WO2023141876A1 - 数据传输方法、装置、系统、电子设备及可读介质 - Google Patents

数据传输方法、装置、系统、电子设备及可读介质 Download PDF

Info

Publication number
WO2023141876A1
WO2023141876A1 PCT/CN2022/074293 CN2022074293W WO2023141876A1 WO 2023141876 A1 WO2023141876 A1 WO 2023141876A1 CN 2022074293 W CN2022074293 W CN 2022074293W WO 2023141876 A1 WO2023141876 A1 WO 2023141876A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
security
key
module
data transmission
Prior art date
Application number
PCT/CN2022/074293
Other languages
English (en)
French (fr)
Inventor
马希通
李涛
赵凯
夏友祥
Original Assignee
京东方科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司 filed Critical 京东方科技集团股份有限公司
Priority to CN202280000084.1A priority Critical patent/CN116830525A/zh
Priority to PCT/CN2022/074293 priority patent/WO2023141876A1/zh
Publication of WO2023141876A1 publication Critical patent/WO2023141876A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the disclosure belongs to the field of computer technology, and in particular relates to a data transmission method, device, system, electronic equipment and readable medium.
  • the present disclosure aims to provide a data transmission method, device, system, electronic equipment and readable medium.
  • the first aspect of the present disclosure provides a data transmission method applied to a security enhancement module, which includes:
  • the original transmission data is used for transmission between the data transmission device and the cloud platform, and the security key is obtained from the cloud platform.
  • the data transmission device before receiving the original transmission data sent by the data transmission device, it also includes:
  • the receiving the original transmission data sent by the data transmission device specifically includes: receiving the original transmission data sent by the data transmission device when the device is authenticated.
  • the device registration request is sent by the data transmission device, and the device registration request includes: the module information of the security enhancement module and the device information of the data transmission device; and the platform certificate includes : module information of the security enhancement module and device information of the data transmission device.
  • the auxiliary verification data includes: time stamp data; and, the device information of the data transmission device includes: device service type and/or device authentication type;
  • the determining the security key corresponding to the data type of the original transmission data includes: receiving the security key returned by the cloud platform in response to the key negotiation request sent by the data transmission device; wherein, the The security key is generated according to the device service type and/or device authentication type.
  • the receiving the security key returned by the cloud platform in response to the key negotiation request sent by the data transmission device includes:
  • the security key corresponds to the device identification; when the device authentication type is the second authentication type, the security key corresponds to the device model; when the device When the authentication type is the third authentication type, the security key corresponds to the service type of the device.
  • the platform certificate generated by the cloud platform is a platform certificate in the form of ciphertext; then, adding auxiliary verification data to the platform certificate to obtain the module certificate includes:
  • the module certificate in plain text form is encrypted by the module certificate key to obtain the module certificate in cipher text form.
  • the platform certificate in ciphertext form is obtained through symmetric encryption; the module certificate in ciphertext form is obtained through asymmetric encryption; and the key of the module certificate is obtained from the cloud platform.
  • the determining the security key corresponding to the original transmission data, and performing encryption and decryption processing on the original transmission data through the security key includes:
  • Encryption and decryption are performed on the original transmission data through the security key and the encryption and decryption methods.
  • the data type includes at least one of the following: plaintext type, ciphertext type, sending type, receiving type, transmission data type, and security verification type;
  • the security key includes at least one of the following: a symmetric key, a non-key key, a key obtained from a cloud platform, a locally generated key, an encryption key, a decryption key, a fixed keys, and variable keys;
  • the encryption and decryption methods include: symmetric encryption, symmetric decryption, asymmetric encryption, and asymmetric decryption.
  • the security enhancement module is pluggably connected to the data transmission device through a preset interface, and the security enhancement module is connected to the data transmission device through a preset transmission protocol corresponding to the preset interface Communication; wherein, the preset interface includes a USB interface.
  • data transmission is performed between the security enhancement module and the data transmission device through a preset application program interface; and the application program interface is provided by a software development kit corresponding to the security enhancement module.
  • the second aspect of the present disclosure provides a data transmission method applied to a data transmission device, which includes:
  • the original transmission data is used for transmission between the data transmission device and the cloud platform, and the security key is obtained from the cloud platform.
  • the security enhancement module before sending the original transmission data to the security enhancement module, it also includes:
  • the sending the original transmission data to the security enhancement module specifically includes: sending the original transmission data to the security enhancement module when the device is authenticated.
  • the device registration request includes: the module information of the security enhancement module and the device information of the data transmission device; and the platform certificate includes: the module information of the security enhancement module and the data transmission device device information;
  • the auxiliary verification data includes: timestamp data; the device information of the data transmission device includes: device service type and/or device authentication type; then the security key corresponding to the original transmission data is determined by The cloud platform is generated according to the device service type and/or device authentication type;
  • the security key corresponds to the device identification; when the device authentication type is the second authentication type, the security key corresponds to the device model; when the device When the authentication type is the third authentication type, the security key corresponds to the service type of the device.
  • the security enhancement module before receiving the security enhancement module according to the security key corresponding to the original transmission data, it also includes:
  • the security enhancement module According to the result returned by the cloud platform, provide the security enhancement module with a security key from the cloud platform; wherein, the security key is generated according to the device service type and/or device authentication type.
  • providing the security key from the cloud platform to the security enhancement module includes:
  • the first key is decrypted to obtain the security key.
  • the sending the original transmission data to the security enhancement module includes: performing protocol conversion on the original transmission data received through the platform transmission protocol Processing, sending the original transmission data processed by the protocol conversion to the security enhancement module;
  • the original transmission data is the local data of the data transmission device
  • after receiving the security enhancement module according to the security key corresponding to the original transmission data, after performing encryption and decryption processing to obtain the secure transmission data further include : Perform protocol conversion processing on the secure transmission data received through the preset transmission protocol, and send the secure transmission data after the protocol conversion processing to the cloud platform.
  • the third aspect of the present disclosure provides a data transmission method applied to a cloud platform, which includes:
  • the method also includes:
  • said generating the platform certificate according to the received device registration request includes:
  • the generating the platform certificate according to the module information of the security enhancement module and the device information of the data transmission device includes:
  • the parsing of the module certificate, and performing device authentication according to the parsing result include:
  • the sending the generated security key to the security enhancement module includes:
  • the device information includes: device service type and/or device authentication type.
  • sending the generated security key to the security enhancement module includes:
  • a fourth aspect of the present disclosure provides a data transmission device, which includes:
  • a receiving module configured to receive the original transmission data sent by the data transmission device
  • the encryption and decryption module is configured to determine a security key corresponding to the original transmission data, and perform encryption and decryption processing on the original transmission data through the security key to obtain secure transmission data;
  • a sending module configured to send the secure transmission data to the data transmission device
  • the original transmission data is used for transmission between the data transmission device and the cloud platform, and the security key is obtained from the cloud platform.
  • a fifth aspect of the present disclosure provides a data transmission device, which includes:
  • a sending module configured to send the original transmission data to the security enhancement module
  • the receiving module is configured to receive the secure transmission data obtained after the security enhancement module performs encryption and decryption processing according to the security key corresponding to the original transmission data;
  • the original transmission data is used for transmission between the data transmission device and the cloud platform, and the security key is obtained from the cloud platform.
  • a sixth aspect of the present disclosure provides a cloud platform, which includes:
  • a key sending module configured to send the generated security key to the security enhancement module
  • the first transmission module is configured to send the encrypted first transmission data to the data transmission device, so that the data transmission device provides the first transmission data to the security enhancement module, so that the security enhancement module according to the perform the decryption process using the above security key; and/or,
  • the second transmission module is configured to receive the second transmission data sent by the data transmission device and encrypted by the security enhancement module with the security key.
  • a seventh aspect of the present disclosure provides a data transmission system, which includes: the data transmission device of the fourth aspect, the data transmission device of the fifth aspect, and the cloud platform of the sixth aspect.
  • the eighth aspect of the present disclosure provides an electronic device, including:
  • processors one or more processors
  • a memory on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the above;
  • One or more I/O interfaces are connected between the processor and the memory, configured to realize information exchange between the processor and the memory.
  • a ninth aspect of the present disclosure provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the method described in any one of the above-mentioned methods is implemented.
  • FIG. 1 is a flowchart of a data transmission method applied to a security enhancement module provided by an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a data transmission method applied to a data transmission device provided by an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a data transmission method applied to a cloud platform provided by an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a data transmission method applied to a security enhancement module, a data transmission device, and a cloud platform provided by an embodiment of the present disclosure
  • FIG. 5 is a structural diagram of a data transmission device provided by an embodiment of the present disclosure.
  • FIG. 6 is a structural diagram of a data transmission device provided by another embodiment of the present disclosure.
  • FIG. 7 is a structural diagram of a cloud platform provided by an embodiment of the present disclosure.
  • FIG. 8 is a structural diagram of a data transmission system according to an embodiment of the present disclosure.
  • FIG. 9 is a functional block diagram of an electronic device according to an embodiment of the present disclosure.
  • the embodiments of the present disclosure provide a data transmission method, which improves the reliability of data transmission through a security enhancement module, and avoids data leakage problems caused by attacks on external devices.
  • the data transmission method provided by the embodiment of the present disclosure may be applied to a security enhancement module.
  • the security enhancement module can be connected with the data transmission device through plugging, and the data transmission device and the cloud platform communicate with each other.
  • the method includes:
  • Step S110 Receive the original transmission data sent by the data transmission device.
  • the original transmission data is used for transmission between the data transmission device and the cloud platform.
  • the data transmission device can be various types of external devices.
  • the original transmission data can be the data sent by the cloud platform to the data transmission device, or the data generated by the data transmission device and sent to the cloud platform.
  • the present invention does not limit The data type and data source of the original transmitted data.
  • Step S120 Determine the security key corresponding to the original transmission data, and perform encryption and decryption processing on the original transmission data through the security key to obtain secure transmission data.
  • the security key is obtained from the cloud platform. If the original transmission data is the data sent by the cloud platform to the data transmission device, it is usually in an encrypted state. Therefore, it is necessary to perform decryption processing through the security key to obtain the secure transmission data in the decrypted state. If the original transmission data is generated by the data transmission device and sent to the cloud platform, it is usually in an unencrypted state. Therefore, it is necessary to perform encryption processing with a security key to obtain secure transmission data in an encrypted state.
  • Step S130 Send the secure transmission data to the data transmission device.
  • the security enhancement module sends the encrypted or decrypted secure transmission data to the data transmission device for subsequent processing by the data transmission device.
  • the data transmission method provided by the embodiment of the present disclosure may be applied to a data transmission device.
  • the method includes:
  • Step S210 Send the original transmission data to the security enhancement module.
  • the original transmission data is used for transmission between the data transmission device and the cloud platform.
  • the data transmission device can be various types of external devices.
  • the original transmission data can be the data sent by the cloud platform to the data transmission device, or the data generated by the data transmission device and sent to the cloud platform.
  • the present invention does not limit The data type and data source of the original transmitted data.
  • Step S220 Receive the secure transmission data obtained after the security enhancement module performs encryption and decryption processing according to the security key corresponding to the original transmission data.
  • the security key is obtained from the cloud platform. If the original transmission data is the data sent by the cloud platform to the data transmission device, it is usually in an encrypted state. Therefore, it is necessary to perform decryption processing through the security key to obtain the secure transmission data in the decrypted state. If the original transmission data is generated by the data transmission device and sent to the cloud platform, it is usually in an unencrypted state. Therefore, it is necessary to perform encryption processing with a security key to obtain secure transmission data in an encrypted state.
  • the data transmission method provided by the embodiment of the present disclosure may be applied to a cloud platform.
  • the method includes:
  • Step S310 Send the generated security key to the security enhancement module.
  • the security key can be generated in various ways, for example, the security key can be obtained through a key negotiation operation between the cloud platform and the data transmission device.
  • the security key may also be determined according to the device type of the data transmission device, so that the security key is sent to the security enhancement module through the data transmission device.
  • Step S320 Send the encrypted first transmission data to the data transmission device, so that the data transmission device provides the first transmission data to the security enhancement module, so that the security enhancement module performs decryption processing according to the security key.
  • the cloud platform sends the encrypted first transmission data to the data transmission device, so that the data transmission device provides the first transmission data to the security enhancement module, and correspondingly, the security enhancement module performs decryption according to the security key provided by the cloud platform deal with.
  • Step S330 Receive the second transmission data sent by the data transmission device and encrypted by the security enhancement module with the security key.
  • the cloud platform receives the encrypted second transmission data sent by the data transmission device, and the encrypted second transmission data is encrypted by the security enhancement module with the help of the security key provided by the cloud platform.
  • step S320 and step S330 can be performed alternatively, or step S320 and step S330 can also be performed simultaneously or alternately, which is not limited in the present invention.
  • encryption and decryption operations can be performed on the transmission data between the cloud platform and the data transmission device. Since the encryption and decryption processes are all implemented inside the security enhancement module, and the security key is obtained from the Therefore, it avoids potential safety hazards caused by untrustworthy data transmission equipment and improves data security.
  • the data transmission method provided by the embodiment of the present disclosure is used to implement data interaction among a cloud platform, a data transmission device, and a security enhancement module.
  • the data transmission device can be various types of external devices used to access cloud platforms such as the Internet of Things, including various types of devices such as conference devices and security devices. Due to the large number of external devices, various sources, and different types, it will undoubtedly take a lot of time and cost to conduct security checks on each external device one by one, and it is easy to cause safety hazards due to missed inspections and other problems. It can be seen that, in the application scenario of this embodiment, data transmission devices have characteristics such as wide sources and difficult security checks.
  • a security enhancement module is provided.
  • the encryption and decryption process of sensitive data is realized through the security enhancement module, so as to ensure that the sensitive data is not leaked, and the communication security is improved in the scenario where the data transmission equipment is untrustworthy.
  • the security enhancement module can communicate with the data transmission device in various ways.
  • the security enhancement module can be connected with the data transmission device through a wired or wireless manner.
  • the security enhancement module in order to improve the flexibility of setting the security enhancement module, is plugged with the data transmission device in a pluggable manner to realize mutual communication.
  • the security enhancement module may be connected to the data transmission device through a USB interface, or may also be connected through an internal data bus, such as PICE/LVDS/I2C/UART.
  • the security enhancement module can be inserted into the data transmission device as a security chip (FPGA), thereby connecting to a SOC (System on Chip, System on Chip) through an internal data bus, thereby communicating with the data transmission device.
  • FPGA security chip
  • SOC System on Chip, System on Chip
  • the present disclosure does not limit the specific access form of the security enhancement module, as long as the purpose of communicating with the data transmission device flexibly and conveniently can be achieved.
  • the security enhancement module can replace the data transmission device to implement data encryption and decryption, data verification, etc., thereby improving security.
  • device registration and device authentication operations are performed before data transmission, and data transmission is performed after the device authentication is passed, thereby effectively preventing suspicious devices from accessing the cloud platform. into the cloud platform.
  • the method includes the following steps:
  • Step S1 The data transmission device sends a device registration request to the cloud platform.
  • the device registration request is used to register the relevant information of the data transmission device on the cloud platform, and, during the device registration process, the cloud platform not only needs to record the device information of the data transmission device, but also needs to record the information associated with the data transmission device Module information for the security-enhanced module of the relationship.
  • the legitimacy of the data transmission device and the security enhancement module is verified to ensure the trusted access of the device.
  • the security enhancement module is assigned to the data transmission device in advance, and correspondingly, the device registration request sent by the data transmission device includes: module information of the security enhancement module and device information of the data transmission device.
  • the module information of the security enhancement module is used to uniquely identify a security enhancement module, for example, may be an ID of the security enhancement module.
  • the device information of the data transmission device is used to describe the device characteristics of the data transmission device.
  • the device information includes: a device service type and/or a device authentication type.
  • the device service type is used to describe the service type of the data transmission device, such as conference type, security type, and the like.
  • the device service type may also be a gateway type, a lighting type, a camera type, and the like.
  • the device authentication type is used to describe the authentication method of the device, which can be set by the security level of the device.
  • the data transmission device sends a device registration request. Therefore, the corresponding relationship between the data transmission device and the security enhancement module can be flexibly adjusted, which facilitates the flexible pairing between the security enhancement module and the data transmission device, and has high flexibility.
  • the security enhancement module is not pre-assigned to the data transmission device.
  • the cloud platform receives the device registration request, it allocates the corresponding security enhancement module to the data transmission device.
  • the device registration request sent by the data transmission device includes: the device information of the data transmission device, but does not include the module information of the security enhancement module.
  • the security enhancement module is directly allocated by the cloud platform. Therefore, the corresponding relationship between the security enhancement module and the data transmission device is preset by the cloud platform, and cannot be changed at will later, so the security is high.
  • At least one of the above two methods can be flexibly selected according to the characteristics of specific business scenarios.
  • Step S2 The cloud platform generates a platform certificate according to the received device registration request.
