WO2018233041A1 - 一种基于位置的物联网数据加密方法及系统 - Google Patents

一种基于位置的物联网数据加密方法及系统 Download PDF

Info

Publication number
WO2018233041A1
WO2018233041A1 PCT/CN2017/100001 CN2017100001W WO2018233041A1 WO 2018233041 A1 WO2018233041 A1 WO 2018233041A1 CN 2017100001 W CN2017100001 W CN 2017100001W WO 2018233041 A1 WO2018233041 A1 WO 2018233041A1
Authority
WO
WIPO (PCT)
Prior art keywords
access device
terminal device
location information
data packet
key generation
Prior art date
Application number
PCT/CN2017/100001
Other languages
English (en)
French (fr)
Inventor
杜光东
Original Assignee
深圳市盛路物联通讯技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市盛路物联通讯技术有限公司 filed Critical 深圳市盛路物联通讯技术有限公司
Publication of WO2018233041A1 publication Critical patent/WO2018233041A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/52—Network services specially adapted for the location of the user terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/025—Services making use of location information using location based information parameters

Definitions

  • the present invention relates to the field of Internet of Things technologies, and in particular, to a location-based method and system for encrypting Internet of Things data.
  • the Internet of Things system manages a large number of terminal devices. Because the terminal devices are scattered in various places and have a wide distribution range, they are weak nodes in the Internet of Things system and are also a potential security hazard. Users have higher data security requirements for the Internet of Things.
  • the commonly used Internet of Things encryption method in the market adopts an encryption algorithm in the terminal device and the aggregation unit.
  • the encryption algorithm includes a symmetric encryption algorithm and an asymmetric encryption algorithm.
  • the encryption key and the decryption key are the same.
  • the encryption key and the decryption key are paired keys, and the two encryption algorithms are relatively easy to crack, which reduces the security and reliability of the Internet of Things data transmission.
  • the embodiment of the invention discloses a location-based IoT data encryption method and system, and abandon the traditional encryption method, which is used to solve the problem that the existing Internet of Things encryption algorithm is easily cracked, resulting in low data transmission security and reliability. Provides a highly secure data communication link for data transmission, improving the security and reliability of data transmission.
  • a first aspect of the present invention discloses a location-based IoT data encryption method, which may include:
  • the aggregation unit sets a key generation algorithm, and packages the key generation algorithm together with the location information of the convergence unit to be sent to the access device;
  • the access device receives the key generation algorithm and location information of interest to the aggregation unit, saves the key generation algorithm and location information of interest to the aggregation unit, and writes the key generation algorithm Entering into the terminal device whose location information in the coverage of the wireless network matches the location information of interest to the convergence unit;
  • the access device determines that the location information of the terminal device matches the location information of the aggregation unit, the access device obtains the unique serial number of the access device, and uses the unique serial number of the access device. And generating, according to the saved key generation algorithm, second authentication information;
  • the access device performs authentication and encryption on the first data packet to obtain a second data packet, and sends the second data packet to the convergence unit.
  • the access device performs authentication and encryption on the first data packet to obtain second data, based on the second authentication information.
  • the method further includes:
  • the aggregation unit receives the second data packet sent by the access device
  • the aggregation unit generates, according to the stored unique serial number of the access device, the first verification information, based on the key generation algorithm, and performs authentication and decryption on the second data packet according to the first verification information. Obtaining the first data packet;
  • the aggregation unit generates, according to the stored unique serial number of the terminal device, the second verification information, based on the key generation algorithm, and performs authentication and decryption on the first data packet according to the second verification information. Obtaining the data to be sent.
  • the access device matches the location information that is interested in the convergence unit by writing the key generation algorithm into the coverage of the wireless network.
  • the method further includes:
  • the access device broadcasts a listening message within its wireless network coverage after writing the key generation algorithm to a terminal device whose location information in the wireless network coverage matches the location information of interest to the convergence unit ;
  • the access device acquires location information of the new terminal device when it is determined that the new terminal device is accessed within the coverage of the wireless network;
  • the access device determines whether the location information of the new terminal device matches the location information of the convergence unit
  • the access device writes the key generation algorithm into the new terminal device when determining that the location information of the new terminal device matches the location information of the aggregation unit.
  • the access device determines, when the location information of the new terminal device matches the location information of the convergence unit, Before the key generation algorithm is written in the new terminal device, the method further includes:
  • the access device performs the step of writing the key generation algorithm into the new terminal device when determining that the key generation algorithm is in an expiration date.
  • the access device sends the second data packet to the convergence unit, including:
  • the access device determines, by using a frequency hopping manner, a frequency domain location of a physical resource block used to send the second data packet from a target transmission frequency band;
  • the access device sends the second data packet to the aggregation unit on a time-frequency resource corresponding to a frequency domain location of the determined physical resource block.
  • a second aspect of the present invention discloses a location-based Internet of Things data encryption system, which may include:
  • a convergence unit configured to set a key generation algorithm, and package the key generation algorithm together with the location information of the aggregation unit and send the information to the access device;
  • the access device is configured to receive the key generation algorithm and location information of interest by the aggregation unit, save the key generation algorithm and location information of interest by the aggregation unit, and save the key Generating an algorithm into a terminal device whose location information in the coverage of the wireless network matches location information of interest to the aggregation unit;
  • the terminal device is further configured to acquire data to be sent and a unique serial number of the terminal device, and generate a first authentication based on the unique key number of the terminal device, based on the key generation algorithm.
  • the information, and the data to be sent are encrypted and encrypted according to the first authentication information to obtain a first data packet;
  • the terminal device is further configured to send the first data packet to the access device;
  • the access device is further configured to: according to the first data packet, identify whether the location information of the terminal device matches the location information of the convergence unit;
  • the access device is further configured to: when determining that the location information of the terminal device matches the location information of the convergence unit, obtain a unique serial number of the access device, where the access device is Based on the unique serial number, the second authentication information is generated based on the saved key generation algorithm;
  • the access device is further configured to perform authentication and encryption on the first data packet by using the second authentication information to obtain a second data packet, and send the second data packet to the Said aggregation unit.
  • the aggregation unit is further configured to receive the second data packet sent by the access device;
  • the aggregation unit is further configured to generate, according to the stored unique serial number of the access device, the first verification information, based on the key generation algorithm, and the second data packet according to the first verification information. Performing authentication and decryption to obtain the first data packet;
  • the aggregation unit is further configured to generate, according to the stored unique serial number of the terminal device, the second verification information, based on the key generation algorithm, and perform the first data packet according to the second verification information.
  • the decryption is performed to obtain the data to be transmitted.
  • the access device is further configured to: when the key generation algorithm is written into the coverage of the wireless network, the location information is interested in matching the convergence unit. After the location information in the terminal device, broadcast a listening message within its wireless network coverage;
  • the access device is further configured to receive a response message that is sent by the terminal device in the coverage of the wireless network to the interception message;
  • the access device is further configured to determine, according to the response message, whether a new terminal device is accessed within a coverage of the wireless network;
  • the access device is further configured to acquire location information of the new terminal device when the new terminal device is accessed within the coverage of the wireless network;
  • the access device is further configured to determine whether the location information of the new terminal device matches the location information of the convergence unit;
  • the access device is further configured to write the key generation algorithm into the new terminal device when determining that location information of the new terminal device matches location information of interest by the aggregation unit.
  • the access device is further configured to: when determining that the location information of the new terminal device matches the location information of the convergence unit, Determining whether the key generation algorithm is in an expiration date;
  • the access device is further configured to perform writing the key generation algorithm into the new terminal device when determining that the key generation algorithm is in an expiration date.
  • the manner in which the access device is further configured to send the second data packet to the convergence unit is specifically:
  • the access device is further configured to determine, by using a frequency hopping manner, a frequency domain location of a physical resource block used to send the second data packet from a target transmission frequency band, where the frequency domain location of the determined physical resource block corresponds to Sending, by the frequency resource, the second data packet to the aggregation unit.
  • the embodiment of the invention has the following beneficial effects:
  • the aggregation unit sets a key generation algorithm for generating the authentication information, and the key generation algorithm and the location information of the aggregation unit are packaged and sent together to the access device, and the access device saves the The key generation algorithm and the location information of the aggregation unit are interested, and within the coverage of the wireless network, the key generation algorithm is written into the terminal device corresponding to the location information of interest to the aggregation unit. After the key generation algorithm is written, the terminal device generates the first authentication information based on the unique sequence number, generates the first authentication information based on the key generation algorithm, and performs authentication and encryption on the data to be sent by using the first authentication information to obtain the first The packet is then sent to the access device.
  • the access device After receiving the first data packet, the access device generates the second authentication information based on the saved key generation algorithm based on the unique unique sequence number, and authenticates the first data packet by using the second authentication information. Encrypt, obtain a second data packet, and then send the second data packet to the aggregation unit.
  • the terminal device that specifies the location information by the aggregation unit generates the authentication information by using the key generation algorithm given by the aggregation unit, and the factor for generating the authentication information is the unique serial number of the device. Since the unique serial number of each device is unique, the generated authentication information is also different, and each device encrypts the data in the entire data communication link, providing a data transmission. A highly secure data communication link improves the security and reliability of data transmission.
  • FIG. 1 is a schematic diagram of an Internet of Things architecture disclosed by some embodiments of the present invention.
  • FIG. 2 is a schematic flowchart of a location-based IoT data encryption method according to an embodiment of the present invention
  • FIG. 3 is another schematic flowchart of a location-based IoT data encryption method according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a location-based Internet of Things data encryption system according to an embodiment of the present invention.
  • the embodiment of the invention discloses a location-based IoT data encryption method, which is used for providing a high-security data communication link for data transmission, thereby improving the security and reliability of data transmission.
  • the embodiment of the invention also correspondingly discloses a location-based Internet of Things data encryption system.
  • FIG. 1 is a schematic diagram of an Internet of Things architecture disclosed in some embodiments of the present invention. It should be noted that FIG. 1 is only some implementations of the present invention. The schematic diagram of the disclosed Internet of Things architecture, and other schematic diagrams obtained by optimizing or deforming on the basis of FIG. 1 are all within the scope of protection of the present invention, and are not exemplified herein.
  • the IoT architecture shown in FIG. 1 may include three layers of a terminal device layer, an access device layer, and an aggregation layer according to functions.
