WO2019201154A1 - 物联网设备之间的通信方法及装置 - Google Patents

物联网设备之间的通信方法及装置 Download PDF

Info

Publication number
WO2019201154A1
WO2019201154A1 PCT/CN2019/082261 CN2019082261W WO2019201154A1 WO 2019201154 A1 WO2019201154 A1 WO 2019201154A1 CN 2019082261 W CN2019082261 W CN 2019082261W WO 2019201154 A1 WO2019201154 A1 WO 2019201154A1
Authority
WO
WIPO (PCT)
Prior art keywords
internet
communication
trusted
things
communication key
Prior art date
Application number
PCT/CN2019/082261
Other languages
English (en)
French (fr)
Inventor
金海峰
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2019201154A1 publication Critical patent/WO2019201154A1/zh
Priority to US17/072,608 priority Critical patent/US11729156B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/065—Network architectures or network communication protocols for network security for supporting key management in a packet data network for group communications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y30/00—IoT infrastructure
    • G16Y30/10—Security thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information

Definitions

  • the present application relates to the field of Internet of Things technologies, and in particular, to a communication method and apparatus between Internet of Things devices.
  • IoT devices are directly connected and communicated through plain text, but plain text communication easily leads to data leakage, and communication security is low.
  • the present application has been made in order to provide a communication method and apparatus between Internet of Things devices that overcome the above problems or at least partially solve the above problems.
  • the application provides a communication method between Internet of Things devices, including:
  • the first communication key being provided by the trusted device to the first Internet of Things device and/or the second Internet of Things device;
  • the first communication key is generated by the first Internet of Things device
  • the obtaining the first communication key includes:
  • the first communication key is generated by the trusted device or the second Internet of Things device;
  • the obtaining the first communication key includes:
  • the first IoT device stores a list of trusted authentication identifiers
  • the method further includes:
  • the performing, according to the first communication key, performing encrypted communication with the second Internet of Things device includes:
  • the establishing a communication connection between the first IoT device and the trusted device includes:
  • the verification information includes a digital certificate
  • the performing the trusted verification with the trusted device according to the verification information includes:
  • the method further includes:
  • the verification information is encrypted by a cloud private key
  • the method further includes: before the performing the trusted verification with the trusted device according to the verification information, the method further includes:
  • the verification information is decrypted according to a cloud public key corresponding to the cloud private key.
  • the method further includes:
  • the second communication key is generated by the first Internet of Things device
  • the obtaining the second communication key includes:
  • the second communication key is generated by the trusted device
  • the obtaining the second communication key includes:
  • the method further includes:
  • a property change event is detected and notified to the monitoring device.
  • the method before the acquiring the subscription request of the monitoring device to the attribute change event of the first IoT device, the method further includes:
  • the method before the detecting the attribute change event, the method further includes:
  • the application also provides a communication method between the Internet of Things devices, including:
  • Providing a first communication key to the first IoT device and/or the second IoT device such that the first IoT device and the second IoT device are based on the first communication key Perform encrypted communication.
  • the establishing a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device respectively includes:
  • the method further includes:
  • the first communication key is generated by the trusted device
  • the providing the first communication key to the first Internet of Things device and/or the second Internet of Things device comprises:
  • the first communication key is generated by the first Internet of Things device or the second Internet of Things device;
  • the providing the first communication key to the first Internet of Things device and/or the second Internet of Things device comprises:
  • the method further includes:
  • the method further includes:
  • the application also provides a communication device between the Internet of Things devices, including:
  • a communication connection establishing module configured to establish a communication connection between the first IoT device and the trusted device
  • a first communication key acquisition module configured to acquire a first communication key, where the first communication key is provided by the trusted device to the first Internet of Things device and/or the second Internet of Things device;
  • a communication module configured to perform encrypted communication with the second Internet of Things device based on the first communication key.
  • the first communication key is generated by the first Internet of Things device
  • the first communication key acquisition module includes:
  • a first key generation parameter obtaining submodule configured to acquire first key generation parameters from at least one end of the trusted device, the first Internet of Things device, and the second Internet of Things device;
  • the first communication key generation submodule is configured to generate the first communication key according to the acquired first key generation parameter.
  • the first communication key is generated by the trusted device or the second Internet of Things device;
  • the first communication key acquisition module includes:
  • a first communication key acquisition submodule configured to acquire, from the trusted device, the first communication key generated by the trusted device or the second Internet of Things device.
  • the first IoT device stores a list of trusted authentication identifiers
  • the device also includes:
  • a trusted authentication identifier obtaining module configured to acquire a trusted authentication identifier provided by the second Internet of Things device
  • the first determining module is configured to determine that the trusted authentication identifier exists in the trusted authentication identifier list.
  • the communication connection establishing module includes:
  • a verification information obtaining submodule configured to obtain verification information from the trusted device
  • the trusted verification submodule is configured to complete a trusted check with the trusted device according to the verification information.
  • the device further includes:
  • a second communication key obtaining module configured to acquire a second communication key, to perform encrypted communication with the trusted device based on the second communication key.
  • the device further includes:
  • a subscription request obtaining module configured to acquire a subscription request of the monitoring device for an attribute change event of the first IoT device
  • the attribute change event detecting module is configured to detect an attribute change event and notify the monitoring device.
  • the application also provides a communication device between the Internet of Things devices, including:
  • a communication connection establishing module configured to separately establish a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device;
  • a first communication key providing module configured to provide a first communication key to the first Internet of Things device and/or the second Internet of Things device, to enable the first Internet of Things device and the second object
  • the networked device performs encrypted communication based on the first communication key.
  • the communication connection establishing module includes:
  • a verification information providing submodule configured to provide verification information to the first Internet of Things device and the second Internet of Things device, respectively, for the first Internet of Things device and the second Internet of Things device respectively.
  • the trusted device completes a trusted check.
  • the first communication key is generated by the trusted device
  • the first communication key providing module includes:
  • a first communication key sending submodule configured to send the first communication key to the first Internet of Things device and the second Internet of Things device.
  • the first communication key is generated by the first Internet of Things device or the second Internet of Things device;
  • the first communication key providing module includes:
  • a first communication key sending submodule configured to acquire the first communication key, and send the first communication key to another one of the first IoT device and the second IoT device .
  • the present application also provides a computer device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, the processor executing the computer program to implement one or more of the foregoing method.
  • the application also provides a computer readable storage medium having stored thereon a computer program that, when executed by a processor, implements one or more of the methods described above.
  • a communication connection between the first IoT device and the trusted device may be established, and the first communication key is obtained, and since the trusted device is trusted, the trusted device may be securely and reliably Providing the first communication key to the first Internet of Things device and/or the second Internet of Things device, ensuring that the first IoT device and the second Internet of Things can obtain the first communication key, thereby based on the first communication key Encrypted communication improves the security and reliability of communication between the first IoT device and the second IoT device.
  • FIG. 1 is a flowchart of a method for communication between Internet of Things devices according to an embodiment of the present application
  • FIG. 2 is a flow chart showing a communication method between Internet of Things devices according to a second embodiment of the present application
  • FIG. 3 is a flow chart showing a method for communication between Internet of Things devices according to a third embodiment of the present application.
  • FIG. 4 is a flow chart showing a method of communication between Internet of Things devices according to an embodiment of the present application.
  • FIG. 5 is a flow chart showing a communication method between another IoT device according to an embodiment of the present application.
  • FIG. 6 is a block diagram showing the structure of a communication device between Internet of Things devices according to a fourth embodiment of the present application.
  • FIG. 7 is a block diagram showing the structure of a communication device between Internet of Things devices according to a fifth embodiment of the present application.
  • FIG. 8 shows a block diagram of an exemplary system in accordance with one embodiment of the present application.
  • IoT devices can include VR (Virtual Reality) devices, tablets, e-book readers, MP3 (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture) Experts Group Audio Layer IV, dynamic imaging experts compress standard audio layers 4) players, laptops, laptops, set-top boxes, smart TVs, wearables, smart lights, smart speakers, home gateways and more.
  • the IoT device can include an application or plug-in, and can include any of the devices of Figures 6-8 below, implementing any of the methods of Figures 1-5 to communicate with other IoT devices.
  • the first Internet of Things device or the second Internet of Things device may be any two devices in the Internet of Things.
  • the application can be run in an IoT device to implement a communication method between the Internet of Things devices provided by the embodiments of the present application.
  • the plug-in may be included in an application running on the Internet of Things device to implement a communication method between the Internet of Things devices provided by the embodiments of the present application.
  • the trusted device is a secure and trusted device capable of providing a first communication key for the first Internet of Things and/or the second Internet of Things device, including generation and/or forwarding of the first communication key, and the like.
  • the trusted device can include a client.
  • the trusted device may also provide other communication related services or data to the first IoT device and/or the second IoT device, for example, providing a key required to generate the first communication key. Generate parameters, etc.
  • a trusted device can include a cell phone.
  • the communication key is used for encrypted communication between the IoT devices, including encrypting the communication data by the communication key and/or decrypting the data by the communication key.
  • Embodiments of the present application can be applied to scenarios of communication between Internet of Things devices. Since the communication between the IoT devices directly through the plaintext communication may cause data leakage and the like, the security of the communication is low. Therefore, the present application provides a communication method between the Internet of Things devices.
  • the trusted device can securely provide the first communication key to the first Internet of Things and/or the second Internet of Things device, and thus, the first Internet of Things device can establish a communication connection with the trusted device.
  • the second IoT device can also obtain the first communication key in the same manner, that is, the first Internet of Things device and the second Internet of Things device that are in communication can obtain a first communication key, therefore, the first IoT device can perform encrypted communication with the second IoT device based on the first communication key, thereby reducing the relationship between the first IoT device and the second IoT device
  • the possibility of communication data leakage increases the security of communication between IoT devices.
  • the first Internet of Things device and the second Internet of Things device may be in an offline state with the cloud or one of the Internet of Things devices is in an offline state with the cloud, because at least one IoT device cannot be connected to the cloud. Communication is performed, therefore, it is impossible to operate the IoT device through the server to realize linkage between two IoT devices.
  • the communication connection is established based on the trusted device, and the implementation is implemented. Encrypted communication between the first IoT device and the second IoT device.
  • FIG. 1 a flow chart of a method for communication between Internet of Things devices according to an embodiment of the present application is shown. The specific steps include:
  • Step 101 Establish a communication connection between the first Internet of Things device and the trusted device.
  • the trusted device Since the trusted device is trusted, in order to enable the first IoT device and the second IoT device to obtain the first communication key in a secure and reliable manner, the possibility of leakage of the first communication key is reduced, thereby implementing encryption.
  • Communication to improve the security of communication, can establish a communication connection between the first IoT device and the trusted device.
  • the first IoT device and the trusted device can pass through a router component to a local area network.
  • the communication connection between the first IoT device and the trusted device can be established through TCP (Transmission Control Protocol) or UDP (User Datagram Protocol).
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • a communication connection between the first IoT device and the trusted device can be established based on other protocols.
  • Step 102 Acquire a first communication key, where the first communication key is provided by the trusted device to the first Internet of Things device and/or the second Internet of Things device.
  • a first communication key can be obtained, and the first communication key can be securely and reliably provided to the first IoT device and/or by the trusted device. Or a second IoT device.
  • the first communication key may be generated by at least one of the first Internet of Things device, the second Internet of Things device, and the trusted device.
  • the first Internet of Things device, the second Internet of Things device, or the trusted device may acquire key generation parameters from at least one of the first Internet of Things device, the second Internet of Things device, and the trusted device, and generate a first A communication key.
  • the more the source of the key generation parameters and the more key generation parameters the higher the security of the generated communication key.
  • the key generation parameter is a parameter required to generate a communication key, and the key generation parameter may include a random number or a previously specified number.
  • the key generation algorithm is an algorithm for generating a key, and the key generation algorithm may be a preset key generation algorithm. Of course, in practical applications, the key generation algorithm may also be used by the first Internet of Things device and the second object. Networked devices or trusted devices are available.
  • the first communication key may be provided to the second Internet of Things device by the trusted device; if the first communication key is used by the second Internet of Things device or the trusted device Generating, the first communication key can be obtained by the trusted device; if the first communication key is generated by the first Internet of Things device and the second Internet of Things device, the first IoT device and the second device can be ensured by the trusted device
  • the communication key generated by the Internet of Things device is the same, such as providing the same key generation parameter to the first Internet of Things device and the second Internet of Things device, respectively, or confirming the density adopted by the first Internet of Things device and the second Internet of Things device.
  • the key generation parameters are consistent with the key generation algorithm.
  • Step 103 Perform encrypted communication with the second Internet of Things device based on the first communication key.
  • the first IoT device and the second IoT device obtain the first communication key in a secure and reliable manner, the first IoT device can be based on the first communication key, and between the second IoT device The communication data is encrypted and communicated to ensure the security and reliability of the communication.
  • the first IoT device may encrypt the communication data sent to the second IoT device through the first communication key, and decrypt the communication data received by the second IoT device through the first communication key, thereby realizing Encrypted communication.
  • a communication connection between the first IoT device and the trusted device may be established, and the first communication key is obtained, and since the trusted device is trusted, the trusted device may be securely and reliably Providing the first communication key to the first Internet of Things device and/or the second Internet of Things device, ensuring that the first IoT device and the second Internet of Things can obtain the first communication key, thereby based on the first communication key Encrypted communication improves the security and reliability of communication between the first IoT device and the second IoT device.
  • FIG. 2 a flow chart of a method for communication between Internet of Things devices according to an embodiment of the present application is shown. The specific steps include:
  • Step 201 Establish a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device, respectively.
  • the trusted device Since the trusted device is trusted, in order to enable the first Internet of Things device and the second Internet of Things device to obtain the first communication key in a secure and reliable manner, thereby implementing encrypted communication and improving communication security, respectively, Establish a communication connection between the trusted device and the first IoT device and the second IoT device.
  • the trusted device may determine the first Internet of Things device and the second Internet of Things device from the Internet of Things, such as receiving the first Internet of Things device and the second Internet of Things device by way of user designation, random selection, receiving cloud designation, and the like.
  • the first Internet of Things device and the second Internet of Things device may also be determined by other means, for example, if the connection request of the IoT device is received, the IoT device is determined as the first IoT device, and Another IoT device specified by the IoT device that requires encrypted communication is determined as the second IoT device. After determining the first IoT device and the second IoT device, a communication connection with the first IoT device and the second IoT device can be established separately.
  • the cloud can be implemented as a server or server cluster that is capable of communicating with trusted devices and providing data or services related to encrypted communications between the IoT devices implemented in embodiments of the present application.
  • Step 202 Provide a first communication key to the first IoT device and/or the second IoT device, so that the first IoT device and the second IoT device are based on the first The communication key performs encrypted communication.
  • the possibility of leakage of the first communication key is reduced, thereby improving the first Internet of Things device and the second object.
  • the networked device performs the security and reliability of the encrypted communication, and the trusted device can provide the first communication key to the first Internet of Things device and/or the second Internet of Things device.
  • the trusted device may provide a key generation parameter to the first Internet of Things device or the second Internet of Things device, and the first communication key is The key is provided to the other of the first IoT device and the second IoT device; if the first communication key is generated by the trusted device, the trusted device can provide the first communication key to the first IoT device and a second Internet of Things device; if the first communication key is generated by the first Internet of Things device and the second Internet of Things device, the trusted device ensures that the communication keys generated by the first Internet of Things device and the second Internet of Things device are the same, For example, the first key generation parameter is provided to the first Internet of Things device and the second Internet of Things device, respectively, or the key generation parameters used by the first Internet of Things device and the second Internet of Things device are consistent with the key generation algorithm.
  • a communication connection with the first Internet of Things device and the second Internet of Things device may be established. Since the trusted device is trusted, the first communication key may be securely and reliably passed by the trusted device. Providing to the first Internet of Things device and/or the second Internet of Things device, ensuring that the first IoT device and the second Internet of Things can obtain the first communication key, thereby performing encrypted communication based on the first communication key, thereby improving The security and reliability of communication between the first IoT device and the second IoT device.
  • FIG. 3 a flow chart of a method for communication between Internet of Things devices according to an embodiment of the present application is shown. The specific steps include:
  • Step 301 The trusted device establishes a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device, respectively.
  • the trusted device establishes a communication connection with the first Internet of Things device and the second Internet of Things device, refer to the related description in the foregoing, and details are not described herein again.
  • the trusted device may provide verification information to the first Internet of Things device and the second Internet of Things device, respectively, for The first Internet of Things device and the second Internet of Things device respectively perform a trusted check with the trusted device.
  • the first Internet of Things device or the second Internet of Things device can obtain verification information from the trusted device, and complete a trusted verification with the trusted device according to the verification information.
  • the verification information is information for performing trusted verification on the trusted device.
  • the digital certificate is generated by a highly authoritative certificate visa platform, in order to improve the reliability of authenticating the trusted device, the encrypted communication is improved.
  • the verification information includes a digital certificate, and correspondingly, the first Internet of Things device or the second Internet of Things device may determine the digital certificate according to the preset root certificate. Passed the test.
  • Digital certificates are authoritative data that can be obtained from the certificate visa platform.
  • the digital certificate can be verified against the root certificate generated by the certificate visa platform.
  • the certificate visa platform may include the cloud in the foregoing.
  • the trusted device can obtain the digital certificate by logging in to the cloud through an account corresponding to the cloud.
  • the first IoT device or the second IoT device can obtain the root certificate in advance, for example, preset at the factory, or preset when deployed in the Internet of Things.
  • the digital certificate may further include a user identifier to indicate that the user identifier is valid for the IoT device corresponding to the digital certificate, that is, the trusted device where the user identifier is located has the right to access the Internet of Things device corresponding to the digital certificate. Therefore, the trusted device is trusted for the IoT device.
  • the device identifier is used to identify a device.
  • the device identifier may include a device ID (Identification, ID card) or a device serial number.
  • the user ID is used to identify a user, for example, the user ID can include a user name or a user ID.
  • the user ID can be received by the user and can of course be generated by the certificate visa platform.
  • the trusted device logs into the certificate visa platform, and the certificate visa platform determines the trusted device user identification C1, the digital certificate DC1 for the first Internet of Things device M1, and the digital certificate DC2 for the second Internet of Things device M2.
  • DC1 includes an explanation about C1 being valid for M1
  • DC2 includes a description about C1 being valid for M2, thereby ensuring that the trusted device logging in C1 has the right to access M1 and M2.
  • the verification information may also include other information, such as a trusted authentication identifier.
  • the trusted authentication identifier is an identifier indicating whether the current device is trusted, and may include a character string.
  • the trusted authentication identifier may include a device identifier, a user identifier of the user currently logged in by the device, or may be other information that can be trusted by the provider of the trusted authentication identifier.
