CN112134694B - Data interaction method, master station, terminal and computer readable storage medium - Google Patents

Abstract

The invention discloses a data interaction method, a master station, a terminal and a computer-readable storage medium. The method includes: the master station sends a first message to the terminal. The first message is the master station using an asymmetric encryption algorithm to send a message to the master station. The first private information is encrypted with the ID of the terminal to generate the first private information, and the first private information is combined with the IDs of the master station and the terminal; the master station receives the first response message sent by the terminal, and the first response message contains the The first random number and the second private information generated by the terminal based on the symmetric encryption algorithm and the asymmetric encryption algorithm; the main station verifies the correctness of the second private information and the ID of the main station, and after passing the verification, uses the symmetric encryption algorithm to The random number performs a key agreement operation to generate a second session key, and when the second session key is the same as the first session key, the first session key is saved. This ensures the randomness, diversity and security of session key generation, which is beneficial to improving the security of data interaction.

Description

Data interaction method, main station, terminal and computer-readable storage medium

Technical field

The present invention relates to the technical field of computer information security, and in particular to a data interaction method, a main station, a terminal and a computer-readable storage medium.

Background technique

In recent years, the State Grid Corporation of China has been comprehensively promoting the construction of an electricity information collection system. This system can achieve comprehensive coverage of all power users and gateways, and enable online monitoring of metering devices and real-time collection of important information such as user load, power, and voltage. , provide basic data for relevant systems in a timely, complete and accurate manner, provide support for analysis and decision-making in all aspects of enterprise operation and management, and provide an information basis for realizing intelligent two-way interactive services. In order to realize the above functions, the system requires a large number of terminals (also called power information collection equipment) to participate in the collection of data information. These devices can usually realize the collection of energy meter data, data management, two-way data transmission, and forwarding or execution. control commands, etc.

In order to establish a comprehensive power consumption information collection system, it is necessary to build a system main station, transmission channel, terminal and electronic energy meter. Currently, most terminal data upload communication channels use GPRS (General Packet Radio Service). In order to ensure the safe and stable operation of the power information collection system, prevent power supply interruption to users, and prevent intrusions into the main station through public networks and user terminals from causing wider security risks, authentication and encryption are required when the main station interacts with terminals. , which requires stipulating the methods and rules for data transmission between the main station and the terminal.

In related technologies, when the master station and the terminal interact with each other in data, symmetrical external authentication is first performed, and after the authentication is passed, the communication data is encrypted to ensure safe transmission of data. Although this method has authentication operations before data interaction, this authentication method is easy to be cracked and replayed, and has low security.

Contents of the invention

The present invention aims to solve one of the technical problems in the related art, at least to a certain extent. To this end, the first purpose of the present invention is to propose a data interaction method that uses a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm to perform session key negotiation to obtain the session key, ensuring the randomness of session key generation. , diversity and security, thus providing a secure basis for subsequent data interaction and conducive to improving the security of data interaction.

The second object of the present invention is to propose another data interaction method.

The third object of the present invention is to provide a master station.

The fourth object of the present invention is to provide a terminal.

The fifth object of the present invention is to provide a computer-readable storage medium.

In order to achieve the above object, the first embodiment of the present invention proposes a data interaction method, which includes the following steps: the master station sends a first message to the terminal, and the first message is the master station using an asymmetric encryption algorithm to The terminal's ID (Identity Document, identity identification number) is encrypted to generate the first private information, and the first private information is combined with the IDs of the main station and the terminal; the main station receives the first response message sent by the terminal, and the first The response message carries the first random number generated by the terminal, and the terminal performs a key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a first session key, and generates a first session key based on an asymmetric encryption algorithm. The second private information is encrypted with the ID of the primary station; the primary station verifies the correctness of the second private information and the ID of the primary station, and after passing the verification, uses a symmetric encryption algorithm to perform a key negotiation operation on the first random number to generate a second session key, and determine whether the second session key is the same as the first session key, and if they are the same, save the first session key to complete the session key negotiation.

According to the data interaction method of the embodiment of the present invention, the session key is obtained through session key negotiation by using a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm, thereby ensuring the randomness, diversity and security of the session key generation. This provides a secure basis for subsequent data interaction and is conducive to improving the security of data interaction.

In order to achieve the above object, the second embodiment of the present invention proposes another data interaction method, which includes the following steps: the terminal receives the first message sent by the master station, the first message carries the IDs of the master station and the terminal, and , the primary station uses a non-encryption algorithm to encrypt the IDs of the primary station and the terminal to generate the first private information; the terminal verifies the correctness of the first private information, and after passing the verification, generates the first random number, and uses a symmetric encryption algorithm to The first random number performs a key negotiation operation to generate a first session key, and an asymmetric encryption algorithm is used to encrypt the first session key and the ID of the primary station to generate the second private information, and the first random number and the second The private information is merged to generate a first response message and sent to the main station, so that the main station performs a key negotiation operation on the first random number based on the symmetric encryption algorithm to generate a second session key, and determines the second session key and the first session key. After the keys are the same, the first session key is saved to complete the session key negotiation.