  • the terminal device layer may include a mass-scale terminal device, such as a hygrometer, a smoke sensor, a ventilation device, a rain sensor, an irrigation valve, etc.; the access device layer may include a large number of access devices connected to the network, and the access device The device may include a router, a repeater, an access point, and the like, which are not limited in the embodiment of the present invention; the access device may use any standard networking protocol, and the access device may implement data parsing between different network standards; The layer may include a convergence unit, and the aggregation unit may perform high-level management on each access device of the access device layer, thereby implementing control of data transmission frequency, network topology, and other networking functions; the aggregation unit may not only generate objects for the mass terminal device.
  • a mass-scale terminal device such as a hygrometer, a smoke sensor, a ventilation device, a rain sensor, an irrigation valve, etc.
  • the access device layer may include a large number of access devices connected to the network,
  • Networked data for analysis and decision making can also be used to obtain information or configure terminal device parameters (where data is transmitted to the terminal device); the aggregation unit can also introduce various services, from big data to social networks, and even from social The tool "likes" to weather sharing and more.
  • each access device can provide IoT data receiving and receiving services for a large number of terminal devices within its own wireless network coverage, wherein each access device has its own wireless network coverage.
  • Each terminal device can have a built-in wireless communication module, which enables each access device to communicate wirelessly with each terminal device within its own wireless network coverage via wireless network communication.
  • the wireless communication module built into the terminal device can input the upper frequency point 470MHz and the lower frequency point 510MHz during production, so that the wireless communication module can automatically define the communication frequency band as 470MHz ⁇ 510MHz, It complies with the provisions of China's SRRC standard; alternatively, it can input the upper frequency point of 868MHz and the lower frequency point of 908MHz, so that the wireless communication module can automatically define the communication frequency band as 868MHz to 908MHz to comply with the European ETSI standard; or, you can enter The frequency is 918MHz and the lower frequency is 928MHz, so the wireless communication module can automatically define the communication frequency band as 918MHz ⁇ 928MHz to meet the requirements of the US FCC standard.
  • the communication frequency band of the wireless communication module can also be defined as conforming to the Japanese ARIB standard or Canada.
  • the specification of the IC standard is not limited in the embodiment of the present invention.
  • the terminal equipment can adopt Frequency Division Multiple Access (FDMA) and frequency hopping. (Frequency-Hopping Spread Spectrum, FHSS), Dynamic Time Division Multiple Access (DTDMA), and Backtracking Multiplexing (CSMA) are combined to solve the interference problem.
  • FDMA Frequency Division Multiple Access
  • FHSS Frequency-Hopping Spread Spectrum
  • DTDMA Dynamic Time Division Multiple Access
  • CSMA Backtracking Multiplexing
  • FIG. 2 is a schematic flowchart of a location-based IoT data encryption method according to an embodiment of the present invention. As shown in FIG. 2, a location-based IoT data encryption method may include:
  • the aggregation unit sets a key generation algorithm, and packages the key generation algorithm and the location information of interest of the aggregation unit together and sends the information to the access device.
  • the aggregation unit needs to strengthen the security of the data sent by the terminal device at this location for the location information of interest (the location of the terminal device for collecting important data can be set). Further, in the embodiment of the present invention, the aggregation unit may set a corresponding encryption algorithm for the terminal devices at these locations.
  • a key generation algorithm is provided. The key generation algorithm uses the unique serial number of the device as a factor, and generates authentication information for authentication and encryption.
  • the access device receives the key generation algorithm and the location information of interest of the aggregation unit, saves the key generation algorithm and the location information of interest of the aggregation unit, and writes the key generation algorithm to the location information matching in the coverage of the wireless network.
  • the terminal device of the location information of interest to the aggregation unit receives the key generation algorithm and the location information of interest of the aggregation unit, saves the key generation algorithm and the location information of interest of the aggregation unit, and writes the key generation algorithm to the location information matching in the coverage of the wireless network.
  • the access device writes the key generation algorithm to the terminal device in the location information of the wireless network coverage that matches the location information of the convergence unit, including: the access device determines the wireless device. A terminal device that matches location information of interest to the aggregation unit within the network coverage, and then sends the key generation algorithm to the corresponding terminal device for automatic writing or saving.
  • the terminal device obtains the to-be-transmitted data and the unique serial number of the terminal device, and generates the first authentication information based on the key generation algorithm based on the unique serial number of the terminal device, and sends the first authentication information based on the first authentication information.
  • the data is authenticated and encrypted to obtain a first data packet.
  • the terminal device sends the first data packet to the access device.
  • the sending, by the terminal device, the first data packet to the access device includes: acquiring, by the terminal device, a target transmission frequency band, and then determining a time-frequency resource corresponding to the target transmission frequency band, and performing the direct connection on the time-frequency resource.
  • the incoming device sends the first data packet.
  • the aggregation unit may specify a time point for reporting the data to the terminal device, and send the time point of reporting the data to the terminal device by the access device, so that the terminal device can set the time point at which the data is reported.
  • the sending, by the terminal device, the first data packet to the access device includes: detecting, by the terminal device, the current system time, determining whether the current system time reaches the time of reporting the data specified by the aggregation unit, and reaching the report specified by the convergence unit at the current system time. At the time of the number, the first data packet is sent to the access device.
  • the sending, by the terminal device, the first data packet to the access device includes: detecting, by the terminal device, a current system time, determining whether the current system time reaches a time point for reporting the data specified by the aggregation unit, where When the system time reaches the time point of the number of reports specified by the aggregation unit, the target transmission band is obtained, and then the time-frequency resource corresponding to the target transmission band is determined, and the first data packet is sent to the access device on the time-frequency resource.
  • the access device identifies, according to the first data packet, whether the location information of the terminal device matches the location information of interest of the convergence unit. If the result of the determination is a match, the process proceeds to step 206. When the result of the determination is a mismatch, the first data packet is directly sent to the convergence unit.
  • the terminal device carries the location information of the terminal device in the first data packet, and the access device extracts the location information from the first data packet, and uses the extracted location information as the location information of the terminal device; or
  • the terminal device carries the device identifier in the first data packet, and after receiving the first data packet, the access device extracts the device identifier from the first data packet, and uses the device identifier as a keyword index to be managed by the access device.
  • the location information corresponding to the device identifier is searched in the terminal device information table, and the location information that is found is used as the location information of the terminal device.
  • the access device obtains the unique serial number of the access device, and generates the second authentication information based on the saved key generation algorithm based on the unique serial number of the access device.
  • the access device performs authentication and encryption on the first data packet to obtain a second data packet, and sends the second data packet to the convergence unit.
  • the access device sends the second data packet to the aggregation unit, where the access device determines, by using a frequency hopping manner, a frequency domain of the physical resource block used to send the second data packet from the target transmission frequency band. a location, where the second data packet is sent to the aggregation unit on the time-frequency resource corresponding to the determined frequency domain location of the physical resource block.
  • the access device performs authentication and encryption on the first data packet to obtain the second data packet, and sends the second data packet to the convergence unit.
  • the embodiment of the invention further includes:
  • the aggregation unit receives the second data packet sent by the access device
  • the aggregation unit generates the first verification information based on the unique serial number of the stored access device, and performs authentication and decryption on the second data packet according to the first verification information to obtain the first data packet.
  • the aggregation unit generates the second verification information based on the unique serial number of the stored terminal device, and performs authentication and decryption on the first data packet according to the second verification information to obtain data to be sent.
  • the aggregation unit can generate verification information and verify and decrypt the data packet according to the key generation algorithm by using the unique serial number of the device as a factor.
  • the aggregation unit generates the first verification information based on the unique sequence number of the stored access device, generates a first verification information according to the key generation algorithm, and performs authentication and decryption on the second data packet according to the first verification information to obtain the first data packet.
  • the aggregation unit generates first verification information based on the unique serial number of the access device, based on the key generation algorithm, and uses the first verification information to verify whether the second authentication information used for authenticating and encrypting the first data packet is correct. And when the judgment result is correct, the first data packet is obtained by decryption;
  • the aggregation unit sends a verification failure notification to the access device.
  • the aggregation unit generates the second verification information based on the unique serial number of the stored terminal device, generates a second verification information based on the key generation algorithm, and performs authentication and decryption on the first data packet according to the second verification information to obtain data to be sent, including:
  • the aggregation unit generates second verification information based on the unique serial number of the terminal device based on the key generation algorithm, and uses the second verification information to verify whether the first authentication information used for authentication and encryption of the data to be sent is correct, and is determined When the result is correct, the data to be sent is obtained by decryption;
  • the aggregation unit sends a verification failure notification to the access device.
  • the failure notification is sent in the verification failure to notify the access device and the terminal device.
  • the aggregation unit sets a key generation algorithm for generating authentication information
  • the key generation algorithm and the location information of the aggregation unit are packaged and sent together to the access device, and the access device saves the key generation algorithm and the location information of interest of the aggregation unit, and within the coverage of the wireless network,
  • the key generation algorithm is written into the terminal device corresponding to the location information of interest to the aggregation unit.
  • the terminal device After the key generation algorithm is written, the terminal device generates the first authentication information based on the unique sequence number, generates the first authentication information based on the key generation algorithm, and performs authentication and encryption on the data to be sent by using the first authentication information to obtain the first
  • the packet is then sent to the access device.
  • the access device After receiving the first data packet, the access device generates the second authentication information based on the saved key generation algorithm based on the unique unique sequence number, and authenticates the first data packet by using the second authentication information. Encrypt, obtain a second data packet, and then send the second data packet to the aggregation unit.
  • the terminal device that specifies the location information by the aggregation unit generates the authentication information by using the key generation algorithm given by the aggregation unit, and the factor for generating the authentication information is the unique serial number of the device. Since the unique serial number of each device is unique, the generated authentication information is also different, and each device encrypts the data in the entire data communication link, providing a security comparison for data transmission. High data communication links improve the security and reliability of data transmission.
  • FIG. 3 is another schematic flowchart of a location-based IoT data encryption method according to an embodiment of the present invention. As shown in FIG. 3, a location-based IoT data encryption method may include:
  • the aggregation unit sets a key generation algorithm, and packages the key generation algorithm and the location information of interest of the aggregation unit together and sends the information to the access device.
  • the access device receives the key generation algorithm and the location information of interest of the aggregation unit, saves the key generation algorithm and the location information of interest of the aggregation unit, and writes the key generation algorithm to the location information matching in the coverage of the wireless network.