  • the cloud platform obtains the module information of the security enhancement module and the device information of the data transmission device contained in the device registration request, and generates a platform certificate according to the module information of the security enhancement module and the device information of the data transmission device.
  • the module information of the security enhancement module and the device information of the data transmission device are further encrypted to obtain the platform in ciphertext form Certificate.
  • the cloud platform parses the device registration request, obtains the module information of the security enhancement module contained in it and the device information of the data transmission device, and uses the platform certificate key (such as key A) to verify the security
  • the module information of the enhancement module and the device information of the data transmission device are encrypted, and the platform certificate is obtained according to the encrypted result.
  • the encryption operation may be a symmetric encryption operation.
  • an AES encryption algorithm may be used. It can be seen that the plaintext of the platform certificate includes the module information of the security enhancement module and the device information of the data transmission device, and the security in the transmission process can be improved through the encryption operation.
  • the cloud platform parses the device registration request, obtains the device information of the data transmission device contained therein, and allocates a corresponding security enhancement module according to the type of the data transmission device.
  • the platform certificate key such as key A
  • the security enhancement module is allocated by the cloud platform according to the device information in the device registration request.
  • the cloud platform selects the The security enhancement module that matches the device type of the current device is assigned.
  • Step S3 The cloud platform provides the platform certificate to the security enhancement module.
  • the cloud platform can provide the platform certificate to the security enhancement module through the data transmission device, or directly provide the platform certificate to the security enhancement module.
  • the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request.
  • the cloud platform sends the platform certificate to the data transmission device, and the data transmission device provides the platform certificate and the platform certificate key to the security enhancement module.
  • the cloud platform directly provides the platform certificate and the platform certificate key to the security enhancement module.
  • the platform certificate stored in the security enhancement module is added dynamically, so that different data transmission devices can be dynamically adapted, and the flexibility is improved.
  • the platform certificate and platform certificate key can be directly burned in the security enhancement module, thereby further improving security.
  • the cloud platform needs to record the corresponding relationship between the module information of the security enhancement module and the device information of the data transmission device, so as to further improve the security in the subsequent authentication process by means of the corresponding relationship, and prevent the Security risks caused by malicious replacement of data transmission equipment or security enhancement modules.
  • Step S4 the data transmission device sends an authentication instruction to the security enhancement module.
  • the data transmission device actively initiates a device authentication operation, so as to send an authentication instruction to the security enhancement module.
  • Step S5 In response to the authentication instruction, the security enhancement module adds auxiliary verification data to the platform certificate to obtain the module certificate.
  • the security enhancement module In response to the authentication instruction sent by the data transmission device, the security enhancement module adds auxiliary verification data to the stored platform certificate to obtain the module certificate.
  • the auxiliary verification data includes various additional data that can realize the auxiliary verification function, such as time stamp data, device fingerprint data, and the like.
  • the platform certificate generated by the cloud platform is a platform certificate in ciphertext form.
  • the security enhancement module decrypts the platform certificate in ciphertext form according to the platform certificate key (such as key A) provided by the cloud platform to obtain the platform certificate in plaintext form.
  • the platform certificate key such as key A
  • the key of the platform certificate used for decryption is the same as the key of the platform certificate when encrypted by the cloud platform, so that decryption can be realized at a relatively fast speed.
  • it can also be implemented through asymmetric encryption and decryption.
  • auxiliary verification data to the platform certificate in plain text to obtain a module certificate in plain text.
  • the security enhancement module obtains the internal system time, generates time stamp data according to the internal system time, adds the time stamp data to the platform certificate, and obtains the module certificate.
  • This process is essentially equivalent to the certificate reorganization process.
  • certificate reorganization the security can be further improved with the help of auxiliary verification data. For example, if the timestamp data is tampered with, it means that the certificate has been attacked during transmission.
  • the module certificate in plain text is encrypted by the module certificate key to obtain the module certificate in cipher text.
  • the platform certificate in ciphertext is obtained through symmetric encryption; the module certificate in ciphertext is obtained through asymmetric encryption; and the key of the module certificate is obtained from the cloud platform.
  • the module certificate in ciphertext form is obtained through an asymmetric encryption method, the transmission security of the module certificate can be improved.
  • the module certificate key can be obtained in various ways.
  • the security enhancement module sends a communication request (also called a module certificate key acquisition request) to the cloud platform through the data transmission device.
  • the cloud platform produces the module certificate private key b and the module certificate public key B according to the received communication request, wherein the module certificate private key b is stored in the cloud platform, and the module certificate public key B is forwarded to the security enhancement module through the data transmission device.
  • the module certificate public key B is the module certificate key. It can be seen that asymmetric encryption and decryption are realized with the help of the module certificate private key b and the module certificate public key B.
  • the security enhancement module is pluggably connected to the data transmission device through a preset interface, and the security enhancement module uses a preset transmission protocol corresponding to the preset interface (that is, the first A transmission protocol) communicates with the data transmission device; wherein, the preset interface includes a USB interface, and the preset transmission protocol includes a USB protocol.
  • the data transmission device communicates with the cloud platform through a platform transmission protocol, such as MQTT protocol communication.
  • MQTT Message Queuing Telemetry Transport
  • MQTT Message Queuing Telemetry Transport
  • TCP publish/subscribe paradigm under the ISO standard (ISO/IEC PRF 20922).
  • MQTT is a client-server based message publish/subscribe transport protocol.
  • the MQTT protocol is lightweight, simple, open, and easy to implement. These characteristics make it applicable to a wide range of applications.
  • M2M machine-to-machine
  • IoT Internet of Things
  • the data transmission device needs to perform a protocol conversion operation. After performing protocol conversion on the data received from the security enhancement module through the first transmission protocol, it is sent to the cloud platform through the second transmission protocol; After protocol conversion, the data from the cloud platform is sent to the security enhancement module through the first transmission protocol. Therefore, in this step, the data transmission device needs to perform protocol conversion on the communication request from the security enhancement module, so that it is converted from the USB protocol to the MQTT protocol, and then transmitted to the cloud platform. Moreover, after receiving the module certificate public key B sent by the cloud platform through the MQTT protocol, the protocol conversion is performed and sent to the security enhancement module through the USB protocol.
  • Step S6 The security enhancement module sends the module certificate to the cloud platform for the cloud platform to perform device authentication.
  • the security enhancement module first sends the module certificate to the data transmission device, and the data transmission device sends the module certificate to the cloud platform for device authentication.
  • the data transmission device sends the received module certificate from the security enhancement module to the cloud platform for the cloud platform to perform device authentication.
  • the security enhancement module sends the module certificate in ciphertext to the data transmission device through the USB protocol, and the data transmission device sends the module certificate in ciphertext to the cloud platform through the MQTT protocol.
  • Step S7 The cloud platform receives the module certificate sent by the security enhancement module through the data transmission device, analyzes the module certificate, and performs device authentication according to the analysis result.
  • the cloud platform decrypts the received module certificate in ciphertext form to obtain the module certificate in plaintext form; and matches the module certificate in plaintext form with the pre-generated platform certificate; If the matching is successful, the device authentication is passed.
  • the module certificate in ciphertext form can be asymmetrically decrypted through the module certificate private key b mentioned above.
  • the module certificate in plain text includes: the auxiliary verification data and the platform certificate in plain text obtained by parsing the security enhancement module.
  • the module information of the security enhancement module and the device information of the data transmission device contained in the plaintext platform certificate obtained by the security enhancement module analysis are consistent with the relevant information in the platform certificate pre-generated by the cloud platform. Therefore, if the module certificate in plain text matches the pre-generated platform certificate successfully, the device authentication passes; if the match fails, the device authentication fails.
  • the cloud extracts effective information from the decrypted module certificate plaintext, for example, extracts the ID identification of the security enhancement module, that is, the unique internal ID of the security enhancement module is used as the only trusted root of the data transmission device on the cloud platform.
  • the cloud platform compares the internal unique ID of the security enhancement module extracted by the platform with the root of trust stored in the cloud. If the comparison is successful, the authentication is successful, otherwise the authentication fails.
  • the cloud platform transmits the authentication result in plain text to the data transmission device through the MQTT protocol, and the data transmission device transmits the authentication result to the security module through the USB protocol.
  • the cloud platform only compares the module information of the security enhancement module, and as long as the module information of the security enhancement module matches successfully, the authentication is successful.
  • the cloud platform not only compares the module information of the security enhancement module, but also compares the device information of the data transmission device. Only when the combination of the module information of the security enhancement module and the device information of the data transmission device The authentication succeeds only when the relationship is consistent with the pre-stored content on the cloud platform. In this method, the authentication is performed through the combined relationship of the module information of the security enhancement module and the device information of the data transmission device. As long as any device in the data transmission device or the security enhancement module Changes can result in authentication failures, which improves security.
  • Step S8 The cloud platform feeds back the authentication result to the data transmission device.
  • Step S9 When the device authentication is passed, the data transmission device sends the original transmission data to the security enhancement module.
  • This step includes at least the following two situations:
  • the cloud platform sends the encrypted first transmission data to the data transmission device, and correspondingly, the data transmission device provides the encrypted first transmission data to the security enhancement module. That is, the original transmission data is: the first transmission data sent by the cloud platform to the data transmission device.
  • the data transmission device needs to send the unencrypted original transmission data to the cloud platform.
  • the unencrypted original transmission data is first sent to the security enhancement module for encryption processing, and the obtained The second transmits data.
  • the second transmission data is sent by the security enhancement module to the data transmission device, and then sent to the cloud platform by the data transmission device.
  • the cloud platform receives the second transmission data sent by the data transmission device and encrypted by the security enhancement module with the security key.
  • Step S10 the data transmission device sends a key negotiation request to the cloud platform.
  • this step may also be executed before step S9, and the present invention does not limit the execution timing of this step.
  • this step can also be performed multiple times during the subsequent data transmission process, that is, to obtain a key negotiation request from the cloud platform every preset period of time to replace the security key and improve security.
  • the specific execution timing and execution frequency of this step can be flexibly set according to business scenarios.
  • the sending frequency of the key agreement request is determined according to the device service type and/or device authentication type contained in the device information of the aforementioned data transmission device. For example, if it is determined according to the device service type and/or device authentication type that the security level of the device is high, it is necessary to increase the sending frequency of the key agreement request; otherwise, reduce the sending frequency of the key agreement request. In a word, the sending frequency of the key agreement request is determined according to the device service type and/or device authentication type, which can flexibly adapt to various service scenarios.
  • Step S11 The cloud platform sends the generated security key to the security enhancement module through the data transmission device in response to the key agreement request.
  • the cloud platform acquires device information corresponding to the key negotiation request, generates a security key according to the device information, and sends the generated security key to the security enhancement module.
  • the device information includes the above-mentioned device business type and/or device authentication type.
  • the data transmission device provides the security enhancement module with the security key from the cloud platform according to the result returned by the cloud platform.
  • the security key corresponds to the device identifier.
  • This type needs to generate a key for each device, and because the device is unique, it has higher security.
  • the security key corresponds to the device model.
  • This type needs to generate a key for each device model, and since the same model may contain multiple devices, the security is slightly lower than the security key of the first authentication type.
  • the security key corresponds to the device service type.
  • This type can generate a unified security key for all devices, so the security is the lowest.
  • the same security key can be generated for data transmission devices of the same service type.
  • the type of device authentication and the way of generating the security key depend on factors such as the type of data in the business scenario, which is not limited in the present disclosure.
  • the sending frequency of the key agreement request in this disclosure (that is, the replacement frequency of the security key) and the generation method of the security key can be flexibly adjusted according to actual business needs, so it can fully meet various data transmission services security needs.
  • the cloud platform encrypts the generated security key with the platform private key , to obtain the first key; and send the first key to the security enhancement module through the data transmission device.
  • the data transmission device sends the first key obtained after the cloud platform encrypts the security key with the platform private key to the security enhancement module.
  • the security enhancement module receives the first key obtained after the cloud platform encrypts the security key with the platform private key; decrypts the first key with the pre-acquired platform public key to obtain the security key.
  • both the platform public key and the platform private key are generated by the cloud platform, and the cloud platform provides the platform public key to the security enhancement module in advance, and the generation method of the platform public key and the platform private key can be flexibly set, for example, the platform public key
  • the key can be the same as the module certificate public key B mentioned above, and the platform private key can be the same as the module certificate private key b mentioned above.
  • the security key is asymmetrically encrypted with the platform private key to obtain the first key (that is, the security key in ciphertext form). Asymmetric decryption is performed on the first key through the platform public key to obtain a security key. Asymmetric encryption and decryption can improve security.
  • the security key is sent to the data transmission device through the MQTT protocol, and the data transmission device performs protocol conversion and sends it to the security enhancement module through the USB protocol.
  • Step S12 The security enhancement module determines the security key corresponding to the original transmission data, and performs encryption and decryption processing on the original transmission data through the security key to obtain the security transmission data.
  • the security key is obtained through the key agreement operation in the above steps.
  • the security enhancement module further determines the data type of the original transmission data, and determines the security key and the encryption and decryption method according to the data type; through the security key and the encryption and decryption method, the original transmission data is encrypted and decrypted.
  • the data type includes at least one of the following: plaintext type, ciphertext type, sending type, receiving type, transmission data type, and security verification type; and, the security key includes at least one of the following: symmetric key , non-key key, key obtained from the cloud platform, locally generated key, encryption key, decryption key, fixed key, and variable key; encryption and decryption methods include: symmetric encryption, Symmetric decryption, asymmetric encryption, asymmetric decryption.
  • the decryption operation is performed; when the original transmission data is the data transmission device to be When sending data to the cloud platform, that is, the data type is plain text and the sending type, the encryption operation is performed.
  • the original transmission data is: the first transmission data sent by the cloud platform to the data transmission device.
  • the security enhancement module decrypts the first transmission data by using the security key.
  • the original transmission data is the unencrypted original transmission data to be sent to the cloud platform by the data transmission device.
  • the security enhancement module encrypts the original transmission data through the security key.
  • the security key can be obtained in the following ways:
  • the security key returned by the cloud platform in response to the key agreement request sent by the data transmission device is received.
  • the cloud platform first sends the security key to the data transmission device, and then the data transmission device sends it to the security enhancement module.
  • the cloud platform first encrypts the security key with the platform private key to obtain the first key.
  • the security key is obtained in the following way: receiving the first key obtained after the cloud platform encrypts the security key with the platform private key; decrypting the first key with the platform public key obtained in advance to obtain the security key. key.
  • Step S13 the security enhancement module sends the security transmission data to the data transmission device.
  • the security enhancement module can send the security transmission data to the data transmission device through the USB protocol.
  • the data transmission device receives the secure transmission data obtained after the security enhancement module performs encryption and decryption processing according to the security key corresponding to the original transmission data.
  • the original transmission data is the first transmission data sent by the cloud platform to the data transmission device, therefore, the data transmission device processes the decrypted first transmission data.
  • the data transmission device performs protocol conversion processing for the secure transmission data, so as to send it to the cloud platform through the MQTT protocol.
  • the data transmission device needs to perform corresponding protocol conversion processing according to the data type: if the original transmission data is the data received by the data transmission device from the cloud platform, then the data transmission device uses the platform transmission protocol ( For example, the original transmission data received by the MQTT protocol performs protocol conversion processing (conversion into the USB protocol), and sends the original transmission data after the protocol conversion processing to the security enhancement module. If the original transmission data is the local data of the data transmission device, the data transmission device performs protocol conversion processing on the secure transmission data received through the preset transmission protocol (such as the USB protocol), and converts the secure transmission data (converted MQTT protocol) to the cloud platform.
  • the preset transmission protocol such as the USB protocol
  • the transmission protocol adopted between the data transmission device and the cloud platform is different from the transmission protocol adopted between the data transmission device and the security enhancement module, the data transmission device needs to execute the protocol on the received or to-be-sent data. Conversion processing.
  • different transmission protocols between different devices it is possible to avoid network attacks between devices and improve security.
  • this embodiment mainly includes the device registration process (steps S1, S2, S3), device authentication process (steps S4, S5, S6, S7, S8), key agreement process (steps S10, S11) and data interaction Transmission process (steps S9, S12, S13).
  • the device registration process and the device authentication process are mainly used to verify the identity of the device. Therefore, the key negotiation process and data interactive transmission can only be performed after the device registration process and the device authentication process are completed.
  • the key agreement process and the data interactive transmission may be executed sequentially or alternately. Wherein, both the key agreement process and the data interactive transmission process can be performed multiple times. Through multiple key negotiations, the security key can be dynamically changed, thereby improving security.
  • Device registration the device side (that is, the data transmission device) registers on the IOT platform and generates a certificate
  • the device registration process is mainly implemented by the cloud platform, which specifically includes the following steps:
  • Step 1 Device registration: The user is required to provide device number, device type and other information.
  • the device number may be the unique ID of the security enhancement module, that is, the registration of the device is completed through the unique ID of the security enhancement module.