According to the data interaction method of the embodiment of the present invention, the session key is obtained through session key negotiation by using a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm, thereby ensuring the randomness, diversity and security of the session key generation. This provides a secure basis for subsequent data interaction and is conducive to improving the security of data interaction.

In order to achieve the above object, the third embodiment of the present invention proposes a master station, including a first sending unit, a first receiving unit and a first processing unit, wherein the first sending unit is used to send a first report to the terminal. The first message is generated by the first processing unit using an asymmetric encryption algorithm to encrypt the IDs of the main station and the terminal to generate the first private information, and merging the first private information with the IDs of the main station and the terminal; the first The receiving unit is configured to receive a first response message sent by the terminal. The first response message carries a first random number generated by the terminal, and the terminal performs a key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a second response message. a session key and second private information generated by encrypting the first session key and the ID of the primary station based on an asymmetric encryption algorithm; a first processing unit for verifying the correctness of the second private information and the ID of the primary station property, and after passing the verification, use a symmetric encryption algorithm to perform a key negotiation operation on the first random number to generate a second session key, and determine whether the second session key is the same as the first session key, and save the second session key if they are the same. A session key to complete session key negotiation.

According to the embodiment of the present invention, the master station obtains the session key by performing session key negotiation with the terminal by using a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm, thereby ensuring the randomness, diversity and security of the session key generation. , thus providing a secure basis for subsequent data interaction and conducive to improving the security of data interaction.

In order to achieve the above object, the fourth embodiment of the present invention proposes a terminal, including a first receiving unit, a random number generating unit, a first processing unit and a first sending unit, wherein the first receiving unit is used to receive the main The first message sent by the station, the first message carries the IDs of the master station and the terminal, and the first private information generated by the master station using a non-encryption algorithm to encrypt the IDs of the master station and the terminal; the first processing unit, Used to verify the correctness of the first private information, and after passing the verification, generate the first random number through the random number generation unit, and use a symmetric encryption algorithm to perform a key agreement operation on the first random number to generate the first session key, and Using an asymmetric encryption algorithm to encrypt the first session key and the ID of the primary station to generate second private information, and combining the first random number and the second private information to generate a first response message; a first sending unit, configured to Send the first response message to the primary station, so that the primary station performs a key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a second session key, and determines that the second session key is the same as the first session key. Then save the first session key to complete the session key negotiation.

According to the terminal according to the embodiment of the present invention, the session key is obtained through session key negotiation with the main station by using a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm, thereby ensuring the randomness, diversity and security of the session key generation. , thus providing a secure basis for subsequent data interaction and conducive to improving the security of data interaction.

In order to achieve the above object, a fifth embodiment of the present invention provides a computer-readable storage medium for storing a computer program. When the computer program is executed by a processor, the method of the first embodiment or the implementation of the second aspect is implemented. Example method.

According to the computer-readable storage medium of the embodiment of the present invention, the session key is obtained through session key negotiation by using a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm, thereby ensuring the randomness, diversity and security of the session key generation. This provides a secure basis for subsequent data interaction and is conducive to improving the security of data interaction.

Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Description of the drawings

Figure 1 is a flow chart of a data interaction method according to the first embodiment of the present invention;

Figure 2 is a schematic diagram of the session key negotiation process according to the first embodiment of the present invention;

Figure 3 is a flow chart of terminal authentication by the master station according to the first embodiment of the present invention;

Figure 4 is a schematic diagram of the process of terminal authentication by the master station according to the first embodiment of the present invention;

Figure 5 is a schematic diagram of the process of terminal authentication to the primary station according to the first embodiment of the present invention;

Figure 6 is a flow chart of a data interaction method according to the second embodiment of the present invention;

Figure 7 is a schematic diagram of a master station according to an embodiment of the present invention;

Figure 8 is a schematic diagram of a terminal according to an embodiment of the present invention.

Detailed ways

Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present invention and are not to be construed as limiting the present invention.

The following describes the data interaction method, main station, terminal and computer-readable storage medium proposed by the embodiment of the present invention with reference to the accompanying drawings.

In this application, the interaction process between the master station and the terminal can be divided into three steps: the first step is the session key negotiation between the master station and the terminal to obtain the session key; the second step is to use the session key obtained through negotiation. Authentication operation; the third step is to use the negotiated session key for data transmission after the authentication is passed.

