HK1234924B - Key generation method and device - Google Patents

Description

Key generation method and device

Technical Field

The present application relates to the field of network security technology, and in particular to a key generation method and device.

Background Art

In order to ensure the secure transmission of data between terminal devices and gateway devices, and between gateway devices and public network servers, secure transmission channels are usually established between terminal devices and gateway devices, and between gateway devices and public network servers respectively. The gateway device forwards data from one secure channel to another secure channel, thereby realizing the function of data forwarding. In the process of forwarding data, the gateway device needs to use the shared key with the terminal device to decrypt the data encrypted by the terminal device, and then encrypt it with the shared key with the server and forward it to the server. Therefore, there is a risk of data leakage in the gateway device.

Summary of the Invention

In view of this, the present application provides a new technical solution that can prevent the gateway device from obtaining the shared key between the two devices, thereby reducing the risk of data being illegally intercepted during network transmission.

To achieve the above objectives, this application provides the following technical solutions:

According to a first aspect of the present application, a key generation method is proposed, which is applied on a first device and includes:

Encrypting a first key factor generated by the first device using an initial key and sending the encrypted key factor to the second device through a first secure channel, wherein the initial key is a key preset between the first device and the second device;

receiving, through the first secure channel, a second key factor encrypted by the initial key, wherein the second key factor is generated by the second device;

decrypting the second key factor encrypted with the initial key and received through the first secure channel to obtain the second key factor;

A shared key between the first device and the second device is generated according to the first key factor and the second key factor.

According to a second aspect of the present application, a key generation method is proposed, which is applied on a second device and includes:

receiving, through a second secure channel, a first key factor encrypted by an initial key from a first device, wherein the initial key is a key preset between the first device and the second device;

decrypting the first key factor encrypted by the initial key to obtain the first encryption factor;

A shared key between the first device and the second device is generated according to the first key factor and a second key factor generated by the second device.

According to a third aspect of the present application, a key generation apparatus is provided, which is applied to a first device and includes:

a first encryption module, configured to encrypt a first key factor generated by the first device using an initial key, and send the encrypted key factor to the second device through a first secure channel, wherein the initial key is a key preset between the first device and the second device;

a first receiving module, configured to receive, through the first secure channel, a second key factor encrypted by the initial key, wherein the second key factor is generated by the second device;

a first decryption module, configured to decrypt the second key factor encrypted with the initial key and received by the first receiving module through the first secure channel to obtain the second key factor;

The first key generation module is configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor obtained by decryption by the first decryption module.

According to a fourth aspect of the present application, a key generation device is provided, which is applied on a second device and includes:

a third receiving module, configured to receive, from the first device through the second secure channel, a first key factor encrypted with an initial key, wherein the initial key is a key preset between the first device and the second device;

a third decryption module, configured to decrypt the first key factor encrypted by the initial key to obtain the first encryption factor;

The second key generation module is configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor generated by the second device.

It can be seen from the above technical solution that since the first key factor and the second key factor are both encrypted with the initial key during the forwarding process of the gateway device, and the initial key is the preset key between the first device and the second device, the gateway device cannot obtain the first key factor and the second key factor; the shared key between the first device and the second device is generated by the first key factor and the second key factor, so that the final negotiated shared key is only known to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, so it can ensure that data is transmitted more securely between the first device and the second device, and further reduce the risk of data being illegally intercepted during transmission.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 shows a schematic flow chart of a key generation method according to an exemplary embodiment 1 of the present invention;

FIG2 shows a schematic flow chart of a key generation method according to a second exemplary embodiment of the present invention;

FIG3 shows a schematic flow chart of a key generation method according to a third exemplary embodiment of the present invention;

FIG4 shows a schematic flow chart of a key generation method according to a fourth exemplary embodiment of the present invention;

FIG5 shows a schematic flow chart of a key generation method according to a fifth exemplary embodiment of the present invention;

FIG6 shows a schematic flow chart of a key generation method according to a sixth exemplary embodiment of the present invention;

FIG7 shows a schematic flow chart of a key generation method according to a seventh exemplary embodiment of the present invention;

FIG8 shows a schematic diagram of signaling for key negotiation between a terminal device and a server according to an exemplary embodiment of the present invention;

FIG9 shows a schematic diagram of signaling for data transmission between a terminal device and a server according to an exemplary embodiment of the present invention;

FIG10 shows a schematic structural diagram of a terminal device according to an exemplary embodiment of the present invention;

FIG11 shows a schematic structural diagram of a server according to an exemplary embodiment of the present invention;

FIG12 shows a schematic structural diagram of a key generation device according to an exemplary embodiment of the present invention;

FIG13 shows a schematic structural diagram of a key generation device according to another exemplary embodiment of the present invention;

FIG14 shows a schematic structural diagram of a key generation device according to yet another exemplary embodiment of the present invention;

FIG15 shows a schematic structural diagram of a key generation device according to another exemplary embodiment of the present invention.

DETAILED DESCRIPTION

Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

To further illustrate this application, the following examples are provided:

According to one embodiment of the present application, since the first key factor and the second key factor are both encrypted with the initial key during the forwarding process of the gateway device, and the initial key is a preset key between the first device and the second device, the gateway device cannot obtain the first key factor and the second key factor; the shared key between the first device and the second device is generated by the first key factor and the second key factor, so that the final negotiated shared key is only known to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, thereby ensuring that data is transmitted more securely between the first device and the second device, further reducing the risk of data being illegally intercepted during transmission.