  • the device number is backed up in the cloud.
  • Device types include gateways, lighting, cameras, etc. This solution does not limit the device types.
  • Step 2 Select the authentication type: including one machine one secret, one type one secret, and unified key.
  • One machine one secret is used for key generation for a single device, one type one secret is for a certain type of device to generate a key, and the unified key is used for key generation for all devices.
  • This scheme does not limit the authentication type.
  • the key generated in this step is recorded as the authentication key (that is, the platform certificate key and/or module certificate key mentioned above).
  • Step 3 Platform certificate encryption: The plaintext of the platform certificate consists of device number, device type, and authentication type.
  • key A and symmetric encryption are used, such as AES encryption algorithm, to generate platform certificate ciphertext.
  • Device authentication refers to the trusted access of devices to the cloud platform.
  • the overall authentication process includes multiple steps. The following describes the security enhancement module side, device side, and cloud respectively.
  • the security enhancement module side specifically performs the following steps:
  • Step 1 Receive an authentication instruction initiated by the device.
  • the security enhancement module uses key A and symmetric decryption to decrypt the ciphertext of the platform certificate to generate the plaintext of the platform certificate.
  • Key A is the same as the key used by the cloud platform to encrypt the plaintext of the platform certificate.
  • Step 2 Certificate reorganization: Obtain the system time from inside the security enhancement module, and generate the plaintext of the module certificate by adding a time stamp to the plaintext of the generated platform certificate.
  • Step 3 Generation of module certificate ciphertext: Encrypt the plaintext of the module certificate produced in step 2, using public key B and asymmetric encryption.
  • the acquisition process of the public key B is as follows: first, the security enhancement module sends a communication request, and performs protocol conversion through the device side, converting the USB protocol into the MQTT protocol.
  • the cloud receives the communication request, produces the private key b and the public key B, stores the private key b in the cloud, sends the public key B to the device through the MQTT protocol, and converts the device into a USB protocol and sends it to the security module.
  • the device side is used to send the module certificate ciphertext: the module certificate ciphertext produced by the security enhancement module is transmitted to the device side through the USB protocol, and the device side transmits the module certificate ciphertext to the cloud through the MQTT protocol.
  • the cloud certification process specifically includes the following steps:
  • Step 1 Decryption of module certificate ciphertext: the cloud decrypts the module certificate ciphertext through private key b and asymmetric decryption.
  • Step 2 Platform certificate extraction: The cloud extracts effective information from the decrypted module certificate plaintext. In this solution, the unique internal ID of the security enhancement module is extracted, that is, the unique internal ID of the security enhancement module is the only trusted root of the device in the cloud.
  • Step 3 Platform comparison: compare the internal unique ID of the security module extracted by the platform with the root of trust stored in the cloud. If the results are compared, the authentication is successful, otherwise the authentication fails.
  • Step 4 The authentication result is transmitted to the device through the MQTT protocol in plain text, and the device transmits the authentication result to the security module through the USB protocol.
  • the key agreement process specifically includes the following steps:
  • Step 1 The cloud platform asymmetrically encrypts the key C through the platform private key to generate the key C ciphertext.
  • Step 2 the key C ciphertext is transmitted to the data transmission device through the MQTT protocol for protocol conversion, and the MQTT protocol is converted into a USB protocol.
  • the data transmission device transmits the key C ciphertext to the security enhancement module through the USB protocol.
  • Step 3 The security enhancement module decrypts the key C ciphertext in an asymmetric decryption manner through the platform public key to obtain the key C plaintext.
  • the plaintext of the key C is the security key determined through key negotiation.
  • Step 1 The data transmission device transmits the uploaded data in clear text to the security enhancement module through the USB protocol.
  • Step 2 The security enhancement module encrypts the plaintext of the uploaded data by using the key C and a symmetric encryption method to generate a ciphertext of the uploaded data.
  • Step 3 The security enhancement module transmits the uploaded data ciphertext to the data transmission device through the USB protocol, and the data transmission device converts the USB protocol into the MQTT protocol through protocol conversion, and transmits the uploaded data ciphertext to the cloud platform.
  • Step 4 The cloud platform decrypts the ciphertext of the uploaded data through the key C and the symmetric decryption method to obtain the plaintext of the uploaded data.
  • Step 1 The cloud platform encrypts the plaintext of the delivered data through the key C and symmetric encryption, produces the ciphertext of the delivered data, and transmits it to the data transmission device in the form of the MQTT protocol.
  • Step 2 The data transmission device converts the MQTT protocol into a USB protocol through protocol conversion, and transmits the data ciphertext to the security enhancement module.
  • Step 3 The security enhancement module decrypts the ciphertext of the delivered data by using the key C and the symmetric decryption method to obtain the plaintext of the delivered data.
  • Step 4 The security enhancement module transmits the delivered data in plain text to the data transmission device through the USB protocol.
  • this embodiment can customize different security enhancement modules in combination with specific scenarios, and through the customized solution of security enhancement modules, it can be linked with edge devices and terminal devices to achieve system-level security enhancement.
  • This disclosure protects the security of the device to the greatest extent by adding a security enhancement module to the device, through the security enhancement module, device authentication, and platform-side device authentication and the establishment of a security data interaction method.
  • the security enhancement module performs data interaction with the device side through the USB interface, so as to be compatible with current existing devices.
  • a secure data interaction mechanism between the security module, the device, and the cloud platform is built through the security module and the device-side security SDK.
  • the security enhancement module has at least the following characteristics:
  • Trusted storage for sensitive data such as keys and certificates cannot be sent externally through the USB interface.
  • sensitive data is stored inside the security enhancement module in an encrypted manner, and even if the security enhancement module is cracked, the plaintext information of the encrypted data stored inside cannot be directly obtained.
  • the security key stored inside the security enhancement module is stored in ciphertext through a secondary encryption process.
  • the sensitive data stored inside the security enhancement module will not be sent out.
  • Sensitive data such as certificates can be written through customized host computer software, and can only be written but not read.
  • the encryption and decryption processes are all completed inside the security enhancement module, which avoids vulnerable defects caused by encryption and decryption in external devices.
  • the security enhancement module can dynamically execute the key negotiation operation through the data transmission device and the cloud platform, and the frequency of the key negotiation can be flexibly adjusted according to the device type and authentication method.
  • the security key obtained through key negotiation can be generated in different ways in combination with device types and authentication methods, so that the generation method of the security key can be determined according to the data security level, and security can be further improved.
  • the key in the authentication process and the key in the data transmission process can be flexibly set according to the data type.
  • the cloud platform dynamically determines the key matching the data type according to the type of data to be transmitted. That is: the type of key and the way of encryption and decryption can be flexibly set according to the data type and the interaction process.
  • different encryption and decryption methods can be selected for different interaction processes, such as using symmetric keys for platform certificates and asymmetric keys for module certificates, so that keys and encryption and decryption methods can be set according to the interaction process and data security level.
  • the security module is provided by the cloud platform of the Internet of Things, so it is a trusted device, and the data transmission device is an external device independent of the cloud platform, so it is an untrusted device.
  • the security enhancement module In order to avoid security problems caused by attacks on untrusted devices, all sensitive data and encryption and decryption processes are implemented by the security enhancement module.
  • a software development kit SDK is provided for the security enhancement module.
  • the data transmission device only needs to integrate the SDK to communicate with the security enhancement module and the cloud platform. That is: data transmission is performed between the security enhancement module and the data transmission device through a preset application program interface; and the application program interface is provided by a software development kit corresponding to the security enhancement module. It can be seen that, in this embodiment, when data is transmitted between the data transmission device and the security enhancement module, the application program interface API function provided by the SDK must be called to realize it.
  • the data transmission device when the data transmission device sends data to the security enhancement module, it needs to call the implementation of the sending API that matches the type of data sent; when the data transmission device receives the data returned by the security enhancement module, it needs to call The matching receiver class API implementation. Since the parameters and execution logic of each application program interface function included in the SDK are pre-defined, it is possible to avoid writing the execution logic related to accessing sensitive data into the interface function during the process of setting the SDK, thereby avoiding sensitive The problem of data being accessed maliciously.
  • An embodiment of the present disclosure also provides a data transmission device, which may be the security enhancement module mentioned above.
  • a data transmission device provided by an embodiment of the present disclosure includes:
  • the receiving module 51 is configured to receive the original transmission data sent by the data transmission device
  • the encryption and decryption module 52 is configured to determine a security key corresponding to the original transmission data, and perform encryption and decryption processing on the original transmission data through the security key to obtain secure transmission data;
  • the sending module 53 is configured to send the secure transmission data to the data transmission device; wherein, the original transmission data is used for transmission between the data transmission device and the cloud platform, and the security key is obtained from The cloud platform obtains.
  • the apparatus further includes: a module certificate generation module configured to receive and store the platform certificate generated by the cloud platform in response to the device registration request; Instructions, add auxiliary verification data to the platform certificate, obtain a module certificate, and send the module certificate to the data transmission device, so that the data transmission device provides the module certificate to the cloud platform for device authentication; and, the receiving module 51 is configured to: receive the original transmission data sent by the data transmission device when the device passes the authentication.
  • a module certificate generation module configured to receive and store the platform certificate generated by the cloud platform in response to the device registration request
  • the receiving module 51 is configured to: receive the original transmission data sent by the data transmission device when the device passes the authentication.
  • the device registration request is sent by the data transmission device, and the device registration request includes: module information of the security enhancement module and device information of the data transmission device ; and the platform certificate includes: the module information of the security enhancement module and the device information of the data transmission device.
  • the auxiliary verification data includes: time stamp data; and, the device information of the data transmission device includes: a device service type and/or a device authentication type;
  • the encryption and decryption module is configured to: receive the security key returned by the cloud platform in response to the key negotiation request sent by the data transmission device; wherein the security key is based on the device service type and /or device authentication type generation.
  • the encryption and decryption module is specifically configured as:
  • the security key when the device authentication type is the first authentication type, the security key corresponds to the device identifier; when the device authentication type is the second authentication type, the security key corresponds to the device ID corresponding to the model; when the device authentication type is the third authentication type, the security key corresponds to the device service type.
  • the platform certificate generated by the cloud platform is a platform certificate in ciphertext form; then the module certificate generation module is specifically configured as:
  • the module certificate in plain text form is encrypted by the module certificate key to obtain the module certificate in cipher text form.
  • the platform certificate in ciphertext form is obtained through symmetric encryption; the module certificate in ciphertext form is obtained through asymmetric encryption; and the module certificate key is obtained from the Cloud platform acquisition.
  • the encryption and decryption module is specifically configured as:
  • Encryption and decryption are performed on the original transmission data through the security key and the encryption and decryption methods.
  • the data type includes at least one of the following: plaintext type, ciphertext type, sending type, receiving type, transmission data type, and security verification type;
  • the security key includes at least one of the following: a symmetric key, a non-key key, a key obtained from a cloud platform, a locally generated key, an encryption key, a decryption key, a fixed keys, and variable keys;
  • the encryption and decryption methods include: a symmetric encryption method, a symmetric decryption method, an asymmetric encryption method, and an asymmetric decryption method.
  • An embodiment of the present disclosure also provides a data transmission device, which may be the data transmission device mentioned above.
  • a data transmission device provided by an embodiment of the present disclosure includes:
  • the sending module 61 is configured to send the original transmission data to the security enhancement module
  • the receiving module 62 is configured to receive the secure transmission data obtained after the security enhancement module performs encryption and decryption processing according to the security key corresponding to the original transmission data;
  • the original transmission data is used for transmission between the data transmission device and the cloud platform, and the security key is obtained from the cloud platform.
  • the device further includes:
  • the registration module 63 is configured to send a device registration request to the cloud platform, so that the security enhancement module receives and stores the platform certificate generated by the cloud platform in response to the device registration request;
  • the authentication module 64 is configured to send an authentication instruction to the security enhancement module, so that the security enhancement module can add auxiliary verification data to the platform certificate to obtain the module certificate;
  • the receiving module 62 is further configured to: send the received module certificate from the security enhancement module to the cloud platform for the cloud platform to perform device authentication;
  • the sending module 61 is specifically configured to: send the original transmission data to the security enhancement module when the device is authenticated.
  • the device registration request includes: module information of the security enhancement module and device information of the data transmission device; and the platform certificate includes: information of the security enhancement module Module information and device information of the data transmission device;
  • the auxiliary verification data includes: timestamp data; the device information of the data transmission device includes: device service type and/or device authentication type; then the security key corresponding to the original transmission data is determined by The cloud platform is generated according to the device service type and/or device authentication type;
  • the security key corresponds to the device identification; when the device authentication type is the second authentication type, the security key corresponds to the device model; when the device When the authentication type is the third authentication type, the security key corresponds to the service type of the device.
  • the device further includes:
  • a key agreement module configured to send a key agreement request to the cloud platform
  • the security enhancement module According to the result returned by the cloud platform, provide the security enhancement module with a security key from the cloud platform; wherein, the security key is generated according to the device service type and/or device authentication type.
  • the key agreement module is specifically configured as:
  • the first key is decrypted to obtain the security key.
  • the sending module is specifically configured to: Perform protocol conversion processing on the data, and send the original transmission data after the protocol conversion processing to the security enhancement module;
  • the receiving module is further configured to: perform protocol conversion processing on the secure transmission data received through the preset transmission protocol, and convert the secure transmission data after protocol conversion into sent to the cloud platform.
  • the embodiment of the present disclosure also provides a cloud platform.
  • the cloud platform provided by an embodiment of the present disclosure includes:
  • the key sending module 71 is configured to send the generated security key to the security enhancement module
  • the first transmission module 72 is configured to send the encrypted first transmission data to the data transmission device, so that the data transmission device provides the first transmission data to the security enhancement module, so that the security enhancement module according to said security key performs a decryption process; and/or,
  • the second transmission module 73 is configured to receive the second transmission data sent by the data transmission device and encrypted by the security enhancement module with the security key.
  • the cloud platform also includes:
  • the platform certificate generation module is configured to generate a platform certificate according to the received device registration request, and provide the platform certificate to the security enhancement module;
  • the second transmission module is further configured to: receive the module certificate sent by the security enhancement module through the data transmission device; analyze the module certificate, and perform device authentication according to the result of the analysis.
  • the platform certificate generation module is specifically configured as:
  • the platform certificate generation module is specifically configured as:
  • the second transmission module is specifically configured to: decrypt the received module certificate in ciphertext to obtain a module certificate in plaintext; match the module certificate in plaintext with the pre-generated platform certificate; if matched If successful, the device authentication is passed.
  • the key sending module is specifically configured to: respond to the key negotiation request sent by the data transmission device, and acquire device information corresponding to the key negotiation request; according to The device information generates a security key, and sends the generated security key to the security enhancement module; wherein, the device information includes: device service type and/or device authentication type.
  • the key sending module is specifically configured to: encrypt the security key with a platform private key to obtain a first key; pass the first key through the The data transmission device sends it to the security enhancement module, so that the security enhancement module decrypts the first key by using the pre-acquired platform public key to obtain the security key.
  • a data transmission system provided by an embodiment of the present disclosure includes:
  • the first data transmission device 81 may be the security enhancement module shown in FIG. 5
  • the second data transmission device 82 may be the data transmission device shown in FIG. 6
  • the structure of the cloud platform 83 may be shown in FIG. 7 .
  • an electronic device which includes:
  • processors 901 one or more processors 901;
  • Memory 902 on which one or more programs are stored, and when one or more programs are executed by one or more processors, one or more processors implement any one of the data transmission methods described above;
  • One or more I/O interfaces 903 are connected between the processor and the memory, and are configured to realize information exchange between the processor and the memory.
  • the processor 901 is a device with data processing capability, which includes but not limited to a central processing unit (CPU), etc.
  • the memory 902 is a device with data storage capability, which includes but not limited to a random access memory (RAM, more specifically Such as SDRAM, DDR, etc.), read-only memory (ROM), electrified erasable programmable read-only memory (EEPROM), flash memory (FLASH); I/O interface (read-write interface) 903 is connected between processor 901 and memory 902 , can realize information interaction between the processor 901 and the memory 902, which includes but not limited to a data bus (Bus) and the like.
  • RAM random access memory
  • ROM read-only memory
  • EEPROM electrified erasable programmable read-only memory
  • FLASH flash memory
  • I/O interface (read-write interface) 903 is connected between processor 901 and memory 902 , can realize information interaction between the processor 901 and the memory 902, which includes but not limited to a data bus (Bus) and the
  • the processor 901, the memory 902 and the I/O interface 903 are connected to each other through a bus, and further connected to other components of the computing device.
  • This embodiment also provides a computer-readable medium, on which a computer program is stored.
  • the program is executed by a processor, the data transmission method provided by this embodiment is implemented. In order to avoid repeated descriptions, details of the data transmission method will not be repeated here. step.
  • the functional modules/units in the system, and the device can be implemented as software, firmware, hardware, and an appropriate combination thereof.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components. Components cooperate to execute.
  • Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit .
  • Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • computer storage media includes both volatile and nonvolatile media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. permanent, removable and non-removable media.
  • Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tape, magnetic disk storage or other magnetic storage, or may be used Any other medium that stores desired information and can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据传输方法、装置、系统、电子设备及可读介质，属于计算机技术领域，数据传输方法包括：接收数据传输设备发送的原始传输数据；确定与原始传输数据相对应的安全密钥，通过安全密钥对原始传输数据执行加解密处理，得到安全传输数据；将安全传输数据发送给数据传输设备；其中，原始传输数据用于在数据传输设备与云平台之间传输，且安全密钥从云平台获取。可提升数据传输的安全性，避免数据传输过程中被破解的问题。

