元标识添加到加密处理后的数据包的包头扩展字段。
可选的，加密单元804具体，用于生成密钥对，所述密钥对包括：公钥和私钥，采用公钥通过第一加密单元对数据包进行加密处理，所述发送单元，用于将加密处理后的数据包通过第一路径发送，将私钥通过第二路径发送。
参阅图9，图9为本发明提供的一种物联网接入点900，该物联网接入点可以为部署在互联网系统中的一个节点，互联网系统还可以包括：物联网终端和无线接入控制器，该物联网接入点900包括但不限于：计算机、服务器等设备，如图9所示，该物联网接入点900包括：处理器901、存储器902、收发器903和总线904。收发器903用于与外部设备(例如互联系统中的其他设备，包括但不限于：中继器，核心网设备等)之间收发数据。物联网接入点900中的处理器901的数量可以是一个或多个。本申请的一些实施例中，处理器901、存储器902和收发器903可通过总线系统或其他方式连接。关于本实施例涉及的术语的含义以及举例，可以参考图3或图6对应的实施例，此处不再赘述。
其中，存储器902中可以存储程序代码。处理器901用于调用存储器902中存储的程序代码，用于执行以下操作：
收发器903，用于接收物联网终端发送的数据包；
处理器901，用于识别所述物联网终端的类型，依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元，调用所述第一加密单元对所述数据包进行加密处理。
收发器903，还用于将加密处理后的数据包发送至无线接入控制器。
可选的，处理器901、收发器903，还可以用于执行如图3或如图6所示实施例中的步骤以及步骤的细化方案以及可选方案。
需要说明的是，这里的处理器901可以是一个处理元件，也可以是多个处理元件的统称。例如，该处理元件可以是中央处理器(Central Processing Unit，CPU)，也可以是特定集成电路(Application Specific Integrated Circuit，ASIC)，或者是被配置成实施本申请实施例的一个或多个集成电路，例如：一个或多个微处理器(digital singnal processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)。
存储器903可以是一个存储装置，也可以是多个存储元件的统称，且用于存储可执行程序代码或应用程序运行装置运行所需要参数、数据等。且存储器903可以包括随机存储器(RAM)，也可以包括非易失性存储器(non-volatile memory)，例如磁盘存储器，闪存(Flash)等。
总线904可以是工业标准体系结构(Industry Standard Architecture，ISA)总线、外部设备互连(Peripheral Component，PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
该用户设备还可以包括输入输出装置，连接于总线904，以通过总线与处理器901等其它部分连接。该输入输出装置可以为操作人员提供一输入界面，以便操作人员通过该输入界面选择布控项，还可以是其它接口，可通过该接口外接其它设备。
需要说明的是，对于前述的各个方法实施例，为了简单描述，故将其都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某一些步骤可以采用其他顺序或者同时 进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详细描述的部分，可以参见其他实施例的相关描述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：闪存盘、只读存储器(英文：Read-Only Memory，简称：ROM)、随机存取器(英文：Random Access Memory，简称：RAM)、磁盘或光盘等。
以上对本申请实施例所提供的内容下载方法及相关设备、系统进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (10)

  1. 一种物联网接入点基于类型的上行数据加密控制方法，其特征在于，所述方法包括如下步骤：
    所述物联网接入点接收物联网终端发送的数据包；
    所述物联网接入点识别所述物联网终端的类型，依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元；
    所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理；
    所述物联网接入点将加密处理后的数据包发送至无线接入控制器。
  2. 根据权利要求1所述的方法，其特征在于，所述物联网接入点识别所述物联网终端的类型具体，包括：
    所述物联网接入点通过所述物联网终端的标识来识别物联网终端的类型。
  3. 根据权利要求1所述的方法，其特征在于，所述物联网接入点识别所述物联网终端的类型具体，包括：
    所述物联网接入点向物联网终端发送物联网终端类型表，
    所述物联网接入点接收物联网终端发送的依据所述物联网终端类型表查找出与自身匹配的物联网终端类型。
  4. 根据权要求1所述的方法，其特征在于，所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理具体，包括：
    所述物联网接入点调用所述第一加密单元对所述数据包进行加密处理，如加密成功，进行后续步骤，如加密不成功，所述物联网接入点调用第一加密单元的备用加密单元对所述数据包进行加密处理，将采用备用加密单元标识添加到加密处理后的数据包的包头扩展字段。
  5. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述物联网接入点生成密钥对，所述密钥对包括：公钥和私钥，所述物联网接入点采用公钥通过第一加密单元对数据包进行加密处理，将加密处理后的数据包通过第一路径发送，将私钥通过第二路径发送。
  6. 一种物联网接入点基于类型的上行数据加密控制装置，其特征在于，所述装置包括：
    接收单元，用于接收物联网终端发送的数据包；
    识别单元，用于识别所述物联网终端的类型；
    查找单元，用于依据所述类型在预先配置的类型与加密单元映射表中查询出所述类型对应的第一加密单元；
    加密单元，用于调用所述第一加密单元对所述数据包进行加密处理；
    发送单元，用于将加密处理后的数据包发送至无线接入控制器。
  7. 根据权利要求6所述的装置，其特征在于，所述识别单元具体，用于通过所述物联网终端的标识来识别物联网终端的类型。
  8. 根据权利要求6所述的装置，其特征在于，所述识别单元具体，用于向物联网终端发送物联网终端类型表，接收物联网终端发送的依据所述物联网终端类型表查找出与自身匹配的物联网终端类型。
  9. 根据权要求6所述的装置，其特征在于，所述加密单元具体，用于调用所述第一加密单元对所述数据包进行加密处理，如加密成功，进行后续步骤，如加密不成功，调用第一加密单元的备用加密单元对所述数据包进行加密处理，将采用备用加密单元标识添加到加密处理后的数据包的包头扩展字段。
  10. 根据权利要求6所述的装置，其特征在于，所述加密单元具体，用于生成密钥对，所述密钥对包括：公钥和私钥，采用公钥通过第一加密单元对数据包进行加密处理，所述发送单元，用于将加密处理后的数据包通过第一路径发送，将私钥通过第二路径发送。
PCT/CN2016/103371 2016-09-20 2016-10-26 物联网接入点基于类型的上行数据加密控制方法及装置 WO2018053895A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610834313.6 2016-09-20
CN201610834313.6A CN107846683A (zh) 2016-09-20 2016-09-20 物联网接入点基于类型的上行数据加密控制方法及装置