  • the terminal device of the location information of interest to the aggregation unit receives the key generation algorithm and the location information of interest of the aggregation unit, saves the key generation algorithm and the location information of interest of the aggregation unit, and writes the key generation algorithm to the location information matching in the coverage of the wireless network.
  • the access device After the access device writes the key generation algorithm into the terminal device whose location information matches the location information of the convergence unit in the coverage of the wireless network, the access device broadcasts the interception message within its wireless network coverage.
  • the access device After receiving the key generation algorithm sent by the aggregation unit and the location information of the convergence unit, the access device writes the key generation algorithm to the location information of the location information matching the convergence unit in the coverage area of the wireless network. In the terminal device, afterwards, a listening message is broadcasted within its wireless network coverage to intercept the accessed new terminal device in real time.
  • the access device also broadcasts a listening message within its wireless network coverage to listen to the terminal device that is not online for a long time to update the routing table in real time.
  • the access device receives, by the terminal device in the coverage of the wireless network, a response message for the feedback of the interception message.
  • the access device determines, according to the response message, whether the new terminal device is accessed within the coverage of the wireless network. When the determination result is YES, the process proceeds to step 306; when the determination result is negative, the process ends.
  • the access device acquires location information of the new terminal device when determining that the new terminal device is accessed within the coverage of the wireless network.
  • the access device determines whether the location information of the new terminal device matches the location information of interest of the aggregation unit. When the determination result is YES, the process proceeds to step 306; when the determination result is negative, the process ends.
  • the access device writes a key generation algorithm into the new terminal device when determining that the location information of the new terminal device matches the location information of the convergence unit.
  • the access device implements the method before determining that the location information of the new terminal device matches the location information of the convergence unit, and before the key generation algorithm is written into the new terminal device. Examples also include:
  • the access device determines that the location information of the new terminal device matches the location information of interest of the aggregation unit, determining whether the key generation algorithm is in an expiration date;
  • the access device performs the step of writing the key generation algorithm into the new terminal device when it is determined that the key generation algorithm is in the validity period.
  • the aggregation unit writes the validity period in the key generation algorithm, and during the validity period, the access device may send the key generation algorithm to the new terminal device, so that the new terminal device can generate the template according to the key generation algorithm.
  • the access device after receiving the key generation algorithm sent by the aggregation unit and the location information of the convergence unit, the access device writes the key generation algorithm to the matching aggregation unit in the coverage of the wireless network.
  • the terminal device of the location information of interest after which the real-time interception of the wireless network coverage is performed, and when the new terminal device is heard, the key generation algorithm is written into the new terminal device, so that the new terminal device can generate according to the key
  • the algorithm generates authentication information for encrypting and encrypting data
  • the access device can also generate authentication information for encrypting and encrypting data according to the key generation algorithm. To improve data security in the data transmission link.
  • FIG. 4 is a schematic structural diagram of a location-based Internet of Things data encryption system according to an embodiment of the present invention. As shown in FIG. 4, a location-based Internet of Things data encryption system may include:
  • the aggregation unit 410 is configured to set a key generation algorithm, and package the key generation algorithm together with the location information of the convergence unit 410 and send it to the access device 420;
  • the access device 420 is configured to receive the key generation algorithm and the location information of interest by the convergence unit 410, save the key generation algorithm and the location information of interest by the aggregation unit 410, and write the key generation algorithm to its wireless network coverage.
  • the internal location information is matched in the terminal device 430 of the location information of interest to the convergence unit 410;
  • the terminal device 430 is further configured to acquire the data to be sent and the unique serial number of the terminal device 430, based on the unique serial number of the terminal device 430, generate the first authentication information based on the key generation algorithm, and use the first authentication information. Based on the authentication, the data to be sent is encrypted and encrypted to obtain a first data packet;
  • the terminal device 430 is further configured to send the first data packet to the access device 420;
  • the access device 420 is further configured to: according to the first data packet, identify whether the location information of the terminal device 430 matches the location information of interest by the convergence unit 410;
  • the access device 420 is further configured to acquire the unique serial number of the access device 420 when the location information of the terminal device 430 is matched with the location information of the convergence unit 410, based on the unique serial number of the access device 420. Generating second authentication information based on the saved key generation algorithm;
  • the access device 420 is further configured to perform authentication and encryption on the first data packet to obtain the second data packet, and send the second data packet to the convergence unit 410.
  • the terminal device 430 carries the location information of the terminal device 430 in the first data packet, and the access device 420 extracts the location information from the first data packet, and uses the extracted location information as the location information of the terminal device 430; or
  • the terminal device 430 carries the device identifier in the first data packet, and after receiving the first data packet, the access device 420 extracts the device identifier from the first data packet, and uses the device identifier as a key index, and the slave device
  • the location information corresponding to the device identifier is searched in the terminal device information table managed by the 420, and the location information that is found is used as the location information of the terminal device 430.
  • the access device 420 is configured to write the key generation algorithm into the terminal device 430 of the location information of the location information matching the convergence unit 410 in the coverage of the wireless network, specifically:
  • the ingress device 420 is configured to determine the terminal device 430 within its wireless network coverage that matches the location information of interest to the aggregation unit 410, and then transmits the key generation algorithm to the corresponding terminal device 430 for automatic writing or saving.
  • the terminal device 430 is further configured to send the first data packet to the access device 420, where the terminal device 430 is further configured to acquire a target transmission frequency band, and then determine a target transmission frequency band corresponding to the target transmission frequency band.
  • the time-frequency resource sends the first data packet to the access device 420 on the time-frequency resource.
  • the aggregation unit 410 may specify the time point of reporting the data to the terminal device 430, and send the time point of reporting the data to the terminal device 430 through the access device 420, so that the terminal device 430 can set it. The point in time when the data is reported.
  • the manner in which the terminal device 430 is further configured to send the first data packet to the access device 420 is specifically: the terminal device 430 is further configured to detect the current system time, and determine whether the current system time reaches the time for reporting the data specified by the convergence unit 410. The first data packet is sent to the access device 420 when the current system time reaches the time point of the number of reports specified by the aggregation unit 410.
  • the manner in which the terminal device 430 is configured to send the first data packet to the access device 420 is specifically: the terminal device 430 detects the current system time, and determines whether the current system time reaches the specified by the convergence unit 410. When the current system time reaches the time point of the number of reports specified by the aggregation unit 410, the target transmission band is obtained, and then the time-frequency resource corresponding to the target transmission band is determined, and the time-frequency resource is transmitted to the access device 420. Send the first data packet.
  • the aggregation unit 410 is further configured to receive the second data packet sent by the access device 420.
  • the aggregation unit 410 is further configured to generate, according to the unique serial number of the stored access device 420, the first verification information according to the key generation algorithm, and perform authentication and decryption on the second data packet according to the first verification information to obtain the first a data packet;
  • the aggregation unit 410 is further configured to generate, according to the unique serial number of the stored terminal device 430, the second verification information according to the key generation algorithm, and the first data packet according to the second verification information. The right is decrypted to get the data to be sent.
  • the access device 420 is further configured to: perform authentication and encryption on the first data packet to obtain a second data packet, and send the second data packet to the second authentication information.
  • the aggregation unit 410 is further configured to receive the second data packet sent by the access device 420.
  • the aggregation unit 410 is further configured to generate, according to the unique serial number of the stored access device 420, the first verification information by using a key generation algorithm, and perform authentication and decryption on the second data packet according to the first verification information to obtain the first data pack;
  • the aggregation unit 410 is further configured to generate second verification information based on the unique serial number of the stored terminal device 430, and perform authentication and decryption on the first data packet according to the second verification information to obtain data to be sent. .
  • the convergence unit 410 can generate verification information and verify and decrypt the data packet according to the key generation algorithm by using the unique serial number of the device as a factor.
  • the access device 420 is further configured to: after the key generation algorithm is written in the terminal device 430 whose location information matches the location information of the convergence unit 410 in the coverage of the wireless network, Broadcast listening messages within the coverage of the wireless network;
  • the access device 420 is further configured to receive, by the terminal device 430 in the coverage of the wireless network, a response message for the feedback of the interception message;
  • the access device 420 is further configured to determine, according to the response message, whether the new terminal device 430 is accessed within the coverage of the wireless network;
  • the access device 420 is further configured to acquire location information of the new terminal device 430 when it is determined that the new terminal device 430 is accessed within the coverage of the wireless network;
  • the access device 420 is further configured to determine whether the location information of the new terminal device 430 matches the location information of interest by the convergence unit 410.
  • the access device 420 is further configured to write a key generation algorithm into the new terminal device 430 when it is determined that the location information of the new terminal device 430 matches the location information of interest by the aggregation unit 410.
  • the access device 420 is further configured to: determine, when the location information of the new terminal device 430 matches the location information of the convergence unit 410, whether the key generation algorithm is in an expiration date;
  • the access device 420 is further configured to perform the key when determining that the key generation algorithm is in the validity period
  • the generation algorithm is written into the new terminal device 430.
  • the manner in which the access device 420 is further configured to send the second data packet to the convergence unit 410 is specifically:
  • the access device 420 is further configured to determine, by using a frequency hopping manner, a frequency domain location of the physical resource block used to send the second data packet from the target transmission frequency band, where the frequency domain location of the determined physical resource block corresponds to the time frequency resource. Sending a second data packet to the aggregation unit 410.
  • the terminal device that specifies the location information by the aggregation unit generates the authentication information by using the key generation algorithm given by the aggregation unit, and the factor for generating the authentication information is the unique serial number of the device, because the unique sequence of each device The number is unique, the generated authentication information is also different, and each device in the entire data communication link is authenticated and encrypted, providing a highly secure data communication link for data transmission. Improve the security and reliability of data transmission.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • PROM Programmable Read-Only Memory
  • EPROM Erasable Programmable Read Only Memory
  • OTPROM One-Time Programmable Read-Only Memory
  • EEPROM Electronically-Erasable Programmable Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory

Abstract

本发明公开一种基于位置的物联网数据加密方法及系统，该方法包括：汇聚单元设置密钥生成算法，将密钥生成算法和汇聚单元感兴趣的位置信息发送给接入设备；接入设备将密钥生成算法写入位置信息匹配汇聚单元感兴趣的位置信息的终端设备中；终端设备根据唯一序列号，基于密钥生成算法生成第一鉴权信息，以第一鉴权信息对待发送数据进行鉴权加密获得第一数据包并发送给接入设备；接入设备识别终端设备的位置信息是否与汇聚单元感兴趣的位置信息相匹配，若是，根据接入设备的唯一序列号，基于密钥生成算法生成第二鉴权信息，以第二鉴权信息对第一数据包进行鉴权加密，获得第二数据包并发送给汇聚单元；提高数据传输的安全性和可靠性。

Description

一种基于位置的物联网数据加密方法及系统 技术领域
本发明涉及物联网技术领域，具体涉及一种基于位置的物联网数据加密方法及系统。
背景技术
物联网系统管理着海量终端设备，由于终端设备分散在各个地方，分布范围较广，是物联网系统中的薄弱节点，也是安全隐患较大的位置。而用户对物联网某些数据安全性要求也比较高。在市场上常用的物联网加密方式是在终端设备和汇聚单元中采用加密算法，该加密算法包括有对称加密算法和非对称加密算法，在对称加密算法中，加密密钥和解密密钥是相同的；在非对称加密算法中，加密密钥和解密密钥为配对的密钥，这两种加密算法都比较容易破解，降低了物联网数据传输的安全和可靠性。
发明内容
本发明实施例公开了一种基于位置的物联网数据加密方法及系统，摒弃传统的加密方式，用于解决现有物联网加密算法容易被破解，导致数据传输安全性和可靠性较低的问题，为数据传输提供安全性较高的数据通信链路，提高数据传输的安全和可靠性。
本发明第一方面公开了一种基于位置的物联网数据加密方法，可包括：
汇聚单元设置密钥生成算法，并将所述密钥生成算法和所述汇聚单元感兴趣的位置信息一起打包并发送给接入设备；
所述接入设备接收所述密钥生成算法和所述汇聚单元感兴趣的位置信息，保存所述密钥生成算法和所述汇聚单元感兴趣的位置信息，以及将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中；
所述终端设备获取待发送数据和所述终端设备的唯一序列号，以所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第一鉴权信息，以 及以所述第一鉴权信息为依据，对所述待发送数据进行鉴权加密，以获得第一数据包；
所述终端设备将所述第一数据包发送给所述接入设备；
所述接入设备根据所述第一数据包，识别所述终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
所述接入设备在确定出所述终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，获取所述接入设备的唯一序列号，以所述接入设备的唯一序列号为依据，基于保存的所述密钥生成算法生成第二鉴权信息；
所述接入设备以所述第二鉴权信息为依据，对所述第一数据包进行鉴权加密，以获得第二数据包，并将所述第二数据包发送给所述汇聚单元。
作为一种可选的实施方式，在本发明第一方面中，所述接入设备以所述第二鉴权信息为依据，对所述第一数据包进行鉴权加密，以获得第二数据包，并将所述第二数据包发送给所述汇聚单元之后，所述方法还包括：
所述汇聚单元接收所述接入设备发送的所述第二数据包；
所述汇聚单元以存储的所述接入设备的唯一序列号为依据，基于所述密钥生成算法生成第一验证信息，根据所述第一验证信息对所述第二数据包进行鉴权解密，以获得所述第一数据包；
所述汇聚单元以存储的所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第二验证信息，根据所述第二验证信息对所述第一数据包进行鉴权解密，以获得所述待发送数据。
作为一种可选的实施方式，在本发明第一方面中，所述接入设备在将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中之后，所述方法还包括：
所述接入设备在将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中之后，在其无线网络覆盖范围内广播侦听消息；
所述接入设备接收其无线网络覆盖范围内的终端设备针对所述侦听消息反馈的响应消息；
所述接入设备根据所述响应消息，判断其无线网络覆盖范围内是否接入 新终端设备；
所述接入设备在确定出其无线网络覆盖范围内接入有所述新终端设备时，获取所述新终端设备的位置信息；
所述接入设备判断所述新终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
所述接入设备在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，将所述密钥生成算法写入所述新终端设备中。
作为一种可选的实施方式，在本发明第一方面中，所述接入设备在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，以及将所述密钥生成算法写入所述新终端设备中之前，所述方法还包括：
所述接入设备在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，确定所述密钥生成算法是否处于有效期；
所述接入设备在确定出所述密钥生成算法处于有效期时，执行将所述密钥生成算法写入所述新终端设备中的步骤。
作为一种可选的实施方式，在本发明第一方面中，所述接入设备将所述第二数据包发送给所述汇聚单元，包括：
所述接入设备通过跳频方式从目标传输频段中确定用于发送所述第二数据包的物理资源块的频域位置；
所述接入设备在确定的物理资源块的频域位置所对应的时频资源上，向所述汇聚单元发送所述第二数据包。
本发明第二方面公开了一种基于位置的物联网数据加密系统，可包括：
汇聚单元，用于设置密钥生成算法，并将所述密钥生成算法和所述汇聚单元感兴趣的位置信息一起打包并发送给接入设备；
所述接入设备，用于接收所述密钥生成算法和所述汇聚单元感兴趣的位置信息，保存所述密钥生成算法和所述汇聚单元感兴趣的位置信息，以及将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中；
所述终端设备，还用于获取待发送数据和所述终端设备的唯一序列号，以所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第一鉴权 信息，以及以所述第一鉴权信息为依据，对所述待发送数据进行鉴权加密，以获得第一数据包；
所述终端设备，还用于将所述第一数据包发送给所述接入设备；
所述接入设备，还用于根据所述第一数据包，识别所述终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
所述接入设备还用于在确定出所述终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，获取所述接入设备的唯一序列号，以所述接入设备的唯一序列号为依据，基于保存的所述密钥生成算法生成第二鉴权信息；
所述接入设备，还用于以所述第二鉴权信息为依据，对所述第一数据包进行鉴权加密，以获得第二数据包，并将所述第二数据包发送给所述汇聚单元。
作为一种可选的实施方式，在本发明第二方面中，所述汇聚单元，还用于接收所述接入设备发送的所述第二数据包；
所述汇聚单元，还用于以存储的所述接入设备的唯一序列号为依据，基于所述密钥生成算法生成第一验证信息，根据所述第一验证信息对所述第二数据包进行鉴权解密，以获得所述第一数据包；
所述汇聚单元，还用于以存储的所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第二验证信息，根据所述第二验证信息对所述第一数据包进行鉴权解密，以获得所述待发送数据。
作为一种可选的实施方式，在本发明第二方面中，所述接入设备还用于在将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中之后，在其无线网络覆盖范围内广播侦听消息；
所述接入设备，还用于接收其无线网络覆盖范围内的终端设备针对所述侦听消息反馈的响应消息；
所述接入设备，还用于根据所述响应消息，判断其无线网络覆盖范围内是否接入新终端设备；
所述接入设备还用于在确定出其无线网络覆盖范围内接入有所述新终端设备时，获取所述新终端设备的位置信息；
所述接入设备，还用于判断所述新终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
所述接入设备还用于在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，将所述密钥生成算法写入所述新终端设备中。
作为一种可选的实施方式，在本发明第二方面中，所述接入设备还用于在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，确定所述密钥生成算法是否处于有效期；
所述接入设备还用于在确定出所述密钥生成算法处于有效期时，执行将所述密钥生成算法写入所述新终端设备中。
作为一种可选的实施方式，在本发明第二方面中，所述接入设备还用于将所述第二数据包发送给所述汇聚单元的方式具体为：
所述接入设备还用于通过跳频方式从目标传输频段中确定用于发送所述第二数据包的物理资源块的频域位置，在确定的物理资源块的频域位置所对应的时频资源上，向所述汇聚单元发送所述第二数据包。
与现有技术相比，本发明实施例具有以下有益效果：
在本发明实施例中，汇聚单元设置好用于生成鉴权信息的密钥生成算法，将密钥生成算法和汇聚单元感兴趣的位置信息一起打包发送给接入设备，接入设备自己保存该密钥生成算法和汇聚单元感兴趣的位置信息，并在其无线网络覆盖范围内，将密钥生成算法写入到汇聚单元感兴趣的位置信息对应的终端设备中。终端设备在写入了密钥生成算法后，以其唯一序列号为依据，基于该密钥生成算法生成第一鉴权信息，利用第一鉴权信息对待发送数据进行鉴权加密，获得第一数据包，然后将第一数据包发送给接入设备。接入设备在接收到第一数据包后，以其自身的唯一序列号为依据，基于保存的密钥生成算法生成第二鉴权信息，利用第二鉴权信息对第一数据包进行鉴权加密，获得第二数据包，然后将第二数据包发送给汇聚单元。可以看出，在本发明实施例中，对于汇聚单元指定位置信息的终端设备，利用汇聚单元给以的密钥生成算法生成鉴权信息，而且生成鉴权信息的因子为设备的唯一序列号，由于每个设备的唯一序列号为唯一的，生成的鉴权信息也不相同，而且在整条数据通信链路中每个设备都会数据进行了鉴权加密，为数据传输提供了一 条安全性较高的数据通信链路，提高了数据传输的安全和可靠性。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一些实施例公开的物联网架构示意图；