Description

数据传输方法、装置、系统、电子设备及可读介质 技术领域
本公开属于计算机技术领域，具体涉及一种数据传输方法、装置、系统、电子设备及可读介质。
背景技术
近年来，随着万物互联时代的来临，越来越多的外部设备需要接入物联网平台，借助云服务器实现互联互通。为了确保外部设备的可信任接入，会针对外部设备进行设备鉴权。通常情况下，在设备鉴权时，由外部设备提供用于鉴权的身份验证信息，以供云平台根据身份验证信息执行鉴权操作。
但是，发明人在实现本发明的过程中发现，上述方式至少存在以下缺陷：一方面，身份验证信息容易伪造，因此，鉴权可靠性较低；另一方面，一旦外部设备遭到攻击，则会导致身份验证信息的泄露，从而造成安全隐患。
由此可见，在外部设备与云平台相互通信的物联网场景中，亟需一种更加安全的数据传输方式。
发明内容
本公开旨在提供一种数据传输方法、装置、系统、电子设备及可读介质。
本公开第一方面提供一种数据传输方法，应用于安全增强模块，其包括：
接收数据传输设备发送的原始传输数据；
确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理，得到安全传输数据；
将所述安全传输数据发送给所述数据传输设备；
其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
其中，所述接收数据传输设备发送的原始传输数据之前，还包括：
接收并存储云平台响应于设备注册请求生成的平台证书；
响应于所述数据传输设备发送的认证指令，针对所述平台证书添加辅助校验数据，得到模块证书，将所述模块证书发送给所述数据传输设备，以供所述数据传输设备将所述模块证书提供给所述云平台进行设备认证；
并且，所述接收数据传输设备发送的原始传输数据具体包括：在设备认证通过的情况下，接收数据传输设备发送的原始传输数据。
其中，所述设备注册请求由所述数据传输设备发送，并且，所述设备注册请求中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；且所述平台证书中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息。
其中，所述辅助校验数据包括：时间戳数据；并且，所述数据传输设备的设备信息包括：设备业务类型和/或设备认证类型；
则所述确定与所述原始传输数据的数据类型相对应的安全密钥包括：接收所述云平台响应于所述数据传输设备发送的密钥协商请求返回的所述安全密钥；其中，所述安全密钥根据所述设备业务类型和/或设备认证类型生成。
其中，所述接收所述云平台响应于所述数据传输设备发送的密钥协商请求返回的所述安全密钥包括：
接收所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
其中，当所述设备认证类型为第一认证类型时，安全密钥与设备标识 相对应；当所述设备认证类型为第二认证类型时，安全密钥与设备型号相对应；当所述设备认证类型为第三认证类型时，安全密钥与设备业务类型相对应。
其中，所述云平台生成的平台证书为密文形式的平台证书；则所述针对所述平台证书添加辅助校验数据，得到模块证书包括：
根据所述云平台提供的平台证书密钥对所述密文形式的平台证书进行解密，得到明文形式的平台证书；
针对所述明文形式的平台证书添加辅助校验数据，得到明文形式的模块证书；
通过模块证书密钥对所述明文形式的模块证书进行加密，得到密文形式的模块证书。
其中，所述密文形式的平台证书通过对称加密方式得到；所述密文形式的模块证书通过非对称加密方式得到；并且，所述模块证书密钥从所述云平台获取。
其中，所述确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理包括：
确定所述原始传输数据的数据类型，根据所述数据类型确定安全密钥以及加解密方式；
通过所述安全密钥以及加解密方式，对所述原始传输数据执行加解密处理。
其中，所述数据类型包括以下中的至少一个：明文类型、密文类型、发送类型、接收类型、传输数据类型、以及安全校验类型；
并且，所述安全密钥包括以下中的至少一种：对称密钥、非密钥密钥、从云平台获取的密钥、本地生成的密钥、加密类密钥、解密类密钥、固定密钥、以及可变密钥；
所述加解密方式包括：对称加密方式、对称解密方式、非对称加密方 式、非对称解密方式。
其中，所述安全增强模块通过预设接口以可插拔方式与所述数据传输设备连接，且所述安全增强模块通过与所述预设接口相对应的预设传输协议与所述数据传输设备通信；其中，所述预设接口包括USB接口。
其中，所述安全增强模块与所述数据传输设备之间通过预设的应用程序接口进行数据传输；并且，所述应用程序接口由对应于所述安全增强模块的软件开发工具包提供。
本公开第二方面提供一种数据传输方法，应用于数据传输设备，其包括：
将原始传输数据发送给安全增强模块；
接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据；
其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
其中，所述将原始传输数据发送给安全增强模块之前，还包括：
向所述云平台发送设备注册请求，以使所述安全增强模块接收并存储云平台响应于所述设备注册请求生成的平台证书；
向所述安全增强模块发送认证指令，以供所述安全增强模块针对所述平台证书添加辅助校验数据，得到模块证书；
将接收到的来自所述安全增强模块的模块证书发送给云平台，以供所述云平台进行设备认证；
并且，所述将原始传输数据发送给安全增强模块具体包括：在设备认证通过的情况下，将原始传输数据发送给安全增强模块。
其中，所述设备注册请求中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；且所述平台证书中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；
并且，所述辅助校验数据包括：时间戳数据；所述数据传输设备的设备信息包括：设备业务类型和/或设备认证类型；则所述与所述原始传输数据相对应的安全密钥由所述云平台根据所述设备业务类型和/或设备认证类型生成；
其中，当所述设备认证类型为第一认证类型时，安全密钥与设备标识相对应；当所述设备认证类型为第二认证类型时，安全密钥与设备型号相对应；当所述设备认证类型为第三认证类型时，安全密钥与设备业务类型相对应。
其中，所述接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥之前，还包括：
向云平台发送密钥协商请求；
根据云平台返回的结果，向安全增强模块提供来自云平台的安全密钥；其中，所述安全密钥根据所述设备业务类型和/或设备认证类型生成。
其中，所述向安全增强模块提供来自云平台的安全密钥包括：
将所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
其中，若原始传输数据为所述数据传输设备从所述云平台接收到的数据，则所述将原始传输数据发送给安全增强模块包括：针对通过平台传输协议接收到的原始传输数据执行协议转换处理，将协议转换处理后的原始传输数据发送给安全增强模块；
若原始传输数据为所述数据传输设备的本地数据，则所述接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到安全传输数据之后，还包括：针对通过预设传输协议接收到的安全传输数据执行协议转换处理，将协议转换处理后的安全传输数据发送给所述云平台。
本公开第三方面提供一种数据传输方法，应用于云平台，其包括：
将生成的安全密钥发送给安全增强模块；
向数据传输设备发送加密后的第一传输数据，以供所述数据传输设备将所述第一传输数据提供给安全增强模块，以使所述安全增强模块根据所述安全密钥执行解密处理；和/或，
接收所述数据传输设备发送的由所述安全增强模块通过所述安全密钥加密得到的第二传输数据。
其中，所述方法还包括：
根据接收到的设备注册请求，生成平台证书，将所述平台证书提供给所述安全增强模块；
接收所述安全增强模块通过所述数据传输设备发送的模块证书；
针对所述模块证书进行解析，根据解析结果进行设备认证。
其中，所述根据接收到的设备注册请求，生成平台证书包括：
获取所述设备注册请求中包含的所述安全增强模块的模块信息以及所述数据传输设备的设备信息，根据所述安全增强模块的模块信息以及所述数据传输设备的设备信息生成所述平台证书。
其中，所述根据所述安全增强模块的模块信息以及所述数据传输设备的设备信息生成所述平台证书包括：
对所述安全增强模块的模块信息以及所述数据传输设备的设备信息进行加密，得到密文形式的平台证书；
所述针对所述模块证书进行解析，根据解析结果进行设备认证包括：
对接收到的密文形式的模块证书进行解密，得到明文形式的模块证书；
将所述明文形式的模块证书与预先生成的平台证书进行匹配；若匹配成功，则设备认证通过。
其中，所述将生成的安全密钥发送给安全增强模块包括：
响应于所述数据传输设备发送的密钥协商请求，获取与所述密钥协商 请求相对应的设备信息；
根据所述设备信息，生成安全密钥，并将生成的安全密钥发送给安全增强模块；其中，所述设备信息包括：设备业务类型和/或设备认证类型。
其中，所述并将生成的安全密钥发送给安全增强模块包括：
通过平台私钥对所述安全密钥进行加密，得到第一密钥；
将所述第一密钥通过所述数据传输设备发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
本公开第四方面提供一种数据传输装置，其包括：
接收模块，被配置为接收数据传输设备发送的原始传输数据；
加解密模块，被配置为确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理，得到安全传输数据；
发送模块，被配置为将所述安全传输数据发送给所述数据传输设备；
其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
本公开第五方面提供一种数据传输装置，其包括：
发送模块，被配置为将原始传输数据发送给安全增强模块；
接收模块，被配置为接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据；
其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
本公开第六方面提供一种云平台，其包括：
密钥发送模块，被配置为将生成的安全密钥发送给安全增强模块；
第一传输模块，被配置为向数据传输设备发送加密后的第一传输数据，以供所述数据传输设备将所述第一传输数据提供给安全增强模块，以使所 述安全增强模块根据所述安全密钥执行解密处理；和/或，
第二传输模块，被配置为接收所述数据传输设备发送的由所述安全增强模块通过所述安全密钥加密得到的第二传输数据。
本公开第七方面提供一种数据传输系统，其包括：上述第四方面的数据传输装置、第五方面的数据传输装置、以及第六方面的云平台。
本公开第八方面提供一种电子设备，包括：
一个或多个处理器；
存储器，其上存储有一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现上述任意一项所述的方法；
一个或多个I/O接口，连接在所述处理器与存储器之间，配置为实现所述处理器与存储器的信息交互。
本公开第九方面提供一种计算机可读介质，其上存储有计算机程序，所述程序被处理器执行时实现上述任意一项所述的方法。
附图说明
附图是用来提供对本公开的进一步理解，并且构成说明书的一部分，与下面的具体实施方式一起用于解释本公开，但并不构成对本公开的限制。在附图中：
图1为本公开实施例提供的应用于安全增强模块的数据传输方法的流程图；
图2为本公开实施例提供的应用于数据传输设备的数据传输方法的流程图；
图3为本公开实施例提供的应用于云平台的数据传输方法的流程图；
图4为本公开实施例提供的应用于安全增强模块、数据传输设备以及云平台的数据传输方法的流程图；
图5为本公开一个实施例提供的数据传输装置的结构图；
图6为本公开另一个实施例提供的数据传输装置的结构图；
图7为本公开实施例提供的云平台的结构图；
图8为本公开实施例数据传输系统的结构图；
图9为本公开实施例提供一种电子设备的原理框图。
具体实施方式
为使本领域技术人员更好地理解本公开/实用新型的技术方案，下面结合附图和具体实施方式对本公开/实用新型作进一步详细描述。
除非另外定义，本公开使用的技术术语或者科学术语应当为本公开所属领域内具有一般技能的人士所理解的通常意义。本公开中使用的“第一”、“第二”以及类似的词语并不表示任何顺序、数量或者重要性，而只是用来区分不同的组成部分。同样，“一个”、“一”或者“该”等类似词语也不表示数量限制，而是表示存在至少一个。“包括”或者“包含”等类似的词语意指出现该词前面的元件或者物件涵盖出现在该词后面列举的元件或者物件及其等同，而不排除其他元件或者物件。“连接”或者“相连”等类似的词语并非限定于物理的或者机械的连接，而是可以包括电性的连接，不管是直接的还是间接的。“上”、“下”、“左”、“右”等仅用于表示相对位置关系，当被描述对象的绝对位置改变后，则该相对位置关系也可能相应地改变。
第一方面，本公开实施例提供一种数据传输方法，通过安全增强模块提升数据传输的可靠性，避免因外部设备遭遇攻击所导致的数据泄露问题。
如图1所示，本公开实施例提供的数据传输方法，可以应用于安全增强模块。其中，安全增强模块可通过插接方式与数据传输设备相连，数据传输设备与云平台相互通信。该方法包括：
步骤S110：接收数据传输设备发送的原始传输数据。
其中，原始传输数据用于在数据传输设备与云平台之间传输。数据传 输设备可以为各种类型的外部设备，原始传输数据可以是由云平台发送给数据传输设备的数据，也可以是由数据传输设备生成且用于发送给云平台的数据，本发明不限定原始传输数据的数据类型和数据来源。