Figure 1 is a flow chart of a data interaction method according to the first embodiment of the present invention. The flow chart is described from the perspective of the master station. The data interaction method includes the following steps:

Step S101, the master station sends a first message to the terminal. The first message is that the master station uses an asymmetric encryption algorithm to encrypt the IDs of the master station and the terminal to generate first private information, and combines the first private information with the master station and the terminal. Generated by merging the terminal IDs.

Specifically, as shown in Figure 2, when performing session key negotiation, the master station first obtains its own ID and the ID of the terminal that needs to perform data interaction, and uses the preset asymmetric encryption algorithm to compare the IDs of itself and the terminal. Encryption is performed to generate the first private information. For example, the private key in the asymmetric key pair is used to digitally sign the IDs of itself and the terminal to form a signature S1, which is the first private information. Then, the master station combines its own ID, the terminal's ID and the first private information to generate a first message and sends it to the terminal.

Step S102: The master station receives the first response message sent by the terminal. The first response message carries the first random number generated by the terminal, and the terminal performs a key negotiation operation on the first random number based on the symmetric encryption algorithm to generate the second random number. A session key, and second private information generated by encrypting the first session key and the ID of the primary station based on an asymmetric encryption algorithm.

Specifically, continuing to refer to Figure 2, after the terminal receives the first message sent by the master station, the terminal verifies the correctness of the first private information, for example, using the public key in the preset asymmetric key pair. Correctness of signature S1. After passing the verification, the terminal generates the first random number R1, uses the preset symmetric encryption algorithm to perform a key negotiation operation on the first random number R1 to generate the first session key, and uses the preset asymmetric encryption algorithm to perform key negotiation on the first session key. A session key and the ID of the primary station are encrypted to generate the second private information. For example, a symmetric key is used to operate the first random number R1 using a preset key agreement algorithm to generate the first session key Ks, and the first random number R1 is generated using a non-symmetric key. The private key in the symmetric key pair digitally signs the first session key Ks and the ID of the primary station to form a signature S2, which is the second private information. Then, the first random number R1 and the second private information are combined into a first response message and sent to the main station.

Step S103: The primary station verifies the correctness of the second private information and the ID of the primary station, and after passing the verification, uses a symmetric encryption algorithm to perform a key negotiation operation on the first random number to generate a second session key, and determines the second session Whether the key is the same as the first session key, and if they are the same, the first session key is saved to complete the session key negotiation.

Specifically, after receiving the first response message sent by the terminal, the master station first verifies the correctness of the second private information and the ID of the master station, for example, using the public key in the preset asymmetric key pair to verify the signature. For the correctness of S2, after passing the verification, compare the received ID of the master station sent by the terminal and its own ID obtained in step S101 to see if they are the same. If they are the same, it means that the ID of the master station is correct. Then, the master station uses a preset symmetric encryption algorithm to perform a key negotiation operation on the first random number R1 to generate the second session key Ks'. For example, the main station uses a symmetric key to use the same preset key as the terminal for the first random number R1. The key agreement algorithm operates, generates the second session key Ks', and determines whether the second session key Ks' is the same as the first session key Ks. If they are the same, the first session key Ks is saved for subsequent mutual exchange. Used during authentication, the session key negotiation between the master station and the terminal is completed.

According to the data interaction method of the embodiment of the present invention, the session key is obtained through session key negotiation by using a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm, thereby ensuring the randomness, diversity and security of the session key generation. This provides a secure basis for subsequent data interaction and is conducive to improving the security of data interaction.

According to an embodiment of the present invention, with reference to Figure 3, after the session key negotiation is completed, the data interaction method further includes the following steps:

Step 201: The master station sends a second message to the terminal. In the second message, the master station uses the first session key to encrypt the second random number generated by the master station to generate a first encrypted ciphertext, and adds the first encrypted ciphertext to the terminal. generated by merging the text and the second random number.

Specifically, after the session key negotiation is completed, the primary station can use the first session key Ks obtained through the negotiation to perform an authentication operation on the terminal. Referring to Figure 4, at this time, the main station can first generate the second random number R2, and use the first session key Ks to encrypt the second random number R2 to obtain the first encrypted ciphertext, and then convert the first encrypted ciphertext into It is combined with the second random number R2 to generate a second message and sends it to the terminal.

Step 202: The master station receives a second response message sent by the terminal. The second response message carries third private information generated by the terminal using an asymmetric encryption algorithm to encrypt the first random number and the second random number.

Specifically, continuing to refer to Figure 4, after the terminal receives the second message sent by the master station, the terminal first uses a preset symmetric encryption algorithm to decrypt the first encrypted ciphertext to obtain the third random number R3, for example, using The symmetric key decrypts the first encrypted ciphertext to obtain the third random number R3, and determines whether the third random number R3 and the second random number R2 are the same. If they are the same, use the preset asymmetric encryption algorithm to The number R1 and the second random number R2 are encrypted to generate the third private information. For example, the private key in the asymmetric key pair is used to digitally sign the first random number R1 and the second random number R2 to form the signature S3, which is the third private information. . Then, a second response message is generated according to the third private information and sent to the main station.