图2为本发明实施例公开的基于位置的物联网数据加密方法的流程示意图；
图3为本发明实施例公开的基于位置的物联网数据加密方法的另一流程示意图；
图4为本发明实施例公开的基于位置的物联网数据加密系统的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
需要说明的是，本发明的说明书和权利要求书中的术语“第一”、“第二”等是用于区别不同的对象，而不是用于描述特定顺序。本发明实施例的术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本发明实施例公开了一种基于位置的物联网数据加密方法，用于为数据传输提供一条安全性较高的数据通信链路，提高了数据传输的安全和可靠性。本发明实施例还相应地公开了一种基于位置的物联网数据加密系统。
在介绍本发明技术方案之前，先简单介绍本发明一些实施例公开的物联网架构，图1为本发明一些实施例公开的物联网架构示意图，需要说明的是，图1仅为本发明一些实施例公开的物联网架构示意图，其它在图1基础上进行优化或者变形得到的示意图均属于本发明的保护范围，在此不再一一举例。图1所示的物联网架构按照功能划分可以包括终端设备层、接入设备层以及汇聚层三个层。其中，终端设备层可以包括海量规模的终端设备，例如湿度计、烟感器、通风设备、雨量传感器、灌溉阀等等；接入设备层可以包括网络连接的大量的接入设备，接入设备可以包括路由器、中继器、接入点等设备，本发明实施例不作限定；接入设备可以使用任何标准的组网协议，而且接入设备可以在不同的网络制式之间实现数据解析；汇聚层可以包括汇聚单元，汇聚单元可以对接入设备层的各个接入设备进行高层管理，从而实现数据传输频率、网络拓扑以及其他组网功能的控制；汇聚单元不仅可以对海量终端设备产生的物联网数据进行分析和决策，还可以通过发指令去获取信息或者配置终端设备参数(此时数据的传输指向终端设备)；汇聚单元还可以引入各种业务，从大数据到社交网络、甚至从社交工具“点赞”到天气分享等。在图1所示的物联网架构中，每一个接入设备可以为其自身无线网络覆盖范围内的海量终端设备提供物联网数据收发服务，其中，每一个接入设备自身无线网络覆盖范围内的每一个终端设备可以内置有无线通讯模块，这使得每一个接入设备可以通过无线网络通讯方式与自身无线网络覆盖范围内的每一个终端设备进行无线通讯。在图1所示的物联网架构中，终端设备内置的无线通讯模块在生产时，可以输入上频点470MHz，下频点510MHz，这样无线通讯模块可以自动将通讯频段定义为470MHz～510MHz，以符合中国SRRC标准的规定；或者，也可以输入上频点868MHz，下频点908MHz，这样无线通讯模块可以自动将通讯频段定义为868MHz～908MHz，以符合欧洲ETSI标准的规定；或者，可以输入上频点918MHz，下频点928MHz，这样无线通讯模块可以自动将通讯频段定义为918MHz～928MHz，以符合美国FCC标准的规定；或者，无线通讯模块的通讯频段也可以定义为符合日本ARIB标准或加拿大IC标准的规定，本发明实施例不作限定。在图1所示的物联网架构中，终端设备可以采用频分复用(Frequency Division Multiple Access，FDMA)、跳频 (Frequency-Hopping Spread Spectrum，FHSS)、动态时分复用(Dynamic Time Division Multiple Access，DTDMA)、退避复用(CSMA)相结合的方法来解决干扰问题。
基于图1所示的物联网架构，下面将结合具体实施例，对本发明技术方案进行详细说明。
请参阅图2，图2为本发明实施例公开的基于位置的物联网数据加密方法的流程示意图；如图2所示，一种基于位置的物联网数据加密方法可包括：
201、汇聚单元设置密钥生成算法，并将密钥生成算法和汇聚单元感兴趣的位置信息一起打包并发送给接入设备。
其中，汇聚单元针对其感兴趣的位置信息(可以设置了用于采集重要数据的终端设备所在位置)，需要加强这个位置的终端设备发出的数据的安全。进而，在本发明实施例中，汇聚单元可以针对这些位置的终端设备，设置相应的加密算法。在本发明实施例中提供了密钥生成算法，该密钥生成算法采用设备的唯一序列号作为因子，生成鉴权信息用于鉴权加密。
202、接入设备接收密钥生成算法和汇聚单元感兴趣的位置信息，保存密钥生成算法和汇聚单元感兴趣的位置信息，以及将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元感兴趣的位置信息的终端设备中。
作为一种可选的实施方式，该接入设备将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元感兴趣的位置信息的终端设备中，包括：接入设备确定出其无线网络覆盖范围内匹配该汇聚单元感兴趣的位置信息的终端设备，然后将密钥生成算法发送给对应的终端设备以进行自动写入或者保存。
203、终端设备获取待发送数据和终端设备的唯一序列号，以终端设备的唯一序列号为依据，基于密钥生成算法生成第一鉴权信息，以及以第一鉴权信息为依据，对待发送数据进行鉴权加密，以获得第一数据包。
204、终端设备将第一数据包发送给接入设备。
作为一种可选的实施方式，终端设备将第一数据包发送给接入设备具体包括：终端设备获取目标传输频段，然后确定目标传输频段所对应的时频资源，在时频资源上向接入设备发送该第一数据包。
作为另一种可选的实施方式，汇聚单元可以对终端设备指定上报数据的时间点，并通过接入设备将上报数据的时间点发送给终端设备，以便终端设备能够设置其上报数据的时间点。进而，终端设备将第一数据包发送给接入设备具体包括：终端设备检测当前系统时间，判断当前系统时间是否到达汇聚单元指定的上报数据的时间点，在当前系统时间到达汇聚单元指定的上报数的时间点时，将第一数据包发送给接入设备。
作为另一种可选的实施方式，终端设备将第一数据包发送给接入设备具体包括：终端设备检测当前系统时间，判断当前系统时间是否到达汇聚单元指定的上报数据的时间点，在当前系统时间到达汇聚单元指定的上报数的时间点时，获取目标传输频段，然后确定目标传输频段所对应的时频资源，在时频资源上向接入设备发送该第一数据包。
205、接入设备根据第一数据包，识别终端设备的位置信息是否与汇聚单元感兴趣的位置信息相匹配。其中，在判断结果为匹配时，转向步骤206；在判断结果为不匹配时，直接将第一数据包发送给汇聚单元。
其中，终端设备在第一数据包中携带终端设备的位置信息，接入设备从第一数据包中提取该位置信息，以提取的位置信息作为该终端设备的位置信息；或者
终端设备在第一数据包中携带设备标识，接入设备在接收到第一数据包后，从第一数据包中提取该设备标识，以该设备标识为关键字索引，从接入设备管理的终端设备信息表中查找该设备标识对应的位置信息，以查到的位置信息作为该终端设备的位置信息。
206、接入设备获取接入设备的唯一序列号，以接入设备的唯一序列号为依据，基于保存的密钥生成算法生成第二鉴权信息。
207、接入设备以第二鉴权信息为依据，对第一数据包进行鉴权加密，以获得第二数据包，并将第二数据包发送给汇聚单元。
作为一种可选的实施方式，接入设备将第二数据包发送给汇聚单元包括：接入设备通过跳频方式从目标传输频段中确定用于发送第二数据包的物理资源块的频域位置；在确定的物理资源块的频域位置所对应的时频资源上，向汇聚单元发送第二数据包。
作为一种可选的实施方式，接入设备以第二鉴权信息为依据，对第一数据包进行鉴权加密，以获得第二数据包，并将第二数据包发送给汇聚单元之后，本发明实施例还包括：
汇聚单元接收接入设备发送的第二数据包；
汇聚单元以存储的接入设备的唯一序列号为依据，基于密钥生成算法生成第一验证信息，根据第一验证信息对第二数据包进行鉴权解密，以获得第一数据包；
汇聚单元以存储的终端设备的唯一序列号为依据，基于密钥生成算法生成第二验证信息，根据第二验证信息对第一数据包进行鉴权解密，以获得待发送数据。
通过上述实施方式，汇聚单元能够根据密钥生成算法，以设备的唯一序列号为因子，生成验证信息，对数据包进行验证和解密。
进一步地，汇聚单元以存储的接入设备的唯一序列号为依据，基于密钥生成算法生成第一验证信息，根据第一验证信息对第二数据包进行鉴权解密，以获得第一数据包，包括：
汇聚单元根据接入设备的唯一序列号，基于密钥生成算法生成第一验证信息，利用该第一验证信息验证用于对第一数据包进行鉴权和加密的第二鉴权信息是否正确，并在判断结果为正确时，以解密得到第一数据包；
汇聚单元在判断结果为不正确时，向接入设备发送验证失败通知。
另外，汇聚单元以存储的终端设备的唯一序列号为依据，基于密钥生成算法生成第二验证信息，根据第二验证信息对第一数据包进行鉴权解密，以获得待发送数据，包括：
汇聚单元根据终端设备的唯一序列号，基于密钥生成算法生成第二验证信息，利用该第二验证信息验证用于对待发送数据进行鉴权和加密的第一鉴权信息是否正确，并在判断结果为正确时，以解密得到待发送数据；
汇聚单元在判断结果为不正确时，向接入设备发送验证失败通知。
在上述实施方式中，在验证失败发送失败通知以通知接入设备和终端设备。
在本发明实施例中，汇聚单元设置好用于生成鉴权信息的密钥生成算法， 将密钥生成算法和汇聚单元感兴趣的位置信息一起打包发送给接入设备，接入设备自己保存该密钥生成算法和汇聚单元感兴趣的位置信息，并在其无线网络覆盖范围内，将密钥生成算法写入到汇聚单元感兴趣的位置信息对应的终端设备中。终端设备在写入了密钥生成算法后，以其唯一序列号为依据，基于该密钥生成算法生成第一鉴权信息，利用第一鉴权信息对待发送数据进行鉴权加密，获得第一数据包，然后将第一数据包发送给接入设备。接入设备在接收到第一数据包后，以其自身的唯一序列号为依据，基于保存的密钥生成算法生成第二鉴权信息，利用第二鉴权信息对第一数据包进行鉴权加密，获得第二数据包，然后将第二数据包发送给汇聚单元。可以看出，在本发明实施例中，对于汇聚单元指定位置信息的终端设备，利用汇聚单元给以的密钥生成算法生成鉴权信息，而且生成鉴权信息的因子为设备的唯一序列号，由于每个设备的唯一序列号为唯一的，生成的鉴权信息也不相同，而且在整条数据通信链路中每个设备都会数据进行了鉴权加密，为数据传输提供了一条安全性较高的数据通信链路，提高了数据传输的安全和可靠性。
实施例二
请参阅图3，图3为本发明实施例公开的基于位置的物联网数据加密方法的另一流程示意图；如图3所示，一种基于位置的物联网数据加密方法可包括：