FIG1 shows a flow chart of a key generation method according to an exemplary embodiment 1 of the present invention. In one embodiment, the first device may be a terminal device, and the second device may be a server. Alternatively, the first device may be a server, and the second device may be a terminal device. This embodiment is described by taking application on a terminal device as an example. As shown in FIG1 , the key generation method includes the following steps:

Step 101: Encrypt a first key factor generated by a first device using an initial key and send the encrypted key to a second device via a first secure channel. The initial key is a key preset between the first device and the second device.

Step 102: Receive a second key factor encrypted with an initial key through a first secure channel, wherein the second key factor is generated by a second device;

Step 103: decrypt the second key factor encrypted with the initial key and received through the first secure channel to obtain the second key factor;

Step 104: Generate a shared key between the first device and the second device based on the first key factor and the second key factor.

In step 101, in one embodiment, the initial key K _basic can be issued in advance by the second device to the first device before the first device is put into use, and can _be issued to the first device by hardware writing. In one embodiment, the first device and the second device forward relevant data information through a gateway device, wherein a first secure channel can be established by negotiation between the first device and the gateway device, and relevant data information is transmitted through the first secure channel, and a second secure channel can be established by negotiation between the server and the gateway device, and relevant data information is transmitted through the second secure channel. It will be understood by those skilled in the art that the establishment process of the first secure channel and the second secure channel can refer to the relevant description of the prior art. For example, the key negotiation mechanism of the Secure Sockets Layer (SSL) or the Transport Layer Security (TLS) protocol can be adopted.

In one embodiment, when a first device needs to initiate a key negotiation process with a second device, it generates a first key factor using a pseudorandom function, encrypts the first key factor using an initial key, and then encrypts the first key factor using a first encryption key of a first secure channel to obtain a second encrypted first key factor. By doubly encrypting the first key factor, the first key factor is rendered unknown at the gateway device, thereby reducing the risk of the first key factor being illegally intercepted at the gateway device.

In step 103, the doubly encrypted second key factor is decrypted using the first encryption key to obtain the first decrypted second key factor. The first decrypted second key factor is then decrypted using the initial key to obtain the second key factor. Because the second key factor has been doubly encrypted at the second device, it is unknown at the gateway device, thus reducing the risk of the second key factor being illegally intercepted at the gateway device.

A detailed description of how to generate a shared key between the first device and the second device according to the first key factor and the second key factor in step 104 is provided below and will not be described in detail here.

From the above description, it can be seen that since the first key factor and the second key factor are both encrypted with the initial key during the forwarding process of the gateway device, and the initial key is the preset key between the first device and the second device, the gateway device cannot obtain the first key factor and the second key factor; by generating the shared key between the first device and the second device through the first key factor and the second key factor, the final negotiated shared key can be known only to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, so it can ensure that data is transmitted more securely between the first device and the second device, and further reduce the risk of data being illegally intercepted during transmission.

FIG2 is a flow chart of a key generation method according to a second exemplary embodiment of the present invention. This embodiment uses step 105 in the embodiment shown in FIG1 as an example to illustrate how a shared key between a first device and a second device is generated using a first key factor and a second key factor. As shown in FIG2 , the key generation method includes the following steps:

Step 201: Determine an initial key shared between a first device and a second device and a device identifier of the first device;

Step 202: Concatenate the initial key, the device identifier, the first key factor, and the second key factor in sequence to obtain a combined string;

Step 203, dividing the combined string into two sub-strings of equal length;

Step 204: performing hash operations on the two substrings respectively to obtain two hash results;

Step 205: Perform a bitwise XOR operation on the two hash results to obtain a shared key between the first device and the second device.

After the first device obtains the second key factor through step 104 in the embodiment shown in FIG1 , the first device now has the first key factor p and the second key factor q. The first device can use the first key factor and the second key factor as inputs and utilize a shared key generation algorithm to obtain the key K _AC . The key generation algorithm is as follows:

K _AC =KeyGenerate(K _basic , "Shared Key", p, q);

Among them, K _basic is the initial key, Shared Key is the device identifier of the first device, and the device identifier can be the device serial number of the first device, or the MAC address, or a combination of the above two, etc., as long as the second device can distinguish the first device from other devices through the device identifier.

In addition, when generating the shared key through the function KeyGenerate, the strings corresponding to the first encryption key K _basic , "Shared Key", p, q may be sequentially connected to obtain a combined string, which is then used to generate the shared key K _AC using the function KeyGenerate.

In one embodiment, the process implemented by the function KeyGenerate may specifically be: dividing the input composite string into two substrings of equal length (if the length of the composite string is an odd number, the last bit of the composite string is padded with 1), then performing a hash operation (e.g., MD5) on each of the two substrings, and performing a bitwise XOR operation on the two calculation results to obtain the shared key K _AC .

Taking MD5 as an example, since MD5 can convert input of any length into a 128-bit result, the shared key K _AC is 128 bits long, simplifying the complexity of the shared key calculation. Since MD5 is used to calculate the shared key K _AC , the computational complexity is manageable for the first device with limited computing power.

In this embodiment, a shared key K _AC is generated using the first key factor, the second key factor, the initial key, and the device identifier of the first device. This ensures that the shared key K _AC is shared between the first device and the second device through secure negotiation, and that the shared key K _AC is unknown to the gateway device serving as an intermediate node. This ensures that the first device can use the shared key K _AC to encrypt data sent to the second device, thereby ensuring the security of the data during network transmission.