Step 203: The main station verifies the correctness of the third private information, and completes the authentication of the terminal by the main station after passing the verification.

Specifically, after the primary station receives the second response message sent by the terminal, the primary station verifies the correctness of the third private information, for example, using the second random number R2 and the first random number R1 generated during session negotiation to verify the signature. The correctness of S3, after passing the verification, the master station successfully authenticates the terminal, and subsequently uses the first session key Ks generated in the session key negotiation for data transmission, etc.

According to the data interaction method of the embodiment of the present invention, a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm is used to perform session key negotiation and the primary station's authentication operation on the terminal, so as to establish a secure link between the primary station and the terminal. In this way, the communication security between the two can be protected.

According to an embodiment of the present invention, after the session key negotiation is completed, the data interaction method further includes the following steps: the master station sends a third message to the terminal, and the third message is the master station using an asymmetric encryption algorithm to The fourth private information generated by encrypting the number and the second encrypted ciphertext generated by encrypting the first random number using the first session key are combined and generated, so that the terminal can complete the process after verifying that the fourth private information and the first random number are correct. Authentication of the terminal to the main station.

Specifically, after the session key negotiation is completed, the terminal can use the first session key Ks obtained through the negotiation to perform an authentication operation on the primary station. Referring to Figure 5, at this time, the main station can first use the preset asymmetric encryption algorithm to encrypt the fourth private information generated by the first random number R1, and use the first session key Ks to encrypt the first random number R1. The second encrypted ciphertext generated by encryption, for example, uses the private key in the asymmetric key pair to digitally sign the first random number R1 to form the signature S4, which is the fourth private information, and uses the first session key Ks to digitally sign the first random number R1. Number R1 is encrypted to generate the second encrypted ciphertext. Then, the fourth private information and the second encrypted ciphertext are combined to generate a third message and sent to the terminal.

After receiving the third message sent by the master station, the terminal first uses the preset asymmetric encryption algorithm to verify the correctness of the fourth private information, for example, uses the public key in the asymmetric key pair to verify the correctness of the signature S4, After the verification is passed, the first session key Ks is used to verify the correctness of the first random number R1. After the verification is passed, the terminal successfully authenticates the master station and subsequently uses the first session key Ks generated in the session key negotiation. Perform data transfer, etc.

According to the data interaction method of the embodiment of the present invention, a combination of a symmetric encryption algorithm and an asymmetric encryption algorithm is used to perform session key negotiation and the primary station's authentication operation on the terminal, so as to establish a secure link between the primary station and the terminal. In this way, the communication security between the two can be protected.

It should be noted that in actual applications, the corresponding authentication method can be selected according to the actual application security requirements. For example, the terminal is authenticated only through the main station, or the main station is authenticated only through the terminal, or the terminal is authenticated through the main station and the main station is authenticated through the terminal at the same time. The more authentication methods, the higher the security.

According to an embodiment of the present invention, after the authentication is completed, the data interaction method further includes the following steps: the master station uses the first session key to perform data encryption and decryption processing, and determines whether the life cycle of the first session key reaches the preset value. Life cycle; if yes, the master reinitiates session key negotiation. Further, according to an embodiment of the present invention, the main station determines whether the life cycle of the first session key reaches the preset life cycle, including: the main station determines whether the number of uses of the first session key reaches the preset number of times; if so , then it is determined that the life cycle of the first session key reaches the preset life cycle.

Specifically, in order to ensure the security of the session between the master station and the terminal, when using the negotiated session key for data encryption and decryption, a life cycle limit can be set on the session key. For example, when the session key is used a certain number of times, After the number of times is limited, the session key becomes invalid. At this time, the master station needs to re-initiate a session key negotiation process to negotiate a new session key. For example, if the life cycle of the session key is set to 10,000 times, then the session key can be used up to 10,000 times. After 10,000 times is reached, the session key negotiation needs to be re-negotiated before communication can be carried out again, thus ensuring the expiration of the session key and Safety.

In practical applications, you can also set the number of communications between the master station and the terminal. When the number of communications reaches the limit, the session key becomes invalid. At this time, the master station re-initiates the session key negotiation process.

According to the data interaction method of the embodiment of the present invention, the security of data interaction between the main station and the terminal is ensured through session key negotiation, security authentication between the main station and the terminal, and restriction of the session key life cycle, and is carried out Session key negotiation and security authentication between the master station and the terminal use a combination of symmetric encryption algorithms and asymmetric encryption algorithms, such as signatures, symmetric encryption and other security mechanisms to ensure the establishment of a link between the master station and the terminal. The security of the communication between the main station and the terminal is protected, and the security of data interaction is greatly improved. At the same time, when performing session key negotiation, the key agreement algorithm is used to disperse the session key, ensuring the randomness and diversity of key generation.

