CN106549924B - A kind of communication security protection methods, devices and systems - Google Patents

Abstract

The invention discloses a kind of communication security protection methods, devices and systems, wherein the described method includes: terminal generates specific parameter Para according to preset first rule；According to application programming interface key A PI Key, the message Payload and the Para to be transmitted, summary information is generated；According to mark Device ID of the terminal, the Payload, the Para and the summary information, generates the first information and be sent to server；The server obtains the API Key prestored according to the Device ID in the first information；According to the Payload and the Para in API Key prestored, the first information, validation value is calculated；The validation value and the summary information in the first information are compared；When the validation value is matched with the summary information, determine that the authentication is passed for the first information.

Description

A communication security protection method, device and system

technical field

The present invention relates to computer technology, and in particular, to a communication security protection method, device and system.

Background technique

Usually, IoT companies develop open cloud platforms, as shown in Figure 1, third-party applications operate the resources provided by the open cloud platform through http clients; the device implements the RestFUL interface provided by OneNet, and encapsulates business data into the format required by the open platform and transmits it to OneNet for storage. When third-party applications need business data, they can be obtained through the RestFUL interface.

Referring to Figure 2, the platform provides resources such as devices, data streams, data points, triggers, and API keys. The platform can be added, deleted, checked, and modified through the REST API.

Each platform user can create its own device list and set device-related properties; under each device, multiple data streams can be created; a data stream is a certain type of data points stored in chronological order; data points are based on time The stamp is the key, and any json data type is a key-value pair of value; for each data stream, triggers for monitoring data points can be set; the key is used to specify whether the user has the authority to operate related resources, refinement to the data stream level; resource operations are implemented using standard HTTP methods.

According to the specification in the prior art, as shown in FIG. 3 , the API key is placed in the HTTP header information in the format of "api-key:xxxx-ffff-zzzzz" and sent in plain text. According to the design principle, the API key is the key used to identify the identity of the IoT terminal device on the IoT OneNet cloud platform. However, the key is sent in plain text. When the attacker intercepts the relevant message, he can directly parse and obtain the API key, and then the attacker can use the same API key to pretend to be an IoT terminal to send false messages, so that the IoT OneNet cloud platform receives Incorrect feedback or requests.

The traditional solution is to encrypt the API key, but after encryption, it will not solve the problem of device identification, and will face the problem of the message being replayed after being intercepted.

Or the traditional solution is to use the challenge/response process to complete the authentication of the user's identity, and then use the session key generated at the same time to protect the subsequent messages. However, this method will bring extra process and key calculation, which will lead to extra overhead of the device, which is very expensive for the resource-constrained device such as the terminal of the Internet of Things.

SUMMARY OF THE INVENTION

In order to solve the existing technical problems, the embodiments of the present invention provide a communication security protection method, device and system.

An embodiment of the present invention provides a communication security protection method, which is applied to the Internet of Things, and the method includes:

The terminal generates a specific parameter Para according to the preset first rule;

Generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

According to the identification Device ID of the terminal, the Payload, the Para and the digest message, generate first information and send it to the server;

The server obtains a pre-stored API Key according to the Device ID in the first information;

Calculate the verification value according to the pre-stored API Key, the Payload and the Para in the first information;

comparing the verification value with the digest message in the first information;

When the verification value matches the digest message, it is determined that the authentication of the first information is passed.

Wherein, the method also includes:

The server determines whether the Para in the first information satisfies a preset condition;

When the Para does not meet the preset condition, determine that the first information is replayed information;

When the Para meets the preset condition, the step of acquiring the pre-stored API Key according to the Device ID in the first information is performed.

Wherein, the method also includes:

generating, by the terminal, a first random number RAND according to a preset second rule;

Correspondingly, the generating a summary message includes:

Generate a digest message according to the API Key, the message Payload to be delivered, the Para and the RAND;

The generating the first information includes:

generating first information according to the identification Device ID of the terminal, the Payload, the Para, the RAND and the digest message;

The verification value obtained by the calculation includes:

The verification value is calculated and obtained according to the pre-stored API Key, the Payload, the Para and the RAND in the first information.