FIG3 shows a schematic flow chart of a key generation method according to a third exemplary embodiment of the present invention. Based on the above embodiment, as shown in FIG3 , the key generation method includes the following steps:

Step 301: Determine a replacement period for a shared key between a first device and a second device;

Step 302: re-determine the first encryption factor and the second encryption factor according to the replacement cycle;

Step 303: Replace the shared key between the first device and the second device according to the newly determined first encryption factor and second encryption factor.

In one embodiment, the first device and the second device may agree on a replacement cycle for the shared key K _AC . When the shared key K _AC has been used for a period corresponding to the replacement cycle, the first device and the second device re-initiate a process for generating the shared key K _AC , thereby further ensuring the security of the shared key K _AC and data during network transmission, and further reducing the possibility of the shared key K _AC being cracked.

FIG4 is a flow chart of a key generation method according to a fourth exemplary embodiment of the present invention. After a shared key is generated in the embodiment shown in FIG1 , data to be transmitted by the first device can be encrypted using the shared key and transmitted to the second device. As shown in FIG4 , the process of encrypting and transmitting the data to be transmitted includes the following steps:

Step 401: Determine data to be transmitted that a first device needs to send to a second device;

Step 402: Encrypt the data to be transmitted using the shared key and send it to the second device through the first secure channel;

Step 403: receiving, through the first security channel, response data generated by the second device after receiving the data to be transmitted, where the response data has been encrypted using the shared key;

Step 404: Decrypt the response data encrypted by the shared key using the shared key to obtain the response data.

In step 401, the data to be transmitted may be IoT data acquired by a sensor on the first device.

The relevant description of the first security channel in step 402 and step 403 can be found in the relevant description of the embodiment shown in Figure 1 above, and will not be described in detail here.

In step 404, when the response data encrypted by the shared key is received through the first secure channel, the response data encrypted by the shared key can be first decrypted using the first encryption key of the first secure channel, and then the response data can be decrypted a second time using the shared key to obtain the original response data.

In this embodiment, since the data to be transmitted is encrypted with a shared key during the forwarding process of the gateway device, and the shared key is a key jointly negotiated between the first device and the second device, the gateway device cannot obtain the shared key. Therefore, it can ensure that the data to be transmitted is transmitted more securely between the first device and the second device, further reducing the risk of data being illegally intercepted during the transmission process.

FIG5 shows a flowchart of a key generation method according to a fifth exemplary embodiment of the present invention. In this embodiment, the first device may be a terminal device, and the second device may be a server. This embodiment may be applied to the second device. As shown in FIG5 , the key generation method includes the following steps:

Step 501: Receive a first key factor encrypted with an initial key from a first device via a second secure channel, where the initial key is a key preset between the first device and the second device.

Step 502: decrypt the first key factor encrypted with the initial key to obtain a first encryption factor;

Step 503: Generate a shared key between the first device and the second device based on the first key factor and the second key factor generated by the second device.

For the relevant description of the second security channel in step 501, please refer to the relevant description of the embodiment shown in Figure 1 above, which will not be described in detail here.

In step 502, after receiving the first key factor encrypted with the initial key through the second secure channel, the first key factor encrypted with the initial key can be decrypted first using the second encryption key of the second secure channel, and then the first key factor can be decrypted a second time using the initial key to obtain the original first key factor.

A detailed description of how to generate a shared key between the first device and the second device according to the first key factor and the second key factor in step 503 can be found in the description of the embodiment shown in FIG. 2 , and will not be described in detail here.

From the above description, it can be seen that since the first key factor and the second key factor are both encrypted with the initial key during the forwarding process of the gateway device, and the initial key is the preset key between the first device and the second device, the gateway device cannot obtain the first key factor and the second key factor; by generating the shared key between the first device and the second device through the first key factor and the second key factor, the final negotiated shared key can be known only to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, so it can ensure that data is transmitted more securely between the first device and the second device, and further reduce the risk of data being illegally intercepted during transmission.

FIG6 shows a flow chart of a key generation method according to a sixth exemplary embodiment of the present invention. As shown in FIG6 , the key generation method includes the following steps:

Step 601: Encrypt a second key factor generated by a second device using an initial key;

Step 602: Send the second key factor encrypted with the initial key to the first device through the second secure channel.

In this embodiment, the second encryption key of the second security channel is used to encrypt the second key factor after the initial key encryption for the second time, so that the second key factor is unknown to the gateway device when it is forwarded via the gateway device during the process of being sent to the first device, avoiding the risk of the second key factor being illegally intercepted on the gateway device side.

FIG7 shows a flow chart of a key generation method according to a seventh exemplary embodiment of the present invention. As shown in FIG7 , the key generation method includes the following steps:

Step 701: receiving data to be transmitted encrypted with a shared key from a first device through a second secure channel;

Step 702: Decrypt the data to be transmitted using the shared key;

Step 703, after receiving the data to be transmitted, generating response data;

Step 704: Encrypt the response data using the shared key;

Step 705: Send response data encrypted with the shared key to the first device through the second secure channel.

For the description of the second secure channel in step 701 , please refer to the description of the embodiment shown in FIG1 , which will not be described in detail here.