  • the trusted authentication identifier can be generated by either end of the participating communication or the certificate visa platform and stored at both ends of the communication. When one end determines that the trusted authentication identifier provided by the other end is stored locally, it can be determined that the other end is trusted. Therefore, the first Internet of Things device or the second Internet of Things device can detect whether the trusted authentication identifier provided by the trusted device is stored locally, and if yes, determine that the trusted device is trusted, otherwise determine that the trusted device is not trusted.
  • the first Internet of Things device or the second Internet of Things device may obtain the trusted authentication identifier in advance, and store the trusted authentication identifier in the local trusted authentication identifier list.
  • the trusted device may provide the currently logged-in user identifier to the first Internet of Things device or the second Internet of Things device, and after the first Internet of Things device or the second Internet of Things device performs a trusted check on the trusted device, The user identifier is stored in the trusted authentication identifier list as a trusted authentication identifier. After the trusted device provides the user identifier, the trusted device can be determined to be trusted.
  • the trusted device fails to perform the trusted check, the subsequent operations can be stopped.
  • the trusted device can provide a digital signature to the first IoT device and the second IoT device, respectively, for the first IoT device and the second IoT device to verify The verification information is complete.
  • the first Internet of Things device or the second Internet of Things device can obtain a digital signature from the trusted device, and determine that the verification information is complete according to the digital signature.
  • a digital signature is a numeric string that can only be generated by a data sender, and is a proof of the authenticity of the data sender of the data.
  • the digital signature is non-repudiation so that the integrity of the data can be verified.
  • the trusted device may generate summary information of the transmitted communication data (such as the verification information in the foregoing), and encrypt the summary information through the cloud private key to obtain a digital signature, correspondingly, the first Internet of Things device or the second
  • the Internet of Things device decrypts the digital signature according to the cloud public key corresponding to the cloud private key, generates summary information again according to the received communication data, and compares the generated summary information with the decrypted summary information to verify the communication data.
  • the integrity if consistent, determines that the received data is complete, otherwise it determines that the received data is incomplete.
  • the summary information may be a hash value of the communication data.
  • the cloud private key and the cloud public key can be generated by the cloud.
  • the trusted device can obtain the cloud private key and the cloud public key from the cloud in advance.
  • the cloud public key and the cloud private key can be obtained when the digital certificate is obtained from the cloud as the certificate visa platform.
  • the first Internet of Things device or the second Internet of Things device may obtain the cloud public key from the digital certificate in the foregoing, or the cloud public key may be preset in the first Internet of Things device or the second Internet of Things device.
  • the verification information is encrypted by the cloud private key
  • the IoT device or the second IoT device may decrypt the verification information according to the cloud public key corresponding to the cloud private key before completing the trusted verification with the trusted device according to the verification information.
  • the trusted device can encrypt the communication data (such as the verification information) through the cloud private key, so that the first Internet of Things device or the second Internet of Things device can decrypt the encrypted communication data through the cloud public key corresponding to the cloud. To ensure the security of communication data.
  • the encrypted communication based on symmetric encryption is more efficient than the encrypted communication based on asymmetric encryption. Therefore, in order to improve the efficiency of the encrypted communication between the trusted device and the first IoT device, the trusted device and the first IoT device may acquire the second communication communication key, thereby based on the second communication key, Encrypted communication between the trusted device and the first IoT device is performed.
  • the second communication key is a communication key used by the trusted device to perform encrypted communication with the first Internet of Things device.
  • the second communication key can be generated by at least one of the trusted device and the first IoT device.
  • the second communication key is generated by the first Internet of Things device.
  • the first IoT device may obtain a second key generation parameter from at least one end of the trusted device and the first IoT device, and generate the second communication according to the acquired second key generation parameter. Key.
  • the trusted device can obtain the second communication key from the first IoT device.
  • the second key generation parameter is a key generation parameter required to generate the second communication key.
  • the first IoT device may generate a second communication key by using a key generation algorithm according to the second key generation parameter.
  • the second communication key is generated by the trusted device.
  • the trusted device may obtain a second key generation parameter from at least one end of the trusted device and the first IoT device, and generate the second communication key according to the acquired second key generation parameter.
  • the first IoT device can acquire the second communication key from the trusted device.
  • the manner in which the trusted device generates the second communication key may be the same as the manner in which the first IoT device generates the second communication key, and details are not described herein again.
  • the second communication key may be respectively generated by the trusted device and the first Internet of Things device, and the same second secret may be obtained from at least one end of the trusted device and the first Internet of Things device respectively.
  • the key generates parameters, thereby generating a second communication key by using the same key generation algorithm according to the acquired second key generation parameter.
  • the trusted device or the first IoT device may separately generate a second key generation parameter and notify the generated second key generation parameter to the other end, thereby ensuring that the trusted device and the first Internet of Things device can acquire the same The second key generation parameter.
  • the trusted device generates and provides a 32-bit random number R11 to M1, and M1 generates and provides a 32-bit random number R21 to the trusted device, so that the trusted device and M1 can obtain the same second key generation.
  • the trusted device and M1 can generate a 64-bit second communication key E1 based on R11 and R21, respectively.
  • the encrypted communication based on symmetric encryption is more efficient than the encrypted communication based on asymmetric encryption. Therefore, in order to improve the efficiency of the encrypted communication between the trusted device and the second Internet of Things device, the trusted device and the second IoT device may acquire the third communication communication key, thereby based on the third communication key, Encrypted communication between the trusted device and the third IoT device.
  • the manner in which the trusted device and the second IoT device obtain the third communication key may be the same as the manner in which the trusted device and the first IoT device obtain the second communication key, and details are not described herein again.
  • the trusted device can generate a 32-bit random number R31 and send the R31 to M2, which generates a 32-bit random number R32 and sends R32 to the trusted device.
  • the trusted device and M2 generate a 64-bit third communication key E3 according to R31 and R32 (R31 and R32 are the third key generation parameters, respectively).
  • Step 302 The trusted device provides a first communication key to the first Internet of Things device and/or the second Internet of Things device.
  • the networked device performs security and reliability of the encrypted communication, and the trusted device can provide the first communication key to the first Internet of Things device and/or the second Internet of Things device, the first Internet of Things device and/or the second Internet of Things The device can obtain the first communication key.
  • the first communication key is generated by the trusted device.
  • the trusted device may obtain the first key generation parameter from the at least one end of the trusted device, the first Internet of Things device, and the second Internet of Things device, and generate a parameter according to the acquired first key. Generating the first communication key.
  • the first IoT device and the second IoT device may obtain the first communication key generated by the trusted device from the trusted device, and correspondingly, the trusted device may send the first communication key to the first object A networked device and the second Internet of Things device.
  • the first key generation parameter is a key generation parameter required to generate the first communication key.
  • the first IoT device or the second IoT device may generate a first key generation parameter, and the generated first key generation parameter is sent to the trusted device. And in order to ensure the security of the first key generation parameter, the first physical network device or the second physical network device may further encrypt the sent first key generation parameter, for example, the first Internet of Things device may pass the second The communication key encrypts the first key generation parameter.
  • the first communication key is used by the first Internet of Things device.
  • the first IoT device may obtain the first key generation parameter from at least one of the trusted device, the first Internet of Things device, and the second Internet of Things device, and generate the first key according to the acquired first key. a parameter, generating the first communication key.
  • the trusted device may acquire the first communication key and send the first communication key to another one of the second Internet of Things devices, and correspondingly, the second Internet of Things device may obtain from the trusted device The first communication key generated by the second Internet of Things device.
  • the trusted device may generate a first key generation parameter and send the first key generation parameter to the first Internet of Things device.
  • the second IoT device may generate a first key generation parameter and send the first key generation parameter to the trusted device, and the trusted device forwards the first key generation parameter to the first Internet of Things device.
  • M1 generates a 32-bit random number R21
  • the trusted device generates a 32-bit random number R22
  • M1 can send E2 to the trusted device
  • the trusted device sends E2 to M2.
  • the first communication key is used by the second Internet of Things device.
  • the second IoT device may obtain the first key generation parameter from the at least one end of the trusted device, the first IoT device, and the second IoT device, and generate the first key according to the acquired first key. a parameter, generating the first communication key.
  • the trusted device may acquire the first communication key and send the first communication key to the first Internet of Things device, and correspondingly, the second Internet of Things device may obtain the The first communication key generated by the second Internet of Things device.
  • the manner in which the second IoT device obtains the first key generation parameter and generates the first communication key may be the same as the manner in which the first IoT device acquires the first key generation parameter and generates the first communication key. I will not repeat them one by one.
  • the first communication secret is generated by the first IoT device and the second IoT device.
  • the first IoT device and the second IoT device may respectively acquire the first key generation parameter from at least one of the trusted device, the first IoT device, and the second IoT device, and pass the
  • the signaling device determines that the first key generation parameters used are the same and the key generation algorithm used is the same, and then uses the first key parameter to generate the first communication key according to the key generation algorithm.
  • the first key generation parameter may be provided to the first Internet of Things device and the second Internet of Things device by the trusted device. Another; if the trusted device generates the first key generation parameter, the first key generation parameter may be separately sent to the first Internet of Things device and the second Internet of Things device, thereby ensuring the first Internet of Things device and the second Internet of Things
  • the first key generation parameter used by the device is the same.
  • Step 303 The first Internet of Things device and the second Internet of Things device perform mutual authentication with each other.
  • the first IoT device and the second IoT device can perform mutual authentication with each other.
  • the first IoT device stores A trusted authentication identifier list.
  • the first IoT device can obtain the trusted authentication identifier provided by the second Internet of Things device, and determine that the trusted authentication identifier exists in the trusted authentication identifier list. If it is determined that the trusted authentication identifier exists in the trusted authentication identifier list, it may be determined that the second IoT device is trusted, otherwise the second IoT device may be determined to be untrustworthy.
  • the first Internet of Things device may obtain the device identifier or the user identifier of the second Internet of Things device as a trusted authentication identifier in advance.
  • the first IoT device may generate a string as a trusted authentication identifier and provide the trusted authentication identifier to the second Internet of Things device through the trusted device.
  • the second IoT device, the trusted device, or the cloud as the certificate visa platform generates a string as a trusted authentication identifier, and the first IoT device obtains the trusted authentication identifier through the trusted device and stores the identifier.
  • the trusted device provides The trusted authentication identifier can also be trusted, thus implementing trusted authentication between the first Internet of Things device and the second Internet of Things device using the trusted device as a medium.
  • the second IoT device in order to reduce the possibility that the second IoT device communicates with the untrusted IoT device, the security and reliability of the communication are further improved, and the second IoT device stores A trusted authentication identifier list, and correspondingly, the second Internet of Things device can obtain the trusted authentication identifier provided by the first Internet of Things device, and determine that the trusted authentication identifier exists in the trusted authentication identifier list. If it is determined that the trusted authentication identifier exists in the trusted authentication identifier list, it may be determined that the first Internet of Things device is trusted, otherwise the first Internet of Things device may be determined to be untrustworthy.
  • the second Internet of Things device may obtain the device identifier or the user identifier of the first Internet of Things device as a trusted authentication identifier in advance.
  • the second IoT device may generate a trusted authentication identifier and provide the trusted authentication identifier to the first Internet of Things device through the trusted device.
  • the first Internet of Things device, the trusted device, or the cloud as the certificate visa platform generates a string as a trusted authentication identifier, and the second Internet of Things device obtains the unfortunate authentication identifier through the trusted device and stores the identifier.
  • the trusted device randomly generates a trusted authentication identifier C2, provides C2 to M1 and M2, and M1 and M2 acquires C2 and stores C2 in the local trusted authentication list.
  • M1 a trusted authentication identifier
  • M2 M1 and M2 acquires C2 and stores C2 in the local trusted authentication list.
  • M1 receives C2 provided by M2, since C2 is stored in the trusted authentication list stored locally by M1, it can be determined that M2 is trusted.
  • M2 can also determine that M1 is trusted, thus completing the trusted verification between M1 and M2.
  • step 303 is an optional step.
  • Step 304 The first Internet of Things device and the second Internet of Things device perform encrypted communication based on the first communication key.
  • the encrypted communication can be performed through the first communication key, thereby ensuring communication data security.
  • the first Internet of Things device may be first based on the first communication key pair.
  • the communication data of the Internet of Things device is encrypted and transmitted to the second IoT device; or the communication data of the second IoT device is decrypted based on the first communication key.
  • the second IoT device may encrypt the communication data of the second IoT device based on the first communication key and send the data to the first IoT device; or, based on the first communication key pair
  • the communication data of an Internet of Things device is decrypted.
  • the trusted data identifier may be carried in the communication data, so that the first Internet of Things device or the second Internet of Things device determines that the source of the communication data is trusted.
  • the Internet of Things device may have a variable attribute, in order to facilitate the user to perceive the attribute of the IoT device in time, and improve the effectiveness of obtaining the attribute of the IoT device, Activating the synchronization performance between the monitoring device and the IoT device, the first IoT device may acquire a subscription request of the monitoring device for the attribute change event of the first IoT device, detect an attribute change event, and notify the monitoring device.
  • the properties of the IoT device are the attributes of the IoT device.
  • the properties of the IoT device may include the switch state, the color of the light, or the brightness of the light; when the IoT device is an air conditioner, The properties of the IoT device may include switch states, operating modes or temperature settings, and the like.
  • the monitoring device is a device that monitors the attributes of the IoT device, and the monitoring may include a client or a second IoT device.
  • An attribute change event is an event generated by an IoT device changing according to an attribute.
  • the subscription request for the attribute change event is a request for the monitoring device to subscribe to the property change device for the property change event.
  • the monitoring device may send a subscription request for the attribute change event to the first IoT device based on the CoAP (Constrained Application Protocol).
  • CoAP Constrained Application Protocol
  • the CoAP-based attribute change event protocol includes event topics and event content.
  • the event subject can be a string that includes the device ID of the target device and the event path.
  • the target device is the device that needs to subscribe to the event, such as the first IoT device.
  • the event location is the location of the property change event in the target device.
  • the event topic can include "/dev/ ⁇ $devId ⁇ /thing/event/property/post".
  • dev is a fixed prefix
  • $devId is the device identifier of the target device, and the device identifier can be provided by the target device
  • thing/event/property/post is the event location of the attribute change event at the target device, of course, in practice
  • the location of an event can also be represented by other forms.
  • Event content includes event subscriptions, event subscription cancellations, and event triggers.
  • the content of the event can be represented by the observe field or the observe option in the CoAP protocol.
  • the subscription request can include event topics and event content for the subscribed event: event subscription.
  • the observe field is in the payload of the CoAP protocol.
  • the value of the observe field can indicate the number of times the attribute change event is triggered.
  • the subscription request carries the observe string format field, and the value is non-empty.
  • the first IoT device When receiving the subscription request, the first IoT device subscribes to the attribute change event according to the event location included in the attribute change event protocol. If the subscription is successful, the first IoT device feeds back the subscription success message to the monitoring device, and the message type is successful. The subscription success message carries the observe string format field, and the value is non-empty. If the subscription fails, the first IoT device feeds back the subscription failure message to the monitoring device, the message type is failure, and the subscription failure message carries the observe string format field, and the value is non-empty.
  • the first IoT device may return an attribute change event notification to the monitoring device when the attribute change event is detected, the attribute change event notification includes the subscribed attribute, and the attribute change event notification carries the observe string format field The value of this observe is the value of the value of observe in the last attribute change event notification incremented by 1.
  • the target attribute may be included in the subscription request, so that only the attribute change event for the target attribute is subscribed.
  • the target attribute is an attribute that needs to be subscribed, and the target attribute can be determined by the monitoring device.
  • the monitoring device can also send a subscription cancellation request of the attribute change event like the first IoT device, and the subscription cancellation request does not carry the observe string format field.
  • the first IoT device receives the subscription cancellation request, and if the subscription is successfully cancelled, the subscription cancellation cancellation success message is sent, and the message type is successful. If the unsubscribe fails, the subscription subscription cancellation failure message is returned and the message type is failed.
  • the first IoT device may provide attribute related information to the monitoring device before the obtaining monitoring device subscribes to the attribute change event of the first IoT device.
  • the attribute related information is information related to an attribute possessed by the IoT device, and the attribute related information may include at least one of an attribute, a range of values of each attribute, whether it can be subscribed, and a subscription manner.
  • the monitoring device may send a CoAP-based device discovery request, where the device discovery request may include a target device identifier, and when the target device receives the device discovery request, feed back the attribute related information to the monitoring device. Therefore, the first IoT device may feed back the attribute related information of the first Internet of Things device to the monitoring device when receiving the device discovery request and determining that the device discovery request carries the device identifier of the first Internet of Things device.
  • the device discovery request may also not carry the target device identifier, and any IoT device that receives the device discovery request feeds back the attribute related information to the monitoring device.
  • the first network device detects the attribute.
  • the attribute initial data of the first Internet of Things device is detected and provided to the monitoring device.
  • the monitoring device can obtain the initial data of the attribute provided by the first Internet of Things device, and display the initial data of the attribute through the page, and then, if the attribute change event is received, update the displayed initial data of the attribute.
  • the attribute initial data is an initial value of the attribute that the first IoT device has before detecting the attribute change event.
  • a communication connection between the first Internet of Things device and the second Internet of Things device and the trusted device may be established. Since the trusted device is trusted, the trusted device may be securely and reliably Providing the first communication key to the first Internet of Things device and/or the second Internet of Things device, ensuring that the first IoT device and the second Internet of Things can obtain the first communication key, thereby based on the first communication key Encrypted communication improves the security and reliability of communication between the first IoT device and the second IoT device.
  • the first Internet of Things device or the second Internet of Things device can perform trusted verification on the trusted device according to the verification information, thereby ensuring the reliability of the trusted device and improving the security of acquiring the first communication key and Reliability improves the security and reliability of encrypted communication based on the first communication key.
  • the first Internet of Things device and the second Internet of Things device can perform mutual trusted verification, including verifying the trusted authentication identifier provided by the other end of the first Internet of Things device and the second Internet of Things device, whether The list of trusted identifiers stored locally reduces the possibility of IoT devices communicating with untrusted IoT devices, further improving the security and reliability of communications.
  • the first Internet of Things device, the second Internet of Things device, and the trusted device are both capable of generating the first communication key, which improves the reliability of generating the first communication key.
  • FIG. 4 a method for communication between Internet of Things devices is illustrated, which specifically includes:
  • the cloud can be used as a certificate visa platform, and the client is used as a trusted device, and the client has an application corresponding to the cloud.
  • the cloud obtains account information from the client
  • the account information may be account information for the cloud.
  • the cloud feeds back a key pair and a digital certificate to the client;
  • the cloud can generate the user account C1 according to the account information of the client login, generate the digital certificate DC1 of the client for the device M1, and the digital certificate DC2 of the client for the device M2.
  • the key pair includes a cloud private key and a cloud public key.
  • the client sends C1 and a 32-bit random number R11 to M1;
  • the transmitted C1 and R11 are encrypted by the cloud private key and carry a digital signature and DC1.
  • S6, M1 decrypts C1 and R11 using the preset cloud public key.
  • M1 can parse the digital certificate and verify whether the digital certificate is trusted by the preset root certificate. If it is not trusted, the result is returned to the client and the process ends. If it is trusted, the cloud public key is extracted from the digital certificate, and the digital signature verification is used to determine whether the received data has been tampered with. If the verification fails, the result is returned to the client and the process ends. If the verification is successful, C1 and R11 are obtained by decrypting the cloud public key.