Wherein, the method also includes:

detecting the state of the terminal;

When the terminal is in the first state, generate a second random parameter KDF_p according to a preset third rule;

Generate a key according to the API Key and the KDF_p;

Correspondingly, the generating a summary message includes:

Generate a digest message according to the key, the message Payload to be delivered, the Para and the KDF_p;

The generating the first information includes:

generating first information according to the identification Device ID of the terminal, the Payload, the Para, the KDF_p and the digest message;

The verification value obtained by the calculation includes:

Generate a verification key according to the pre-stored API Key and the KDF_p;

According to the verification key, the Payload, the Para and the KDF_p in the first information, the verification value is obtained by calculation.

Wherein, the generating a summary message includes:

Digest messages are generated by the HMAC function.

An embodiment of the present invention provides a communication security protection method, which is applied to the Internet of Things, and the method includes:

The terminal generates a specific parameter Para according to the preset first rule;

Generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

According to the identification Device ID of the terminal, the Payload, the Para and the digest message, first information is generated and sent to the server; information is authenticated.

Wherein, the method also includes:

generating, by the terminal, a first random number RAND according to a preset second rule;

Correspondingly, the generating a summary message includes:

Generate a digest message according to the API Key, the message Payload to be delivered, the Para and the RAND;

The generating the first information includes:

Generate first information according to the identification Device ID of the terminal, the Payload, the Para, the RAND and the digest message; so that the server can use the pre-stored API Key, the first information The Payload, the Para and the RAND in , are calculated to obtain a verification value to authenticate the first information.

Wherein, the method also includes:

detecting the state of the terminal;

When the terminal is in the first state, generate a second random parameter KDF_p according to a preset third rule;

Generate a key according to the API Key and the KDF_p;

Correspondingly, the generating a summary message includes:

Generate a digest message according to the key, the message Payload to be delivered, the Para and the KDF_p;

The generating the first information includes:

Generate the first information according to the identification Device ID of the terminal, the Payload, the Para, the KDF_p and the digest message; so that the server can generate the first information according to the pre-stored API Key and the KDF_p A verification key; and a verification value is calculated according to the verification key, the Payload, the Para and the KDF_p in the first information to authenticate the first information.

Another communication security protection method according to an embodiment of the present invention is applied to the Internet of Things, and the method includes:

The server receives the first information sent by the terminal; the first information includes: API Key, a specific parameter Para, the message Payload to be delivered, and a digest message; the parameter Para is generated by the terminal according to a preset first rule , the digest message is generated according to the API Key, the Payload and the Para;

Acquire a pre-stored API Key according to the Device ID in the first information;

Calculate the verification value according to the pre-stored API Key, Payload and Para in the first information;

comparing the verification value with the digest message in the first information;

When the verification value matches the digest message, it is determined that the authentication of the first information is passed.

Wherein, the method also includes:

The server determines whether the Para in the first information satisfies a preset condition;

When the Para does not meet the preset condition, determine that the first information is replayed information;

When the Para meets the preset condition, the step of acquiring the pre-stored API Key according to the Device ID in the first information is performed.

Another communication security protection system according to the embodiment of the present invention is applied to the Internet of Things, and the system includes a terminal and a server:

The terminal is used to generate a specific parameter Para according to the preset first rule; according to the application programming interface key API Key, the message Payload to be delivered and the Para, generate a summary message; according to the identification Device of the terminal ID, the Payload, the Para and the digest message, generate first information and send it to the server;

The server is configured to obtain a pre-stored API Key according to the Device ID in the first information; according to the pre-stored API Key, the Payload and the Para in the first information, the calculation is verified value; compare the verification value with the digest message in the first information; when the verification value matches the digest message, it is determined that the authentication of the first information is passed.

An embodiment of the present invention provides a terminal, which is applied to the Internet of Things, and the terminal includes:

a first generating unit, configured to generate a specific parameter Para according to a preset first rule;

A second generating unit, configured to generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

A third generating unit, configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para and the digest message

A sending unit, configured to send the first information to a server; so that the server authenticates the first information according to the information in the first information.

Wherein, the terminal also includes:

a fourth generating unit, configured to generate a first random number RAND according to a preset second rule;

Correspondingly, the second generating unit is configured to generate a digest message according to the API Key, the message Payload to be delivered, the Para and the RAND;

The third generating unit: configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para, the RAND and the digest message; so that the server can The API Key, the Payload, the Para and the RAND in the first information are calculated to obtain a verification value to authenticate the first information.