In step 704, after receiving the data to be transmitted from the first device through the second secure channel, the data to be transmitted is decrypted using the shared key to obtain the original data. When a response to the first device is required, the response data encrypted by the shared key can be first encrypted using the second encryption key of the second secure channel, so that the gateway device cannot obtain the original response data during the process of forwarding the response data.

In this embodiment, since the data to be transmitted is encrypted with a shared key during the forwarding process of the gateway device, and the shared key is a key jointly negotiated between the first device and the second device, the gateway device cannot obtain the shared key. Therefore, it can ensure that the data to be transmitted is transmitted more securely between the first device and the second device, further reducing the risk of data being illegally intercepted during the transmission process.

Through the above embodiment, based on the initial key preset between the first device and the second device, a shared key can be generated by a key generation algorithm in their respective local locations, and finally the shared key is used to encrypt the data to be transmitted, so that the gateway device cannot view the original data when forwarding data in the network, thereby achieving the purpose of secure data transmission.

FIG8 shows a signaling diagram of key negotiation between a terminal device and a server according to an exemplary embodiment of the present invention. A first device is a terminal device, and a second device is a server. Before the terminal device accesses the network, the server needs to pre-issue an initial key (K basic ) to the terminal device. The initial key (K _basic ) may be issued to the terminal device by hardware writing or other methods. As shown in FIG8 , key negotiation between the terminal device and the server includes the following steps:

In step 801, the terminal device negotiates with the gateway device about a first encryption key (K _AB ) of a first security channel and establishes a first security channel between the terminal device and the gateway device. The method for establishing the first security channel can be found in the related description of the prior art.

In step 802, the gateway device negotiates with the server for a second encryption key (K _BC ) for the second secure channel and establishes the second secure channel. Similar to step 801, the process for establishing the second secure channel can be found in the relevant descriptions of the prior art, and key negotiation mechanisms such as SSL and TLS can also be employed. Those skilled in the art will appreciate that the order of steps 801 and 802 is interchangeable and can be set based on actual execution requirements.

In step 803, the terminal device prepares to initiate a key negotiation process with the server. The terminal device generates a first key factor (p), which is used to generate a shared key between the terminal device and the server. Simultaneously, the terminal device encrypts the first key factor using the initial key (K _basic ) to obtain K _basic (p), which is then encrypted using the first encryption key K _AB to obtain K _AB [K _basic (p)].

Step 804: The terminal device sends the doubly encrypted first key factor K _AB [K _basic (p)] to the gateway device through the first secure channel.

In step 805, after receiving the doubly encrypted first key factor K _AB [K _basic (p)], the gateway device uses the first encryption key K _AB of the first security channel to decrypt the doubly encrypted first key factor K _AB [K _basic (p)] to obtain K _basic (p), and then uses the third encryption key K _BC of the second security channel to encrypt it to obtain the doubly encrypted K _BC [K _basic (p)].

Step 806: Send the first key factor K _BC [K _basic (p)] doubly encrypted by the initial key and the second encryption key to the server through the second secure channel.

In step 807, after receiving the doubly encrypted first key factor, the server uses the second encryption key K _BC of the second secure channel to decrypt the doubly encrypted first key factor to obtain K _basic (p), and then uses the initial key K _basic to decrypt K _basic (p) to obtain the first key factor p.

Step 808: The server generates a second key factor (q) through a pseudo-random function. The second key factor q and the first key factor p are used as parameters to generate a shared key K _AC .

In step 809, the server encrypts the second encryption factor q using the initial key K _basic to obtain K _basic (q), and then encrypts K _basic (q) using the second encryption key K _BC to obtain K _BC [K _basic (q)].

Step 810: The server sends the doubly encrypted second key factor K _BC [K _basic (q)] to the gateway device through the second secure channel.

In step 811, after receiving the doubly encrypted second key factor K _BC [K _basic (q)], the gateway device uses the second encryption key K _BC of the second security channel to decrypt the doubly encrypted second encryption factor to obtain K _basic (q), and then uses the first encryption key K _AB of the first security channel to encrypt it to obtain K _AB [K _basic (q)]. The doubly encrypted second encryption factor is then sent to the terminal device through the first security channel.

In step 812, after receiving the doubly encrypted second encryption factor, the terminal device uses the first encryption key K _AB of the first secure channel to decrypt the doubly encrypted second encryption factor to obtain K _basic (q), and then uses the first encryption key K _basic to perform a second decryption on the K _basic (q) after the first decryption to obtain the second key factor q.

In step 813, the terminal device and the server share a first key factor p and a second key factor q. Each of the terminal device and the server uses the first key factor and the second key factor as inputs and employs a key generation algorithm to obtain a shared key K _AC between the terminal device and the server. A detailed description of the key generation algorithm can be found in the description of the embodiment shown in FIG. 2 , and is not further elaborated here.

In this embodiment, the shared key K _AC is securely negotiated and shared between the terminal device and the public network server, and the shared key is unknown to the gateway device serving as the intermediate node. The terminal device can then use the shared key to encrypt the IoT data sent to the public network server, thereby ensuring the security of data transmission.

In order to further ensure the security of the shared key and data transmission, the terminal device may periodically perform a key negotiation process with the server to replace the shared key K _AC , thereby further reducing the possibility of the shared key being cracked.