  • S8 M1 generates a 32-bit random number R12, and generates a 64-bit number E1 as a shared key based on R11 and R12;
  • S9 The M1 sends the encrypted R12 to the client, and the M1 authenticates the client successfully.
  • the client obtains R12, and generates E1 based on R11 and R12;
  • M1 and the client can implement encrypted communication between M1 and the client through E1.
  • the client randomly generates a user account C2 and a 32-bit random number R21;
  • the client encrypts C2 and R21 through E1 and sends it to M1;
  • M1 can decrypt the received data through E1 to obtain C2 and R21.
  • M1 generates a 32-bit random number R22, and generates a 64-bit number E2 as a shared key based on R21 and R22.
  • the client has many areas to R22, and generates E2 based on R21 and R22;
  • the client sends C1 and a 32-bit random number R31 to M2;
  • S20, M2 generates R32, and generates E3 based on R31 and R32;
  • S21, M2 is sent to the client through E3 encryption R32, and the authentication is successful;
  • the client generates E3 based on R31 and R32;
  • S27, M1 uses E2 decryption to obtain C2, and determines that C2 exists and a local trusted list;
  • secure and trusted communication can be implemented based on C2 and E2.
  • FIG. 5 a method for communication between Internet of Things devices is illustrated, which specifically includes:
  • the client sends a discovery protocol and discovers the online device M1;
  • the client can send a CoAP-based discovery protocol in the network, and the target device identifier can be carried in the discovery protocol.
  • M1 After receiving the discovery protocol, M1 can respond to the discovery protocol, and attach the attribute related information of M1, that is, the device capability of M1.
  • the M1 responds to the discovery protocol when determining the device identifier of the target device identifier as M1.
  • M1 When M1 receives a subscription request for an attribute change event, if it is determined that the attribute allows the subscription, the subscription is returned successfully, otherwise the subscription fails.
  • the client obtains the attribute value currently possessed by the M1;
  • M1 can return the acquisition success when it is determined that the client is allowed to obtain the attribute value, and carries the current attribute value. Otherwise, the acquisition fails, and the process ends.
  • M1 determines that the attribute value changes, it actively pushes the attribute change event to the client.
  • the client can display the attribute value through the page, and when the attribute change event is received, update the current attribute value to refresh the display page.
  • the device includes:
  • a communication connection establishing module 601, configured to establish a communication connection between the first IoT device and the trusted device;
  • a first communication key acquisition module 602 configured to acquire a first communication key, where the first communication key is provided by the trusted device to the first Internet of Things device and/or the second Internet of Things device;
  • the communication module 603 is configured to perform encrypted communication with the second Internet of Things device based on the first communication key.
  • the first communication key is generated by the first Internet of Things device
  • the first communication key acquisition module includes:
  • a first key generation parameter obtaining submodule configured to acquire first key generation parameters from at least one end of the trusted device, the first Internet of Things device, and the second Internet of Things device;
  • the first communication key generation submodule is configured to generate the first communication key according to the acquired first key generation parameter.
  • the first communication key is generated by the trusted device or the second Internet of Things device;
  • the first communication key acquisition module includes:
  • a first communication key acquisition submodule configured to acquire, from the trusted device, the first communication key generated by the trusted device or the second Internet of Things device.
  • the first IoT device stores a list of trusted authentication identifiers
  • the device also includes:
  • a trusted authentication identifier obtaining module configured to acquire a trusted authentication identifier provided by the second Internet of Things device
  • the first determining module is configured to determine that the trusted authentication identifier exists in the trusted authentication identifier list.
  • the communication module includes:
  • An encryption submodule configured to encrypt communication data of the first Internet of Things device based on the first communication key, and send the data to the second Internet of Things device;
  • a decryption submodule configured to decrypt the communication data of the second IoT device based on the first communication key.
  • the communication connection establishing module includes:
  • a verification information obtaining submodule configured to obtain verification information from the trusted device
  • the trusted verification submodule is configured to complete a trusted check with the trusted device according to the verification information.
  • the verification information includes a digital certificate
  • the trusted verification sub-module is further configured to:
  • the device further includes:
  • a digital signature obtaining module configured to acquire a digital signature from the trusted device
  • the second determining module is configured to determine that the verification information is complete according to the digital signature.
  • the verification information is encrypted by a cloud private key
  • the device also includes:
  • a decryption module configured to decrypt the verification information according to a cloud public key corresponding to the cloud private key.
  • the device further includes:
  • a second communication key obtaining module configured to acquire a second communication key, to perform encrypted communication with the trusted device based on the second communication key.
  • the second communication key is generated by the first Internet of Things device
  • the second communication key acquisition module includes:
  • a second key generation parameter obtaining submodule configured to acquire a second key generation parameter from at least one end of the trusted device and the first Internet of Things device;
  • a second communication key generation submodule configured to generate the second communication key according to the acquired second key generation parameter.
  • the second communication key is generated by the trusted device
  • the second communication key acquisition module includes:
  • a second communication key acquisition submodule configured to acquire the second communication key from the trusted device.
  • the device further includes:
  • a subscription request obtaining module configured to acquire a subscription request of the monitoring device for an attribute change event of the first IoT device
  • the attribute change event detecting module is configured to detect an attribute change event and notify the monitoring device.
  • the device further includes:
  • the attribute related information obtaining module is configured to provide attribute related information to the monitoring device.
  • the device further includes:
  • the attribute initial data detecting module is configured to detect attribute initial data of the first Internet of Things device and provide the monitoring data to the monitoring device.
  • At least one of the first Internet of Things device and the second Internet of Things device is in an offline state with the cloud.
  • a communication connection between the first IoT device and the trusted device may be established, and the first communication key is obtained, and since the trusted device is trusted, the trusted device may be securely and reliably Providing the first communication key to the first Internet of Things device and/or the second Internet of Things device, ensuring that the first IoT device and the second Internet of Things can obtain the first communication key, thereby based on the first communication key Encrypted communication improves the security and reliability of communication between the first IoT device and the second IoT device.
  • the device includes:
  • a communication connection establishing module 701 configured to separately establish a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device;
  • a first communication key providing module 702 configured to provide a first communication key to the first Internet of Things device and/or the second Internet of Things device, so that the first Internet of Things device and the second The Internet of Things device performs encrypted communication based on the first communication key.
  • the communication connection establishing module includes:
  • a verification information providing submodule configured to provide verification information to the first Internet of Things device and the second Internet of Things device, respectively, for the first Internet of Things device and the second Internet of Things device respectively.
  • the trusted device completes a trusted check.
  • the device further includes:
  • a digital signature providing module configured to provide a digital signature to the first Internet of Things device and the second Internet of Things device, respectively, for the first Internet of Things device and the second Internet of Things device to verify the verification The information is complete.
  • the first communication key is generated by the trusted device
  • the first communication key providing module includes:
  • a first communication key sending submodule configured to send the first communication key to the first Internet of Things device and the second Internet of Things device.
  • the first communication key is generated by the first Internet of Things device or the second Internet of Things device;
  • the first communication key providing module includes:
  • a first communication key sending submodule configured to acquire the first communication key, and send the first communication key to another one of the first IoT device and the second IoT device .
  • the device further includes:
  • a second communication acquiring module configured to acquire a second communication key, to perform encrypted communication with the first Internet of Things device based on the second communication key.
  • the device further includes:
  • a third communication key obtaining module configured to acquire a third communication key, to perform encrypted communication with the second Internet of Things device based on the third communication key.
  • a communication connection with the first Internet of Things device and the second Internet of Things device may be established. Since the trusted device is trusted, the first communication key may be securely and reliably passed by the trusted device. Providing to the first Internet of Things device and/or the second Internet of Things device, ensuring that the first IoT device and the second Internet of Things can obtain the first communication key, thereby performing encrypted communication based on the first communication key, thereby improving The security and reliability of communication between the first IoT device and the second IoT device.
  • the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.
  • Embodiments of the present application can be implemented as a system for performing a desired configuration using any suitable hardware, firmware, software, or any combination thereof.
  • FIG. 8 schematically illustrates an exemplary system (or apparatus) 800 that can be used to implement various embodiments described in this application.
  • FIG. 8 illustrates an exemplary system 800 having one or more processors 802, a system control module (chipset) coupled to at least one of the processor(s) 802. 804.
  • System memory 806 coupled to system control module 804, non-volatile memory (NVM)/storage device 808 coupled to system control module 804, and one or more inputs/outputs coupled to system control module 804 Device 810, and a network interface 812 that is coupled to system control module 806.
  • NVM non-volatile memory
  • Processor 802 can include one or more single or multiple core processors, and processor 802 can comprise any combination of general purpose or special purpose processors (eg, graphics processors, application processors, baseband processors, etc.).
  • system 800 can function as the communication device described in the embodiments of the present application.
  • system 800 can include and be integrated with one or more computer readable media (eg, system memory 806 or NVM/storage device 808) with instructions configured to One or more processors 802 that execute the instructions to implement the modules to perform the actions described herein.
  • computer readable media eg, system memory 806 or NVM/storage device 808
  • processors 802 execute the instructions to implement the modules to perform the actions described herein.
  • system control module 804 can include any suitable interface controller to provide to at least one of processor(s) 802 and/or any suitable device or component in communication with system control module 804. Any suitable interface.
  • System control module 804 can include a memory controller module to provide an interface to system memory 806.
  • the memory controller module can be a hardware module, a software module, and/or a firmware module.
  • System memory 806 can be used, for example, to load and store data and/or instructions for system 800.
  • system memory 806 can include any suitable volatile memory, such as a suitable DRAM.
  • system memory 806 can include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).
  • system control module 804 can include one or more input/output controllers to provide an interface to NVM/storage device 808 and input/output device(s) 810.
  • NVM/storage device 808 can be used to store data and/or instructions.
  • NVM/storage device 808 can include any suitable non-volatile memory (eg, flash memory) and/or can include any suitable non-volatile storage device(s) (eg, one or more hard disk drives (HDD), one or more compact disc (CD) drives and/or one or more digital versatile disc (DVD) drives).
  • HDD hard disk drives
  • CD compact disc
  • DVD digital versatile disc
  • NVM/storage device 808 can include storage resources that are physically part of the device on which system 800 is installed, or that can be accessed by the device without having to be part of the device.
  • the NVM/storage device 808 can be accessed via the network via the input/output device(s) 810.
  • the input/output device(s) 810 can provide an interface to the system 800 to communicate with any other suitable device, and the input/output device 810 can include a communication component, an audio component, a sensor component, and the like.
  • Network interface 812 can provide an interface for system 800 to communicate over one or more networks, and system 800 can interact with one or more of the wireless networks in accordance with any of one or more wireless network standards and/or protocols.
  • the components communicate wirelessly, such as by accessing a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof for wireless communication.
  • At least one of the processor(s) 802 can be packaged with logic of one or more controllers (eg, memory controller modules) of the system control module 804.
  • at least one of the processor(s) 802 can be packaged with the logic of one or more controllers of the system control module 804 to form a system in package (SiP).
  • at least one of the processor(s) 802 can be integrated with the logic of one or more controllers of the system control module 804 on the same mold.
  • at least one of the processor(s) 802 can be integrated with the logic of one or more controllers of the system control module 804 on the same mold to form a system on a chip (SoC).
  • SoC system on a chip
  • system 800 can be, but is not limited to, a workstation, a desktop computing device, or a mobile computing device (eg, a laptop computing device, a handheld computing device, a tablet, a netbook, etc.).
  • system 800 can have more or fewer components and/or different architectures.
  • system 800 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application specific integrated circuit ( ASIC) and speakers.
  • LCD liquid crystal display
  • ASIC application specific integrated circuit
  • the display screen can be implemented as a touch screen display to receive an input signal from the user.
  • the touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel.
  • the touch sensor may sense not only the boundary of the touch or sliding action, but also the duration and pressure associated with the touch or slide operation.
  • the embodiment of the present application further provides a non-volatile readable storage medium, where the storage medium stores one or more programs, and when the one or more modules are applied to the terminal device, the terminal may be The device executes the instructions of the method steps in the embodiment of the present application.
  • An apparatus comprising: one or more processors; and one or more machine-readable media having instructions stored thereon, when executed by the one or more processors, The apparatus is caused to perform a method as performed by the communication apparatus in the embodiment of the present application.
  • Also provided in one example is one or more machine readable medium having stored thereon instructions that, when executed by one or more processors, cause a device to perform a method as performed by a communication device in an embodiment of the present application.
  • the embodiment of the present application discloses a communication method and device between Internet of Things devices.
  • Example 1 A method of communication between IoT devices, including:
  • the first communication key being provided by the trusted device to the first Internet of Things device and/or the second Internet of Things device;
  • Example 2 may include the method of example 1, the first communication key being generated by the first IoT device;
  • the obtaining the first communication key includes:
  • Example 3 may include the method of example 1, the first communication key being generated by the trusted device or the second Internet of Things device;
  • the obtaining the first communication key includes:
  • Example 4 may include the method of example 1, in which the trusted authentication identifier list is stored in the first Internet of Things device;
  • the method further includes:
  • Example 5 may include the method of example 1, the encrypting communication with the second IoT device based on the first communication key comprises:
  • Example 6 may include the method of example 1, the establishing a communication connection between the first IoT device and the trusted device comprises:
  • Example 7 may include the method of example 6, the verification information comprising a digital certificate, and the performing the trusted verification with the trusted device according to the verification information comprises:
  • Example 8 may include the method of example 6, the method further comprising:
  • Example 9 may include the method of example 6, the verification information being encrypted by a cloud private key
  • the method further includes: before the performing the trusted verification with the trusted device according to the verification information, the method further includes:
  • the verification information is decrypted according to a cloud public key corresponding to the cloud private key.
  • Example 10 can include the method of example 1, the method further comprising:
  • Example 11 may include the method of example 10, the second communication key being generated by the first IoT device;
  • the obtaining the second communication key includes:
  • Example 12 may include the method of example 10, the second communication key being generated by the trusted device;
  • the obtaining the second communication key includes:
  • Example 13 may include the method of example 1, the method further comprising:
  • a property change event is detected and notified to the monitoring device.
  • Example 14 may include the method of example 13, before the obtaining a subscription request of the monitoring device for the attribute change event of the first IoT device, the method further comprising:
  • Example 15 may include the method of example 13, before the detecting an attribute change event, the method further comprising:
  • Example 16 may include the method of example 1, the at least one of the first Internet of Things device and the second Internet of Things device being in an offline state with the cloud.
  • Example 17 a method for communication between Internet of Things devices, comprising:
  • Providing a first communication key to the first IoT device and/or the second IoT device such that the first IoT device and the second IoT device are based on the first communication key Perform encrypted communication.
  • the example 18 may include the method of example 17, the establishing a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device, respectively:
  • Example 19 can include the method of example 18, the method further comprising:
  • Example 20 may include the method of example 17, the first communication key being generated by the trusted device;
  • the providing the first communication key to the first Internet of Things device and/or the second Internet of Things device comprises:
  • Example 21 may include the method of example 20, the first communication key being generated by the first IoT device or the second IoT device;
  • the providing the first communication key to the first Internet of Things device and/or the second Internet of Things device comprises:
  • Example 22 can include the method of example 17, the method further comprising:
  • Example 23 can include the method of example 17, the method further comprising:
  • Example 24 A communication device between the Internet of Things devices, comprising:
  • a communication connection establishing module configured to establish a communication connection between the first IoT device and the trusted device
  • a first communication key acquisition module configured to acquire a first communication key, where the first communication key is provided by the trusted device to the first Internet of Things device and/or the second Internet of Things device;
  • a communication module configured to perform encrypted communication with the second Internet of Things device based on the first communication key.
  • Example 25 may include the apparatus of example 24, the first communication key being generated by the first internet of things device;
  • the first communication key acquisition module includes:
  • a first key generation parameter obtaining submodule configured to acquire first key generation parameters from at least one end of the trusted device, the first Internet of Things device, and the second Internet of Things device;
  • the first communication key generation submodule is configured to generate the first communication key according to the acquired first key generation parameter.
  • Example 26 may include the apparatus of example 24, the first communication key being generated by the trusted device or the second Internet of Things device;
  • the first communication key acquisition module includes:
  • a first communication key acquisition submodule configured to acquire, from the trusted device, the first communication key generated by the trusted device or the second Internet of Things device.
  • Example 27 may include the apparatus of example 24, wherein the first Internet of Things device stores a list of trusted authentication identifiers;
  • the device also includes:
  • a trusted authentication identifier obtaining module configured to acquire a trusted authentication identifier provided by the second Internet of Things device
  • the first determining module is configured to determine that the trusted authentication identifier exists in the trusted authentication identifier list.
  • Example 28 can include the apparatus of example 24, the communication connection establishing module comprising:
  • a verification information obtaining submodule configured to obtain verification information from the trusted device
  • the trusted verification submodule is configured to complete a trusted check with the trusted device according to the verification information.
  • Example 29 can include the apparatus of example 24, the apparatus further comprising:
  • a second communication key obtaining module configured to acquire a second communication key, to perform encrypted communication with the trusted device based on the second communication key.
  • Example 30 can include the apparatus of example 24, the apparatus further comprising:
  • a subscription request obtaining module configured to acquire a subscription request of the monitoring device for an attribute change event of the first IoT device
  • the attribute change event detecting module is configured to detect an attribute change event and notify the monitoring device.
  • the example 31 may include the apparatus of example 24, wherein at least one of the first Internet of Things device and the second Internet of Things device is in an offline state with the cloud.
  • Example 32 A communication device between an Internet of Things device, comprising:
  • a communication connection establishing module configured to separately establish a communication connection between the trusted device and the first Internet of Things device and the second Internet of Things device;
  • a first communication key providing module configured to provide a first communication key to the first Internet of Things device and/or the second Internet of Things device, to enable the first Internet of Things device and the second object
  • the networked device performs encrypted communication based on the first communication key.
  • Example 33 can include the apparatus of example 32, the communication connection establishing module comprising:
  • a verification information providing submodule configured to provide verification information to the first Internet of Things device and the second Internet of Things device, respectively, for the first Internet of Things device and the second Internet of Things device respectively.
  • the trusted device completes a trusted check.
  • Example 34 may include the apparatus of example 32, the first communication key being generated by the trusted device;
  • the first communication key providing module includes:
  • a first communication key sending submodule configured to send the first communication key to the first Internet of Things device and the second Internet of Things device.
  • Example 35 may include the apparatus of example 32, the first communication key being generated by the first IoT device or the second IoT device;
  • the first communication key providing module includes:
  • a first communication key sending submodule configured to acquire the first communication key, and send the first communication key to another one of the first IoT device and the second IoT device .
  • Example 36 An apparatus comprising: one or more processors; and one or more machine readable medium having instructions stored thereon, when executed by the one or more processors, causing the apparatus A method of one or more of Example 1 - Example 23 is performed.
  • Example 35 one or more machine readable medium having stored thereon instructions that, when executed by one or more processors, cause the apparatus to perform the method of one or more of Examples 1 - 23.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Medical Informatics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供了一种物联网设备之间的通信方法及装置。所述方法包括：建立第一物联网设备与可信设备的通信连接；获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；基于所述第一通信密钥，与所述第二物联网设备进行加密通信，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。