Wherein, the terminal also includes:

a detection unit, configured to detect the state of the terminal;

a fifth generating unit, configured to generate a second random parameter KDF_p according to a preset third rule when the terminal is in the first state; generate a key according to the API Key and the KDF_p;

Correspondingly, the second generating unit is configured to generate a digest message according to the key, the message Payload to be delivered, the Para and the KDF_p;

The third generating unit: configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para, the KDF_p and the digest message; so that the server can The API Key and the KDF_p are generated, and the verification key is generated; and the verification value is calculated according to the verification key, the Payload in the first information, the Para and the KDF_p to obtain the verification value for the first information. A message is authenticated.

An embodiment of the present invention provides a server, which is applied to the Internet of Things, and the server includes:

a receiving unit, configured to receive the first information sent by the terminal; the first information includes: API Key, a specific parameter Para, the message Payload to be delivered, and a digest message; the parameter Para is preset by the terminal according to the Generated by the first rule, and the digest message is generated according to the API Key, the Payload, and the Para;

an obtaining unit, configured to obtain a pre-stored API Key according to the Device ID in the first information;

a computing unit, configured to calculate and obtain a verification value according to the pre-stored API Key, Payload and Para in the first information;

a comparison unit, which compares the verification value with the digest message in the first information;

A determining unit, configured to determine that the authentication of the first information is passed when the verification value matches the digest message.

Wherein, the server also includes:

a judging unit for judging whether the Para in the first information satisfies a preset condition;

The determining unit is further configured to determine that the first information is replayed information when the Para does not meet the preset condition; when the Para meets the preset condition, control the acquisition unit to execute the information according to the The operation of acquiring the pre-stored API Key by the Device ID in the first information.

As can be seen from the above, the technical solutions of the embodiments of the present invention include: the terminal generates a specific parameter Para according to a preset first rule; generates a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para ; According to the identification Device ID of the terminal, the Payload, the Para and the summary message, generate the first information and send it to the server; The server obtains the pre-stored data according to the Device ID in the first information API Key; calculate a verification value according to the pre-stored API Key, the Payload and the Para in the first information; compare the verification value with the digest message in the first information ; When the verification value matches the digest message, it is determined that the authentication of the first information is passed. Therefore, the embodiments of the present invention can effectively solve the problem of API key being leaked, and ensure communication security.

Description of drawings

Figure 1 is a schematic diagram of the working principle of the interaction between the cloud platform and third-party applications;

Figure 2 is a schematic diagram of the working principle of the cloud platform;

Fig. 3 is the sending schematic diagram of API key in the prior art;

Fig. 4 is the realization flow chart of the first embodiment of a communication security protection method provided by the present invention;

Fig. 5 is the realization flow chart of the second embodiment of a communication security protection method provided by the present invention;

Fig. 6 is the realization flow chart of the third embodiment of a communication security protection method provided by the present invention;

Fig. 7 is the realization flow chart of the fourth embodiment of a communication security protection method provided by the present invention;

FIG. 8 is an implementation flowchart of an embodiment of another communication security protection method provided by the present invention;

Fig. 9 is the realization flow chart of the embodiment of still another communication security protection method provided by the present invention;

10 is a schematic structural diagram of an embodiment of a communication security protection system provided by the present invention;

FIG. 11 is a schematic structural diagram of an embodiment of a terminal provided by the present invention;

12 is a schematic structural diagram of an embodiment of a server provided by the present invention;

FIG. 13 is a schematic diagram of information sending provided by an embodiment of the present invention.

Detailed ways

The first embodiment of a communication security protection method provided by the present invention, as shown in FIG. 4 , is applied to the Internet of Things, and the method includes:

Step 401, the terminal generates a specific parameter Para according to a preset first rule;

Here, the terminal described herein may be an IoT terminal.

Step 402, generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

Specifically, the digest message can be generated through the HMAC function according to the application programming interface key API Key, the message Payload to be delivered, and the Para. For example, HMAC (Payload, API Key, Para).

Step 403, according to the identification Device ID of the terminal, the Payload, the Para and the digest message, generate first information and send it to the server;

Specifically, the first information may be represented as Message (Device ID, Payload, Para, HMAC (Payload, API Key, Para)).

Here, the server described in this article may be an IoT OneNet platform.

Step 404, the server obtains a pre-stored API Key according to the Device ID in the first information;

Here, the Device ID may be set corresponding to the API Key.