FIG9 is a flow chart of a data transmission method according to a first exemplary embodiment of the present invention. After a shared key is generated through the embodiment shown in FIG8 , if a terminal device needs to send IoT data to a server, the data transmission method includes the following steps, as shown in FIG9 :

Step 901: Use the shared key K _AC to encrypt IoT data once to obtain ciphertext K _AC (data), and then use the first encryption key K _AB of the first secure channel to encrypt it again to obtain ciphertext K _AB [K _AC (data)].

Step 902: The terminal device sends a ciphertext K _AB [K _AC (data)] to the gateway device through the first secure channel.

In step 903, after receiving the ciphertext K _AB [K _AC (data)], the gateway device decrypts it using the first security key K _AB to obtain K _AC (data), and then encrypts it using the second encryption key K _BC to obtain the ciphertext K _BC [K _AC (data)].

Step 904: The gateway device sends the ciphertext K _BC [K _AC (data)] to the server through the second secure channel.

In step 905, after receiving the double-encrypted ciphertext K _BC [K _AC (data)], the server decrypts it using the second encryption key K _BC to obtain K _AC (data), and then decrypts it using the shared key K _AC to obtain the original IoT data data.

In step 906, after receiving the original IoT data, the server generates response data (res), encrypts the response data using the shared key K _AC to obtain ciphertext K _AC (res), and then uses the second encryption key K _BC to perform secondary encryption to obtain K _BC [K _AC (res)].

Step 907: The server sends the double-encrypted ciphertext K _BC [K _AC (res)] to the gateway device through the second secure channel.

In step 908, after receiving the double-encrypted ciphertext K _BC [K _AC (res)], the gateway device decrypts it using the second encryption key K _BC to obtain K _AC (res), and then encrypts it using the first encryption key K _AB to obtain the ciphertext K _AB [K _AC (res)].

Step 909: The gateway device sends the double-encrypted ciphertext K _AB [K _AC (res)] to the terminal device through the first secure channel.

In step 910, after receiving the double-encrypted ciphertext K _AB [K _AC (res]), the terminal device decrypts it using the first encryption key K _AB to obtain K _AC (res), and then decrypts it using the shared key K _AC to obtain the original response data (res).

In this embodiment, cross-domain key negotiation and sharing between the terminal device and the server through the gateway device of the intermediate node is realized. The shared key is unknown to the gateway device, ensuring the end-to-end secure transmission of IoT data between the terminal device and the server. In addition, in addition to ensuring the secure transmission of data between the terminal device and the gateway device and the secure transmission of data between the gateway device and the public network server, the data forwarding process within the gateway device on the transmission path is also securely protected. Even if the gateway device is illegally invaded, the IoT data forwarded through the gateway device is still protected by being encrypted with the shared key, preventing the IoT data from being illegally intercepted.

Corresponding to the above-mentioned key generation method, the present application also proposes a schematic structural diagram of a terminal device according to an exemplary embodiment of the present application as shown in FIG10. Please refer to FIG10. At the hardware level, the network server includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a key generation device at the logical level. Of course, in addition to software implementation, the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

Corresponding to the above-mentioned key generation method, the present application also proposes a schematic structural diagram of a server according to an exemplary embodiment of the present application as shown in FIG11. Please refer to FIG11. At the hardware level, the network server includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a key generation device at the logical level. Of course, in addition to software implementation, the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

FIG12 shows a schematic structural diagram of a key generation device according to an exemplary embodiment of the present invention; as shown in FIG12 , the key generation device may include: a first encryption module 1201, a first receiving module 1202, a first decryption module 1203, and a first key generation module 1204. In particular:

A first encryption module 1201 is configured to encrypt a first key factor generated by the first device using an initial key, and send the encrypted key factor to the second device through a first secure channel. The initial key is a key preset between the first device and the second device.

A first receiving module 1202 is configured to receive, through a first secure channel, a second key factor encrypted with an initial key, where the second key factor is generated by a second device;

The first decryption module 1203 is configured to decrypt the second key factor encrypted with the initial key and received by the first receiving module 1202 through the first secure channel to obtain the second key factor;

The first key generation module 1204 is configured to generate a shared key between the first device and the second device according to the first key factor and the second key factor decrypted by the first decryption module 1203 .

FIG13 shows a schematic structural diagram of a key generation device according to another exemplary embodiment of the present invention. As shown in FIG13 , based on the embodiment shown in FIG12 , the first encryption module 1201 may include:

A first factor generation unit 12011 is configured to generate a first key factor by using a pseudo-random function when the first device needs to initiate a key negotiation process with the second device;

The first encryption unit 12012 is configured to encrypt the first key factor generated by the first factor generation unit 12011 using the initial key to obtain the first key factor after the first encryption;

The second encryption unit 12013 is used to encrypt the first key factor encrypted for the first time by the first encryption unit 12012 using the first encryption key of the first security channel to obtain the first key factor encrypted for the second time.

In one embodiment, the first decryption module 1203 includes:

A first decryption unit 12031 is configured to decrypt the doubly encrypted second key factor using the first encryption key to obtain the first decrypted second key factor;

The second encryption unit 12032 is used to decrypt the second key factor after the first decryption by the first decryption unit 12031 using the initial key to obtain the second key factor.

In one embodiment, the first key generation module 1204 may include:

A first determining unit 12041 is configured to determine a first encryption key shared between the first device and the second device and a device identifier of the first device;

The first factor generation unit 12042 is configured to generate a shared key between the first device and the second device according to the first encryption key, the device identifier determined by the first determination unit 12041 , the first key factor, and the second key factor obtained by the first decryption module 1203 .