301、汇聚单元设置密钥生成算法，并将密钥生成算法和汇聚单元感兴趣的位置信息一起打包并发送给接入设备。
302、接入设备接收密钥生成算法和汇聚单元感兴趣的位置信息，保存密钥生成算法和汇聚单元感兴趣的位置信息，以及将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元感兴趣的位置信息的终端设备中。
303、接入设备在将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元感兴趣的位置信息的终端设备中之后，在其无线网络覆盖范围内广播侦听消息。
其中，接入设备在接收汇聚单元下发的密钥生成算法和汇聚单元感兴趣的位置信息之后，将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元感兴趣的位置信息的终端设备中，之后，在其无线网络覆盖范围内广播侦听消息，以实时侦听接入的新终端设备。
作为一种可选的实施方式，接入设备还将在其无线网络覆盖范围内广播侦听消息，以实时侦听长时间不在线的终端设备，以实时更新路由表。
304、接入设备接收其无线网络覆盖范围内的终端设备针对侦听消息反馈的响应消息。
305、接入设备根据响应消息，判断其无线网络覆盖范围内是否接入新终端设备。其中，在判断结果为是时，转向步骤306；在判断结果为否时，结束该流程。
306、接入设备在确定出其无线网络覆盖范围内接入有新终端设备时，获取新终端设备的位置信息。
307、接入设备判断新终端设备的位置信息是否与汇聚单元感兴趣的位置信息相匹配。其中，在判断结果为是时，转向步骤306；在判断结果为否时，结束该流程。
308、接入设备在确定出新终端设备的位置信息与汇聚单元感兴趣的位置信息相匹配时，将密钥生成算法写入新终端设备中。
作为一种可选的实施方式，接入设备在确定出新终端设备的位置信息与汇聚单元感兴趣的位置信息相匹配时，以及将密钥生成算法写入新终端设备中之前，本发明实施例还包括：
接入设备在确定出新终端设备的位置信息与汇聚单元感兴趣的位置信息相匹配时，确定密钥生成算法是否处于有效期；
接入设备在确定出密钥生成算法处于有效期时，执行将密钥生成算法写入新终端设备中的步骤。在该实施方式中，汇聚单元在密钥生成算法中写入有效期，在其有效期内，接入设备可以将密钥生成算法发送给新终端设备，以便新终端设备能够根据密钥生成算法生成鉴权信息。
在本发明实施例中，接入设备在接收到汇聚单元下发的密钥生成算法和汇聚单元感兴趣的位置信息后，将密钥生成算法写入其无线网络覆盖范围内的匹配汇聚单元感兴趣的位置信息的终端设备，之后，对其无线网络覆盖范围进行实时侦听，在侦听到新终端设备时，将密钥生成算法写入新终端设备，以便新终端设备能够根据密钥生成算法生成对数据进行鉴权加密的鉴权信息，而接入设备也能根据密钥生成算法生成对数据进行鉴权加密的鉴权信息， 以提高数据传输链路中的数据安全。
实施例三
请参阅图4，图4为本发明实施例公开的基于位置的物联网数据加密系统的结构示意图；如图4所示，一种基于位置的物联网数据加密系统可包括：
汇聚单元410，用于设置密钥生成算法，并将密钥生成算法和汇聚单元410感兴趣的位置信息一起打包并发送给接入设备420；
接入设备420，用于接收密钥生成算法和汇聚单元410感兴趣的位置信息，保存密钥生成算法和汇聚单元410感兴趣的位置信息，以及将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元410感兴趣的位置信息的终端设备430中；
终端设备430，还用于获取待发送数据和终端设备430的唯一序列号，以终端设备430的唯一序列号为依据，基于密钥生成算法生成第一鉴权信息，以及以第一鉴权信息为依据，对待发送数据进行鉴权加密，以获得第一数据包；
终端设备430，还用于将第一数据包发送给接入设备420；
接入设备420，还用于根据第一数据包，识别终端设备430的位置信息是否与汇聚单元410感兴趣的位置信息相匹配；
接入设备420还用于在确定出终端设备430的位置信息与汇聚单元410感兴趣的位置信息相匹配时，获取接入设备420的唯一序列号，以接入设备420的唯一序列号为依据，基于保存的密钥生成算法生成第二鉴权信息；
接入设备420，还用于以第二鉴权信息为依据，对第一数据包进行鉴权加密，以获得第二数据包，并将第二数据包发送给汇聚单元410。
其中，终端设备430在第一数据包中携带终端设备430的位置信息，接入设备420从第一数据包中提取该位置信息，以提取的位置信息作为该终端设备430的位置信息；或者
终端设备430在第一数据包中携带设备标识，接入设备420在接收到第一数据包后，从第一数据包中提取该设备标识，以该设备标识为关键字索引，从接入设备420管理的终端设备信息表中查找该设备标识对应的位置信息，以查到的位置信息作为该终端设备430的位置信息。
作为一种可选的实施方式，接入设备420用于将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元410感兴趣的位置信息的终端设备430中的方式具体为：接入设备420用于确定出其无线网络覆盖范围内匹配该汇聚单元410感兴趣的位置信息的终端设备430，然后将密钥生成算法发送给对应的终端设备430以进行自动写入或者保存。
作为一种可选的实施方式，终端设备430还用于将第一数据包发送给接入设备420的方式具体为：终端设备430还用于获取目标传输频段，然后确定目标传输频段所对应的时频资源，在时频资源上向接入设备420发送该第一数据包。
作为另一种可选的实施方式，汇聚单元410可以对终端设备430指定上报数据的时间点，并通过接入设备420将上报数据的时间点发送给终端设备430，以便终端设备430能够设置其上报数据的时间点。进而，终端设备430还用于将第一数据包发送给接入设备420的方式具体为：终端设备430还用于检测当前系统时间，判断当前系统时间是否到达汇聚单元410指定的上报数据的时间点，在当前系统时间到达汇聚单元410指定的上报数的时间点时，将第一数据包发送给接入设备420。
作为另一种可选的实施方式，终端设备430用于将第一数据包发送给接入设备420的方式具体为：终端设备430检测当前系统时间，判断当前系统时间是否到达汇聚单元410指定的上报数据的时间点，在当前系统时间到达汇聚单元410指定的上报数的时间点时，获取目标传输频段，然后确定目标传输频段所对应的时频资源，在时频资源上向接入设备420发送该第一数据包。
作为一种可选的实施方式，接入节点420向汇聚单元410发送第二数据包后，汇聚单元410，还用于接收接入设备420发送的第二数据包；
汇聚单元410，还用于以存储的接入设备420的唯一序列号为依据，基于密钥生成算法生成第一验证信息，根据第一验证信息对第二数据包进行鉴权解密，以获得第一数据包；
汇聚单元410，还用于以存储的终端设备430的唯一序列号为依据，基于密钥生成算法生成第二验证信息，根据第二验证信息对第一数据包进行鉴 权解密，以获得待发送数据。
作为一种可选的实施方式，接入设备420还用于以第二鉴权信息为依据，对第一数据包进行鉴权加密，以获得第二数据包，并将第二数据包发送给汇聚单元410之后，汇聚单元410还用于接收接入设备420发送的第二数据包；
汇聚单元410还用于以存储的接入设备420的唯一序列号为依据，基于密钥生成算法生成第一验证信息，根据第一验证信息对第二数据包进行鉴权解密，以获得第一数据包；
汇聚单元410还用于以存储的终端设备430的唯一序列号为依据，基于密钥生成算法生成第二验证信息，根据第二验证信息对第一数据包进行鉴权解密，以获得待发送数据。
通过上述实施方式，汇聚单元410能够根据密钥生成算法，以设备的唯一序列号为因子，生成验证信息，对数据包进行验证和解密。
作为一种可选的实施方式，接入设备420还用于在将密钥生成算法写入其无线网络覆盖范围内位置信息匹配汇聚单元410感兴趣的位置信息的终端设备430中之后，在其无线网络覆盖范围内广播侦听消息；
接入设备420，还用于接收其无线网络覆盖范围内的终端设备430针对侦听消息反馈的响应消息；
接入设备420，还用于根据响应消息，判断其无线网络覆盖范围内是否接入新终端设备430；
接入设备420还用于在确定出其无线网络覆盖范围内接入有新终端设备430时，获取新终端设备430的位置信息；
接入设备420，还用于判断新终端设备430的位置信息是否与汇聚单元410感兴趣的位置信息相匹配；
接入设备420还用于在确定出新终端设备430的位置信息与汇聚单元410感兴趣的位置信息相匹配时，将密钥生成算法写入新终端设备430中。
作为一种可选的实施方式，接入设备420还用于在确定出新终端设备430的位置信息与汇聚单元410感兴趣的位置信息相匹配时，确定密钥生成算法是否处于有效期；
接入设备420还用于在确定出密钥生成算法处于有效期时，执行将密钥 生成算法写入新终端设备430中。
作为一种可选的实施方式，接入设备420还用于将第二数据包发送给汇聚单元410的方式具体为：
接入设备420还用于通过跳频方式从目标传输频段中确定用于发送第二数据包的物理资源块的频域位置，在确定的物理资源块的频域位置所对应的时频资源上，向汇聚单元410发送第二数据包。
实施上述系统，对于汇聚单元指定位置信息的终端设备，利用汇聚单元给以的密钥生成算法生成鉴权信息，而且生成鉴权信息的因子为设备的唯一序列号，由于每个设备的唯一序列号为唯一的，生成的鉴权信息也不相同，而且在整条数据通信链路中每个设备都会数据进行了鉴权加密，为数据传输提供了一条安全性较高的数据通信链路，提高了数据传输的安全和可靠性。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质包括只读存储器(Read-Only Memory，ROM)、随机存储器(Random Access Memory，RAM)、可编程只读存储器(Programmable Read-only Memory，PROM)、可擦除可编程只读存储器(Erasable Programmable Read Only Memory，EPROM)、一次可编程只读存储器(One-time Programmable Read-Only Memory，OTPROM)、电子抹除式可复写只读存储器(Electrically-Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储器、磁盘存储器、磁带存储器、或者能够用于携带或存储数据的计算机可读的任何其他介质。
以上对本发明实施例公开的一种基于位置的物联网数据加密方法及系统进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (10)