The above is an explanation of the data interaction method proposed by the present invention from the perspective of the main station, and the following is an explanation of the data interaction method proposed by the present invention from the perspective of the terminal.

Figure 6 is a flow chart of a data interaction method according to the second embodiment of the present invention. The flow chart is described from the perspective of a terminal. The data interaction method includes the following steps:

Step 301: The terminal receives the first message sent by the master station. The first message carries the IDs of the master station and the terminal, and the master station uses a non-encryption algorithm to encrypt the IDs of the master station and the terminal to generate first private information. .

Step 302: The terminal verifies the correctness of the first private information, and after passing the verification, generates a first random number, and uses a symmetric encryption algorithm to perform a key negotiation operation on the first random number to generate a first session key, and uses an asymmetric The encryption algorithm encrypts the first session key and the ID of the primary station to generate second private information, and combines the first random number and the second private information to generate a first response message and sends it to the primary station, so that the primary station can encrypt based on symmetric The algorithm performs a key agreement operation on the first random number to generate a second session key, and after determining that the second session key is the same as the first session key, saves the first session key to complete the session key agreement.

According to an embodiment of the present invention, after the session key negotiation is completed, the data interaction method further includes: the terminal receives a second message sent by the master station, and the second message carries a second random number generated by the master station and a second message sent by the master station. The first encrypted ciphertext is generated by encrypting the second random number using the first session key; the terminal decrypts the first encrypted ciphertext to obtain the third random number, and determines whether the third random number is the same as the second random number, And at the same time, the first random number and the second random number are encrypted using an asymmetric encryption algorithm to generate third private information, and a second response message is generated based on the third private information and sent to the main station, so that the main station can verify the third private information. After the three private information are correct, the authentication of the terminal by the main station is completed.

According to an embodiment of the present invention, after the session key negotiation is completed, the data interaction method further includes: the terminal receives a third message sent by the master station, and the third message carries the first random message sent by the master station using an asymmetric encryption algorithm. The fourth private information generated by encrypting the first random number and the second encrypted ciphertext using the first session key to encrypt the first random number; the terminal verifies the correctness of the fourth private information and the first random number, and after passing the verification Complete the authentication of the terminal to the main station.

According to an embodiment of the present invention, after the authentication is completed, the data interaction method further includes: the terminal uses the first session key to perform data encryption and decryption processing.

It should be noted that for a detailed description of the data interaction method applied to the terminal in this application, please refer to the description of the data interaction method applied to the master station in this application, which will not be described again here.

According to the data interaction method of the embodiment of the present invention, the security of data interaction between the main station and the terminal is ensured through session key negotiation, security authentication between the main station and the terminal, and restriction of the session key life cycle, and is carried out Session key negotiation and security authentication between the master station and the terminal use a combination of symmetric encryption algorithms and asymmetric encryption algorithms, such as signatures, symmetric encryption and other security mechanisms to ensure the establishment of a link between the master station and the terminal. The security of the communication between the main station and the terminal is protected, and the security of data interaction is greatly improved. At the same time, when performing session key negotiation, the key agreement algorithm is used to disperse the session key, ensuring the randomness and diversity of key generation.

In addition, the present invention also provides a main station and a terminal.

Figure 7 is a schematic diagram of a master station according to an embodiment of the present invention. Referring to Figure 7, the master station includes a first sending unit 11, a first receiving unit 12 and a first processing unit 13, where the first sending unit 11 is In order to send the first message to the terminal, the first message is that the first processing unit 13 uses an asymmetric encryption algorithm to encrypt the IDs of the main station and the terminal to generate the first private information, and combines the first private information with the main station and the terminal. The first receiving unit 12 is used to receive the first response message sent by the terminal, the first response message carries the first random number generated by the terminal, and the terminal performs the first random number based on the symmetric encryption algorithm. Perform key agreement operation to generate a first session key, and encrypt the first session key and the ID of the primary station based on an asymmetric encryption algorithm to generate second private information; the first processing unit 13 is used to verify the second private information. information and the correctness of the ID of the primary station, and after passing the verification, use a symmetric encryption algorithm to perform a key negotiation operation on the first random number to generate a second session key, and determine whether the second session key is the same as the first session key. The same, and when the same, save the first session key to complete the session key negotiation.