In one embodiment, the first factor generation unit is specifically configured to:

Concatenate the first encryption key, the device identifier, the first key factor, and the second key factor in sequence to obtain a combined string;

Split the combined string into two substrings of equal length;

Perform hash operations on the two substrings respectively to obtain two hash results;

The two hash results are subjected to a bitwise exclusive-OR operation to obtain a shared key between the first device and the second device.

In one embodiment, the apparatus may further include:

A first determining module 1205 is configured to determine a replacement period for a shared key between the first device and the second device;

A second determining module 1206 is configured to redetermine the first encryption factor and the second encryption factor according to the replacement period determined by the first determining module 1205;

The first replacing module 1207 is configured to replace the shared key between the first device and the second device according to the first encryption factor and the second encryption factor re-determined by the second determining module 1206 .

In one embodiment, the apparatus may further include:

A third determining module 1208 is configured to determine data to be transmitted that the first device needs to send to the second device;

The data encryption module 1209 is configured to encrypt the data to be transmitted determined by the third determination module 1208 using a shared key, and send the encrypted data to the second device through the first secure channel.

In one embodiment, the apparatus may further include:

The second receiving module 1210 is configured to receive, through the first security channel, response data generated by the second device after receiving the data to be transmitted, where the response data has been encrypted using the shared key;

The second decryption module 1211 is configured to use the shared key to decrypt the response data encrypted by the shared key to obtain the response data.

FIG14 shows a schematic structural diagram of a key generation device according to another exemplary embodiment of the present invention; as shown in FIG14 , the key generation device may include: a third receiving module 1401, a third decryption module 1402, and a second key generation module 1403. Wherein:

The third receiving module 1401 is configured to receive, from the first device through the second secure channel, a first key factor encrypted with an initial key, where the initial key is a key preset between the first device and the second device;

A third decryption module 1402 is configured to decrypt the first key factor encrypted with the initial key to obtain a first encryption factor;

The second key generation module 1403 is used to generate a shared key between the first device and the second device based on the first key factor and the second key factor generated by the second device.

FIG15 shows a schematic structural diagram of a key generation device according to another exemplary embodiment of the present invention. As shown in FIG15 , based on the embodiment shown in FIG14 , the second key generation module 1403 is specifically configured to:

Concatenate the first encryption key, the device identifier of the first device, the first key factor, and the second key factor in sequence to obtain a combined string;

Split the combined string into two substrings of equal length;

Perform hash operations on the two substrings respectively to obtain two hash results;

The two hash results are subjected to a bitwise exclusive-OR operation to obtain a shared key between the first device and the second device.

In one embodiment, the apparatus may further include:

A second encryption module 1404 is configured to encrypt a second key factor generated by the second device using the initial key;

The first sending module 1405 is configured to send the second key factor encrypted with the initial key to the first device through the second secure channel.

In one embodiment, the apparatus may further include:

A third determining module 1406 is configured to determine a replacement period for a shared key between the first device and the second device;

A fourth determining module 1407 is configured to re-determine the first encryption factor and the second encryption factor according to a replacement cycle;

The second replacement module 1408 is configured to replace the shared key between the first device and the second device according to the re-determined first encryption factor and second encryption factor.

In one embodiment, the apparatus may further include:

A fourth receiving module 1409 is configured to receive data to be transmitted encrypted with the shared key from the first device through the second secure channel;

The fourth decryption module 1410 is configured to decrypt the data to be transmitted using the shared key.

In one embodiment, the apparatus may further include:

The response data generating module 1411 is configured to generate response data after receiving the data to be transmitted;

The third encryption module 1412 is used to encrypt the response data using the shared key;

The second sending module 1413 is configured to send response data encrypted with the shared key to the first device through the second secure channel.

It can be seen from the above embodiment that since the first key factor and the second key factor are both encrypted with the initial key during the forwarding process of the gateway device, and the initial key is the preset key between the first device and the second device, the gateway device cannot obtain the first key factor and the second key factor; the shared key between the first device and the second device is generated by the first key factor and the second key factor, so that the final negotiated shared key is only known to the first device and the second device, and the gateway device still cannot obtain the negotiated shared key, thereby ensuring that data is transmitted more securely between the first device and the second device, and further reducing the risk of data being illegally intercepted during transmission.

Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims (24)