Description

物联网设备之间的通信方法及装置
本申请要求2018年04月17日递交的申请号为201810343519.8、发明名称为“物联网设备之间的通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及物联网技术领域，特别是涉及一种物联网设备之间的通信方法及装置。
背景技术
随着物联网技术的发展，各种物联网设备的应用也越来越广泛。为了使实现物联网设备之间的互相联动，物联网设备之间需要进行通信。
现有技术中，物联网设备之间直接连接并通过明文通信，但明文通信容易导致数据泄露，通信的安全性较低。
发明内容
鉴于上述问题，提出了本申请以便提供一种克服上述问题或者至少部分地解决上述问题的物联网设备之间的通信方法及装置。
本申请提供了一种物联网设备之间的通信方法，包括：
建立第一物联网设备与可信设备的通信连接；
获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
可选的，所述第一通信密钥由所述第一物联网设备生成；
所述获取第一通信密钥包括：
从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
根据所获取的第一密钥生成参数，生成所述第一通信密钥。
可选的，所述第一通信密钥由所述可信设备或所述第二物联网设备生成；
所述获取第一通信密钥包括：
从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
可选的，所述第一物联网设备中存储有可信认证标识列表；
在所述基于所述第一通信密钥，与所述第二物联网设备进行加密通信之前，所述方法还包括：
获取所述第二物联网设备提供的可信认证标识；
确定所述可信认证标识存在于可信认证标识列表中。
可选的，所述基于所述第一通信密钥，与所述第二物联网设备进行加密通信包括：
基于所述第一通信密钥对第一物联网设备的通信数据进行加密，并发送至第二物联网设备；或，
基于所述第一通信密钥对第二物联网设备的通信数据进行解密。
可选的，所述建立第一物联网设备与可信设备的通信连接包括：
从所述可信设备获取校验信息；
根据所述校验信息，与所述可信设备完成可信校验。
可选的，所述校验信息包括数字证书，所述根据所述校验信息，与所述可信设备完成可信校验包括：
根据预置的根证书，确定对所述数字证书校验通过。
可选的，所述方法还包括：
从所述可信设备获取数字签名；
根据所述数字签名，确定所述校验信息完整。
可选的，所述校验信息经过云端私钥加密；
在所述根据所述校验信息，与所述可信设备完成可信校验之前，所述方法还包括：
根据与所述云端私钥所对应的云端公钥，对所述校验信息进行解密。
可选的，所述方法还包括：
获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
可选的，所述第二通信密钥由所述第一物联网设备生成；
所述获取第二通信密钥包括：
从所述可信设备和所述第一物联网设备中的至少一端分别获取第二密钥生成参数；
根据所获取的第二密钥生成参数，生成所述第二通信密钥。
可选的，所述第二通信密钥由所述可信设备生成；
所述获取第二通信密钥包括：
从所述可信设备获取所述第二通信密钥。
可选的，所述方法还包括：
获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
检测属性变化事件，并通知至所述监控设备。
可选的，在所述获取监控设备对所述第一物联网设备的属性变化事件的订阅请求之前，所述方法还包括：
向所述监控设备提供属性相关信息。
可选的，在所述检测属性变化事件之前，所述方法还包括：
检测所述第一物联网设备的属性初始数据，并提供给所述监控设备。
本申请还提供了一种物联网设备之间的通信方法，包括：
分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
可选的，所述分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接包括：
分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
可选的，所述方法还包括：
分别向所述第一物联网设备和所述第二物联网设备提供数字签名，以供所述第一物联网设备和所述第二物联网设备验证所述校验信息完整。
可选的，所述第一通信密钥由所述可信设备生成；
所述提供第一通信密钥给所述第一物联网设备和/或第二物联网设备包括：
将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
可选的，所述第一通信密钥由所述第一物联网设备或所述第二物联网设备生成；
所述提供第一通信密钥给所述第一物联网设备和/或第二物联网设备包括：
获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备中的另一个。
可选的，所述方法还包括：
获取第二通信密钥，以基于所述第二通信密钥，与所述第一物联网设备进行加密通信。
可选的，所述方法还包括：
获取第三通信密钥，以基于所述第三通信密钥，与所述第二物联网设备进行加密通信。
本申请还提供了一种物联网设备之间的通信装置，包括：
通信连接建立模块，用于建立第一物联网设备与可信设备的通信连接；
第一通信密钥获取模块，用于获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
通信模块，用于基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
可选的，所述第一通信密钥由所述第一物联网设备生成；
所述第一通信密钥获取模块包括：
第一密钥生成参数获取子模块，用于从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
第一通信密钥生成子模块，用于根据所获取的第一密钥生成参数，生成所述第一通信密钥。
可选的，所述第一通信密钥由所述可信设备或所述第二物联网设备生成；
所述第一通信密钥获取模块包括：
第一通信密钥获取子模块，用于从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
可选的，所述第一物联网设备中存储有可信认证标识列表；
所述装置还包括：
可信认证标识获取模块，用于获取所述第二物联网设备提供的可信认证标识；
第一确定模块，用于确定所述可信认证标识存在于可信认证标识列表中。
可选的，所述通信连接建立模块包括：
校验信息获取子模块，用于从所述可信设备获取校验信息；
可信校验子模块，用于根据所述校验信息，与所述可信设备完成可信校验。
可选的，所述装置还包括：
第二通信密钥获取模块，用于获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
可选的，所述装置还包括：
订阅请求获取模块，用于获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
属性变化事件检测模块，用于检测属性变化事件，并通知至所述监控设备。
本申请还提供了一种物联网设备之间的通信装置，包括：
通信连接建立模块，用于分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
第一通信密钥提供模块，用于提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
可选的，所述通信连接建立模块包括：
校验信息提供子模块，用于分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
可选的，所述第一通信密钥由所述可信设备生成；
所述第一通信密钥提供模块包括：
第一通信密钥发送子模块，用于将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
可选的，所述第一通信密钥由所述第一物联网设备或所述第二物联网设备生成；
所述第一通信密钥提供模块包括：
第一通信密钥发送子模块，用于获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备中的另一个。
本申请还提供了一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述计算机程序时实现如前述的一个或多个的方法。
本申请还提供了一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如前述的一个或多个的方法。
在本申请实施例中，可以建立第一物联网设备与可信设备之间的通信连接，获取第一通信密钥，且由于可信设备是可信的，可以通过可信设备安全可靠地将第一通信密钥，提供给第一物联网设备和/或第二物联网设备，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。
上述说明仅是本申请技术方案的概述，为了能够更清楚了解本申请的技术手段，而 可依照说明书的内容予以实施，并且为了让本申请的上述和其它目的、特征和优点能够更明显易懂，以下特举本申请的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其它的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本申请的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了根据本申请一个实施例一的一种物联网设备之间的通信方法流程图；
图2示出了根据本申请一个实施例二的一种物联网设备之间的通信方法流程图；
图3示出了根据本申请一个实施例三的一种物联网设备之间的通信方法流程图；
图4示出了根据本申请一个实施例的一种物联网设备之间的通信方法流程图；
图5示出了根据本申请一个实施例的另一种物联网设备之间的通信方法流程图；
图6示出了根据本申请一个实施例四的一种物联网设备之间的通信装置结构框图；
图7示出了根据本申请一个实施例五的一种物联网设备之间的通信装置结构框图；
图8示出了根据本申请一个实施例的一种示例性系统的结构框图。
具体实施方式
下面将参照附图更详细地描述本申请示例性实施例。虽然附图中显示了本申请示例性实施例，然而应当理解，可以以各种形式实现本申请而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本申请，并且能够将本申请的范围完整的传达给本领域的技术人员。
为了便于本领域技术人员深入理解本申请实施例，以下将首先介绍本申请实施例中所涉及的专业术语的定义。
物联网设备可以包括VR(Virtual Reality，虚拟现实)设备、平板电脑、电子书阅读器、MP3(Moving Picture Experts Group Audio Layer III，动态影像专家压缩标准音频层面3，)播放器、MP4(Moving Picture Experts Group Audio Layer IV，动态影像专家压缩标准音频层面4)播放器、膝上型便携计算机、车载电脑、机顶盒、智能电视机、可穿戴设备、智能灯、智能音箱、家庭网关等等。该物联网设备可以包括应用程序或插件，且可以包括下图6-图8中的任一装置，实施图1-图5中的任一方法，从而对与其它物联网设备进行通信。
第一物联网设备或第二物联网设备可以是物联网中任意的两个设备。
应用程序能够运行在物联网设备中，从而实现本申请实施例提供的物联网设备之间的通信方法。
插件可以包括在运行于物联网设备的应用程序中，从而实现本申请实施例提供的物联网设备之间的通信方法。
可信设备为安全可信的设备，从而能够为第一物联网和/或第二物联网设备提供第一通信密钥，包括第一通信密钥的生成和/或转发等。该可信设备可以包括客户端。当然，在实际应用中，可信设备还可以向第一物联网设备和/或第二物联网设备提供其它与通信有关的服务或数据，比如，提供生成第一通信密钥所需的密钥生成参数等。比如，可信设备可以包括手机。
通信密钥用于物联网设备之间的加密通信，包括通过该通信密钥加密通信数据和/或通过该通信密钥解密数据。
本申请实施例可以应用于物联网设备之间的通信的场景。由于物联网设备之间直接通过明文通信可能会导致数据泄露等问题，通信的安全性较低，因此，本申请提供了一种物联网设备之间的通信方法。在本申请实施例中，可信设备能够安全地将第一通信密钥提供给第一物联网和/或第二物联网设备，因此，第一物联网设备能够与可信设备建立通信连接，获取到的第一通信密钥，相应的，第二物联网设备也能够通过相同的方式获取到第一通信密钥，即进行通信的第一物联网设备和第二物联网设备均能够获取到第一通信密钥，因此，第一物联网设备可以基于第一通信密钥，与第二物联网设备之间进行加密通信，从而减少了第一物联网设备与第二物联网设备之间的通信数据泄露的可能，提高了物联网设备之间进行通信的安全性。
需要说明的是，上述第一物联网设备和第二物联网设备可以均处于与云端的离线状态下或者其中某一个物联网设备处于与云端的离线状态下，由于至少一个物联网设备无法与云端进行通信，因此，无法通过服务端来操作物联网设备实现两个物联网设备之间的联动。通过本申请实施例的方案，在第一物联网设备和第二物联网设备均离线或是其中某一个物联网设备处于与云端的离线状态下时，基于可信设备建立通信连接，并且实现了第一物联网设备与第二物联网设备之间的加密通信。
实施例一
参照图1，示出了根据本申请一个实施例的一种物联网设备之间的通信方法流程图， 具体步骤包括：
步骤101，建立第一物联网设备与可信设备的通信连接。
由于可信设备是可信的，为了使第一物联网设备和第二物联网设备都能够通过安全可靠的方式获取得到第一通信密钥，减少第一通信密钥泄露的可能，进而实现加密通信，提高通信的安全性，可以建立第一物联网设备与可信设备之间的通信连接。
第一物联网设备和可信设备可以通过路由器组件一个局域网。
可以通过TCP((Transmission Control Protocol，传输控制协议)或UDP(User Datagram Protocol，用户数据报协议)，建立第一物联网设备与可信设备之间的通信连接。当然，在实际应用中，也可以基于其它协议，建立第一物联网设备与可信设备之间的通信连接。
步骤102，获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备。
为了确保后续能够实现与第二物联网设备之间的安全通信，可以获取第一通信密钥，且该第一通信密钥可以通过可信设备，安全可靠地提供给第一物联网设备和/或第二物联网设备。
第一通信密钥可以由第一物联网设备、第二物联网设备和可信设备中的至少一个生成得到。
第一物联网设备、第二物联网设备或可信设备，可以从第一物联网设备、第二物联网设备和可信设备中的至少一个获取密钥生成参数，根据密钥生成算法生成第一通信密钥。
其中，当密钥生成参数的来源越多、密钥生成参数越多，所生成的通信密钥的安全性也越高。
密钥生成参数为生成通信密钥所需的参数，比如，该密钥生成参数可以包括随机数或者事先指定的数字。
密钥生成算法为生成密钥的算法，该密钥生成算法可以是预置的密钥生成算法，当然，在实际应用中，该密钥生成算法也可以由第一物联网设备、第二物联网设备或可信设备提供得到。
若第一通信密钥由第一物联网设备生成，则可以通过可信设备将第一通信密钥提供给第二物联网设备；若第一通信密钥由第二物联网设备或可信设备生成，则可以通过可信设备获取第一通信密钥；若第一通信密钥由第一物联网设备和第二物联网设备生成，则可以通过可信设备确保第一物联网设备和第二物联网设备所生成的通信密钥相同，比 如分别向第一物联网设备和第二物联网设备提供相同的密钥生成参数，或者确认第一物联网设备和第二物联网设备所采用的密钥生成参数和密钥生成算法一致。
步骤103，基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
由于第一物联网设备和第二物联网设备均通过安全可靠的方式获取得到了第一通信密钥，因此，第一物联网设备可以基于第一通信密钥，对于第二物联网设备之间的通信数据进行加密通信，以确保通信的安全性和可靠性。
第一物联网设备可以通过第一通信密钥，对发送给第二物联网设备的通信数据进行加密，通过第一通信密钥，对接收到第二物联网设备的通信数据进行解密，从而实现加密通信。
在本申请实施例中，可以建立第一物联网设备与可信设备之间的通信连接，获取第一通信密钥，且由于可信设备是可信的，可以通过可信设备安全可靠地将第一通信密钥，提供给第一物联网设备和/或第二物联网设备，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。
实施例二