According to an embodiment of the present invention, the main station further includes a second sending unit, a second receiving unit, a random number generating unit and a second processing unit, wherein the second sending unit is used to send a message to the terminal after the session key negotiation is completed. The second message is that the second processing unit uses the first session key to encrypt the second random number generated by the random number generation unit to generate the first encrypted ciphertext, and combines the first encrypted ciphertext and the second Generated by merging random numbers; the second receiving unit is used to receive a second response message sent by the terminal, and the second response message carries a third random number generated by the terminal using an asymmetric encryption algorithm to encrypt the first random number and the second random number. Three private information; the second processing unit is used to verify the correctness of the third private information, and complete the authentication of the terminal by the main station after the verification is passed.

According to an embodiment of the present invention, the master station further includes a third sending unit and a third processing unit, wherein the third sending unit is used to send a third message to the terminal after the session key negotiation is completed, and the third message is The third processing unit uses an asymmetric encryption algorithm to encrypt the first random number and generates the fourth private information and the second encrypted ciphertext generated by using the first session key to encrypt the first random number, so that the terminal can After verifying that the fourth private information and the first random number are correct, the terminal authenticates the main station.

According to an embodiment of the present invention, the main station further includes: a fourth processing unit, used to use the first session key to perform data encryption and decryption processing, and determine whether the life cycle of the first session key reaches the preset life cycle, If yes, the first sending unit reinitiates session key negotiation.

According to an embodiment of the present invention, the fourth processing unit determines whether the number of uses of the first session key reaches a preset number of times, and if so, determines that the life cycle of the first session key reaches the preset life cycle.

It should be noted that, for the detailed description of the main station in this application, please refer to the description of the data interaction method in this application, and the details will not be repeated here.

According to the master station according to the embodiment of the present invention, the security of data interaction between the master station and the terminal is guaranteed through session key negotiation, security authentication between the master station and the terminal, and the restriction of the session key life cycle, and during the session Key negotiation and security authentication between the master station and the terminal use a combination of symmetric encryption algorithms and asymmetric encryption algorithms, such as signatures, symmetric encryption and other security mechanisms, to ensure that the link between the master station and the terminal is established. Security, thereby protecting the communication security between the main station and the terminal, and greatly improving the security of data interaction. At the same time, when performing session key negotiation, the key agreement algorithm is used to disperse the session key, ensuring the randomness and diversity of key generation.

Figure 8 is a schematic diagram of a terminal according to an embodiment of the present invention. Referring to Figure 8, the terminal includes a first receiving unit 21, a random number generating unit 22, a first processing unit 23 and a first sending unit 24, wherein the first The receiving unit 21 is configured to receive a first message sent by the master station. The first message carries the IDs of the master station and the terminal, and the master station uses a non-encryption algorithm to encrypt the IDs of the master station and the terminal to generate a first secret. Information; the first processing unit 23 is used to verify the correctness of the first private information, and after passing the verification, generate a first random number through the random number generation unit 22, and use a symmetric encryption algorithm to perform a key agreement operation on the first random number Generate a first session key, use an asymmetric encryption algorithm to encrypt the first session key and the ID of the primary station to generate second private information, and combine the first random number and the second private information to generate a first response message ; The first sending unit 24 sends the first response message to the main station, so that the main station performs a key negotiation operation on the first random number based on the symmetric encryption algorithm to generate a second session key, and determines the second session key. After being the same as the first session key, the first session key is saved to complete the session key negotiation.

According to an embodiment of the present invention, the terminal further includes a second receiving unit, a second processing unit and a second sending unit, wherein the second receiving unit is used to receive a second message sent by the master station after the session key negotiation is completed. , the second message carries the second random number generated by the master station and the first encrypted ciphertext generated by the master station using the first session key to encrypt the second random number; the second processing unit is used to encrypt the first Decrypt the ciphertext to obtain a third random number, determine whether the third random number and the second random number are the same, and use an asymmetric encryption algorithm to encrypt the first random number and the second random number to generate the third private information if they are the same. , and generate a second response message based on the third private information; the second sending unit is used to send the second response message to the main station, so that the main station can complete the authentication of the terminal after verifying that the third private information is correct. .

According to an embodiment of the present invention, the terminal further includes a third receiving unit and a third processing unit, wherein the third receiving unit is used to receive a third message sent by the master station, and the third message carries a non-transformation message used by the master station. The fourth private information generated by encrypting the first random number using the symmetric encryption algorithm and the second encrypted ciphertext using the first session key to encrypt the first random number; a third processing unit for verifying the fourth private information and The correctness of the first random number, and after passing the verification, the terminal authenticates the main station.

According to an embodiment of the present invention, the terminal further includes: a fourth processing unit, configured to use the first session key to perform data encryption and decryption processing.

It should be noted that, for a detailed description of the terminal in this application, please refer to the description of the data interaction method in this application, which will not be described again here.