1. A cross-domain data transmission method, applied to a first device in a first domain, characterized in that it includes: Before data transmission, the gateway device negotiates a shared key with the second device in the second network domain; After negotiating the shared key, the data is encrypted using the shared key, and the encrypted data is then re-encrypted using a first encryption key before being sent to the gateway device. The gateway device then uses the first encryption key to decrypt the re-encrypted data, restoring the data encrypted with the shared key. Finally, it re-encrypts the data encrypted with the shared key using a second encryption key before forwarding it to the second device. The first encryption key is the transmission key corresponding to the first secure channel between the first device and the gateway device; the second encryption key is the transmission key corresponding to the second secure channel between the second device and the gateway device. Negotiating the shared key between the gateway device and the second device within the second network domain includes: The first key factor generated by the first device is encrypted using an initial key and sent to the gateway device through a first secure channel. The gateway device then sends the encrypted key to the second device through a second secure channel. The initial key is a preset key between the first device and the second device. The second key factor, encrypted with the initial key, is received by the gateway device through the first secure channel. The second key factor is generated by the second device and sent to the gateway device through the second secure channel. The second key factor, which is encrypted with the initial key and received through the first secure channel, is decrypted to obtain the second key factor. A shared key between the first device and the second device is generated based on the first key factor and the second key factor. 2. The method according to claim 1, wherein encrypting the first key factor generated by the first device using an initial key comprises: When the first device needs to initiate a key negotiation process with the second device, a first key factor is generated through a pseudo-random function. The first key factor is encrypted using the initial key to obtain the first encrypted first key factor; The first key factor after the first encryption is encrypted using the first encryption key of the first secure channel to obtain the first key factor after the second encryption. 3. The method according to claim 1, wherein decrypting the second key factor received through the first secure channel and encrypted by the first encryption key comprises: The first encryption key is used to decrypt the second key factor that has been double-encrypted, to obtain the second key factor after the first decryption. The second key factor is obtained by decrypting the first decryption using the initial key. 4. The method according to claim 1, wherein generating a shared key between the first device and the second device based on the first key factor and the second key factor comprises: Determine the initial key shared between the first device and the second device, and the device identifier of the first device; A shared key between the first device and the second device is generated based on the initial key, the device identifier, the first key factor, and the second key factor. 5. The method according to claim 4, wherein generating a shared key between the first device and the second device based on the device identifier, the first encryption key, the first key factor, and the second key factor comprises: The first encryption key, the device identifier, the first key factor, and the second key factor are concatenated sequentially to obtain a combined string; The combined string is divided into two substrings of equal length; Perform hash operations on the two substrings respectively to obtain two hash results; The two hash results are XORed bitwise to obtain the shared key between the first device and the second device. 6. The method according to claim 1, characterized in that the method further comprises: Determine the replacement cycle of the shared key between the first device and the second device; The first encryption factor and the second encryption factor are re-determined according to the replacement cycle; The shared key between the first device and the second device is replaced based on the redefined first encryption factor and second encryption factor. 7. The method according to claim 1, characterized in that the method further comprises: The response data generated by the second device upon receiving the data is received through the first secure channel, and the response data has been encrypted using the shared key. The response data, which has been encrypted with the shared key, is decrypted using the shared key to obtain the response data. 8. A cross-domain data transmission method, applied to a second device in a second domain, characterized in that it includes: Before data transmission, the gateway device negotiates a shared key with the first device in the first network domain; After agreeing on the shared key, the system receives data forwarded by the gateway device, decrypts the received data using the second encryption key, and then decrypts the decrypted data a second time using the shared key. The data forwarded by the gateway device is obtained through the following method: The first device encrypts data using the shared key, and then re-encrypts the encrypted data using the first encryption key before sending it to the gateway device. The gateway device decrypts the re-encrypted data using the first encryption key to restore the data encrypted with the shared key, and then re-encrypts the data encrypted with the shared key using the second encryption key before forwarding it to the second device. The first encryption key is the transmission key corresponding to the first secure channel between the first device and the gateway device; the second encryption key is the transmission key corresponding to the second secure channel between the second device and the gateway device. The negotiation of the shared key between the gateway device and the first device within the first network domain includes: The first key factor, encrypted with an initial key, is received from the gateway device via a second secure channel. The initial key is a preset key between the first device and the second device. The second secure channel is a secure transmission channel established between the second device and the gateway device. The first key factor is sent from the first device to the gateway device via the first secure channel. Decrypt the first key factor that has been encrypted with the initial key to obtain the first encryption factor; A shared key between the first device and the second device is generated based on the first key factor and the second key factor generated by the second device. 9. The method according to claim 8, wherein generating a shared key between the first device and the second device based on the first key factor and the second key factor generated by the second device comprises: The first encryption key, the device identifier of the first device, the first key factor, and the second key factor are concatenated sequentially to obtain a combined string. The combined string is divided into two substrings of equal length; Perform hash operations on the two substrings respectively to obtain two hash results; The two hash results are XORed bitwise to obtain the shared key between the first device and the second device. 10. The method according to claim 8, wherein the method further comprises: The initial key is used to encrypt the second key factor generated by the second device; The second key factor, encrypted with the initial key, is sent to the first device through the second secure channel. 11. The method according to claim 8, wherein the method further comprises: Determine the replacement cycle of the shared key between the first device and the second device; The first encryption factor and the second encryption factor are re-determined according to the replacement cycle; The shared key between the first device and the second device is replaced based on the redefined first encryption factor and second encryption factor. 12. The method according to claim 8, wherein the method further comprises: After receiving the data to be transmitted, generate response data; The response data is encrypted using the shared key; The response data, encrypted with the shared key, is sent to the first device through the second secure channel. 