Publications (1)

Publication Number Publication Date
WO2018053895A1 true WO2018053895A1 (zh) 2018-03-29

Family

ID=61657323

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/103371 WO2018053895A1 (zh) 2016-09-20 2016-10-26 物联网接入点基于类型的上行数据加密控制方法及装置

Country Status (2)

Country Link
CN (1) CN107846683A (zh)
WO (1) WO2018053895A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113448744A (zh) * 2020-03-26 2021-09-28 大唐移动通信设备有限公司 一种应用程序选择方法及装置
CN114666173A (zh) * 2022-05-26 2022-06-24 广州万协通信息技术有限公司 基于中间设备的物联网信息传输方法及装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111800498A (zh) * 2020-06-30 2020-10-20 联想(北京)有限公司 一种数据传输方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101378345A (zh) * 2007-08-28 2009-03-04 巴比禄股份有限公司 无线局域网接入点
CN104394143A (zh) * 2014-11-24 2015-03-04 青岛海尔软件有限公司 一种物联网设备与物联网服务器通信方法及装置
CN104579627A (zh) * 2014-12-06 2015-04-29 上海移远通信技术有限公司 一种数据加密方法及系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102012214794A1 (de) * 2012-08-21 2014-02-27 BSH Bosch und Siemens Hausgeräte GmbH Kommunikationsmodul für ein hausgerät
CN103647762B (zh) * 2013-11-27 2016-08-17 清华大学 基于访问路径的IPv6物联网节点身份认证方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101378345A (zh) * 2007-08-28 2009-03-04 巴比禄股份有限公司 无线局域网接入点
CN104394143A (zh) * 2014-11-24 2015-03-04 青岛海尔软件有限公司 一种物联网设备与物联网服务器通信方法及装置
CN104579627A (zh) * 2014-12-06 2015-04-29 上海移远通信技术有限公司 一种数据加密方法及系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113448744A (zh) * 2020-03-26 2021-09-28 大唐移动通信设备有限公司 一种应用程序选择方法及装置
CN113448744B (zh) * 2020-03-26 2023-08-01 大唐移动通信设备有限公司 一种应用程序选择方法及装置
CN114666173A (zh) * 2022-05-26 2022-06-24 广州万协通信息技术有限公司 基于中间设备的物联网信息传输方法及装置

Also Published As

Publication number Publication date
CN107846683A (zh) 2018-03-27

Similar Documents

Publication Publication Date Title
US11647548B2 (en) Network access method, device, and system
US11758399B2 (en) Wireless local area network configuration using probe request frame having authentication information
WO2018120247A1 (zh) 一种终端匹配方法、装置
WO2019019018A1 (zh) 智能设备控制方法、控制装置及控制系统
WO2019011203A1 (zh) 设备接入方法、设备及系统
CN103581062A (zh) 用于处理未知单播数据包的方法和系统
CN112566113B (zh) 密钥生成以及终端配网方法、装置、设备
WO2018053894A1 (zh) 物联网基于传输速率的接入点切换方法及装置
WO2018050041A1 (zh) 参数配置方法、装置及系统
WO2019041371A1 (zh) 物联网基于连接数量的路由器切换方法及装置
JP5551805B2 (ja) インターネットにアクセスする方法および装置
WO2018053895A1 (zh) 物联网接入点基于类型的上行数据加密控制方法及装置
WO2023179715A1 (zh) 数据通道构建方法及装置
WO2019019282A1 (zh) 物联网终端数据的按顺序加密方法及装置
JP2016208513A (ja) 中継方法並びに対応する通信ネットワークデバイス、システム、コンピュータプログラム及びコンピュータ可読記憶媒体
WO2019019280A1 (zh) 物联网终端数据的分时段加密方法及装置
WO2022183350A1 (zh) 物联网设备配网方法、终端设备和物联网设备
WO2019010793A1 (zh) 物联网接入点接收数据的分时段加密方法及装置
WO2019015041A1 (zh) 一种物联网中继器数据的分时段加密方法及装置
CN107493571B (zh) 物联网中继器基于类型的上行数据加密控制方法及装置
WO2019010796A1 (zh) 物联网ap接收数据的分设备加密方法及装置
WO2019019279A1 (zh) 物联网终端基于类型的上行数据加密控制方法及装置
WO2019015039A1 (zh) 一种基于物联网中继器的选择加密方法及装置
WO2019019287A1 (zh) 一种物联网终端数据的随机加密方法及装置
WO2019015037A1 (zh) 一种基于物联网接入点的选择加密方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16916634

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16916634

Country of ref document: EP

Kind code of ref document: A1