  1. 一种基于位置的物联网数据加密方法，其特征在于，包括：
    汇聚单元设置密钥生成算法，并将所述密钥生成算法和所述汇聚单元感兴趣的位置信息一起打包并发送给接入设备；
    所述接入设备接收所述密钥生成算法和所述汇聚单元感兴趣的位置信息，保存所述密钥生成算法和所述汇聚单元感兴趣的位置信息，以及将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中；
    所述终端设备获取待发送数据和所述终端设备的唯一序列号，以所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第一鉴权信息，以及以所述第一鉴权信息为依据，对所述待发送数据进行鉴权加密，以获得第一数据包；
    所述终端设备将所述第一数据包发送给所述接入设备；
    所述接入设备根据所述第一数据包，识别所述终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
    所述接入设备在确定出所述终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，获取所述接入设备的唯一序列号，以所述接入设备的唯一序列号为依据，基于保存的所述密钥生成算法生成第二鉴权信息；
    所述接入设备以所述第二鉴权信息为依据，对所述第一数据包进行鉴权加密，以获得第二数据包，并将所述第二数据包发送给所述汇聚单元。
  2. 根据权利要求1所述的方法，其特征在于，所述接入设备以所述第二鉴权信息为依据，对所述第一数据包进行鉴权加密，以获得第二数据包，并将所述第二数据包发送给所述汇聚单元之后，所述方法还包括：
    所述汇聚单元接收所述接入设备发送的所述第二数据包；
    所述汇聚单元以存储的所述接入设备的唯一序列号为依据，基于所述密钥生成算法生成第一验证信息，根据所述第一验证信息对所述第二数据包进行鉴权解密，以获得所述第一数据包；
    所述汇聚单元以存储的所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第二验证信息，根据所述第二验证信息对所述第一数据包进行鉴权解密，以获得所述待发送数据。
  3. 根据权利要求1或2所述的方法，其特征在于，所述接入设备在将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中之后，所述方法还包括：
    所述接入设备在将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中之后，在其无线网络覆盖范围内广播侦听消息；
    所述接入设备接收其无线网络覆盖范围内的终端设备针对所述侦听消息反馈的响应消息；
    所述接入设备根据所述响应消息，判断其无线网络覆盖范围内是否接入新终端设备；
    所述接入设备在确定出其无线网络覆盖范围内接入有所述新终端设备时，获取所述新终端设备的位置信息；
    所述接入设备判断所述新终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
    所述接入设备在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，将所述密钥生成算法写入所述新终端设备中。
  4. 根据权利要求3所述的方法，其特征在于，所述接入设备在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，以及将所述密钥生成算法写入所述新终端设备中之前，所述方法还包括：
    所述接入设备在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，确定所述密钥生成算法是否处于有效期；
    所述接入设备在确定出所述密钥生成算法处于有效期时，执行将所述密钥生成算法写入所述新终端设备中的步骤。
  5. 根据权利要求1～4任一项所述的方法，其特征在于，所述接入设备将所述第二数据包发送给所述汇聚单元，包括：
    所述接入设备通过跳频方式从目标传输频段中确定用于发送所述第二数据包的物理资源块的频域位置；
    所述接入设备在确定的物理资源块的频域位置所对应的时频资源上，向所述汇聚单元发送所述第二数据包。
  6. 一种基于位置的物联网数据加密系统，其特征在于，包括：
    汇聚单元，用于设置密钥生成算法，并将所述密钥生成算法和所述汇聚单元感兴趣的位置信息一起打包并发送给接入设备；
    所述接入设备，用于接收所述密钥生成算法和所述汇聚单元感兴趣的位置信息，保存所述密钥生成算法和所述汇聚单元感兴趣的位置信息，以及将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中；
    所述终端设备，还用于获取待发送数据和所述终端设备的唯一序列号，以所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第一鉴权信息，以及以所述第一鉴权信息为依据，对所述待发送数据进行鉴权加密，以获得第一数据包；
    所述终端设备，还用于将所述第一数据包发送给所述接入设备；
    所述接入设备，还用于根据所述第一数据包，识别所述终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
    所述接入设备还用于在确定出所述终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，获取所述接入设备的唯一序列号，以所述接入设备的唯一序列号为依据，基于保存的所述密钥生成算法生成第二鉴权信息；
    所述接入设备，还用于以所述第二鉴权信息为依据，对所述第一数据包进行鉴权加密，以获得第二数据包，并将所述第二数据包发送给所述汇聚单元。
  7. 根据权利要求6所述的系统，其特征在于，
    所述汇聚单元，还用于接收所述接入设备发送的所述第二数据包；
    所述汇聚单元，还用于以存储的所述接入设备的唯一序列号为依据，基于所述密钥生成算法生成第一验证信息，根据所述第一验证信息对所述第二数据包进行鉴权解密，以获得所述第一数据包；
    所述汇聚单元，还用于以存储的所述终端设备的唯一序列号为依据，基于所述密钥生成算法生成第二验证信息，根据所述第二验证信息对所述第一数据包进行鉴权解密，以获得所述待发送数据。
  8. 根据权利要求6或7所述的系统，其特征在于，
    所述接入设备还用于在将所述密钥生成算法写入其无线网络覆盖范围内位置信息匹配所述汇聚单元感兴趣的位置信息的终端设备中之后，在其无线网络覆盖范围内广播侦听消息；
    所述接入设备，还用于接收其无线网络覆盖范围内的终端设备针对所述侦听消息反馈的响应消息；
    所述接入设备，还用于根据所述响应消息，判断其无线网络覆盖范围内是否接入新终端设备；
    所述接入设备还用于在确定出其无线网络覆盖范围内接入有所述新终端设备时，获取所述新终端设备的位置信息；
    所述接入设备，还用于判断所述新终端设备的位置信息是否与所述汇聚单元感兴趣的位置信息相匹配；
    所述接入设备还用于在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，将所述密钥生成算法写入所述新终端设备中。
  9. 根据权利要求8所述的系统，其特征在于，
    所述接入设备还用于在确定出所述新终端设备的位置信息与所述汇聚单元感兴趣的位置信息相匹配时，确定所述密钥生成算法是否处于有效期；
    所述接入设备还用于在确定出所述密钥生成算法处于有效期时，执行将所述密钥生成算法写入所述新终端设备中。
  10. 根据权利要求6～9任一项所述的系统，其特征在于，所述接入设备还用于将所述第二数据包发送给所述汇聚单元的方式具体为：
    所述接入设备还用于通过跳频方式从目标传输频段中确定用于发送所述第二数据包的物理资源块的频域位置，在确定的物理资源块的频域位置所对应的时频资源上，向所述汇聚单元发送所述第二数据包。
PCT/CN2017/100001 2017-06-21 2017-08-31 一种基于位置的物联网数据加密方法及系统 WO2018233041A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710473267.6A CN107248993B (zh) 2017-06-21 2017-06-21 一种基于位置的物联网数据加密方法及系统
CN201710473267.6 2017-06-21