参照图2，示出了根据本申请一个实施例的一种物联网设备之间的通信方法流程图，具体步骤包括：
步骤201，分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接。
由于可信设备是可信的，为了使第一物联网设备和第二物联网设备都能够通过安全可靠的方式获取得到第一通信密钥，进而实现加密通信，提高通信的安全性，可以分别建立可信设备与第一物联网设备以及第二物联网设备之间的通信连接。
可信设备可以从物联网中确定第一物联网设备和第二物联网设备，比如通过接收用户指定、随机选择、接收云端指定等方式第一物联网设备和第二物联网设备。当然，在实际应用中，也可以通过其它方式确定第一物联网设备和第二物联网设备，比如若接收物联网设备的连接请求，则将该物联网设备确定为第一物联网设备，将该物联网设备所指定的需要进行加密通信的另一物联网设备确定为第二物联网设备。在确定第一物联网设备和第二物联网设备之后，可以分别建立与第一物联网设备以及第二物联网设备之间的通信连接。
云端可以实现为服务器或服务器集群，该云端能够与可信设备进行通信，并提供与 本申请实施例中实现物联网设备之间的加密通信有关的数据或服务。
其中，建立可信设备与第一物联网之间的通信连接的方式，可以参见前述中的相关描述，建立可信设备与第二物联网设备之间的通信连接的方式，可以与建立可信设备与第一物联网之间的通信连接的方式相同，此处不再一一赘述。
步骤202，提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
为了确保向第一物联网设备和/或第二物联网设备提供第一通信密钥的安全性和可靠性，减少第一通信密钥泄露的可能，进而提高第一物联网设备和第二物联网设备进行加密通信的安全性和可靠性，可信设备可以将第一通信密钥提供给第一物联网设备和/或第二物联网设备。
其中，若第一通信密钥由第一物联网设备或第二物联网设备生成，则可信设备可以向第一物联网设备或第二物联网设备提供密钥生成参数，将第一通信密钥提供给第一物联网设备和第二物联网设备中的另一个；若第一通信密钥由可信设备生成，则可信设备可以将第一通信密钥提供给第一物联网设备和第二物联网设备；若第一通信密钥由第一物联网设备和第二物联网设备生成，则可信设备确保第一物联网设备和第二物联网设备所生成的通信密钥相同，比如分别向第一物联网设备和第二物联网设备提供相同的密钥生成参数，或者确认第一物联网设备和第二物联网设备所采用的密钥生成参数和密钥生成算法一致。
第一物联网设备与第二物联网设备基于第一通信密钥进行加密通信的方式，可以参见前述中的相关描述，此处不再一一赘述。
在本申请实施例中，可以建立与第一物联网设备以及第二物联网设备之间的通信连接，由于可信设备是可信的，可以通过可信设备安全可靠地将第一通信密钥，提供给第一物联网设备和/或第二物联网设备，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。
实施例三
参照图3，示出了根据本申请一个实施例的一种物联网设备之间的通信方法流程图，具体步骤包括：
步骤301，可信设备分别建立所述可信设备与第一物联网设备以及第二物联网设备 的通信连接。
其中，可信设备分别建立与第一物联网设备以及第二物联网设备之间的通信连接的方式，可以参见前述中的相关描述，此处不再一一赘述。
在本申请实施例中，可选的，为了使第一物联网设备或第二物联网设备确定可信设备可信，即确保可信设备的可靠性，提高后续获取第一通信密钥的安全性和可靠性，提高基于第一通信密钥进行加密通信的安全性和可靠性，可信设备可以分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。相应的，第一物联网设备或第二物联网设备可以从所述可信设备获取校验信息，根据所述校验信息，与所述可信设备完成可信校验。
校验信息为对可信设备进行可信校验的信息。
在本申请实施例中，可选的，由于数字证书是由权威性较高的证书签证平台生成的，因此为了提高对可信设备进行可信校验的可靠性，进而提高用于加密通信的第一通信密钥的安全性和可靠性，所述校验信息包括数字证书，相应的，第一物联网设备或第二物联网设备可以根据预置的根证书，确定对所述数字证书校验通过。
数字证书是一种权威性的数据，可以从证书签证平台获取得到。该数字证书能够根据该证书签证平台生成的根证书进行校验。
其中，证书签证平台可以包括前述中的云端。可信设备可以通过与该云端对应的账号登录该云端，从而获取得到该数字证书。
第一物联网设备或第二物联网设备可以在事先获取得到该根证书，比如在出厂前预置得到，或者在部署至物联网中时预置得到。
另外，数字证书中还可以包括用户标识，以说明该用户标识对该数字证书多对应的物联网设备有效，即该用户标识所在的可信设备具有够访问该数字证书对应的物联网设备的权限，因此，该可信设备对于该物联网设备即是可信的。
设备标识用于标识一个设备，比如该设备标识可以包括设备ID(Identification，身份证)或设备序列号。
用户标识用于标识一个用户，比如该用户标识可以包括用户名称或用户ID。该用户标识可以接收用户提交得到，当然可以由证书签证平台生成。
例如，可信设备登录证书签证平台，证书签证平台确定可信设备用户标识C1、针对第一物联网设备M1的数字证书DC1和针对第二物联网设备M2的数字证书DC2。其中， DC1包括关于C1对M1有效的说明，DC2包括关于C1对M2有效的说明，从而确保登录C1的可信设备具有访问M1和M2的权限。
当然，在实际应用中，该校验信息也可以包括其它信息，比如可信认证标识。
可信认证标识为说明当前设备是否可信的标识，可以包括字符串。该可信认证标识可以包括设备标识，该设备当前登录的用户的用户标识，或者可以是其它能够说明该可信认证标识的提供者可信的信息。该可信认证标识可以由参与通信的任一端或证书签证平台生成，并存储在进行通信的两端。当一端确定本地存储有另一端所提供的可信认证标识时，即可确定另一端可信。因此，第一物联网设备或第二物联网设备可以检测本地是否存储有可信设备提供的可信认证标识，如果是则确定该可信设备可信，否则确定该可信设备不可信。
其中，第一物联网设备或第二物联网设备可以事先获取可信认证标识，并将可信认证标识存储至本地的可信认证标识列表中。比如，信设备可以将当前登录的用户标识提供给第一物联网设备或第二物联网设备，当第一物联网设备或第二物联网设备对可信设备进行可信校验之后，将该用户标识作为可信认证标识存储至可信认证标识列表中，之后，若可信设备提供该用户标识，即可确定该可信设备可信。
另外，若对可信设备进行可信校验失败，则可以停止执行后续操作。
在本申请实施例中，可选的，为了确保可信设备提供的校验信息完整且未被篡改，即确保该校验信息的完整性和可靠性，进而提高对可信设备进行可信校验的可靠性，可信设备可以分别向所述第一物联网设备和所述第二物联网设备提供数字签名，以供所述第一物联网设备和所述第二物联网设备验证所述校验信息完整。相应的，第一物联网设备或第二物联网设备可以从所述可信设备获取数字签名，根据所述数字签名，确定所述校验信息完整。
数字签名是由只有数据发送者才能生成的数字字符串，是数据的数据发送者的真实性证明。该数字签名具有不可抵赖性，从而能够对数据的完整性进行验证。
可信设备可以生成所发送的通信数据(比如前述中的校验信息)的摘要信息，并通过云端私钥对该摘要信息进行加密，得到数字签名，相应的，第一物联网设备或第二物联网设备根据与云端私钥对应的云端公钥，对该数字签名进行解密，根据接收到的通信数据再次生成摘要信息，将生成的摘要信息与解密得到的摘要信息进行比较，以验证通信数据的完整性，如果一致，则确定接收到的数据完整，否则确定接收到的数据不完整。
其中，摘要信息可以为通信数据的哈希值。
云端私钥和云端公钥可以由云端生成，
可信设备可以事先从云端获取云端私钥和云端公钥，比如，可以在从作为证书签证平台的云端中获取数字证书时，获取该云端公钥和云端私钥。
第一物联网设备或第二物联网设备可以从前述中的数字证书中获取得到云端公钥，或者，该云端公钥可以预置在第一物联网设备或第二物联网设备中。
在本申请实施例中，可选的，为了确保校验信息的安全性，进而提高对可信设备进行可信校验的可靠性，所述校验信息经过云端私钥加密，相应的，第一物联网设备或第二物联网设备可以在根据校验信息，与可信设备完成可信校验之前，根据与所述云端私钥所对应的云端公钥，对所述校验信息进行解密。
可信设备可以通过云端私钥对通信数据(比如校验信息)进行加密，从而使第一物联网设备或第二物联网设备能够通过与云端对应的云端公钥，对加密的通信数据进行解密，以确保通信数据的安全性。
在本申请实施例中，可选的，由于基于对称加密的加密通信比基于非对称加密的加密通信的效率高。因此，为了提高了可信设备与第一物联网设备之间进行加密通信的效率，可信设备和第一物联网设备可以获取第二通信通信密钥，从而基于所述第二通信密钥，进行可信设备与第一物联网设备之间的加密通信。
第二通信密钥为可信设备与第一物联网设备进行加密通信所采用的通信密钥。第二通信密钥可以由可信设备和第一物联网设备中的最少一个生成得到。
在本申请实施例中，可选的，为了确保能够生成第二通信密钥，即提高生成第二通信密钥的可靠性，所述第二通信密钥由所述第一物联网设备生成。第一物联网设备可以从所述可信设备和所述第一物联网设备中的至少一端分别获取第二密钥生成参数，根据所获取的第二密钥生成参数，生成所述第二通信密钥。相应的，可信设备可以从第一物联网设备获取第二通信密钥。
第二密钥生成参数为生成第二通信密钥所需的密钥生成参数。
第一物联网设备可以根据第二密钥生成参数，采用密钥生成算法，生成第二通信密钥。
在本申请实施例中，可选的，为了确保能够生成第二通信密钥，即提高生成第二通信密钥的可靠性，所述第二通信密钥由所述可信设备生成。可信设备可以从所述可信设备和所述第一物联网设备中的至少一端分别获取第二密钥生成参数，根据所获取的第二密钥生成参数，生成所述第二通信密钥，相应的，第一物联网设备可以从所述可信设备 获取所述第二通信密钥。
其中，可信设备生成第二通信密钥的方式，可以与第一物联网设备生成第二通信密钥的方式相同，此处不再一一赘述。
在本申请实施例中，可选的，为了减少第二通信密钥泄露的可能，提高第二通信密钥以及基于第二通信密钥进行加密通信的安全性和可靠性，第二通信密钥可以分别由可信设备和第一物联网设备生成，可信设备和第一物联网设备，可以从所述可信设备和所述第一物联网设备中的至少一端分别获取相同的第二密钥生成参数，从而根据所获取的第二密钥生成参数，采用相同的密钥生成算法，生成第二通信密钥。
可信设备或第一物联网设备可以分别生成第二密钥生成参数，并将生成的第二密钥生成参数通知给另一端，从而确保可信设备和第一物联网设备能够获取到相同的第二密钥生成参数。
例如，可信设备生成并向M1提供一个32位的随机数R11，M1生成并向可信设备提供一个32位的随机数R21，则可信设备和M1可以获取到相同的第二密钥生成参数R11和R21。可信设备和M1可以分别基于R11和R21，生成64位的第二通信密钥E1。
在本申请实施例中，可选的，由于基于对称加密的加密通信比基于非对称加密的加密通信的效率高。因此，为了提高了可信设备与第二物联网设备之间进行加密通信的效率，可信设备和第二物联网设备可以获取第三通信通信密钥，从而基于所述第三通信密钥，进行可信设备与第三物联网设备之间的加密通信。
其中，可信设备和第二物联网设备获取第三通信密钥的方式，可以与可信设备和第一物联网设备获取第二通信密钥的方式相同，此处不再一一赘述。
例如，可信设备可以生成一个32位的随机数R31，并将第R31发送给M2，M2生成一个32位的随机数R32并将R32发送给可信设备。可信设备和M2分别根据R31和R32(R31和R32即为第三密钥生成参数)生成一个64位的第三通信密钥E3。
步骤302，所述可信设备提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备。
为了确保向第一物联网设备和/或第二物联网设备提供第一通信密钥的安全性和可靠性，减少第一通信密钥泄露的可能，进而提高第一物联网设备和第二物联网设备进行加密通信的安全性和可靠性，可信设备可以将第一通信密钥提供给第一物联网设备和/或第二物联网设备，第一物联网设备和/或第二物联网设备可以获取第一通信密钥。
在本申请实施例中，可选的，为了确保能够生成第一通信密钥，即提高生成第一通 信密钥的可靠性，所述第一通信密钥由所述可信设备生成。可信设备可以从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数，根据所获取的第一密钥生成参数，生成所述第一通信密钥。第一物联网设备和第二物联网设备可以从可信设备获取可信设备生成的第一通信密钥，相应的，可信设备可以将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
第一密钥生成参数为生成第一通信密钥所需的密钥生成参数。
第一物联网设备或第二物联网设备可以生成第一密钥生成参数，并生成的第一密钥生成参数发送给可信设备。且为了确保第一密钥生成参数的安全性，第一物理网设备或第二物理网设备还都可以对发送的第一密钥生成参数进行加密，比如，第一物联网设备可以通过第二通信密钥对第一密钥生成参数进行加密。
在本申请实施例中，可选的，为了确保能够生成第一通信密钥，即提高生成第一通信密钥的可靠性，所述第一通信密钥由所述第一物联网设备。第一物联网设备可以从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数，根据所获取的第一密钥生成参数，生成所述第一通信密钥。可信设备可以获取所述第一通信密钥，并将所述第一通信密钥发送给第二物联网设备中的另一个，相应的，第二物联网设备可以从所述可信设备获取所述第二物联网设备生成的第一通信密钥。
可信设备可生成第一密钥生成参数，并将第一密钥生成参数发送给第一物联网设备。第二物联网设备可以生成第一密钥生成参数，并将第一密钥生成参数发送给可信设备，可信设备将该第一密钥生成参数转发给第一物联网设备。
例如，M1生成一个32位的随机数R21，可信设备生成一个32位的随机数R22，并将R22发送给M1，M1根据R21和R22生成一个64位的第一通信密钥E2。M1可以将E2发送给可信设备，可信设备将E2发送给M2。
在本申请实施例中，可选的，为了确保能够生成第一通信密钥，即提高生成第一通信密钥的可靠性，所述第一通信密钥由所述第二物联网设备。第二物联网设备可以从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数，根据所获取的第一密钥生成参数，生成所述第一通信密钥。可信设备可以获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备，相应的，第二物联网设备可以从所述可信设备获取所述第二物联网设备生成的第一通信密钥。
其中，第二物联网设备获取第一密钥生成参数以及生成第一通信密钥的方式，可以 与第一物联网设备获取第一密钥生成参数以及生成第一通信密钥的方式相同，此处不再一一赘述。
在本申请实施例中，可选的，为了减少第一通信密钥被泄露的可能，提高第一通信密钥以及基于第一通信密钥进行加密通信的安全性和可靠性，第一通信密钥由第一物联网设备和第二物联网设备生成。第一物联网设备和第二物联网设备可以从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数，并通过可信设备确定所采用的第一密钥生成参数相同以及所采用的密钥生成算法相同，进而分别采用第一密钥参数，按照密钥生成算法，生成第一通信密钥。
其中，若第一物联网设备或第二物联网设备生成第一密钥生成参数，可以通过可信设备，将第一密钥生成参数提供给第一物联网设备和第二物联网设备中的另一个；若可信设备生成第一密钥生成参数，可以分别将第一密钥生成参数发送给第一物联网设备和第二物联网设备，从而确保第一物联网设备和第二物联网设备所采用的第一密钥生成参数相同。
步骤303，第一物联网设备和第二物联网设备互相进行可信验证。
为了减少物联网设备与不可信的物联网设备进行通信的可能，进一步提高通信的安全性和可靠性，第一物联网设备和第二物联网设备可以互相进行可信验证。
在本申请实施例中，可选的，为了减少第一物联网设备与不可信的物联网设备进行通信的可能，进一步提高通信的安全性和可靠性，所述第一物联网设备中存储有可信认证标识列表，相应的，第一物联网设备可以获取所述第二物联网设备提供的可信认证标识，确定所述可信认证标识存在于可信认证标识列表中。如果确定所述可信认证标识存在于可信认证标识列表中，即可确定第二物联网设备可信，否则可以确定第二物联网设备不可信。