Step 405: Calculate the verification value according to the pre-stored API Key, the Payload and the Para in the first information;

Step 406, comparing the verification value with the digest message in the first information;

Step 407: When the verification value matches the digest message, it is determined that the authentication of the first information is passed.

Therefore, the technical solutions provided by the embodiments of the present invention can effectively solve the problem of API key leakage and ensure communication security.

A second embodiment of a communication security protection method provided by the present invention, as shown in FIG. 5 , is applied to the Internet of Things, and the method includes:

Step 501, the terminal generates a specific parameter Para according to a preset first rule;

Step 502, generate a digest message according to the application programming interface key API Key, the message Payload to be delivered and the Para;

Specifically, the digest message can be generated through the HMAC function according to the application programming interface key API Key, the message Payload to be delivered, and the Para.

Step 503, according to the identification Device ID of the terminal, the Payload, the Para and the digest message, generate first information and send it to the server;

Step 504, the server judges whether the Para in the first information satisfies the preset condition; when the Para meets the preset condition, go to step 505; when the Para does not meet the preset condition , enter step 509;

In practical applications, the terminal and the server each set a list, the list of the terminal stores different Para, the list of the server is used to store the Para in the first authentication information sent by the terminal, and the list of the server is initially empty.

The terminal in turn picks Para from its list. When it is determined that the first information passes the verification, the server records the Para according to a preset second rule;

Specifically, the judging whether the Para in the first information satisfies a preset condition may include:

It is judged whether the Para in the first information is the same as the Para recorded by the server, and if they are the same, it is determined that it is a replay attack.

Or, in practical applications, the terminal and the server each set up a list, the list of the terminal stores different Para, and the Para grows synchronously according to time or times; Para in the first message.

The terminal in turn picks Para from its list. When it is determined that the first information passes the verification, the server records the Para according to a preset second rule;

Specifically, the judging whether the Para in the first information satisfies a preset condition may include:

It is judged whether the Para in the first information is the same as or smaller than the Para recorded by the server, and if it is the same or smaller, it is determined to be a replay attack.

Step 505, the server obtains a pre-stored API Key according to the Device ID in the first information;

Step 506: Calculate the verification value according to the pre-stored API Key, the Payload and the Para in the first information;

Step 507, comparing the verification value with the digest message in the first information;

Step 508: When the verification value matches the digest message, it is determined that the authentication of the first information is passed, and this process ends.

Step 509: Determine that the first information is replayed information, and end this process.

Therefore, the technical solutions provided by the embodiments of the present invention can quickly determine whether the first information is a replay attack according to Para, thereby effectively ensuring communication security.

A third embodiment of a communication security protection method provided by the present invention is applied to the Internet of Things. As shown in FIG. 6 , the method includes:

Step 601, the terminal generates a specific parameter Para according to a preset first rule;

Step 602, the terminal generates a first random number RAND according to a preset second rule;

Step 603, generate a digest message according to the API Key, the message Payload to be delivered, the Para and the RAND;

Specifically, the digest message can be generated by the HMAC function according to the API Key, the payload of the message to be delivered, the Para and the RAND. For example, HMAC(Payload, API key, Para||RAND).

Step 604, according to the identification Device ID of the terminal, the Payload, the Para, the RAND and the digest message, generate first information and send it to the server;

Specifically, the first information may be represented as Message(Device ID, Payload, Para||RAND, HMAC(Payload, API key, Para||RAND)).

Step 605, the server obtains a pre-stored API Key according to the Device ID in the first information;

Step 606: Calculate the verification value according to the pre-stored API Key, the Payload, the Para, and the RAND in the first information.

Step 607, comparing the verification value with the digest message in the first information;

Step 608: When the verification value matches the digest message, it is determined that the authentication of the first information is passed.

Therefore, the technical solutions provided by the embodiments of the present invention can also use the random number RAND to avoid API key leakage, and further ensure communication security.

The fourth embodiment of a communication security protection method provided by the present invention is applied to the Internet of Things. As shown in FIG. 7 , the method includes:

Step 701, the terminal generates a specific parameter Para according to a preset first rule;

Step 702, detecting the state of the terminal;

Step 703: When the terminal is in the first state, generate a second random parameter KDF_p according to a preset third rule;

Here, the first state refers to sending KDF_p for the first time, that is, when the IoT terminal generates the first message. It can be understood that the KDF_p that is not sent for the first time may be in the second state, that is, when the IoT terminal generates the first and subsequent messages.