步骤S120：确定与原始传输数据相对应的安全密钥，通过安全密钥对原始传输数据执行加解密处理，得到安全传输数据。
其中，安全密钥从云平台获取。若原始传输数据为云平台发送给数据传输设备的数据，则通常为加密状态，因此，需要通过安全密钥执行解密处理，得到处于解密状态的安全传输数据。若原始传输数据为由数据传输设备生成且用于发送给云平台的数据，则通常为未加密状态，因此，需要通过安全密钥执行加密处理，得到处于加密状态的安全传输数据。
步骤S130：将安全传输数据发送给数据传输设备。
其中，安全增强模块将加密处理或解密处理后的安全传输数据发送给数据传输设备，以供数据传输设备进行后续处理。
如图2所示，本公开实施例提供的数据传输方法，可以应用于数据传输设备。该方法包括：
步骤S210：将原始传输数据发送给安全增强模块。
其中，原始传输数据用于在数据传输设备与云平台之间传输。数据传输设备可以为各种类型的外部设备，原始传输数据可以是由云平台发送给数据传输设备的数据，也可以是由数据传输设备生成且用于发送给云平台的数据，本发明不限定原始传输数据的数据类型和数据来源。
步骤S220：接收安全增强模块根据与原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据。
其中，安全密钥从云平台获取。若原始传输数据为云平台发送给数据传输设备的数据，则通常为加密状态，因此，需要通过安全密钥执行解密处理，得到处于解密状态的安全传输数据。若原始传输数据为由数据传输设备生成且用于发送给云平台的数据，则通常为未加密状态，因此，需要 通过安全密钥执行加密处理，得到处于加密状态的安全传输数据。
如图3所示，本公开实施例提供的数据传输方法，可以应用于云平台。该方法包括：
步骤S310：将生成的安全密钥发送给安全增强模块。
其中，安全密钥可通过多种方式生成，例如，可以由云平台与数据传输设备进行密钥协商操作，得到安全密钥。又如，也可以根据数据传输设备的设备类型确定安全密钥，从而将安全密钥通过数据传输设备发送给安全增强模块。
步骤S320：向数据传输设备发送加密后的第一传输数据，以供数据传输设备将第一传输数据提供给安全增强模块，以使安全增强模块根据安全密钥执行解密处理。
其中，云平台将加密后的第一传输数据发送给数据传输设备，以使数据传输设备将第一传输数据提供给安全增强模块，相应的，安全增强模块根据云平台提供的安全密钥执行解密处理。
步骤S330：接收数据传输设备发送的由安全增强模块通过安全密钥加密得到的第二传输数据。
其中，云平台接收由数据传输设备发送的已加密的第二传输数据，该已加密的第二传输数据由安全增强模块借助云平台提供的安全密钥进行加密得到。
其中，步骤S320和步骤S330可以择一执行，或者，步骤S320和步骤S330也可以同时或交替执行，本发明对此不做限定。
由此可见，通过安全增强模块，能够对云平台与数据传输设备之间的传输数据执行加解密操作，由于加解密过程均在安全增强模块内部实现，且安全密钥通过密钥协商方式从云平台获取，因此，避免了因数据传输设备不可信所导致的安全隐患，提升了数据安全性。
如图4所示，本公开实施例提供的数据传输方法，用于实现云平台、 数据传输设备以及安全增强模块之间的数据交互。
数据传输设备可以为用于接入物联网等云平台的各类外部设备，包括会议设备、安防设备等各种类型的设备。由于外部设备的数量众多、来源多样、且类型不一，因此，若逐一针对各个外部设备进行安全检查，无疑将耗费大量的时间成本，且容易因漏检等问题导致安全隐患。由此可见，在本实施例的应用场景中，数据传输设备存在来源广泛、安全排查困难等特点。
为了能够方便快捷且安全高效的实现对数据传输设备的安全验证，在本实施例中，设置了安全增强模块。通过安全增强模块实现敏感数据的加解密过程，从而确保敏感数据不外泄，在数据传输设备不可信的场景中提升通信安全性。
该安全增强模块可通过各类方式与数据传输设备通信。例如，该安全增强模块可通过有线或无线方式与数据传输设备连接。在一种可选的实现方式中，为了提升安全增强模块设置的灵活性，安全增强模块通过可插拔方式与数据传输设备插接，以实现相互通信。例如，在一种实现方式中，安全增强模块可通过USB接口与数据传输设备连接，或者，也可以通过内部数据总线的方式连接，例如PICE/LVDS/I2C/UART等。又如，在另一种实现方式中，安全增强模块可作为安全芯片(FPGA)插入数据传输设备，从而通过内部数据总线连接SOC(System on Chip,片上系统)，从而与数据传输设备相互通信。总之，本公开不限定安全增强模块的具体接入形式，只要能够实现灵活方便的与数据传输设备通信的目的即可。
由此可见，安全增强模块能够替代数据传输设备实现数据加解密、数据验证等，从而提升安全性。为了防止不可信的设备接入云平台，在本实施例中，在数据传输之前，先执行设备注册以及设备认证操作，在设备认证通过的情况下，再进行数据传输，从而有效防止可疑设备接入云平台。
如图4所示，该方法包括以下步骤：
步骤S1：数据传输设备向云平台发送设备注册请求。
其中，设备注册请求用于将数据传输设备的相关信息在云平台进行注册，并且，在设备注册过程中，云平台不仅要记录数据传输设备的设备信息，还需要记录与该数据传输设备建立关联关系的安全增强模块的模块信息。相应的，在后续的设备认证过程中，针对数据传输设备以及安全增强模块的合法性进行验证，以确保设备的可信接入。
在第一种应用场景中，预先将安全增强模块分配给数据传输设备，相应的，在数据传输设备发送的设备注册请求中包括：安全增强模块的模块信息以及数据传输设备的设备信息。其中，安全增强模块的模块信息用于唯一标识一个安全增强模块，例如，可以是安全增强模块的ID标识。数据传输设备的设备信息用于描述数据传输设备的设备特征，例如，设备信息包括：设备业务类型和/或设备认证类型。其中，设备业务类型用于描述数据传输设备的业务种类，如会议类型、安防类型等。并且，设备业务类型还可以是网关类型、照明类型、摄像头类型等。设备认证类型用于描述设备的认证方式，具体可由设备的安全等级设定。该方式由数据传输设备发送设备注册请求，因此，数据传输设备与安全增强模块之间的对应关系可灵活调整，便于实现安全增强模块与数据传输设备之间的灵活配对，灵活性较高。
在第二种应用场景中，安全增强模块未预先分配给数据传输设备，相应的，在云平台接收到设备注册请求后，为该数据传输设备分配对应的安全增强模块。此时，在数据传输设备发送的设备注册请求中包括：数据传输设备的设备信息，而不包含安全增强模块的模块信息。该方式直接由云平台分配安全增强模块，因此，安全增强模块与数据传输设备之间的对应关系由云平台预先设定，且后期不可随意更改，安全性较高。
实际情况中，可根据具体业务场景的特点灵活选用上述两种方式中的至少一种。
步骤S2：云平台根据接收到的设备注册请求，生成平台证书。
其中，云平台获取设备注册请求中包含的安全增强模块的模块信息以及数据传输设备的设备信息，根据安全增强模块的模块信息以及数据传输设备的设备信息生成平台证书。可选地，在根据安全增强模块的模块信息以及数据传输设备的设备信息生成所述平台证书时，进一步对安全增强模块的模块信息以及数据传输设备的设备信息进行加密，得到密文形式的平台证书。
其中，在上述第一种应用场景中，云平台解析设备注册请求，获取其中包含的安全增强模块的模块信息以及数据传输设备的设备信息，通过平台证书密钥(如密钥A)，对安全增强模块的模块信息以及数据传输设备的设备信息执行加密操作，根据加密结果得到平台证书。为了提升加密执行效率，该加密操作可以为对称加密操作。比如，可采用AES加密算法。由此可见，平台证书的明文包括安全增强模块的模块信息以及数据传输设备的设备信息，通过加密操作能够提升传输过程中的安全性。
在上述第二种应用场景中，云平台解析设备注册请求，获取其中包含的数据传输设备的设备信息，并根据该数据传输设备的类型分配对应的安全增强模块。通过平台证书密钥(如密钥A)，对已分配的安全增强模块的模块信息以及数据传输设备的设备信息执行加密操作，根据加密结果得到平台证书。在该方式中，安全增强模块由云平台根据设备注册请求中的设备信息进行分配。
可选的，当数据传输设备的设备类型为多种时，可以分别针对各种类型的数据传输设备设置不同种类的安全增强模块，相应的，云平台根据设备认证请求中的设备信息，选择与当前设备的设备类型相匹配的安全增强模块进行分配。
步骤S3：云平台将平台证书提供给安全增强模块。
在该步骤中，云平台可以通过数据传输设备将平台证书提供给安全增 强模块，也可以直接将平台证书提供给安全增强模块。相应的，安全增强模块接收并存储云平台响应于设备注册请求生成的平台证书。例如，在上述第一种应用场景中，云平台将平台证书发送给数据传输设备，由数据传输设备将平台证书以及平台证书密钥提供给安全增强模块。在上述第二种应用场景中，云平台直接将平台证书以及平台证书密钥提供给安全增强模块。其中，在前一种方式中，安全增强模块内存储的平台证书动态添加，从而能够动态适配不同的数据传输设备，提升了灵活性。在后一种方式中，可在安全增强模块中直接烧录平台证书以及平台证书密钥，从而进一步提升安全性。
另外，无论采用何种方式，云平台均需要记录安全增强模块的模块信息以及数据传输设备的设备信息之间的对应关系，从而借助该对应关系在后续的认证过程中进一步提升安全性，防止因数据传输设备或安全增强模块被恶意替换而导致的安全隐患。
步骤S4：数据传输设备向安全增强模块发送认证指令。
其中，数据传输设备主动发起设备认证操作，从而向安全增强模块发送认证指令。
步骤S5：安全增强模块响应于认证指令，针对平台证书添加辅助校验数据，得到模块证书。
安全增强模块响应于数据传输设备发送的认证指令，针对已存储的平台证书添加辅助校验数据，得到模块证书。其中，辅助校验数据包括各类能够实现辅助校验功能的附加数据，如时间戳数据、设备指纹数据等。
可选的，为了提升安全性，云平台生成的平台证书为密文形式的平台证书。首先，安全增强模块根据云平台提供的平台证书密钥(如密钥A)对密文形式的平台证书进行解密，得到明文形式的平台证书。其中，当平台证书采用对称加密方式得到时，用于解密的平台证书密钥与云平台加密时的平台证书密钥相同，从而能够以较快的速度实现解密。当然，在其他 安全性更高的应用场景中，也可以通过非对称加解密方式实现。
然后，针对明文形式的平台证书添加辅助校验数据，得到明文形式的模块证书。例如，安全增强模块获取内部系统时间，根据内部系统时间生成时间戳数据，将时间戳数据添加至平台证书中，得到模块证书。该过程实质上相当于证书重组过程，通过证书重组，能够借助辅助校验数据进一步提升安全性。例如，若时间戳数据被篡改，则说明证书在传输过程中遭遇了攻击。
最后，通过模块证书密钥对明文形式的模块证书进行加密，得到密文形式的模块证书。在一种可选的实现方式中，密文形式的平台证书通过对称加密方式得到；密文形式的模块证书通过非对称加密方式得到；并且，模块证书密钥从云平台获取。其中，由于密文形式的模块证书通过非对称加密方式得到，因此，能够提升模块证书的传输安全性。
其中，模块证书密钥可通过多种方式获取。例如，在一种实现方式中，由安全增强模块通过数据传输设备向云平台发送通讯请求(也叫模块证书密钥获取请求)。云平台根据接收到的通讯请求，生产模块证书私钥b以及模块证书公钥B，其中，模块证书私钥b存储在云平台，模块证书公钥B通过数据传输设备转发给安全增强模块。其中，模块证书公钥B即为模块证书密钥。由此可见，借助模块证书私钥b以及模块证书公钥B实现了非对称加解密。
另外，需要说明的是，在本实施例中，安全增强模块通过预设接口以可插拔方式与数据传输设备连接，且安全增强模块通过与预设接口相对应的预设传输协议(即第一传输协议)与数据传输设备通信；其中，预设接口包括USB接口，且预设传输协议包括USB协议。另外，数据传输设备与云平台之间通过平台传输协议，例如MQTT协议通信，进行通信。其中，MQTT(Message Queuing Telemetry Transport，消息队列遥测传输)是基于TCP的非加密协议，是ISO标准(ISO/IEC PRF 20922)下基于发布/订阅范式 的消息协议，其工作在TCP/IP协议族上，是为硬件性能低下的远程设备以及网络状况糟糕的情况下而设计的发布/订阅型消息协议，为此，需要一个消息中间件。MQTT是一个基于客户端-服务器的消息发布/订阅传输协议。MQTT协议是轻量、简单、开放和易于实现的，这些特点使其适用范围非常广泛。在很多情况下，包括受限的环境中，如：机器与机器(M2M)通信和物联网(IoT)。其中，通过卫星链路通信传感器、偶尔拨号的医疗设备、智能家居、及一些小型化设备中已广泛使用。
相应的，数据传输设备需要执行协议转换操作，将通过第一传输协议接收到的来自安全增强模块的数据进行协议转换后，通过第二传输协议发送给云平台；将通过第二传输协议接收到的来自云平台的数据进行协议转换后，通过第一传输协议发送给安全增强模块。因此，在本步骤中，数据传输设备需要对来自安全增强模块的通讯请求进行协议转换，使其由USB协议转换为MQTT协议，从而传输给云平台。并且，当接收到云平台通过MQTT协议发送的模块证书公钥B后，进行协议转换，并通过USB协议发送给安全增强模块。
步骤S6：安全增强模块将模块证书发送给云平台，以供云平台进行设备认证。
其中，安全增强模块先将模块证书发送给数据传输设备，由数据传输设备将模块证书发送给云平台进行设备认证。相应的，数据传输设备将接收到的来自安全增强模块的模块证书发送给云平台，以供云平台进行设备认证。
在一种实现方式中，安全增强模块通过USB协议将密文形式的模块证书发送给数据传输设备，数据传输设备将密文形式的模块证书通过MQTT协议发送给云平台。
步骤S7：云平台接收安全增强模块通过数据传输设备发送的模块证书，针对模块证书进行解析，根据解析结果进行设备认证。
可选的，当模块证书为密文形式时，云平台对接收到的密文形式的模块证书进行解密，得到明文形式的模块证书；将明文形式的模块证书与预先生成的平台证书进行匹配；若匹配成功，则设备认证通过。其中，可通过上文提到的模块证书私钥b对密文形式的模块证书进行非对称解密。