第一物联网设备可以事先获取第二物联网设备的设备标识或用户标识作为可信认证标识。或者，第一物联网设备可以生成一个字符串作为可信认证标识，并通过可信设备将该可信认证标识提供给第二物联网设备。或者，第二物联网设备、可信设备或作为证书签证平台的云端生成一个字符串作为可信认证标识，第一物联网设备通过可信设备获取该可信认证标识并存储。
其中，若第一物联网设备或第二物联网设备通过可信设备获取可信认证标识，则由于可信设备经由权威的证书签证平台提供的数字证书所验证，因此，该可信设备提供的可信认证标识也可以可信的，因而也就实现了以可信设备作为媒介，完成第一物联网设 备与第二物联网设备之间的可信验证。
在本申请实施例中，可选的，为了减少第二物联网设备与不可信的物联网设备进行通信的可能，进一步提高通信的安全性和可靠性，所述第二物联网设备中存储有可信认证标识列表，相应的，第二物联网设备可以获取所述第一物联网设备提供的可信认证标识，确定所述可信认证标识存在于可信认证标识列表中。如果确定所述可信认证标识存在于可信认证标识列表中，即可确定第一物联网设备可信，否则可以确定第一物联网设备不可信。
第二物联网设备可以事先获取第一物联网设备的设备标识或用户标识作为可信认证标识。或者，第二物联网设备可以生成可信认证标识，并通过可信设备将该可信认证标识提供给第一物联网设备。或者，第一物联网设备、可信设备或作为证书签证平台的云端生成一个字符串作为可信认证标识，第二物联网设备通过可信设备获取该可惜认证标识并存储。
例如，可信设备随机生成一个可信认证标识C2，将C2提供给M1和M2，M1和M2获取C2并将C2存储至本地的可信认证列表中。以M1为例，若M1接收到M2提供的C2，由于M1本地存储的可信认证列表中存储有C2，因此，可以确定M2可信。相似的，M2也可以确定M1可信，从而完成M1与M2之间的可信验证。
另外，在本申请的另一可选实施例中，为了提高加密通信的效率，第一物联网设备和第二物联网设备也可以不互相进行可信验证，即步骤303为可选的步骤。
步骤304，所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥，进行加密通信。
由于第一物联网设备和第二物联网设备是通过安全可靠的方式获取得到的第一通信密钥，因此，可以通过第一通信密钥进行加密通信，从而确保通信数据安全性。
在本申请实施例中，可选的，为了确保第一物联网设备和第二物联网设备之间的通信数据的安全性，第一物联网设备可以基于所述第一通信密钥对第一物联网设备的通信数据进行加密，并发送至第二物联网设备；或，基于所述第一通信密钥对第二物联网设备的通信数据进行解密。相应的，第二物联网设备可以基于所述第一通信密钥对第二物联网设备的通信数据进行加密，并发送至第一物联网设备；或，基于所述第一通信密钥对第一物联网设备的通信数据进行解密。
其中，通信数据中可以携带可信认证标识，从而使第一物联网设备或第二物联网设备，确定该通信数据的来源可信。
在本申请实施例中，可选的，由于物联网设备可能具有可变的属性，因此为了便于用户及时感知该物联网设备所具有的属性，提高获取物联网设备所具有属性的实效性，以提高与监控设备与物联网设备之间的同步性能，第一物联网设备可以获取监控设备对所述第一物联网设备的属性变化事件的订阅请求，检测属性变化事件，并通知至所述监控设备。
物联网设备的属性即为物联网设备所具有的属性，比如当物联网设备为智能灯泡时，该物联网设备的属性可以包括开关状态、灯光颜色或灯光亮度；当物联网设备为空调时，该物联网设备的属性可以包括开关状态、运行模式或温度设定值等。
监控设备为对物联网设备的属性进行监控的设备，该监控可以包括客户端或第二物联网设备。
属性变化事件即为物联网设备根据属性进行变化所生成的事件。
属性变化事件的订阅请求为监控设备向物联网设备订阅属性变化事件的请求。
监控设备可以基于CoAP(Constrained Application Protocol，受限制的应用协议)向第一物联网设备发送属性变化事件的订阅请求。
基于CoAP的属性变化事件协议包括事件主题和事件内容。
事件主题可以为一个字符串，其中包括目标设备的设备标识以及事件路径。
目标设备即为所需订阅事件的设备，比如第一物联网设备。
事件位置即为属性变化事件在目标设备中的位置。
例如，事件主题可以包括“/dev/{$devId}/thing/event/property/post”。其中，dev为固定前缀；$devId为目标设备的设备标识，该设备标识可以由目标设备提供；“thing/event/property/post”即为属性变化事件在目标设备的事件位置，当然，在实际应用中，事件位置还可以通过其它形式来表示。
事件内容包括事件订阅、事件订阅取消以及事件触发。该事件内容可以通过CoAP协议中的observe字段或observe option表示。
订阅请求中可以包括所订阅事件的事件主题和事件内容：事件订阅。
以observe字段为例，observe字段处于CoAP协议的payload(有效荷载)中，该observe字段的值可以表示属性变化事件被触发的次数。当事件内容为事件订阅时，订阅请求中携带observe字符串格式字段，值为非空。
第一物联网设备在接收到订阅请求时，根据该属性变化事件协议包括的事件位置，订阅属性变化事件，若订阅成功，第一物联网设备向监控设备反馈订阅成功消息，消息 类型为成功，且订阅成功消息中携带observe字符串格式字段，值为非空。若订阅失败，第一物联网设备被向监控设备反馈订阅失败消息，消息类型为失败，且订阅失败消息中携带observe字符串格式字段，值为非空。
第一物联网设备可以在检测到属性变化事件被触发时，向监控设备返回属性变化事件通知，该属性变化事件通知中包括所订阅的属性，且该属性变化事件通知中携带observe字符串格式字段，该observe的值为在上次属性变化事件通知中observe的值递增1后的数值。
在本申请实施例中，可选的，为了提高属性订阅的准确性，订阅请求中可以包括目标属性，从而仅订阅针对目标属性的属性变化事件。
目标属性为需要订阅的属性，该目标属性可以由监控设备确定。
当然，监控设备也可以像第一物联网设备发送属性变化事件的订阅取消请求，该订阅取消请求中不携带observe字符串格式字段。第一物联网设备接收到该订阅取消请求，若取消订阅成功，则反馈订阅取消成功消息，消息类型为成功。若取消订阅失败，则反馈订阅取消失败消息，消息类型为失败。
在本申请实施例中，可选的，为了感知第一物联网设备中与属性相关的信息，以便于确定是否进行属性变化事件的订阅或者确定目标属性，进而监控第一物联网设备的属性的准确性，第一物联网设备可以在所述获取监控设备对所述第一物联网设备的属性变化事件的订阅请求之前，向所述监控设备提供属性相关信息。
属性相关信息为与物联网设备所具有的属性相关的信息，该属性相关信息可以包括属性、各属性的取值范围、是否可被订阅和订阅方式中的至少一个。
监控设备可以在发送基于CoAP协议的设备发现请求，该设备发现请求中可以包括目标设备标识，当目标设备接收到该设备发现请求时，向该监控设备反馈属性相关信息。因此，第一物联网设备可以在接收到设备发现请求，且确定设备发现请求中携带由第一物联网设备的设备标识时，向该监控设备反馈第一物联网设备的属性相关信息。
在本申请的另一可选实施例中，设备发现请求中也可以不携带目标设备标识，接收到该设备发现请求的任一物联网设备都向该监控设备反馈属性相关信息。
在本申请实施例中，可选的，为了使监控设备能够及时获取到第一物联网设备当前具有的属性，提高感知第一物联网设备所具有属性的时效性，第一网设备述检测属性变化事件之前，检测所述第一物联网设备的属性初始数据，并提供给所述监控设备。相应的，监控设备可以获取第一物联网设备提供的属性初始数据，并通过页面展示该属性初 始数据，之后，若接收到属性变化事件，则对显示的属性初始数据进行更新。
属性初始数据为第一物联网设备在检测属性变化事件之前，所具有属性的初始值。
在本申请实施例中，首先，可以建立第一物联网设备和第二物联网设备与可信设备之间的通信连接，由于可信设备是可信的，可以通过可信设备安全可靠地将第一通信密钥，提供给第一物联网设备和/或第二物联网设备，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。
其次，第一物联网设备或第二物联网设备可以根据校验信息对可信设备进行可信校验，从而能够确保可信设备的可靠性，提高了获取第一通信密钥的安全性和可靠性，提高了基于第一通信密钥进行加密通信的安全性和可靠性。
另外，第一物联网设备与第二物联网设备之间可以互相进行可信验证，包括验证第一物联网设备与第二物联网设备中的另一端所提供的可信认证标识，是否存在与本地存储的可信标识列表中，从而减少物联网设备与不可信的物联网设备进行通信的可能，进一步提高通信的安全性和可靠性。
另外，第一物联网设备、第二物联网设备和可信设备均能够生成第一通信密钥，提高了生成第一通信密钥的可靠性。
本领域的技术人员应可理解，上述实施例中的方法步骤并非每一个都必不可少，在具体状况下，可以省略其中的一个或多个步骤，只要能够实现物联网设备之间加密通信的技术目的。本申请并不限定的实施例中步骤的数量及其顺序，本申请的保护范围当以权利要求书的限定为准。
为了便于本领域技术人员更好地理解本申请，以下通过几个具体的示例对本申请实施例的一种物联网设备之间的通信方法进行说明，具体包括如下步骤：
参照图4，示出了一种物联网设备之间的通信方法，具体包括：
S1，客户端登录云端；
其中，云端即可作为证书签证平台，客户端作为可信设备，且该客户端安装有与该云端对应的应用程序。
S2，云端向客户端反馈登录结果；
S3，云端从客户端获取账号信息；
其中，账号信息可以为针对云端的账号信息。
S4，云端向客户端反馈密钥对和数字证书；
云端可以根据客户端登录的账号信息，生成使用者账号C1，生成该客户端针对设备M1的数字证书DC1、以及该客户端针对设备M2的数字证书DC2。
其中，密钥对包括云端私钥和云端公钥。
S5，客户端向M1发送C1和一个32位的随机数R11；
其中，所发送的C1和R11是经过云端私钥加密的，且携带有数字签名和DC1。
S6，M1使用预置的云端公钥对C1和R11进行解密。
其中，M1可以解析数字证书，通过预置的根证书验证数字证书是否可信。如果不可信，则返回结果给客户端，流程结束。如果可信则从数字证书中提取云端公钥，通过数字签名验证确定所接收到的数据是否被篡改过。如果验证失败则返回结果给客户端，流程结束。如果验证成功，则通过云端公钥解密得到C1和R11。
S7，M1将C1添加至可信任列表；
S8，M1生成一个32位的随机数R12，基于R11和R12生成64位的数字E1作为共享密钥；
S9，M1将加密后的R12发送给客户端，M1对客户端认证成功；
S10，客户端获取到R12，基于R11和R12生成E1；
当M1和客户端均获取得到E1时，M1和客户端即可通过E1实现M1和客户端之间的加密通信。
S11，客户端随机生成使用者账号C2和一个32位随机数R21；
S12，客户端通过E1对C2和R21加密后发送给M1；
S13，M1添加C2至可信任列表；
其中，M1可以通过E1对接收到的数据进行解密，得到C2和R21。
S14，M1生成32位随机数R22，基于R21和R22生成64位数字E2作为共享密钥。
S15，M1通过E1对R22加密后发送给客户端；
S16，客户端很多区到R22，基于R21和R22生成E2；
S17，客户端向M2发送C1和一个32位的随机数R31；
S18，M2获取得到C1和R31；
S19，M2将C1添加至可信任列表；
S20，M2生成R32，基于R31和R32生成E3；
S21，M2通过E3加密R32发送给客户端，认证成功；
S22，客户端基于R31和R32生成E3；
S23，客户端将C2和E2发送给M2；
S24，M2将C2添加至可信任列表；
S25，M2通知客户端添加成功；
S26，M2通过E2加密C2后发送给M1请求认证；
S27，M1使用E2解密得到C2，确定C2存在与本地的可信任列表；
S28，M1向M2反馈认证成功。
M1与M2认证成功之后，可以基于C2和E2实现安全可信的通信。
参照图5，示出了一种物联网设备之间的通信方法，具体包括：
S1，客户端发送发现协议，发现在线设备M1；
其中，客户端可以在网络中发送基于CoAP的发现协议，且该发现协议中可以携带目标设备标识。
S2，M1返回设备能力；
M1接收到发现协议后可以对该发现协议进行相应，并附带M1的属性相关信息，即说明M1的设备能力。
当然，若发现协议中携带目标设备标识，M1在确定该目标设备标识为M1的设备标识时，对该发现协议进行响应。
S3，客户端向M1订阅属性变化事件；
S4，M1返回订阅成功；
M1接收针对属性变化事件的订阅请求时，如果确定属性允许订阅，则返回订阅成功，否则返回订阅失败。
S5，客户端获取M1当前所具有的属性值；
S6，M1向客户端返回属性值；
M1可以在确定允许客户端获取属性值时，返回获取成功，并携带当前的属性值，否则获取失败，流程结束。
S7，M1确定属性值发生变化；
M1在确属性值发生变化时，主动向该客户端推送属性变化事件。
S8，M1向客户端通知最新的属性值。
客户端可以通过页面显示属性值，并在接收到属性变化事件时，对当前属性值进行更新，刷新展示页面。
实施例四
参照图6，示出了根据本申请一个实施例的一种物联网设备之间的通信的结构框图，该装置包括：
通信连接建立模块601，用于建立第一物联网设备与可信设备的通信连接；
第一通信密钥获取模块602，用于获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
通信模块603，用于基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
可选的，所述第一通信密钥由所述第一物联网设备生成；
所述第一通信密钥获取模块包括：
第一密钥生成参数获取子模块，用于从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
第一通信密钥生成子模块，用于根据所获取的第一密钥生成参数，生成所述第一通信密钥。
可选的，所述第一通信密钥由所述可信设备或所述第二物联网设备生成；
所述第一通信密钥获取模块包括：
第一通信密钥获取子模块，用于从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
可选的，所述第一物联网设备中存储有可信认证标识列表；
所述装置还包括：
可信认证标识获取模块，用于获取所述第二物联网设备提供的可信认证标识；
第一确定模块，用于确定所述可信认证标识存在于可信认证标识列表中。
可选的，所述通信模块包括：
加密子模块，用于基于所述第一通信密钥对第一物联网设备的通信数据进行加密，并发送至第二物联网设备；或，
解密子模块，用于基于所述第一通信密钥对第二物联网设备的通信数据进行解密。
可选的，所述通信连接建立模块包括：
校验信息获取子模块，用于从所述可信设备获取校验信息；
可信校验子模块，用于根据所述校验信息，与所述可信设备完成可信校验。
可选的，所述校验信息包括数字证书，所述可信校验子模块还用于：
根据预置的根证书，确定对所述数字证书校验通过。
可选的，所述装置还包括：
数字签名获取模块，用于从所述可信设备获取数字签名；
第二确定模块，用于根据所述数字签名，确定所述校验信息完整。
可选的，所述校验信息经过云端私钥加密；
所述装置还包括：
解密模块，用于根据与所述云端私钥所对应的云端公钥，对所述校验信息进行解密。
可选的，所述装置还包括：
第二通信密钥获取模块，用于获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
可选的，所述第二通信密钥由所述第一物联网设备生成；
所述第二通信密钥获取模块包括：
第二密钥生成参数获取子模块，用于从所述可信设备和所述第一物联网设备中的至少一端分别获取第二密钥生成参数；
第二通信密钥生成子模块，用于根据所获取的第二密钥生成参数，生成所述第二通信密钥。
可选的，所述第二通信密钥由所述可信设备生成；
所述第二通信密钥获取模块包括：
第二通信密钥获取子模块，用于从所述可信设备获取所述第二通信密钥。
可选的，所述装置还包括：
订阅请求获取模块，用于获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
属性变化事件检测模块，用于检测属性变化事件，并通知至所述监控设备。
可选的，所述装置还包括：
属性相关信息获取模块，用于向所述监控设备提供属性相关信息。
可选的，所述装置还包括：
属性初始数据检测模块，用于检测所述第一物联网设备的属性初始数据，并提供给所述监控设备。
可选的，所述第一物联网设备与所述第二物联网设备中的至少一个处于与云端的离线状态下。