Publications (1)

Publication Number Publication Date
WO2018233041A1 true WO2018233041A1 (zh) 2018-12-27

Family

ID=60019447

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/100001 WO2018233041A1 (zh) 2017-06-21 2017-08-31 一种基于位置的物联网数据加密方法及系统

Country Status (2)

Country Link
CN (1) CN107248993B (zh)
WO (1) WO2018233041A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11394608B2 (en) * 2018-09-28 2022-07-19 Huawei Technologies Co., Ltd. Speaker interaction method, speaker, and speaker system
CN114866303A (zh) * 2022-04-26 2022-08-05 武昌理工学院 一种防劫持的探测信号鉴权方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116668200B (zh) * 2023-07-31 2023-10-17 深圳市联新移动医疗科技有限公司 一种物联网数据安全传输方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101133418A (zh) * 2004-10-12 2008-02-27 阿诺托股份公司 来自电子笔的信息的安全管理方法和系统
JP2008072442A (ja) * 2006-09-14 2008-03-27 Nippon Hoso Kyokai <Nhk> 共有暗号鍵生成装置、その方法およびそのプログラム
CN103442353A (zh) * 2013-08-22 2013-12-11 江苏赛联信息产业研究院股份有限公司 一种安全可控的物联网数据传输方法
CN105450620A (zh) * 2014-09-30 2016-03-30 阿里巴巴集团控股有限公司 一种信息处理方法及装置
CN105532057A (zh) * 2013-09-27 2016-04-27 诺基亚技术有限公司 用于不同d2d区域下的d2d设备的密钥配对的方法和装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102480713B (zh) * 2010-11-25 2014-05-28 中国移动通信集团河南有限公司 一种汇聚节点与移动通信网络间的通信方法、系统及装置
CN105610872B (zh) * 2016-03-16 2018-09-07 中国联合网络通信集团有限公司 物联网终端加密方法和物联网终端加密装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101133418A (zh) * 2004-10-12 2008-02-27 阿诺托股份公司 来自电子笔的信息的安全管理方法和系统
JP2008072442A (ja) * 2006-09-14 2008-03-27 Nippon Hoso Kyokai <Nhk> 共有暗号鍵生成装置、その方法およびそのプログラム
CN103442353A (zh) * 2013-08-22 2013-12-11 江苏赛联信息产业研究院股份有限公司 一种安全可控的物联网数据传输方法
CN105532057A (zh) * 2013-09-27 2016-04-27 诺基亚技术有限公司 用于不同d2d区域下的d2d设备的密钥配对的方法和装置
CN105450620A (zh) * 2014-09-30 2016-03-30 阿里巴巴集团控股有限公司 一种信息处理方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11394608B2 (en) * 2018-09-28 2022-07-19 Huawei Technologies Co., Ltd. Speaker interaction method, speaker, and speaker system
CN114866303A (zh) * 2022-04-26 2022-08-05 武昌理工学院 一种防劫持的探测信号鉴权方法
CN114866303B (zh) * 2022-04-26 2023-05-26 武昌理工学院 一种防劫持的探测信号鉴权方法

Also Published As

Publication number Publication date
CN107248993B (zh) 2020-03-24
CN107248993A (zh) 2017-10-13

Similar Documents

Publication Publication Date Title
CN111478902B (zh) 电力边缘网关设备及基于该设备的传感数据上链存储方法
Meneghello et al. IoT: Internet of threats? A survey of practical security vulnerabilities in real IoT devices
CN107770182B (zh) 家庭网关的数据存储方法及家庭网关
Chakrabarty et al. Black SDN for the Internet of Things
CN107454079B (zh) 基于物联网平台的轻量级设备认证及共享密钥协商方法
US20050123141A1 (en) Broadcast encryption key distribution system
CN106330856A (zh) 听力设备和听力设备通信的方法
US20200382885A1 (en) Rights management in a hearing device
CN110958142A (zh) 设备维护方法、维护设备、存储介质及计算机程序产品
WO2018233046A1 (zh) 一种基于数据类型的通信控制方法及系统
WO2018233048A1 (zh) 一种控制物联网终端设备通信的方法及系统
WO2018233041A1 (zh) 一种基于位置的物联网数据加密方法及系统
WO2015003503A1 (zh) 一种提高信息安全性的方法、终端设备及网络设备
US10637651B2 (en) Secure systems and methods for resolving audio device identity using remote application
WO2018233045A1 (zh) 一种物联网通信模式的切换控制方法及系统
CN111447283A (zh) 一种用于实现配电站房系统信息安全的方法
CN108092958A (zh) 信息认证方法、装置、计算机设备及存储介质
CN108234119B (zh) 一种数字证书管理方法和平台
CN104883372B (zh) 一种基于无线自组织网的防欺骗和抗攻击的数据传输方法
CN104038931B (zh) 基于lte网络的配用电通信系统及其通信方法
CN115038084A (zh) 一种面向蜂窝基站的去中心化可信接入方法
WO2018233035A1 (zh) 一种物联网数据传输的加密方法及系统
WO2018233044A1 (zh) 一种基于过滤网关的物联网数据过滤方法及系统
CN113972995B (zh) 一种网络配置方法及装置
WO2018233031A1 (zh) 一种基于物联网的数据传输控制方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17914556

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 18.05.2020)

122 Ep: pct application non-entry in european phase

Ref document number: 17914556

Country of ref document: EP

Kind code of ref document: A1