其中，明文形式的模块证书包括：辅助校验数据以及安全增强模块解析得到的明文形式的平台证书。正常情况下，安全增强模块解析得到的明文形式的平台证书中包含的安全增强模块的模块信息以及数据传输设备的设备信息与云平台预先生成的平台证书中的相关信息一致。因此，若明文形式的模块证书与预先生成的平台证书匹配成功，则设备认证通过；若匹配不成功，则设备认证失败。
在一种示例中，云端通过对解密后的模块证书明文进行有效信息提取，例如，提取安全增强模块的ID标识，即将安全增强模块内部唯一ID作为数据传输设备在云平台的唯一可信任根。相应的，云平台在比对过程中，将平台提取的安全增强模块内部唯一ID与云端存储的可信任根进行比对。如果比对成功，则认证成功，否则认证失败。云平台将认证结果以明文形式，通过MQTT协议传递给数据传输设备，数据传输设备将认证结果通过USB协议传递给安全模块。在该示例中，云平台仅比对安全增强模块的模块信息，只要安全增强模块的模块信息匹配成功，则认证成功。
为了提升安全性，在其他示例中，云平台不仅比对安全增强模块的模块信息，还要比对数据传输设备的设备信息，只有当安全增强模块的模块信息以及数据传输设备的设备信息的组合关系与云平台预先存储的内容一致时，才认证成功，该方式通过安全增强模块的模块信息以及数据传输设备的设备信息的组合关系进行认证，只要数据传输设备或安全增强模块中的任一设备发生改变则会导致认证失败，从而提升了安全性。
步骤S8：云平台向数据传输设备反馈认证结果。
步骤S9：在设备认证通过的情况下，数据传输设备将原始传输数据发 送给安全增强模块。
本步骤至少包括下述两种情况：
在第一种情况中，云平台向数据传输设备发送加密后的第一传输数据，相应的，数据传输设备将加密后的第一传输数据提供给安全增强模块。即：原始传输数据为：由云平台向数据传输设备发送的第一传输数据。
在第二种情况中，数据传输设备需要将待发送的未加密的原始传输数据发送给云平台，为了提升安全性，先将该未加密的原始传输数据发送给安全增强模块进行加密处理，得到第二传输数据。该第二传输数据由安全增强模块发送给数据传输设备，再由数据传输设备发送给云平台。相应的，云平台接收数据传输设备发送的由安全增强模块通过安全密钥加密得到的第二传输数据。
步骤S10：数据传输设备向云平台发送密钥协商请求。
其中，本步骤也可以在步骤S9之前执行，本发明不限定本步骤的执行时机。另外，本步骤也可以在后续的数据传输过程中多次执行，即：每隔预设时长向云平台获取一次密钥协商请求，以更换安全密钥，提升安全性。其中，本步骤的具体执行时机以及执行频次可根据业务场景灵活设置。
可选的，密钥协商请求的发送频次根据上文提到的数据传输设备的设备信息中包含的设备业务类型和/或设备认证类型确定。例如，若根据设备业务类型和/或设备认证类型确定该设备的安全等级较高，则需要增加密钥协商请求的发送频次；反之，则降低密钥协商请求的发送频次。总之，根据设备业务类型和/或设备认证类型确定密钥协商请求的发送频次，能够灵活适配各类业务场景。
步骤S11：云平台响应于密钥协商请求，将生成的安全密钥通过数据传输设备发送给安全增强模块。
其中，云平台获取与密钥协商请求相对应的设备信息，根据设备信息生成安全密钥，并将生成的安全密钥发送给安全增强模块。其中，设备信 息包括上文提到的设备业务类型和/或设备认证类型。相应的，数据传输设备根据云平台返回的结果，向安全增强模块提供来自云平台的安全密钥。
在一种实现方式中，当设备认证类型为第一认证类型(如一机一密类型)时，安全密钥与设备标识相对应。该类型需要分别针对每个设备生成一个密钥，由于设备具有唯一性，因而安全性较高。
当设备认证类型为第二认证类型(如一型一密类型)时，安全密钥与设备型号相对应。该类型需要分别针对每个设备型号生成一个密钥，由于同一型号可能包含多个设备，因而安全性略低于第一认证类型的安全密钥。
当设备认证类型为第三认证类型(如统一密钥类型)时，安全密钥与设备业务类型相对应。该类型可以针对所有设备都生成统一的安全密钥，因而安全性最低，例如，可以针对同一业务类型的数据传输设备都生成相同的安全密钥。
其中，设备认证类型以及安全密钥的生成方式具体取决于业务场景中的数据种类等因素，本公开对此不做限定。
由此可见，本公开中的密钥协商请求的发送频次(即安全密钥的更换频次)以及安全密钥的生成方式都可以根据实际业务需求灵活调整，因此，能够充分满足各类数据传输业务的安全需求。
可选的，为了进一步提升安全性，避免因安全密钥在传输过程中被恶意截获所导致的安全问题，在一种实现方式中，云平台通过平台私钥对已生成的安全密钥进行加密，得到第一密钥；将第一密钥通过数据传输设备发送给安全增强模块。其中，数据传输设备将云平台通过平台私钥对安全密钥进行加密后得到的第一密钥发送给安全增强模块。相应的，安全增强模块接收云平台通过平台私钥对安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对第一密钥进行解密，得到安全密钥。其中，平台公钥和平台私钥都由云平台生成，且云平台预先将平台公钥提供给安全增强模块，其中，平台公钥和平台私钥的生成方式可以灵活设定，例如， 平台公钥可以与上文提到的模块证书公钥B相同，平台私钥可以与上文提到的模块证书私钥b相同。另外，通过平台私钥对安全密钥进行非对称加密，以得到第一密钥(即密文形式的安全密钥)。通过平台公钥对第一密钥进行非对称解密，得到安全密钥。非对称加解密方式能够提升安全性。
其中，安全密钥通过MQTT协议发送给数据传输设备，数据传输设备执行协议转换后通过USB协议发送给安全增强模块。
步骤S12：安全增强模块确定与原始传输数据相对应的安全密钥，通过安全密钥对原始传输数据执行加解密处理，得到安全传输数据。
其中，安全密钥通过上述步骤中的密钥协商操作获取。另外，安全增强模块进一步确定原始传输数据的数据类型，根据数据类型确定安全密钥以及加解密方式；通过安全密钥以及加解密方式，对原始传输数据执行加解密处理。其中，数据类型包括以下中的至少一个：明文类型、密文类型、发送类型、接收类型、传输数据类型、以及安全校验类型；并且，安全密钥包括以下中的至少一种：对称密钥、非密钥密钥、从云平台获取的密钥、本地生成的密钥、加密类密钥、解密类密钥、固定密钥、以及可变密钥；加解密方式包括：对称加密方式、对称解密方式、非对称加密方式、非对称解密方式。例如，当原始传输数据为云平台向数据传输设备发送的加密后的第一传输数据时，即数据类型为密文类型且为接收类型，则执行解密操作；当原始传输数据为数据传输设备将要发送给云平台的数据时，即数据类型为明文类型且为发送类型，则执行加密操作。
在上文提到的第一种情况中，原始传输数据为：由云平台向数据传输设备发送的第一传输数据。相应的，安全增强模块通过安全密钥对第一传输数据进行解密处理。
在上文提到的第二种情况中，原始传输数据为数据传输设备将要发送给云平台的未加密的原始传输数据。相应的，安全增强模块通过安全密钥对原始传输数据进行加密处理。
另外，安全密钥可通过如下方式获取：
接收云平台响应于数据传输设备发送的密钥协商请求返回的安全密钥。其中，云平台先将安全密钥发送给数据传输设备，再由数据传输设备发送给安全增强模块。
可选的，为了提升安全性，云平台先通过平台私钥对安全密钥进行加密，得到第一密钥。相应的，安全密钥通过如下方式获取：接收云平台通过平台私钥对安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对第一密钥进行解密，得到安全密钥。
步骤S13：安全增强模块将安全传输数据发送给数据传输设备。
其中，安全增强模块可以通过USB协议将安全传输数据发送给数据传输设备。相应的，数据传输设备接收安全增强模块根据与原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据。
在上文提到的第一种情况中，原始传输数据为由云平台向数据传输设备发送的第一传输数据，因此，数据传输设备针对解密后得到的第一传输数据进行处理。在上文提到的第二种情况中，数据传输设备针对安全传输数据执行协议转换处理，以通过MQTT协议发送给云平台。
由此可见，在本实施例中，数据传输设备需要根据数据类型执行对应的协议转换处理：若原始传输数据为数据传输设备从云平台接收到的数据，则数据传输设备针对通过平台传输协议(例如MQTT协议)接收到的原始传输数据执行协议转换处理(转换为USB协议)，将协议转换处理后的原始传输数据发送给安全增强模块。若原始传输数据为数据传输设备的本地数据，则数据传输设备针对通过预设传输协议(例如USB协议)接收到的安全传输数据执行协议转换处理，将协议转换处理后的安全传输数据(已转换为MQTT协议)发送给云平台。
在本实施例中，由于数据传输设备与云平台之间采用的传输协议不同于数据传输设备与安全增强模块之间采用的传输协议，因此，数据传输设 备需要对接收或待发送的数据执行协议转换处理。另外，通过在不同设备间采用不同传输协议，能够避免设备间的网络攻击，提升安全性。
综上可知，本实施例主要包括设备注册过程(步骤S1、S2、S3)、设备认证过程(步骤S4、S5、S6、S7、S8)、密钥协商过程(步骤S10、S11)以及数据交互传输过程(步骤S9、S12、S13)。其中，设备注册过程以及设备认证过程主要用于验证设备身份，因此，当设备注册过程以及设备认证过程完成之后，方可执行密钥协商过程以及数据交互传输。另外，密钥协商过程以及数据交互传输可先后执行，也可以交替执行。其中，密钥协商过程以及数据交互传输过程都可以执行多次。通过多次密钥协商，能够使安全密钥动态改变，从而提升安全性。
为了便于理解，下面针对各个过程分别加以详细介绍：
一、设备注册：设备端(即数据传输设备)在IOT平台注册以及证书生成
设备注册过程主要由云平台实施，具体包括以下步骤：
步骤一、设备注册：需用户提供设备号、设备类型等信息。其中，设备号可采用安全增强模块的唯一ID，即通过安全增强模块的唯一ID完成对设备的注册。设备号在云端进行备份。设备类型包括网关、照明、摄像头等，本方案不对设备类型进行限定。
步骤二、选择认证类型：包括一机一密、一型一密、统一密钥。一机一密针对单一设备进行密钥生成，一型一密针对某一类设备进行密钥生成，统一密钥针对所有设备进行密钥生成。本方案不对认证类型进行限定。本步骤生产密钥记作认证密钥(即上文提到的平台证书密钥和/或模块证书密钥)。
步骤三、平台证书加密：平台证书明文由设备号、设备类型、认证类型构成。针对平台证书加密采用密钥A和对称加密的方式进行，比如AES加密算法，生成平台证书密文。
二、设备认证
设备认证即设备对云平台的可信任接入，整体认证过程包括多个步骤，下面分别从安全增强模块端、设备端、云端进行描述。
1、安全增强模块端：
预先将已生成的平台证书密文存储在安全增强模块中，相应的，安全增强模块端具体执行以下步骤：
步骤一、接收设备端发起的认证指令。
安全增强模块内部采用密钥A和对称解密的方式对平台证书密文进行解密，生成平台证书明文。密钥A与云平台对平台证书明文进行加密采用的密钥一致。
步骤二、证书重组：从安全增强模块内部获取系统时间，通过对生成的平台证书明文进行时间戳的添加，生成模块证书明文。
步骤三、模块证书密文生成：针对步骤二生产的模块证书明文进行加密，采用公钥B和非对称加密的方式进行加密。公钥B的获取流程如下：首先，安全增强模块发送通讯请求，通过设备端进行协议转换，将USB协议转换成MQTT协议。云端收到通讯请求，生产私钥b和公钥B，私钥b进行云端存储，公钥B通过MQTT协议发送给设备端，设备端转换成USB协议发送给安全模块。
2、设备端：
设备端用于实现模块证书密文的发送：针对安全增强模块生产的模块证书密文，通过USB协议传输给设备端，设备端将模块证书密文通过MQTT协议传输给云端。
3、云端：
云端的认证流程具体包括以下步骤：
步骤一、模块证书密文解密：云端通过私钥b和非对称解密的方式对模块证书密文进行解密。
步骤二、平台证书提取：云端通过对解密后的模块证书明文进行有效信息提取，本方案中提取安全增强模块内部唯一ID，即安全增强模块内部唯一ID为设备在云端的唯一可信任根。
步骤三、平台比对：将平台提取的安全模块内部唯一ID与云端存储的可信任根进行比对。如果比对成果，认证成功，否则认证失败。
步骤四、认证结果以明文形式，通过MQTT协议传递给设备端，设备端将认证结果通过USB协议传递给安全模块。
三、密钥协商
密钥协商过程，具体包括以下步骤：
步骤一、云平台通过平台私钥对密钥C进行非对称加密，生成密钥C密文。
步骤二、将密钥C密文通过MQTT协议传输给数据传输设备进行协议转换，将MQTT协议转换成USB协议。数据传输设备通过USB协议将密钥C密文传递给安全增强模块。
步骤三、安全增强模块通过平台公钥，以非对称解密方式对密钥C密文进行解密，得到密钥C明文。该密钥C明文即为通过密钥协商确定的安全密钥。
四、数据交互传输
首先，介绍数据交互传输过程中的上传数据过程，具体包括以下步骤：
步骤一、数据传输设备通过USB协议将上传数据明文传递给安全增强模块。
步骤二、安全增强模块采用密钥C和对称加密方式对上传数据明文进行加密，生成上传数据密文。
步骤三、安全增强模块通过USB协议将上传数据密文传递给数据传输设备，数据传输设备通过协议转换，将USB协议转换成MQTT协议，将上传数据密文传递给云平台。
步骤四、云平台通过密钥C和对称解密方式对上传数据密文进行解密，得到上传数据明文。
接下来，介绍数据交互传输过程中的数据下发过程，具体包括以下步骤：
步骤一、云平台通过密钥C和对称加密方式对下发数据明文进行加密，生产下发数据密文，并以MQTT协议形式传递给数据传输设备。
步骤二、数据传输设备通过协议转换，将MQTT协议转换成USB协议，将下发数据密文传递给安全增强模块。
步骤三、安全增强模块采用密钥C和对称解密方式对下发数据密文进行解密，得到下发数据明文。
步骤四、安全增强模块通过USB协议将下发数据明文传递给数据传输设备。