When the network side receives the first message, it takes out KDF_p and saves it. Then, when the IoT terminal sends other messages, it uses the saved KDF_p for calculation.

When the network side receives the message, it judges whether it is the first message according to whether the message has KDF_p stored, and if not, directly fetches the stored KDF_p of the corresponding terminal for calculation.

Step 704, generate a key according to the API Key and the KDF_p;

Step 705, generate a digest message according to the key, the message Payload to be delivered, the Para and the KDF_p;

Specifically, according to the key, the message Payload to be delivered, the Para and the KDF_p, a digest message is generated through the HMAC function, for example, HMAC(Payload, f(API key, KDF_p), Para||KDF_p).

Step 706, according to the identification Device ID of the terminal, the Payload, the Para, the KDF_p and the digest message, generate first information and send it to the server;

Here, the first information may be represented as Message(Device ID, Payload, Para||KDF_p, HMAC(Payload, f(API key, KDF_p), Para||KDF_p)).

Step 707, the server judges whether the Para in the first information satisfies the preset condition; when the Para meets the preset condition, go to step 708; when the Para does not meet the preset condition , enter step 713;

Step 708, the server obtains a pre-stored API Key according to the Device ID in the first information;

Step 709, generate a verification key according to the pre-stored API Key and the KDF_p;

Step 710: Calculate and obtain a verification value according to the verification key, the Payload, the Para, and the KDF_p in the first information.

Step 711: Compare the verification value with the digest message in the first information;

Step 712: When the verification value matches the digest message, it is determined that the authentication of the first information is passed, and this process ends.

Step 713: Determine that the first information is replayed information, and end this process.

Here, it should be noted that when the server receives the first piece of first information and passes the authentication, it saves the KDF_p in it, and when it receives other messages subsequently sent by the terminal, it uses the saved KDF_p to calculate the verification password. key and calculate the verification value.

It is not difficult to understand that the first information that is not the first time is: Message(Device ID, Payload, Para, HMAC(Payload, f(API key, KDF_p), Para))

Therefore, the technical solutions provided by the embodiments of the present invention can also use the random parameter KDF_p to avoid API key leakage, and further ensure communication security.

Another embodiment of the communication security protection method provided by the present invention is applied to the Internet of Things, as shown in FIG. 8 , the method includes:

Step 801, the terminal generates a specific parameter Para according to a preset first rule;

Step 802, generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

Step 803: According to the identification Device ID of the terminal, the Payload, the Para and the summary message, generate first information and send it to the server; The first information is authenticated.

In one embodiment, the method includes:

Step 801, the terminal generates a specific parameter Para according to a preset first rule;

Step 802, generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

Step 803: According to the identification Device ID of the terminal, the Payload, the Para and the summary message, generate first information and send it to the server; The first information is authenticated. In addition, the method also includes:

generating, by the terminal, a first random number RAND according to a preset second rule;

Correspondingly, the generating a summary message includes:

Generate a digest message according to the API Key, the message Payload to be delivered, the Para and the RAND;

The generating the first information includes:

Generate first information according to the identification Device ID of the terminal, the Payload, the Para, the RAND and the digest message; so that the server can use the pre-stored API Key, the first information The Payload, the Para and the RAND in , are calculated to obtain a verification value to authenticate the first information.

In one embodiment, the method includes:

Step 801, the terminal generates a specific parameter Para according to a preset first rule;

Step 802, generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

Step 803: According to the identification Device ID of the terminal, the Payload, the Para and the summary message, generate first information and send it to the server; The first information is authenticated. In addition, the method also includes:

detecting the state of the terminal;

When the terminal is in the first state, generate a second random parameter KDF_p according to a preset third rule;

Generate a key according to the API Key and the KDF_p;

Correspondingly, the generating a summary message includes:

Generate a digest message according to the key, the message Payload to be delivered, the Para and the KDF_p;

The generating the first information includes:

Generate the first information according to the identification Device ID of the terminal, the Payload, the Para, the KDF_p and the digest message; so that the server can generate the first information according to the pre-stored API Key and the KDF_p A verification key; and a verification value is calculated according to the verification key, the Payload, the Para and the KDF_p in the first information to authenticate the first information.