The terminal according to the embodiment of the present invention ensures the security of data interaction between the main station and the terminal through session key negotiation, security authentication between the main station and the terminal, and restriction of the life cycle of the session key, and performs session encryption. During key negotiation and security authentication between the master station and the terminal, a combination of symmetric encryption algorithm and asymmetric encryption algorithm is used, such as involving signatures, symmetric encryption and other security mechanisms to ensure the security of the link establishment between the master station and the terminal. , thus realizing the protection of communication security between the main station and the terminal, and greatly improving the security of data interaction. At the same time, when performing session key negotiation, the key agreement algorithm is used to disperse the session key, ensuring the randomness and diversity of key generation.

In addition, embodiments of the present invention also provide a computer-readable storage medium for storing a computer program. When the computer program is executed by a processor, the above-mentioned data interaction method is implemented.

According to the readable storage medium of the embodiment of the present invention, the security of data interaction between the primary station and the terminal is ensured through session key negotiation, security authentication between the primary station and the terminal, and restriction of the life cycle of the session key, and in When conducting session key negotiation and security authentication between the main station and the terminal, a combination of symmetric encryption algorithm and asymmetric encryption algorithm is used, such as involving signatures, symmetric encryption and other security mechanisms to ensure the link between the main station and the terminal. Establishing security to protect the communication security between the main station and the terminal, greatly improving the security of data interaction. At the same time, when performing session key negotiation, the key agreement algorithm is used to disperse the session key, ensuring the randomness and diversity of key generation.

It should be noted that the logic and/or steps represented in the flowcharts or otherwise described herein, for example, may be considered to be a sequenced list of executable instructions for implementing logical functions, which may be embodied in any computer. in a readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can retrieve and execute instructions from the instruction execution system, apparatus, or device) Used by instruction execution systems, devices or equipment. For the purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer readable media include the following: electrical connections with one or more wires (electronic device), portable computer disk cartridges (magnetic device), random access memory (RAM), Read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium may even be paper or other suitable medium on which the program may be printed, as the paper or other medium may be optically scanned, for example, and subsequently edited, interpreted, or otherwise suitable as necessary. process to obtain the program electronically and then store it in computer memory.

It should be understood that various parts of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, various steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if it is implemented in hardware, as in another embodiment, it can be implemented by any one or a combination of the following technologies known in the art: a logic gate circuit with a logic gate circuit for implementing a logic function on a data signal. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), etc.

In the description of this specification, reference to the terms "one embodiment," "some embodiments," "an example," "specific examples," or "some examples" or the like means that specific features are described in connection with the embodiment or example. , structures, materials or features are included in at least one embodiment or example of the invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

In addition, the terms “first” and “second” are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the quantity of indicated technical features. Therefore, features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise expressly and specifically limited.

In the present invention, unless otherwise clearly stated and limited, the terms "installation", "connection", "connection", "fixing" and other terms should be understood in a broad sense. For example, it can be a fixed connection or a detachable connection. , or integrated into one; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be an internal connection between two elements or an interactive relationship between two elements, unless otherwise specified restrictions. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

Although the embodiments of the present invention have been shown and described above, it can be understood that the above-mentioned embodiments are illustrative and should not be construed as limitations of the present invention. Those of ordinary skill in the art can make modifications to the above-mentioned embodiments within the scope of the present invention. The embodiments are subject to changes, modifications, substitutions and variations.

Claims (12)

1. A method of data interaction, comprising the steps of:

the method comprises the steps that a primary station sends a first message to a terminal, wherein the first message is generated by encrypting IDs of the primary station and the terminal by using a private key in an asymmetric key pair by the primary station to generate first private information, and combining the first private information with the IDs of the primary station and the terminal;

the master station receives a first response message sent by the terminal, wherein the first response message carries a first random number generated by the terminal after verifying that the first private information is correct, and second private information generated by the terminal performing key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a first session key and encrypting the first session key and the ID of the master station based on a private key in an asymmetric key pair;

the master station verifies the correctness of the second private information and the ID of the master station, performs key negotiation operation on the first random number by using a symmetric encryption algorithm after verification is passed to generate a second session key, determines whether the second session key is identical to the first session key, and stores the first session key when the second session key is identical to the first session key so as to complete session key negotiation.

2. The data interaction method of claim 1, wherein after the session key negotiation is completed, the method further comprises:

the master station sends a second message to the terminal, wherein the second message is generated by the master station encrypting a second random number generated by the master station by using the first session key to generate a first encrypted ciphertext and combining the first encrypted ciphertext and the second random number;

the master station receives a second response message sent by the terminal, wherein the second response message carries third private information generated by the terminal encrypting the first random number and the second random number by using an asymmetric encryption algorithm;

and the master station verifies the correctness of the third private information, and completes the authentication of the master station to the terminal after the verification is passed.