在本申请实施例中，可以建立第一物联网设备与可信设备之间的通信连接，获取第一通信密钥，且由于可信设备是可信的，可以通过可信设备安全可靠地将第一通信密钥，提供给第一物联网设备和/或第二物联网设备，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。
实施例五
参照图7，示出了根据本申请一个实施例的一种物联网设备之间的通信的结构框图，该装置包括：
通信连接建立模块701，用于分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
第一通信密钥提供模块702，用于提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
可选的，所述通信连接建立模块包括：
校验信息提供子模块，用于分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
可选的，所述装置还包括：
数字签名提供模块，用于分别向所述第一物联网设备和所述第二物联网设备提供数字签名，以供所述第一物联网设备和所述第二物联网设备验证所述校验信息完整。
可选的，所述第一通信密钥由所述可信设备生成；
所述第一通信密钥提供模块包括：
第一通信密钥发送子模块，用于将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
可选的，所述第一通信密钥由所述第一物联网设备或所述第二物联网设备生成；
所述第一通信密钥提供模块包括：
第一通信密钥发送子模块，用于获取所述第一通信密钥，并将所述第一通信密钥发 送给所述第一物联网设备和所述第二物联网设备中的另一个。
可选的，所述装置还包括：
第二通信获取模块，用于获取第二通信密钥，以基于所述第二通信密钥，与所述第一物联网设备进行加密通信。
可选的，所述装置还包括：
第三通信密钥获取模块，用于获取第三通信密钥，以基于所述第三通信密钥，与所述第二物联网设备进行加密通信。
在本申请实施例中，可以建立与第一物联网设备以及第二物联网设备之间的通信连接，由于可信设备是可信的，可以通过可信设备安全可靠地将第一通信密钥，提供给第一物联网设备和/或第二物联网设备，确保了第一物联网设备和第二物联网可以获取得到第一通信密钥，从而基于第一通信密钥进行加密通信，提高了第一物联网设备与第二物联网设备之间进行通信的安全性和可靠性。
对于装置实施例而言，由于其与方法实施例基本相似，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本申请实施例可被实现为使用任意适当的硬件，固件，软件，或及其任意组合进行想要的配置的系统。图8示意性地示出了可被用于实现本申请中所述的各个实施例的示例性系统(或装置)800。
对于一个实施例，图8示出了示例性系统800，该系统具有一个或多个处理器802、被耦合到(一个或多个)处理器802中的至少一个的系统控制模块(芯片组)804、被耦合到系统控制模块804的系统存储器806、被耦合到系统控制模块804的非易失性存储器(NVM)/存储设备808、被耦合到系统控制模块804的一个或多个输入/输出设备810，以及被耦合到系统控制模块806的网络接口812。
处理器802可包括一个或多个单核或多核处理器，处理器802可包括通用处理器或专用处理器(例如图形处理器、应用处理器、基频处理器等)的任意组合。在一些实施例中，系统800能够作为本申请实施例中所述的通信装置。
在一些实施例中，系统800可包括具有指令的一个或多个计算机可读介质(例如，系统存储器806或NVM/存储设备808)以及与该一个或多个计算机可读介质相合并被配置为执行指令以实现模块从而执行本申请中所述的动作的一个或多个处理器802。
对于一个实施例，系统控制模块804可包括任意适当的接口控制器，以向(一个或多个)处理器802中的至少一个和/或与系统控制模块804通信的任意适当的设备或组件提供任意适当的接口。
系统控制模块804可包括存储器控制器模块，以向系统存储器806提供接口。存储器控制器模块可以是硬件模块、软件模块和/或固件模块。
系统存储器806可被用于例如为系统800加载和存储数据和/或指令。对于一个实施例，系统存储器806可包括任意适当的易失性存储器，例如，适当的DRAM。在一些实施例中，系统存储器806可包括双倍数据速率类型四同步动态随机存取存储器(DDR4SDRAM)。
对于一个实施例，系统控制模块804可包括一个或多个输入/输出控制器，以向NVM/存储设备808及(一个或多个)输入/输出设备810提供接口。
例如，NVM/存储设备808可被用于存储数据和/或指令。NVM/存储设备808可包括任意适当的非易失性存储器(例如，闪存)和/或可包括任意适当的(一个或多个)非易失性存储设备(例如，一个或多个硬盘驱动器(HDD)、一个或多个光盘(CD)驱动器和/或一个或多个数字通用光盘(DVD)驱动器)。
NVM/存储设备808可包括在物理上作为系统800被安装在其上的设备的一部分的存储资源，或者其可被该设备访问而不必作为该设备的一部分。例如，NVM/存储设备808可通过网络经由(一个或多个)输入/输出设备810进行访问。
(一个或多个)输入/输出设备810可为系统800提供接口以与任意其他适当的设备通信，输入/输出设备810可以包括通信组件、音频组件、传感器组件等。网络接口812可为系统800提供接口以通过一个或多个网络通信，系统800可根据一个或多个无线网络标准和/或协议中的任意标准和/或协议来与无线网络的一个或多个组件进行无线通信，例如接入基于通信标准的无线网络，如WiFi，2G或3G，或它们的组合进行无线通信。
对于一个实施例，(一个或多个)处理器802中的至少一个可与系统控制模块804的一个或多个控制器(例如，存储器控制器模块)的逻辑封装在一起。对于一个实施例，(一个或多个)处理器802中的至少一个可与系统控制模块804的一个或多个控制器的逻辑封装在一起以形成系统级封装(SiP)。对于一个实施例，(一个或多个)处理器802中的至少一个可与系统控制模块804的一个或多个控制器的逻辑集成在同一模具上。对于一个实施例，(一个或多个)处理器802中的至少一个可与系统控制模块804的一个或多个控制器的逻辑集成在同一模具上以形成片上系统(SoC)。
在各个实施例中，系统800可以但不限于是：工作站、台式计算设备或移动计算设备(例如，膝上型计算设备、手持计算设备、平板电脑、上网本等)。在各个实施例中，系统800可具有更多或更少的组件和/或不同的架构。例如，在一些实施例中，系统800包括一个或多个摄像机、键盘、液晶显示器(LCD)屏幕(包括触屏显示器)、非易失性存储器端口、多个天线、图形芯片、专用集成电路(ASIC)和扬声器。
其中，如果显示器包括触摸面板，显示屏可以被实现为触屏显示器，以接收来自用户的输入信号。触摸面板包括一个或多个触摸传感器以感测触摸、滑动和触摸面板上的手势。所述触摸传感器可以不仅感测触摸或滑动动作的边界，而且还检测与所述触摸或滑动操作相关的持续时间和压力。
本申请实施例还提供了一种非易失性可读存储介质，该存储介质中存储有一个或多个模块(programs)，该一个或多个模块被应用在终端设备时，可以使得该终端设备执行本申请实施例中各方法步骤的指令(instructions)。
在一个示例中提供了一种装置，包括：一个或多个处理器；和，其上存储的有指令的一个或多个机器可读介质，当由所述一个或多个处理器执行时，使得所述装置执行如本申请实施例中通信装置执行的方法。
在一个示例中还提供了一个或多个机器可读介质，其上存储有指令，当由一个或多个处理器执行时，使得装置执行如本申请实施例中通信装置执行的方法。
本申请实施例公开了一种物联网设备之间的通信方法和装置。
示例1、一种物联网设备之间的通信方法，包括：
建立第一物联网设备与可信设备的通信连接；
获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
示例2可包括示例1所述的方法，所述第一通信密钥由所述第一物联网设备生成；
所述获取第一通信密钥包括：
从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
根据所获取的第一密钥生成参数，生成所述第一通信密钥。
示例3可包括示例1所述的方法，所述第一通信密钥由所述可信设备或所述第二物 联网设备生成；
所述获取第一通信密钥包括：
从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
示例4可包括示例1所述的方法，所述第一物联网设备中存储有可信认证标识列表；
在所述基于所述第一通信密钥，与所述第二物联网设备进行加密通信之前，所述方法还包括：
获取所述第二物联网设备提供的可信认证标识；
确定所述可信认证标识存在于可信认证标识列表中。
示例5可包括示例1所述的方法，所述基于所述第一通信密钥，与所述第二物联网设备进行加密通信包括：
基于所述第一通信密钥对第一物联网设备的通信数据进行加密，并发送至第二物联网设备；或，
基于所述第一通信密钥对第二物联网设备的通信数据进行解密。
示例6可包括示例1所述的方法，所述建立第一物联网设备与可信设备的通信连接包括：
从所述可信设备获取校验信息；
根据所述校验信息，与所述可信设备完成可信校验。
示例7可包括示例6所述的方法，所述校验信息包括数字证书，所述根据所述校验信息，与所述可信设备完成可信校验包括：
根据预置的根证书，确定对所述数字证书校验通过。
示例8可包括示例6所述的方法，所述方法还包括：
从所述可信设备获取数字签名；
根据所述数字签名，确定所述校验信息完整。
示例9可包括示例6所述的方法，所述校验信息经过云端私钥加密；
在所述根据所述校验信息，与所述可信设备完成可信校验之前，所述方法还包括：
根据与所述云端私钥所对应的云端公钥，对所述校验信息进行解密。
示例10可包括示例1所述的方法，所述方法还包括：
获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
示例11可包括示例10所述的方法，所述第二通信密钥由所述第一物联网设备生成；
所述获取第二通信密钥包括：
从所述可信设备和所述第一物联网设备中的至少一端分别获取第二密钥生成参数；
根据所获取的第二密钥生成参数，生成所述第二通信密钥。
示例12可包括示例10所述的方法，所述第二通信密钥由所述可信设备生成；
所述获取第二通信密钥包括：
从所述可信设备获取所述第二通信密钥。
示例13可包括示例1所述的方法，所述方法还包括：
获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
检测属性变化事件，并通知至所述监控设备。
示例14可包括示例13所述的方法，在所述获取监控设备对所述第一物联网设备的属性变化事件的订阅请求之前，所述方法还包括：
向所述监控设备提供属性相关信息。
示例15可包括示例13所述的方法，在所述检测属性变化事件之前，所述方法还包括：
检测所述第一物联网设备的属性初始数据，并提供给所述监控设备。
示例16可包括示例1所述的方法，所述第一物联网设备与所述第二物联网设备中的至少一个处于与云端的离线状态下。
示例17、一种物联网设备之间的通信方法，包括：
分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
示例18可包括示例17所述的方法，所述分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接包括：
分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
示例19可包括示例18所述的方法，所述方法还包括：
分别向所述第一物联网设备和所述第二物联网设备提供数字签名，以供所述第一物联网设备和所述第二物联网设备验证所述校验信息完整。
示例20可包括示例17所述的方法，所述第一通信密钥由所述可信设备生成；
所述提供第一通信密钥给所述第一物联网设备和/或第二物联网设备包括：
将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
示例21可包括示例20所述的方法，所述第一通信密钥由所述第一物联网设备或所述第二物联网设备生成；
所述提供第一通信密钥给所述第一物联网设备和/或第二物联网设备包括：
获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备中的另一个。
示例22可包括示例17所述的方法，所述方法还包括：
获取第二通信密钥，以基于所述第二通信密钥，与所述第一物联网设备进行加密通信。
示例23可包括示例17所述的方法，所述方法还包括：
获取第三通信密钥，以基于所述第三通信密钥，与所述第二物联网设备进行加密通信。
示例24、一种物联网设备之间的通信装置，包括：
通信连接建立模块，用于建立第一物联网设备与可信设备的通信连接；
第一通信密钥获取模块，用于获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
通信模块，用于基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
示例25可包括示例24所述的装置，所述第一通信密钥由所述第一物联网设备生成；
所述第一通信密钥获取模块包括：
第一密钥生成参数获取子模块，用于从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
第一通信密钥生成子模块，用于根据所获取的第一密钥生成参数，生成所述第一通信密钥。
示例26可包括示例24所述的装置，所述第一通信密钥由所述可信设备或所述第二物联网设备生成；
所述第一通信密钥获取模块包括：
第一通信密钥获取子模块，用于从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
示例27可包括示例24所述的装置，所述第一物联网设备中存储有可信认证标识列表；
所述装置还包括：
可信认证标识获取模块，用于获取所述第二物联网设备提供的可信认证标识；
第一确定模块，用于确定所述可信认证标识存在于可信认证标识列表中。
示例28可包括示例24所述的装置，所述通信连接建立模块包括：
校验信息获取子模块，用于从所述可信设备获取校验信息；
可信校验子模块，用于根据所述校验信息，与所述可信设备完成可信校验。
示例29可包括示例24所述的装置，所述装置还包括：
第二通信密钥获取模块，用于获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
示例30可包括示例24所述的装置，所述装置还包括：
订阅请求获取模块，用于获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
属性变化事件检测模块，用于检测属性变化事件，并通知至所述监控设备。
示例31可包括示例24所述的装置，所述第一物联网设备与所述第二物联网设备中的至少一个处于与云端的离线状态下。
示例32、一种物联网设备之间的通信装置，包括：
通信连接建立模块，用于分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
第一通信密钥提供模块，用于提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
示例33可包括示例32所述的装置，所述通信连接建立模块包括：
校验信息提供子模块，用于分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
示例34可包括示例32所述的装置，所述第一通信密钥由所述可信设备生成；
所述第一通信密钥提供模块包括：
第一通信密钥发送子模块，用于将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
示例35可包括示例32所述的装置，所述第一通信密钥由所述第一物联网设备或所 述第二物联网设备生成；
所述第一通信密钥提供模块包括：
第一通信密钥发送子模块，用于获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备中的另一个。
示例36、一种装置，包括：一个或多个处理器；和其上存储的有指令的一个或多个机器可读介质，当由所述一个或多个处理器执行时，使得所述装置执行如示例1-示例23一个或多个的方法。
示例35、一个或多个机器可读介质，其上存储有指令，当由一个或多个处理器执行时，使得装置执行如示例1-示例23一个或多个的方法。
虽然某些实施例是以说明和描述为目的的，各种各样的替代、和/或、等效的实施方案、或计算来达到同样的目的实施例示出和描述的实现，不脱离本申请的实施范围。本申请旨在覆盖本文讨论的实施例的任何修改或变化。因此，显然本文描述的实施例仅由权利要求和它们的等同物来限定。