Another embodiment of a communication security protection method provided by the present invention is applied to the Internet of Things, as shown in FIG. 9 , the method includes:

Step 901, the server receives the first information sent by the terminal; the first information includes: API Key, a specific parameter Para, the message Payload to be delivered, and a digest message; the parameter Para is the terminal according to the preset No. Generated by a rule, the digest message is generated according to the API Key, the Payload and the Para;

Step 902, obtaining a pre-stored API Key according to the Device ID in the first information;

Step 903: Calculate the verification value according to the pre-stored API Key, Payload and Para in the first information;

Step 904, comparing the verification value with the digest message in the first information;

Step 905: When the verification value matches the digest message, it is determined that the authentication of the first information is passed.

In one embodiment, the method further includes:

The server determines whether the Para in the first information satisfies a preset condition;

When the Para does not meet the preset condition, determine that the first information is replayed information;

When the Para meets the preset condition, the step of acquiring the pre-stored API Key according to the Device ID in the first information is performed.

An embodiment of a communication security protection system provided by the present invention is applied to the Internet of Things, as shown in FIG. 10 , the system includes a terminal and a server:

The terminal 1001 is configured to generate a specific parameter Para according to a preset first rule; generate a summary message according to the application programming interface key API Key, the message Payload to be delivered, and the Para; according to the identification of the terminal The Device ID, the Payload, the Para, and the digest message generate first information and send it to the server;

The server 1002 is configured to obtain a pre-stored APIKey according to the Device ID in the first information; according to the pre-stored API Key, the Payload and the Para in the first information, the calculation is verified value; compare the verification value with the digest message in the first information; when the verification value matches the digest message, it is determined that the authentication of the first information is passed.

An embodiment of a terminal provided by the present invention is applied to the Internet of Things, as shown in FIG. 11 , the terminal includes:

a first generating unit 1101, configured to generate a specific parameter Para according to a preset first rule;

The second generating unit 1102 is configured to generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

The third generating unit 1103 is configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para and the digest message

The sending unit 1104 is configured to send the first information to a server, so that the server authenticates the first information according to the information in the first information.

In one embodiment, the terminal includes:

a first generating unit 1101, configured to generate a specific parameter Para according to a preset first rule;

The second generating unit 1102 is configured to generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

The third generating unit 1103 is configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para and the digest message

The sending unit 1104 is configured to send the first information to a server, so that the server authenticates the first information according to the information in the first information. In addition, the terminal also includes:

a fourth generating unit 1105, configured to generate a first random number RAND according to a preset second rule;

Correspondingly, the second generating unit is configured to generate a digest message according to the API Key, the message Payload to be delivered, the Para and the RAND;

The third generating unit 1103 is configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para, the RAND and the digest message; so that the server can The pre-stored API Key, the Payload, the Para and the RAND in the first information are calculated to obtain a verification value to authenticate the first information.

In one embodiment, the terminal includes:

a first generating unit 1101, configured to generate a specific parameter Para according to a preset first rule;

The second generating unit 1102 is configured to generate a digest message according to the application programming interface key API Key, the message Payload to be delivered, and the Para;

The third generating unit 1103 is configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para and the digest message

The sending unit 1104 is configured to send the first information to a server, so that the server authenticates the first information according to the information in the first information. In addition, the terminal also includes:

a detection unit 1106, configured to detect the state of the terminal;

The fifth generating unit 1107 is configured to generate a second random parameter KDF_p according to a preset third rule when the terminal is in the first state; generate a key according to the API Key and the KDF_p;

Correspondingly, the second generating unit 1102 is configured to generate a digest message according to the key, the message Payload to be delivered, the Para and the KDF_p;

The third generating unit 1103 is configured to generate the first information according to the identification Device ID of the terminal, the Payload, the Para, the KDF_p and the digest message; so that the server can The pre-stored API Key and the KDF_p generate a verification key; and according to the verification key, the Payload in the first information, the Para and the KDF_p, the verification value is calculated to obtain the verification value for the The first information is authenticated.

In practical applications, the above units may be implemented by a central processing unit (CPU, Central Processing Unit), a digital signal processor (DSP, Digital Signal Processor), or a field-programmable gate array (FPGA, Field-Programmable Gate Array) in the terminal.