3. The data interaction method of claim 1 or 2, wherein after the session key negotiation is completed, the method further comprises:

the master station sends a third message to the terminal, wherein the third message is generated by combining fourth private information generated by encrypting the first random number by the master station through an asymmetric encryption algorithm and second encrypted ciphertext generated by encrypting the first random number through the first session key, so that the terminal can finish authentication of the terminal to the master station after verifying that the fourth private information and the first random number are correct.

4. A data interaction method as claimed in claim 3, wherein after the authentication is completed, the method further comprises:

the master station performs encryption and decryption processing on data by using the first session key and judges whether the life cycle of the first session key reaches a preset life cycle or not;

if so, the master station reinitiates the session key negotiation.

5. The data interaction method of claim 4, wherein the master station determining whether the life cycle of the first session key reaches a preset life cycle comprises:

the master station judges whether the use times of the first session key reach preset times;

if yes, judging that the life cycle of the first session key reaches the preset life cycle.

6. A method of data interaction, comprising the steps of:

a terminal receives a first message sent by a master station, wherein the first message carries IDs of the master station and the terminal, and the master station encrypts the IDs of the master station and the terminal by using a private key in an asymmetric key pair to generate first private information;

the terminal verifies the correctness of the first private information, generates a first random number after verification is passed, performs key negotiation operation on the first random number by utilizing a symmetric encryption algorithm to generate a first session key, encrypts the first session key and the ID of the master station by utilizing a private key in an asymmetric key pair to generate second private information, combines the first random number and the second private information to generate a first response message, and sends the first response message to the master station, so that the master station performs key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a second session key, and stores the first session key after determining that the second session key is identical with the first session key so as to complete session key negotiation.

7. The data interaction method of claim 6, wherein after the session key negotiation is completed, the method further comprises:

the terminal receives a second message sent by the master station, wherein the second message carries a second random number generated by the master station and a first encrypted ciphertext generated by the master station by encrypting the second random number by using the first session key;

the terminal decrypts the first encrypted ciphertext to obtain a third random number, determines whether the third random number is identical to the second random number, encrypts the first random number and the second random number by using an asymmetric encryption algorithm to generate third private information when the third random number is identical to the second random number, generates a second response message according to the third private information, and sends the second response message to the master station, so that the master station can finish authentication of the master station on the terminal after verifying that the third private information is correct.

8. The data interaction method of claim 6 or 7, wherein after the session key negotiation is completed, the method further comprises:

the terminal receives a third message sent by the master station, wherein the third message carries fourth private information generated by the master station by encrypting the first random number by using an asymmetric encryption algorithm and second encrypted ciphertext by encrypting the first random number by using the first session key;

And the terminal verifies the correctness of the fourth private information and the first random number, and completes the authentication of the terminal to the master station after the verification is passed.

9. The data interaction method of claim 8, wherein after the authentication is completed, the method further comprises:

and the terminal uses the first session key to encrypt and decrypt data.

10. A master station is characterized by comprising a first transmitting unit, a first receiving unit and a first processing unit, wherein,

the first sending unit is configured to send a first message to a terminal, where the first message is generated by encrypting IDs of the master station and the terminal by using a private key in an asymmetric key pair by the first processing unit to generate first private information, and combining the first private information with the IDs of the master station and the terminal;

the first receiving unit is configured to receive a first response message sent by the terminal, where the first response message carries a first random number generated by the terminal after verifying that the first private information is correct, and second private information generated by the terminal performing a key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a first session key, and encrypting the first session key and an ID of the master station based on a private key in an asymmetric key pair;

The first processing unit is configured to verify correctness of the second private information and the ID of the master station, perform a key negotiation operation on the first random number by using a symmetric encryption algorithm after verification is passed to generate a second session key, determine whether the second session key is identical to the first session key, and store the first session key when the second session key is identical to the first session key to complete session key negotiation.

11. A terminal is characterized by comprising a first receiving unit, a random number generating unit, a first processing unit and a first transmitting unit, wherein,

the first receiving unit is configured to receive a first packet sent by a master station, where the first packet carries IDs of the master station and the terminal, and first private information generated by encrypting the IDs of the master station and the terminal by using a private key in an asymmetric key pair by the master station;

the first processing unit is used for verifying the correctness of the first private information, generating a first random number through the random number generating unit after verification is passed, performing key negotiation operation on the first random number by utilizing a symmetric encryption algorithm to generate a first session key, encrypting the first session key and the ID of the master station by utilizing a private key in an asymmetric key pair to generate second private information, and combining the first random number and the second private information to generate a first response message;

The first sending unit is configured to send the first response message to the master station, so that the master station performs a key negotiation operation on the first random number based on a symmetric encryption algorithm to generate a second session key, and stores the first session key after determining that the second session key is the same as the first session key, so as to complete session key negotiation.

12. A computer readable storage medium for storing a computer program which, when executed by a processor, implements the method of any one of claims 1 to 5 or the method of any one of claims 6 to 9.