Claims (37)

  1. 一种物联网设备之间的通信方法，其特征在于，包括：
    建立第一物联网设备与可信设备的通信连接；
    获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
    基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
  2. 根据权利要求1所述的方法，其特征在于，所述第一通信密钥由所述第一物联网设备生成；
    所述获取第一通信密钥包括：
    从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
    根据所获取的第一密钥生成参数，生成所述第一通信密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述第一通信密钥由所述可信设备或所述第二物联网设备生成；
    所述获取第一通信密钥包括：
    从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
  4. 根据权利要求1所述的方法，其特征在于，所述第一物联网设备中存储有可信认证标识列表；
    在所述基于所述第一通信密钥，与所述第二物联网设备进行加密通信之前，所述方法还包括：
    获取所述第二物联网设备提供的可信认证标识；
    确定所述可信认证标识存在于可信认证标识列表中。
  5. 根据权利要求1所述的方法，其特征在于，所述基于所述第一通信密钥，与所述第二物联网设备进行加密通信包括：
    基于所述第一通信密钥对第一物联网设备的通信数据进行加密，并发送至第二物联网设备；或，
    基于所述第一通信密钥对第二物联网设备的通信数据进行解密。
  6. 根据权利要求1所述的方法，其特征在于，所述建立第一物联网设备与可信设备的通信连接包括：
    从所述可信设备获取校验信息；
    根据所述校验信息，与所述可信设备完成可信校验。
  7. 根据权利要求6所述的方法，其特征在于，所述校验信息包括数字证书，所述根据所述校验信息，与所述可信设备完成可信校验包括：
    根据预置的根证书，确定对所述数字证书校验通过。
  8. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    从所述可信设备获取数字签名；
    根据所述数字签名，确定所述校验信息完整。
  9. 根据权利要求6所述的方法，其特征在于，所述校验信息经过云端私钥加密；
    在所述根据所述校验信息，与所述可信设备完成可信校验之前，所述方法还包括：
    根据与所述云端私钥所对应的云端公钥，对所述校验信息进行解密。
  10. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
  11. 根据权利要求10所述的方法，其特征在于，所述第二通信密钥由所述第一物联网设备生成；
    所述获取第二通信密钥包括：
    从所述可信设备和所述第一物联网设备中的至少一端分别获取第二密钥生成参数；
    根据所获取的第二密钥生成参数，生成所述第二通信密钥。
  12. 根据权利要求10所述的方法，其特征在于，所述第二通信密钥由所述可信设备生成；
    所述获取第二通信密钥包括：
    从所述可信设备获取所述第二通信密钥。
  13. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
    检测属性变化事件，并通知至所述监控设备。
  14. 根据权利要求13所述的方法，其特征在于，在所述获取监控设备对所述第一物联网设备的属性变化事件的订阅请求之前，所述方法还包括：
    向所述监控设备提供属性相关信息。
  15. 根据权利要求13所述的方法，其特征在于，在所述检测属性变化事件之前，所述方法还包括：
    检测所述第一物联网设备的属性初始数据，并提供给所述监控设备。
  16. 根据权利要求1所述的方法，其特征在于，所述第一物联网设备与所述第二物联网设备中的至少一个处于与云端的离线状态下。
  17. 一种物联网设备之间的通信方法，其特征在于，包括：
    分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
    提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
  18. 根据权利要求17所述的方法，其特征在于，所述分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接包括：
    分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    分别向所述第一物联网设备和所述第二物联网设备提供数字签名，以供所述第一物联网设备和所述第二物联网设备验证所述校验信息完整。
  20. 根据权利要求17所述的方法，其特征在于，所述第一通信密钥由所述可信设备生成；
    所述提供第一通信密钥给所述第一物联网设备和/或第二物联网设备包括：
    将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
  21. 根据权利要求20所述的方法，其特征在于，所述第一通信密钥由所述第一物联网设备或所述第二物联网设备生成；
    所述提供第一通信密钥给所述第一物联网设备和/或第二物联网设备包括：
    获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备中的另一个。
  22. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    获取第二通信密钥，以基于所述第二通信密钥，与所述第一物联网设备进行加密通信。
  23. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    获取第三通信密钥，以基于所述第三通信密钥，与所述第二物联网设备进行加密通信。
  24. 一种物联网设备之间的通信装置，其特征在于，包括：
    通信连接建立模块，用于建立第一物联网设备与可信设备的通信连接；
    第一通信密钥获取模块，用于获取第一通信密钥，所述第一通信密钥通过所述可信设备提供给所述第一物联网设备和/或第二物联网设备；
    通信模块，用于基于所述第一通信密钥，与所述第二物联网设备进行加密通信。
  25. 根据权利要求24所述的装置，其特征在于，所述第一通信密钥由所述第一物联网设备生成；
    所述第一通信密钥获取模块包括：
    第一密钥生成参数获取子模块，用于从所述可信设备、所述第一物联网设备和所述第二物联网设备中的至少一端分别获取第一密钥生成参数；
    第一通信密钥生成子模块，用于根据所获取的第一密钥生成参数，生成所述第一通信密钥。
  26. 根据权利要求24所述的装置，其特征在于，所述第一通信密钥由所述可信设备或所述第二物联网设备生成；
    所述第一通信密钥获取模块包括：
    第一通信密钥获取子模块，用于从所述可信设备获取所述可信设备或所述第二物联网设备生成的第一通信密钥。
  27. 根据权利要求24所述的装置，其特征在于，所述第一物联网设备中存储有可信认证标识列表；
    所述装置还包括：
    可信认证标识获取模块，用于获取所述第二物联网设备提供的可信认证标识；
    第一确定模块，用于确定所述可信认证标识存在于可信认证标识列表中。
  28. 根据权利要求24所述的装置，其特征在于，所述通信连接建立模块包括：
    校验信息获取子模块，用于从所述可信设备获取校验信息；
    可信校验子模块，用于根据所述校验信息，与所述可信设备完成可信校验。
  29. 根据权利要求24所述的装置，其特征在于，所述装置还包括：
    第二通信密钥获取模块，用于获取第二通信密钥，以基于所述第二通信密钥，与所述可信设备进行加密通信。
  30. 根据权利要求24所述的装置，其特征在于，所述装置还包括：
    订阅请求获取模块，用于获取监控设备对所述第一物联网设备的属性变化事件的订阅请求；
    属性变化事件检测模块，用于检测属性变化事件，并通知至所述监控设备。
  31. 根据权利要求24所述的装置，其特征在于，所述第一物联网设备与所述第二物联网设备中的至少一个处于与云端的离线状态下。
  32. 一种物联网设备之间的通信装置，其特征在于，包括：
    通信连接建立模块，用于分别建立可信设备与第一物联网设备以及第二物联网设备的通信连接；
    第一通信密钥提供模块，用于提供第一通信密钥给所述第一物联网设备和/或所述第二物联网设备，以使所述第一物联网设备与所述第二物联网设备基于所述第一通信密钥进行加密通信。
  33. 根据权利要求32所述的装置，其特征在于，所述通信连接建立模块包括：
    校验信息提供子模块，用于分别向所述第一物联网设备和所述第二物联网设备提供校验信息，以供所述第一物联网设备和所述第二物联网设备分别与所述可信设备完成可信校验。
  34. 根据权利要求32所述的装置，其特征在于，所述第一通信密钥由所述可信设备生成；
    所述第一通信密钥提供模块包括：
    第一通信密钥发送子模块，用于将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备。
  35. 根据权利要求32所述的装置，其特征在于，所述第一通信密钥由所述第一物联网设备或所述第二物联网设备生成；
    所述第一通信密钥提供模块包括：
    第一通信密钥发送子模块，用于获取所述第一通信密钥，并将所述第一通信密钥发送给所述第一物联网设备和所述第二物联网设备中的另一个。
  36. 一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述计算机程序时实现如权利要求1-23任一项所述的一个或多个的方法。
  37. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1-23任一项所述的一个或多个的方法。
PCT/CN2019/082261 2018-04-17 2019-04-11 物联网设备之间的通信方法及装置 WO2019201154A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/072,608 US11729156B2 (en) 2018-04-17 2020-10-16 Method and apparatus for communication between internet of things devices

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810343519.8A CN110392014B (zh) 2018-04-17 2018-04-17 物联网设备之间的通信方法及装置
CN201810343519.8 2018-04-17

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/072,608 Continuation US11729156B2 (en) 2018-04-17 2020-10-16 Method and apparatus for communication between internet of things devices

Publications (1)

Publication Number Publication Date
WO2019201154A1 true WO2019201154A1 (zh) 2019-10-24

Family

ID=68239971

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/082261 WO2019201154A1 (zh) 2018-04-17 2019-04-11 物联网设备之间的通信方法及装置

Country Status (4)

Country Link
US (1) US11729156B2 (zh)
CN (1) CN110392014B (zh)
TW (1) TW201944756A (zh)
WO (1) WO2019201154A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111586125A (zh) * 2020-04-28 2020-08-25 济南浪潮高新科技投资发展有限公司 一种物联网系统
CN115913730A (zh) * 2022-11-29 2023-04-04 北方工业大学 基于物联网设备的信息处理方法、装置、设备及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108964924B (zh) * 2018-07-24 2020-06-05 腾讯科技（深圳）有限公司 数字证书校验方法、装置、计算机设备和存储介质
CN111049799B (zh) 2019-11-13 2022-01-21 华为终端有限公司 控制方法、装置和系统
TWI733265B (zh) * 2019-12-04 2021-07-11 中華電信股份有限公司 安全連線系統及方法
CN111092735B (zh) * 2019-12-20 2022-12-13 杭州涂鸦信息技术有限公司 一种基于椭圆曲线算法的设备授权的离线校验方法及系统
CN111669430B (zh) * 2020-04-30 2021-12-31 华为技术有限公司 通信方法、控制物联网设备的方法、电子设备
US20220394028A1 (en) * 2021-06-03 2022-12-08 Unisys Corporation Flexible authentication service for iot devices accommodating non-ip environments
CN113612747B (zh) * 2021-07-26 2024-02-09 深圳Tcl新技术有限公司 设备控制权限的设置方法、装置、计算机设备和存储介质
WO2023142072A1 (zh) * 2022-01-29 2023-08-03 Oppo广东移动通信有限公司 加密配置方法、装置、设备、存储介质及程序产品
CN114666097B (zh) * 2022-02-25 2024-05-28 深圳极联信息技术股份有限公司 一种物联网设备的通信方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101873588A (zh) * 2010-05-27 2010-10-27 大唐微电子技术有限公司 一种业务应用安全实现方法及系统
CN103475624A (zh) * 2012-06-06 2013-12-25 中兴通讯股份有限公司 一种物联网密钥管理中心系统、密钥分发系统和方法
CN103532963A (zh) * 2013-10-22 2014-01-22 中国联合网络通信集团有限公司 一种基于物联网设备认证方法、装置和系统
CN105162772A (zh) * 2015-08-04 2015-12-16 三星电子（中国）研发中心 一种物联网设备认证与密钥协商方法和装置
US20180006829A1 (en) * 2010-04-30 2018-01-04 T-Central, Inc. Secure communication of iot devices for vehicles

Family Cites Families (42)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6263441B1 (en) * 1998-10-06 2001-07-17 International Business Machines Corporation Real-time alert mechanism for signaling change of system configuration
EP1865656A1 (en) * 2006-06-08 2007-12-12 BRITISH TELECOMMUNICATIONS public limited company Provision of secure communications connection using third party authentication
US9832026B2 (en) * 2010-04-30 2017-11-28 T-Central, Inc. System and method from Internet of Things (IoT) security and management
US9413827B2 (en) 2013-02-25 2016-08-09 Qualcomm Incorporated Context aware actions among heterogeneous internet of things (IOT) devices
US9680726B2 (en) 2013-02-25 2017-06-13 Qualcomm Incorporated Adaptive and extensible universal schema for heterogeneous internet of things (IOT) devices
US9847961B2 (en) 2013-02-25 2017-12-19 Qualcomm Incorporated Automatic IoT device social network expansion
US9900171B2 (en) 2013-02-25 2018-02-20 Qualcomm Incorporated Methods to discover, configure, and leverage relationships in internet of things (IoT) networks
US9853826B2 (en) 2013-02-25 2017-12-26 Qualcomm Incorporated Establishing groups of internet of things (IOT) devices and enabling communication among the groups of IOT devices
US9900172B2 (en) 2013-04-25 2018-02-20 Qualcomm Incorporated Coordinated resource sharing in machine-to-machine communication using a network-based group management and floor control mechanism
US9871865B2 (en) 2013-07-11 2018-01-16 Neura, Inc. Physical environment profiling through internet of things integration platform
EP3105888B1 (en) 2014-02-14 2020-05-06 Intertrust Technologies Corporation Network security systems and methods
US9754097B2 (en) 2014-02-21 2017-09-05 Liveensure, Inc. Method for peer to peer mobile context authentication
CN103812869B (zh) * 2014-02-21 2017-03-22 昆山中创软件工程有限责任公司 一种基于物联网的数据传输方法及装置
US10158536B2 (en) 2014-05-01 2018-12-18 Belkin International Inc. Systems and methods for interaction with an IoT device
CN103986575B (zh) * 2014-06-05 2017-04-12 武汉大学 一种计算非对称的共享密钥建立方法
CN104283881B (zh) * 2014-10-11 2017-10-27 上海华和得易信息技术发展有限公司 用于物联网传感设备的认证授权和安全使用的方法
US9832173B2 (en) * 2014-12-18 2017-11-28 Afero, Inc. System and method for securely connecting network devices
US9762556B2 (en) 2015-01-09 2017-09-12 Verisign, Inc. Registering, managing, and communicating with IOT devices using domain name system processes
CN104660498B (zh) * 2015-03-17 2018-10-12 联想(北京)有限公司 网关设备和信息处理方法
US10469464B2 (en) * 2015-06-09 2019-11-05 Intel Corporation Self-configuring key management system for an internet of things network
CN105119785A (zh) * 2015-07-15 2015-12-02 泰凌微电子（上海）有限公司 智能家居网络节点的配置方法、数据发送和接收方法
US10631040B2 (en) * 2015-12-14 2020-04-21 Afero, Inc. System and method for internet of things (IoT) video camera implementations
US10412064B2 (en) 2016-01-11 2019-09-10 Centurylink Intellectual Property Llc System and method for implementing secure communications for internet of things (IOT) devices
US10419930B2 (en) * 2016-05-27 2019-09-17 Afero, Inc. System and method for establishing secure communication channels with internet of things (IoT) devices
EP3253020A1 (en) * 2016-06-03 2017-12-06 Gemalto Sa A method and an apparatus for publishing assertions in a distributed database of a mobile telecommunication network
US10447683B1 (en) * 2016-11-17 2019-10-15 Amazon Technologies, Inc. Zero-touch provisioning of IOT devices with multi-factor authentication
CN106453648B (zh) * 2016-11-29 2020-04-28 海信集团有限公司 智能家居设备的设备状态确定方法及装置
CN111683103B (zh) * 2016-12-21 2022-08-30 创新先进技术有限公司 信息交互方法及装置
US10164983B2 (en) * 2017-01-20 2018-12-25 Verizon Patent And Licensing Inc. Distributed authentication for internet-of-things resources
US10447665B2 (en) * 2017-03-31 2019-10-15 Konica Minolta Laboratory U.S.A., Inc. IPv6 link local secure network with biometric security to secure IOT devices
US10341329B2 (en) * 2017-07-05 2019-07-02 Nxp B.V. Method for generating a public/private key pair and public key certificate for an internet of things device
CN107370597A (zh) * 2017-07-11 2017-11-21 深圳市雪球科技有限公司 基于物联网的安全认证方法以及安全认证系统
WO2019035700A1 (en) * 2017-08-18 2019-02-21 Samsung Electronics Co., Ltd. METHOD AND APPARATUS FOR BOARDING IN AN IOT NETWORK
CN107483301A (zh) * 2017-08-28 2017-12-15 四川长虹电器股份有限公司 智能家居系统的控制方法
US10805381B2 (en) * 2017-10-03 2020-10-13 Citrix Systems, Inc Web storage based IoT device protect mechanism
US10943005B2 (en) * 2017-11-22 2021-03-09 Aeris Communications, Inc. Secure authentication of devices for internet of things
US10838705B2 (en) * 2018-02-12 2020-11-17 Afero, Inc. System and method for service-initiated internet of things (IoT) device updates
US10587400B2 (en) * 2018-02-12 2020-03-10 Afero, Inc. System and method for securely configuring a new device with network credentials
US10819526B2 (en) * 2018-02-19 2020-10-27 Microsoft Technology Licensing, Llc Identity-based certificate authority system architecture
US20190266278A1 (en) * 2018-02-26 2019-08-29 Altibase Corp. IoT Data Management System and Method
US11153309B2 (en) * 2018-03-13 2021-10-19 At&T Mobility Ii Llc Multifactor authentication for internet-of-things devices
US10911224B1 (en) * 2018-03-21 2021-02-02 Amazon Technologies, Inc. Secure network-enabled lock

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180006829A1 (en) * 2010-04-30 2018-01-04 T-Central, Inc. Secure communication of iot devices for vehicles
CN101873588A (zh) * 2010-05-27 2010-10-27 大唐微电子技术有限公司 一种业务应用安全实现方法及系统
CN103475624A (zh) * 2012-06-06 2013-12-25 中兴通讯股份有限公司 一种物联网密钥管理中心系统、密钥分发系统和方法
CN103532963A (zh) * 2013-10-22 2014-01-22 中国联合网络通信集团有限公司 一种基于物联网设备认证方法、装置和系统
CN105162772A (zh) * 2015-08-04 2015-12-16 三星电子（中国）研发中心 一种物联网设备认证与密钥协商方法和装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111586125A (zh) * 2020-04-28 2020-08-25 济南浪潮高新科技投资发展有限公司 一种物联网系统
CN115913730A (zh) * 2022-11-29 2023-04-04 北方工业大学 基于物联网设备的信息处理方法、装置、设备及存储介质
CN115913730B (zh) * 2022-11-29 2023-09-15 北方工业大学 基于物联网设备的信息处理方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US20210036999A1 (en) 2021-02-04
US11729156B2 (en) 2023-08-15
TW201944756A (zh) 2019-11-16
CN110392014B (zh) 2022-08-05
CN110392014A (zh) 2019-10-29

Similar Documents

Publication Publication Date Title
WO2019201154A1 (zh) 物联网设备之间的通信方法及装置
JP6923611B2 (ja) サービス層におけるコンテンツセキュリティ
US20200092108A1 (en) Data communication method, device and apparatus, and storage medium
WO2019120091A1 (zh) 身份认证方法、系统及计算设备
US20160269176A1 (en) Key Configuration Method, System, and Apparatus
US20200259667A1 (en) Distributed management system for remote devices and methods thereof
US11658949B2 (en) Secure publish-subscribe communication methods and apparatus
CN109862560B (zh) 一种蓝牙认证方法、装置、设备和介质
US20210377047A1 (en) Systems, methods, and apparatuses for network management
US10601590B1 (en) Secure secrets in hardware security module for use by protected function in trusted execution environment
US10129229B1 (en) Peer validation
US10963593B1 (en) Secure data storage using multiple factors
WO2022100356A1 (zh) 身份认证系统、方法、装置、设备及计算机可读存储介质
CN111654481B (zh) 一种身份认证方法、装置和存储介质
US20200396088A1 (en) System and method for securely activating a mobile device storing an encryption key
TW201539239A (zh) 伺服器、用戶設備以及用戶設備與伺服器的交互方法
US10972912B1 (en) Dynamic establishment of trust between locally connected devices
EP4336393A1 (en) Security authentication method, readable medium, and electronic device
WO2023141876A1 (zh) 数据传输方法、装置、系统、电子设备及可读介质
CN113904830B (zh) 一种spa认证的方法、装置、电子设备和可读存储介质
CN116248268A (zh) 国密握手请求的处理方法、设备及可读存储介质
CN114666154B (zh) 设备通信方法、装置、网关、设备、系统、介质和产品
EP3952204B1 (en) Coordinated management of cryptographic keys for communication with peripheral devices
US20210344557A1 (en) Systems, methods, and apparatuses for network management
CN116708039B (zh) 基于零信任单包认证的访问方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19788237

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19788237

Country of ref document: EP

Kind code of ref document: A1