由此可见，本实施例从安全角度出发，可以结合特定场景定制不同的安全增强模块，通过安全增强模块定制化解决方案，与边缘设备和终端设备联动，实现系统级安全增强。本公开通过对设备端进行安全增强模块的加入，通过安全增强模块、设备端、平台端的设备认证以及安全数据交互方式的建立，最大限度保护设备端的安全。安全增强模块通过USB接口与设备端进行数据交互，以兼容目前的现有设备。另外，通过安全模块与设备端安全SDK构建安全模块、设备端、云平台之间的安全数据交互机制。
其中，安全增强模块至少具备以下特性：
针对密钥、证书等敏感数据进行可信存储，不可以通过USB接口对外发送。并且，敏感数据通过加密方式存储在安全增强模块内部，即使安全增强模块被破解，也无法直接获取到内部存储的已加密的数据的明文信息。例如，安全增强模块内部存储的安全密钥通过二次加密过程，以密文形式存储。
另外，安全增强模块内部存储的敏感数据不外发。证书等敏感数据可 通过定制的上位机软件写入，且只可写入不可读出。而且，加解密过程均在安全增强模块内部完成，避免了在外部设备中加解密所导致的易受攻击的缺陷。
安全增强模块可通过数据传输设备与云平台动态执行密钥协商操作，且密钥协商的频次可根据设备类型以及认证方式灵活调整。并且，通过密钥协商得到的安全密钥可以结合设备类型以及认证方式采取不同的生成方式，从而便于根据数据安全等级确定安全密钥的生成方式，进一步提升安全性。
认证过程中的密钥以及数据传输过程中的密钥都可以根据数据类型灵活设定。例如，云平台根据待传输的数据类型动态确定与数据类型相匹配的密钥。即：密钥的种类以及加解密方式都能根据数据类型和交互过程而灵活设定。例如，可针对不同交互过程选用不同加解密方式，比如对平台证书使用对称密钥，对模块证书使用非对称密钥，从而根据交互过程和数据安全等级设定密钥以及加解密方式。
另外，在本公开的应用场景中，安全模块由物联网云平台提供，因此，属于可信任设备，而数据传输设备为独立于云平台的外部设备，因而属于不可信设备。为了避免不可信设备遭遇攻击所导致的安全问题，将敏感数据以及加解密过程全部由安全增强模块实施。
并且，为了进一步提升安全性，针对安全增强模块设置有软件开发工具包SDK，相应的，数据传输设备只需集成该SDK即可与安全增强模块以及云平台通信。即：安全增强模块与数据传输设备之间通过预设的应用程序接口进行数据传输；并且，应用程序接口由对应于安全增强模块的软件开发工具包提供。由此可见，在本实施例中，数据传输设备与安全增强模块之间传输数据时，必须调用由SDK提供的应用程序接口API函数方可实现。例如，数据传输设备向安全增强模块发送数据时，需要调用与发送的数据类型相匹配的发送类应用程序接口实现；数据传输设备接收安全增强 模块返回的数据时，需要调用与接收的数据类型相匹配的接收类应用程序接口实现。由于SDK中包含的各个应用程序接口函数的参数、执行逻辑都是预先定义的，因此，能够在设定SDK的过程中，避免将与访问敏感数据相关的执行逻辑写入接口函数，从而避免敏感数据被恶意访问的问题。
本公开实施例还提供了一种数据传输装置，该装置可以为上文提到的安全增强模块。如图5所示，本公开一个实施例提供的数据传输装置包括：
接收模块51，被配置为接收数据传输设备发送的原始传输数据；
加解密模块52，被配置为确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理，得到安全传输数据；
发送模块53，被配置为将所述安全传输数据发送给所述数据传输设备；其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
在一种可选的实现方式中，所述装置，还包括：模块证书生成模块，被配置为接收并存储云平台响应于设备注册请求生成的平台证书；响应于所述数据传输设备发送的认证指令，针对所述平台证书添加辅助校验数据，得到模块证书，将所述模块证书发送给所述数据传输设备，以供所述数据传输设备将所述模块证书提供给所述云平台进行设备认证；并且，所述接收模块51被配置为：在设备认证通过的情况下，接收数据传输设备发送的原始传输数据。
在一种可选的实现方式中，所述设备注册请求由所述数据传输设备发送，并且，所述设备注册请求中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；且所述平台证书中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息。
在一种可选的实现方式中，所述辅助校验数据包括：时间戳数据；并且，所述数据传输设备的设备信息包括：设备业务类型和/或设备认证类型；
则所述加解密模块被配置为：接收所述云平台响应于所述数据传输设备发送的密钥协商请求返回的所述安全密钥；其中，所述安全密钥根据所述设备业务类型和/或设备认证类型生成。
在一种可选的实现方式中，所述加解密模块具体被配置为：
接收所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
在一种可选的实现方式中，当所述设备认证类型为第一认证类型时，安全密钥与设备标识相对应；当所述设备认证类型为第二认证类型时，安全密钥与设备型号相对应；当所述设备认证类型为第三认证类型时，安全密钥与设备业务类型相对应。
在一种可选的实现方式中，所述云平台生成的平台证书为密文形式的平台证书；则所述模块证书生成模块具体被配置为：
根据所述云平台提供的平台证书密钥对所述密文形式的平台证书进行解密，得到明文形式的平台证书；
针对所述明文形式的平台证书添加辅助校验数据，得到明文形式的模块证书；
通过模块证书密钥对所述明文形式的模块证书进行加密，得到密文形式的模块证书。
在一种可选的实现方式中，所述密文形式的平台证书通过对称加密方式得到；所述密文形式的模块证书通过非对称加密方式得到；并且，所述模块证书密钥从所述云平台获取。
在一种可选的实现方式中，所述加解密模块具体被配置为：
确定所述原始传输数据的数据类型，根据所述数据类型确定安全密钥以及加解密方式；
通过所述安全密钥以及加解密方式，对所述原始传输数据执行加解密 处理。
在一种可选的实现方式中，所述数据类型包括以下中的至少一个：明文类型、密文类型、发送类型、接收类型、传输数据类型、以及安全校验类型；
并且，所述安全密钥包括以下中的至少一种：对称密钥、非密钥密钥、从云平台获取的密钥、本地生成的密钥、加密类密钥、解密类密钥、固定密钥、以及可变密钥；
所述加解密方式包括：对称加密方式、对称解密方式、非对称加密方式、非对称解密方式。
本公开实施例还提供了一种数据传输装置，该装置可以为上文提到的数据传输设备。如图6所示，本公开一个实施例提供的数据传输装置包括：
发送模块61，被配置为将原始传输数据发送给安全增强模块；
接收模块62，被配置为接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据；
其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
在一种可选的实现方式中，所述装置还包括：
注册模块63，被配置为向所述云平台发送设备注册请求，以使所述安全增强模块接收并存储云平台响应于所述设备注册请求生成的平台证书；
认证模块64，被配置为向所述安全增强模块发送认证指令，以供所述安全增强模块针对所述平台证书添加辅助校验数据，得到模块证书；
则所述接收模块62进一步被配置为：将接收到的来自所述安全增强模块的模块证书发送给云平台，以供所述云平台进行设备认证；
并且，所述发送模块61具体被配置为：在设备认证通过的情况下，将原始传输数据发送给安全增强模块。
在一种可选的实现方式中，所述设备注册请求中包括：所述安全增强 模块的模块信息以及所述数据传输设备的设备信息；且所述平台证书中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；
并且，所述辅助校验数据包括：时间戳数据；所述数据传输设备的设备信息包括：设备业务类型和/或设备认证类型；则所述与所述原始传输数据相对应的安全密钥由所述云平台根据所述设备业务类型和/或设备认证类型生成；
其中，当所述设备认证类型为第一认证类型时，安全密钥与设备标识相对应；当所述设备认证类型为第二认证类型时，安全密钥与设备型号相对应；当所述设备认证类型为第三认证类型时，安全密钥与设备业务类型相对应。
在一种可选的实现方式中，所述装置还包括：
密钥协商模块，被配置为向云平台发送密钥协商请求；
根据云平台返回的结果，向安全增强模块提供来自云平台的安全密钥；其中，所述安全密钥根据所述设备业务类型和/或设备认证类型生成。
在一种可选的实现方式中，所述密钥协商模块具体被配置为：
将所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
在一种可选的实现方式中，若原始传输数据为所述数据传输设备从所述云平台接收到的数据，则所述发送模块具体被配置为：针对通过平台传输协议接收到的原始传输数据执行协议转换处理，将协议转换处理后的原始传输数据发送给安全增强模块；
若原始传输数据为所述数据传输设备的本地数据，则所述接收模块还被配置为：针对通过预设传输协议接收到的安全传输数据执行协议转换处理，将协议转换处理后的安全传输数据发送给所述云平台。
本公开实施例还提供了一种云平台。如图7所示，本公开一个实施例 提供的云平台包括：
密钥发送模块71，被配置为将生成的安全密钥发送给安全增强模块；
第一传输模块72，被配置为向数据传输设备发送加密后的第一传输数据，以供所述数据传输设备将所述第一传输数据提供给安全增强模块，以使所述安全增强模块根据所述安全密钥执行解密处理；和/或，
第二传输模块73，被配置为接收所述数据传输设备发送的由所述安全增强模块通过所述安全密钥加密得到的第二传输数据。
在一种可选的实现方式中，所述云平台还包括：
平台证书生成模块，被配置为根据接收到的设备注册请求，生成平台证书，将所述平台证书提供给所述安全增强模块；
并且，所述第二传输模块进一步被配置为：接收所述安全增强模块通过所述数据传输设备发送的模块证书；针对所述模块证书进行解析，根据解析结果进行设备认证。
在一种可选的实现方式中，所述平台证书生成模块具体被配置为：
获取所述设备注册请求中包含的所述安全增强模块的模块信息以及所述数据传输设备的设备信息，根据所述安全增强模块的模块信息以及所述数据传输设备的设备信息生成所述平台证书。
在一种可选的实现方式中，所述平台证书生成模块具体被配置为：
对所述安全增强模块的模块信息以及所述数据传输设备的设备信息进行加密，得到密文形式的平台证书；
所述第二传输模块具体被配置为：对接收到的密文形式的模块证书进行解密，得到明文形式的模块证书；将所述明文形式的模块证书与预先生成的平台证书进行匹配；若匹配成功，则设备认证通过。
在一种可选的实现方式中，所述密钥发送模块具体被配置为：响应于所述数据传输设备发送的密钥协商请求，获取与所述密钥协商请求相对应的设备信息；根据所述设备信息，生成安全密钥，并将生成的安全密钥发 送给安全增强模块；其中，所述设备信息包括：设备业务类型和/或设备认证类型。
在一种可选的实现方式中，所述密钥发送模块具体被配置为：通过平台私钥对所述安全密钥进行加密，得到第一密钥；将所述第一密钥通过所述数据传输设备发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
本公开实施例还提供了一种数据传输系统。如图8所示，本公开一个实施例提供的数据传输系统包括：
第一数据传输装置81、第二数据传输装置82以及云平台83。其中，第一数据传输装置81可以为图5所示的安全增强模块，第二数据传输装置82可以为图6所示的数据传输设备，云平台83的结构可参见图7所示。
参照图9，本公开实施例提供一种电子设备，其包括：
一个或多个处理器901；
存储器902，其上存储有一个或多个程序，当一个或多个程序被一个或多个处理器执行，使得一个或多个处理器实现上述任意一项的数据传输方法；
一个或多个I/O接口903，连接在处理器与存储器之间，配置为实现处理器与存储器的信息交互。
其中，处理器901为具有数据处理能力的器件，其包括但不限于中央处理器(CPU)等；存储器902为具有数据存储能力的器件，其包括但不限于随机存取存储器(RAM，更具体如SDRAM、DDR等)、只读存储器(ROM)、带电可擦可编程只读存储器(EEPROM)、闪存(FLASH)；I/O接口(读写接口)903连接在处理器901与存储器902间，能实现处理器901与存储器902的信息交互，其包括但不限于数据总线(Bus)等。
在一些实施例中，处理器901、存储器902和I/O接口903通过总线相互连接，进而与计算设备的其它组件连接。
本实施例还提供一种计算机可读介质，其上存储有计算机程序，程序被处理器执行时实现本实施例提供的数据传输方法，为避免重复描述，在此不再赘述数据传输方法的具体步骤。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其它数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其它存储器技术、CD-ROM、数字多功能盘(DVD)或其它光盘存储、磁盒、磁带、磁盘存储或其它磁存储器、或者可以用于存储期望的信息并且可以被计算机访问的任何其它的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其它传输机制之类的调制数据信号中的其它数据，并且可包括任何信息递送介质。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该 要素的过程、方法、物品或者装置中还存在另外的相同要素。
可以理解的是，以上实施方式仅仅是为了说明本公开/实用新型的原理而采用的示例性实施方式，然而本公开/实用新型并不局限于此。对于本领域内的普通技术人员而言，在不脱离本公开/实用新型的精神和实质的情况下，可以做出各种变型和改进，这些变型和改进也视为本公开/实用新型的保护范围。