13. A cross-domain data transmission device, applied to a first device in a first domain, characterized in that it comprises: The key negotiation module is used to negotiate a shared key with a second device in the second network domain before data transmission; A data transmission module is used to encrypt data using the shared key after the shared key has been negotiated, and then encrypt the encrypted data a second time using a first encryption key before sending it to the gateway device. The gateway device then uses the first encryption key to decrypt the second-encrypted data, restoring the data encrypted with the shared key. Finally, it uses a second encryption key to encrypt the data encrypted with the shared key again before forwarding it to the second device. The first encryption key is the transmission key corresponding to the first secure channel between the first device and the gateway device; the second encryption key is the transmission key corresponding to the second secure channel between the second device and the gateway device. The key negotiation module includes: The first encryption module is used to encrypt the first key factor generated by the first device using an initial key and send it to the gateway device through a first secure channel, and the gateway device sends it to the second device through a second secure channel, wherein the initial key is a preset key between the first device and the second device; The first receiving module is configured to receive a second key factor encrypted with the initial key sent by the gateway device through the first secure channel, wherein the second key factor is generated by the second device and sent to the gateway device through the second secure channel; The first decryption module is used to decrypt the second key factor, which is encrypted by the initial key and received by the first receiving module through the first secure channel, to obtain the second key factor. The first key generation module is used to generate a shared key between the first device and the second device based on the first key factor and the second key factor obtained by the first decryption module. 14. The apparatus according to claim 13, wherein the first encryption module comprises: The first factor generation unit is used to generate a first key factor through a pseudo-random function when the first device needs to initiate a key negotiation process with the second device. The first encryption unit is used to encrypt the first key factor generated by the first factor generation unit using an initial key to obtain the first encrypted first key factor. The second encryption unit is used to encrypt the first key factor after the first encryption unit has been encrypted for the first time using the first encryption key of the first secure channel, so as to obtain the first key factor after the second encryption. 15. The apparatus according to claim 13, wherein the first decryption module comprises: The first decryption unit is used to decrypt the second key factor that has been double-encrypted using the first encryption key to obtain the second key factor after the first decryption. The second encryption unit is used to decrypt the second key factor after the first decryption unit has decrypted it for the first time using the initial key, so as to obtain the second key factor. 16. The apparatus according to claim 13, wherein the first key generation module comprises: The first determining unit is configured to determine the first encryption key shared between the first device and the second device and the device identifier of the first device; The first factor generation unit is used to generate a shared key between the first device and the second device based on the first encryption key, the device identifier determined by the first determining unit, the first key factor, and the second key factor obtained by the first decryption module. 17. The apparatus according to claim 16, wherein the first factor generation unit is specifically used for: The first encryption key, the device identifier, the first key factor, and the second key factor are concatenated sequentially to obtain a combined string; The combined string is divided into two substrings of equal length; Perform hash operations on the two substrings respectively to obtain two hash results; The two hash results are XORed bitwise to obtain the shared key between the first device and the second device. 18. The apparatus according to claim 13, wherein the apparatus further comprises: The first determining module is used to determine the replacement cycle of the shared key between the first device and the second device; The second determining module is used to re-determine the first encryption factor and the second encryption factor according to the replacement cycle determined by the first determining module; The first replacement module is used to replace the shared key between the first device and the second device according to the first encryption factor and the second encryption factor re-determined by the second determining module. 19. The apparatus according to claim 13, wherein the apparatus further comprises: The second receiving module is configured to receive response data generated by the second device upon receiving data to be transmitted via the first secure receiving method, wherein the response data has been encrypted using the shared key; The second decryption module is used to decrypt the response data encrypted with the shared key using the shared key, so as to obtain the response data. 20. A cross-domain data transmission device, applied to a second device in a second domain, characterized in that it comprises: The key negotiation module is used to negotiate a shared key with the first device in the first network domain using the gateway device before data transmission; The data transmission module is configured to receive data forwarded by the gateway device after the shared key has been negotiated, decrypt the received data using a second encryption key, and then decrypt the decrypted data again using the shared key; wherein the data forwarded by the gateway device is obtained through the following method: The first device encrypts data using the shared key, and then encrypts the encrypted data a second time using the first encryption key before sending it to the gateway device. The gateway device decrypts the second-encrypted data using the first encryption key to restore the data encrypted with the shared key, and then encrypts the data encrypted with the shared key a second time using the second encryption key before forwarding it to the second device. The first encryption key is the transmission key corresponding to the first secure channel between the first device and the gateway device; the second encryption key is the transmission key corresponding to the second secure channel between the second device and the gateway device. The third receiving module is used to receive a first key factor encrypted with an initial key from the first device via the second secure channel. The initial key is a preset key between the first device and the second device, and the first key factor is sent by the first device to the gateway device via the first secure channel. The third decryption module is used to decrypt the first key factor encrypted by the initial key to obtain the first encryption factor; The second key generation module is used to generate a shared key between the first device and the second device based on the first key factor and the second key factor generated by the second device. 21. The apparatus according to claim 20, wherein the second key generation module is specifically used for: The first encryption key, the device identifier of the first device, the first key factor, and the second key factor are concatenated sequentially to obtain a combined string. The combined string is divided into two substrings of equal length; Perform hash operations on the two substrings respectively to obtain two hash results; The two hash results are XORed bitwise to obtain the shared key between the first device and the second device. 22. The apparatus according to claim 20, wherein the apparatus further comprises: The second encryption module is used to encrypt the second key factor generated by the second device using the initial key; The first sending module is used to send the second key factor, which has been encrypted by the initial key, to the first device through the second secure channel. 23. The apparatus according to claim 22, wherein the apparatus further comprises: The third determining module is used to determine the replacement cycle of the shared key between the first device and the second device; The fourth determining module is used to re-determine the first encryption factor and the second encryption factor according to the replacement cycle; The second replacement module is used to replace the shared key between the first device and the second device according to the re-determined first encryption factor and second encryption factor. 24. The apparatus according to claim 20, wherein the apparatus further comprises: The response data generation module is used to generate response data after receiving the data to be transmitted; The third encryption module is used to encrypt the response data using the shared key; The second sending module is used to send response data encrypted with the shared key to the first device through the second secure channel.