Claims (30)

  1. 一种数据传输方法，应用于安全增强模块，其包括：
    接收数据传输设备发送的原始传输数据；
    确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理，得到安全传输数据；
    将所述安全传输数据发送给所述数据传输设备；
    其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
  2. 根据权利要求1所述的方法，其中，所述接收数据传输设备发送的原始传输数据之前，还包括：
    接收并存储云平台响应于设备注册请求生成的平台证书；
    响应于所述数据传输设备发送的认证指令，针对所述平台证书添加辅助校验数据，得到模块证书，将所述模块证书发送给所述数据传输设备，以供所述数据传输设备将所述模块证书提供给所述云平台进行设备认证；
    并且，所述接收数据传输设备发送的原始传输数据具体包括：在设备认证通过的情况下，接收数据传输设备发送的原始传输数据。
  3. 根据权利要求2所述的方法，其中，所述设备注册请求由所述数据传输设备发送，并且，所述设备注册请求中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；且所述平台证书中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息。
  4. 根据权利要求3所述的方法，其中，所述辅助校验数据包括：时间戳数据；并且，所述数据传输设备的设备信息包括：设备业务类型和/或设备认证类型；
    则所述确定与所述原始传输数据的数据类型相对应的安全密钥包括：接收所述云平台响应于所述数据传输设备发送的密钥协商请求返回的所述安全密钥；其中，所述安全密钥根据所述设备业务类型和/或设备认证类型 生成。
  5. 根据权利要求4所述的方法，其中，所述接收所述云平台响应于所述数据传输设备发送的密钥协商请求返回的所述安全密钥包括：
    接收所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥；通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
  6. 根据权利要求5所述的方法，其中，当所述设备认证类型为第一认证类型时，安全密钥与设备标识相对应；当所述设备认证类型为第二认证类型时，安全密钥与设备型号相对应；当所述设备认证类型为第三认证类型时，安全密钥与设备业务类型相对应。
  7. 根据权利要求2-6任一所述的方法，其中，所述云平台生成的平台证书为密文形式的平台证书；则所述针对所述平台证书添加辅助校验数据，得到模块证书包括：
    根据所述云平台提供的平台证书密钥对所述密文形式的平台证书进行解密，得到明文形式的平台证书；
    针对所述明文形式的平台证书添加辅助校验数据，得到明文形式的模块证书；
    通过模块证书密钥对所述明文形式的模块证书进行加密，得到密文形式的模块证书。
  8. 根据权利要求7所述的方法，其中，所述密文形式的平台证书通过对称加密方式得到；所述密文形式的模块证书通过非对称加密方式得到；并且，所述模块证书密钥从所述云平台获取。
  9. 根据权利要求1-6任一所述的方法，其中，所述确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理包括：
    确定所述原始传输数据的数据类型，根据所述数据类型确定安全密钥 以及加解密方式；
    通过所述安全密钥以及加解密方式，对所述原始传输数据执行加解密处理。
  10. 根据权利要求9所述的方法，其中，所述数据类型包括以下中的至少一个：明文类型、密文类型、发送类型、接收类型、传输数据类型、以及安全校验类型；
    并且，所述安全密钥包括以下中的至少一种：对称密钥、非密钥密钥、从云平台获取的密钥、本地生成的密钥、加密类密钥、解密类密钥、固定密钥、以及可变密钥；
    所述加解密方式包括：对称加密方式、对称解密方式、非对称加密方式、非对称解密方式。
  11. 根据权利要求1-6任一所述的方法，其中，所述安全增强模块通过预设接口以可插拔方式与所述数据传输设备连接，且所述安全增强模块通过与所述预设接口相对应的预设传输协议与所述数据传输设备通信；其中，所述预设接口包括USB接口。
  12. 根据权利要求1-6任一所述的方法，其中，所述安全增强模块与所述数据传输设备之间通过预设的应用程序接口进行数据传输；并且，所述应用程序接口由对应于所述安全增强模块的软件开发工具包提供。
  13. 一种数据传输方法，应用于数据传输设备，其包括：
    将原始传输数据发送给安全增强模块；
    接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据；
    其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
  14. 根据权利要求13所述的方法，其中，所述将原始传输数据发送给安全增强模块之前，还包括：
    向所述云平台发送设备注册请求，以使所述安全增强模块接收并存储云平台响应于所述设备注册请求生成的平台证书；
    向所述安全增强模块发送认证指令，以供所述安全增强模块针对所述平台证书添加辅助校验数据，得到模块证书；
    将接收到的来自所述安全增强模块的模块证书发送给云平台，以供所述云平台进行设备认证；
    并且，所述将原始传输数据发送给安全增强模块具体包括：在设备认证通过的情况下，将原始传输数据发送给安全增强模块。
  15. 根据权利要求14所述的方法，其中，所述设备注册请求中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；且所述平台证书中包括：所述安全增强模块的模块信息以及所述数据传输设备的设备信息；
    并且，所述辅助校验数据包括：时间戳数据；所述数据传输设备的设备信息包括：设备业务类型和/或设备认证类型；则所述与所述原始传输数据相对应的安全密钥由所述云平台根据所述设备业务类型和/或设备认证类型生成；
    其中，当所述设备认证类型为第一认证类型时，安全密钥与设备标识相对应；当所述设备认证类型为第二认证类型时，安全密钥与设备型号相对应；当所述设备认证类型为第三认证类型时，安全密钥与设备业务类型相对应。
  16. 根据权利要求13-15任一所述的方法，其中，所述接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥之前，还包括：
    向云平台发送密钥协商请求；
    根据云平台返回的结果，向安全增强模块提供来自云平台的安全密钥；其中，所述安全密钥根据设备业务类型和/或设备认证类型生成。
  17. 根据权利要求16所述的方法，其中，所述向安全增强模块提供来 自云平台的安全密钥包括：
    将所述云平台通过平台私钥对所述安全密钥进行加密后得到的第一密钥发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
  18. 根据权利要求13-15任一所述的方法，其中，若原始传输数据为所述数据传输设备从所述云平台接收到的数据，则所述将原始传输数据发送给安全增强模块包括：针对通过平台传输协议接收到的原始传输数据执行协议转换处理，将协议转换处理后的原始传输数据发送给安全增强模块；
    若原始传输数据为所述数据传输设备的本地数据，则所述接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到安全传输数据之后，还包括：针对通过预设传输协议接收到的安全传输数据执行协议转换处理，将协议转换处理后的安全传输数据发送给所述云平台。
  19. 一种数据传输方法，应用于云平台，其包括：
    将生成的安全密钥发送给安全增强模块；
    向数据传输设备发送加密后的第一传输数据，以供所述数据传输设备将所述第一传输数据提供给安全增强模块，以使所述安全增强模块根据所述安全密钥执行解密处理；和/或，
    接收所述数据传输设备发送的由所述安全增强模块通过所述安全密钥加密得到的第二传输数据。
  20. 根据权利要求19所述的方法，其中，所述方法还包括：
    根据接收到的设备注册请求，生成平台证书，将所述平台证书提供给所述安全增强模块；
    接收所述安全增强模块通过所述数据传输设备发送的模块证书；
    针对所述模块证书进行解析，根据解析结果进行设备认证。
  21. 根据权利要求20所述的方法，其中，所述根据接收到的设备注册 请求，生成平台证书包括：
    获取所述设备注册请求中包含的所述安全增强模块的模块信息以及所述数据传输设备的设备信息，根据所述安全增强模块的模块信息以及所述数据传输设备的设备信息生成所述平台证书。
  22. 根据权利要求21所述的方法，其中，所述根据所述安全增强模块的模块信息以及所述数据传输设备的设备信息生成所述平台证书包括：
    对所述安全增强模块的模块信息以及所述数据传输设备的设备信息进行加密，得到密文形式的平台证书；
    所述针对所述模块证书进行解析，根据解析结果进行设备认证包括：
    对接收到的密文形式的模块证书进行解密，得到明文形式的模块证书；
    将所述明文形式的模块证书与预先生成的平台证书进行匹配；若匹配成功，则设备认证通过。
  23. 根据权利要求19-22任一所述的方法，其中，所述将生成的安全密钥发送给安全增强模块包括：
    响应于所述数据传输设备发送的密钥协商请求，获取与所述密钥协商请求相对应的设备信息；
    根据所述设备信息，生成安全密钥，并将生成的安全密钥发送给安全增强模块；其中，所述设备信息包括：设备业务类型和/或设备认证类型。
  24. 根据权利要求23所述的方法，其中，所述并将生成的安全密钥发送给安全增强模块包括：
    通过平台私钥对所述安全密钥进行加密，得到第一密钥；
    将所述第一密钥通过所述数据传输设备发送给所述安全增强模块，以供所述安全增强模块通过预先获取到的平台公钥对所述第一密钥进行解密，得到所述安全密钥。
  25. 一种数据传输装置，其包括：
    接收模块，被配置为接收数据传输设备发送的原始传输数据；
    加解密模块，被配置为确定与所述原始传输数据相对应的安全密钥，通过所述安全密钥对所述原始传输数据执行加解密处理，得到安全传输数据；
    发送模块，被配置为将所述安全传输数据发送给所述数据传输设备；
    其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
  26. 一种数据传输装置，其包括：
    发送模块，被配置为将原始传输数据发送给安全增强模块；
    接收模块，被配置为接收所述安全增强模块根据与所述原始传输数据相对应的安全密钥，执行加解密处理后得到的安全传输数据；
    其中，所述原始传输数据用于在所述数据传输设备与云平台之间传输，且所述安全密钥从所述云平台获取。
  27. 一种云平台，其包括：
    密钥发送模块，被配置为将生成的安全密钥发送给安全增强模块；
    第一传输模块，被配置为向数据传输设备发送加密后的第一传输数据，以供所述数据传输设备将所述第一传输数据提供给安全增强模块，以使所述安全增强模块根据所述安全密钥执行解密处理；和/或，
    第二传输模块，被配置为接收所述数据传输设备发送的由所述安全增强模块通过所述安全密钥加密得到的第二传输数据。
  28. 一种数据传输系统，其包括：
    权利要求25所述的数据传输装置、权利要求26所述的数据传输装置、以及权利要求27所述的云平台。
  29. 一种电子设备，其包括：
    一个或多个处理器；
    存储器，其上存储有一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现根据权利要求 1-12、权利要求13-18或19-24中任意一项所述的方法；
    一个或多个I/O接口，连接在所述处理器与存储器之间，配置为实现所述处理器与存储器的信息交互。
  30. 一种计算机可读介质，其上存储有计算机程序，所述程序被处理器执行时实现根据权利要求1-12、权利要求13-18或19-24中任意一项所述的方法。
PCT/CN2022/074293 2022-01-27 2022-01-27 数据传输方法、装置、系统、电子设备及可读介质 WO2023141876A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280000084.1A CN116830525A (zh) 2022-01-27 2022-01-27 数据传输方法、装置、系统、电子设备及可读介质
PCT/CN2022/074293 WO2023141876A1 (zh) 2022-01-27 2022-01-27 数据传输方法、装置、系统、电子设备及可读介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/074293 WO2023141876A1 (zh) 2022-01-27 2022-01-27 数据传输方法、装置、系统、电子设备及可读介质

Publications (1)

Publication Number Publication Date
WO2023141876A1 true WO2023141876A1 (zh) 2023-08-03

Family

ID=87469906

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/074293 WO2023141876A1 (zh) 2022-01-27 2022-01-27 数据传输方法、装置、系统、电子设备及可读介质

Country Status (2)

Country Link
CN (1) CN116830525A (zh)
WO (1) WO2023141876A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117560224A (zh) * 2024-01-08 2024-02-13 深圳高新区信息网有限公司 一种密码治理系统和方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210044972A1 (en) * 2019-08-08 2021-02-11 Zettaset, Inc. Efficient Internet-Of-Things (IoT) Data Encryption/Decryption
CN112804310A (zh) * 2020-12-31 2021-05-14 河南中盾云安信息科技有限公司 一种面向物联网应用的多链智能安全网关及实现方法
US20210152545A1 (en) * 2019-11-18 2021-05-20 Ciot Systems and methods for authenticating device through iot cloud using hardware security module
US20210209237A1 (en) * 2018-09-26 2021-07-08 Oleg Dmitrievich Gurin Method and system of ensuring interaction of devices of the internet of things (iot)

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210209237A1 (en) * 2018-09-26 2021-07-08 Oleg Dmitrievich Gurin Method and system of ensuring interaction of devices of the internet of things (iot)
US20210044972A1 (en) * 2019-08-08 2021-02-11 Zettaset, Inc. Efficient Internet-Of-Things (IoT) Data Encryption/Decryption
US20210152545A1 (en) * 2019-11-18 2021-05-20 Ciot Systems and methods for authenticating device through iot cloud using hardware security module
CN112804310A (zh) * 2020-12-31 2021-05-14 河南中盾云安信息科技有限公司 一种面向物联网应用的多链智能安全网关及实现方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117560224A (zh) * 2024-01-08 2024-02-13 深圳高新区信息网有限公司 一种密码治理系统和方法
CN117560224B (zh) * 2024-01-08 2024-04-26 深圳高新区信息网有限公司 一种密码治理系统和方法

Also Published As

Publication number Publication date
CN116830525A (zh) 2023-09-29

Similar Documents

Publication Publication Date Title
CN110995642B (zh) 使用预共享密钥提供安全连接
JP6923611B2 (ja) サービス層におけるコンテンツセキュリティ
US11616775B2 (en) Network access authentication method, apparatus, and system
JP6668183B2 (ja) 通信装置、通信方法、通信システムおよびプログラム
US9762567B2 (en) Wireless communication of a user identifier and encrypted time-sensitive data
US9608963B2 (en) Scalable intermediate network device leveraging SSL session ticket extension
CN107659406B (zh) 一种资源操作方法及装置
US11736304B2 (en) Secure authentication of remote equipment
US20090158033A1 (en) Method and apparatus for performing secure communication using one time password
CN109510802B (zh) 鉴权方法、装置及系统
CN114500536B (zh) 云边协同方法及系统、装置、云平台、设备、介质
EP3633949A1 (en) Method and system for performing ssl handshake
US20230164136A1 (en) Authenticating a networked camera using a certificate having device binding information
JP2018517367A (ja) サービスプロバイダ証明書管理
KR20150079489A (ko) 실시간 통신 방법 및 시스템
US20220261798A1 (en) Computer-Implemented System and Method for Facilitating Transactions Associated with a Blockchain Using a Network Identifier for Participating Entities
WO2023241176A1 (zh) 通信方法、装置、设备、存储介质及程序产品
WO2022062980A1 (zh) 一种通信方法、装置及电子设备和存储介质
WO2023141876A1 (zh) 数据传输方法、装置、系统、电子设备及可读介质
TWI827906B (zh) 訊息傳輸系統以及應用其中之使用者裝置與資訊安全硬體模組
US20190149991A1 (en) Technique for authenticating a user device
CN112187726A (zh) 数据传输方法、装置、存储介质及终端
CN108989302B (zh) 一种基于密钥的opc代理连接系统和连接方法
KR101900060B1 (ko) 공유기와 연계되어 동작하는 보안요소, 공유기 및 이를 이용한 네트워크 형성 방법
CN114679287B (zh) 数据处理方法、系统、电子设备及存储介质

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202280000084.1

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 18019843

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22922722

Country of ref document: EP

Kind code of ref document: A1