An embodiment of a server provided by the present invention is applied to the Internet of Things, as shown in FIG. 12 , the server includes:

The receiving unit 1201 is configured to receive the first information sent by the terminal; the first information includes: API Key, a specific parameter Para, the message Payload to be delivered, and a digest message; the parameter Para is the terminal according to the preset The first rule is generated, and the digest message is generated according to the API Key, the Payload and the Para;

an obtaining unit 1202, configured to obtain a pre-stored API Key according to the Device ID in the first information;

The calculation unit 1203 is used to calculate and obtain the verification value according to the pre-stored API Key, Payload and Para in the first information;

The comparison unit 1204 compares the verification value with the digest message in the first information;

The determining unit 1205 is configured to determine that the authentication of the first information is passed when the verification value matches the digest message.

In one embodiment, the server further includes:

Judging unit 1206, for judging whether the Para in the first information satisfies a preset condition;

The determining unit 1205 is further configured to determine that the first information is the replayed information when the Para does not meet the preset condition; when the Para meets the preset condition, control the obtaining unit to execute according to the preset condition. The operation of obtaining the pre-stored API Key from the Device ID in the first information.

In practical applications, the above units can be implemented by a central processing unit (CPU, Central Processing Unit), a digital signal processor (DSP, Digital Signal Processor), or a field-programmable gate array (FPGA, Field-Programmable Gate Array) in the server.

The embodiments of the present invention will be further introduced below with reference to specific embodiments, application scenarios and accompanying drawings.

The embodiments of the present invention relate to an Internet of Things terminal, an Internet of Things OneNet platform and related equipment.

The main technical solution of the embodiment of the present invention is to change the method for transmitting the API Key in plain text, so that the attacker cannot obtain the API key. At the same time, it can also ensure that the OneNet platform can effectively identify the identity of IoT terminal devices. Therefore, in the embodiment of the present invention, when the IoT terminal communicates with the OneNet platform, the IoT terminal identifies the terminal through the Device ID in the message, the message to be sent, and the processing summary of the message directly or indirectly by using the API key together. sent to the network side. The network side uses the same API key to verify the digest. And send messages in the same format in subsequent processes.

To this end, the message transmission method between the IoT terminal device and the OneNet platform becomes:

1. Set the Device ID, use the Device ID to identify the IoT terminal, and bind the Device ID to the terminal API key.

2. When the IoT terminal communicates with the OneNet platform, when the IoT terminal generates a message, it no longer directly writes the API key, but:

A. Add Device ID to the message,

B. Generate a specific parameter Para

C. Generate summary information according to the API key, Para, and the payload of the message to be delivered

Then the terminal combines the above information together with the payload into a new message

3. The terminal sends the message to the network side. At this time, the API key used to mark the sender of the message becomes the Device ID.

4. After receiving the message, the network side needs to determine the sender according to the Device ID that replaces the API key to identify the source of the message, and then obtains the corresponding API key locally, and then judges whether the Para carried in the message is acceptable according to the corresponding rules. If it is not acceptable, the message is considered to be a replayed message and the processing is terminated. If it is acceptable, then use the Payload and Para in the message to calculate the verification value, and finally compare it with the digest information carried in the message, if it is the same, it will pass the verification. And record Para according to the corresponding rules.

The Para parameter is to ensure that the message is not replayed after being intercepted by a third party, so it is necessary to add relevant parameters to the digest to avoid replay attacks.

In the message generation process, the processing of API keys can have the following different embodiments:

Example 1: The API key is used to directly process the message, so the message body is specifically:

Message(Device ID, Payload, Para, HMAC(Payload, API Key, Para))

That is, when the IoT terminal generates a message, as shown in Figure 13, the Device ID is written in the message to generate a specific parameter Para, and the summary information H is generated according to the API key, Para, and the message Payload to be transmitted through the HMAC function (ie H=HMAC(Payload, API Key, Para)). Then the terminal combines the above information together with the payload into a new message

When the network side receives the message, it calculates H'=HMAC(Payload, API Key, Para) according to the same algorithm, compares H and H', if they are consistent, the message is considered correct, otherwise the message is directly discarded

Example 2: In order to prevent the API key from being cracked due to a large number of repeated use of the API key, an additional random number can be used to prevent the API key from being leaked. Therefore, the message body is as follows:

Message(Device ID, Payload, Para||RAND, HMAC(Payload, API key, Para||RAND))

That is, when the IoT terminal generates a message, it writes the Device ID in the message, generates a specific parameter Para, and a randomly generated random number RAND. The terminal generates the summary information H through the HMAC function according to the API key, Para, RAND and the message Payload to be transmitted. The terminal then combines the above information together with the payload into a new message.

When the network side receives the message, it calculates H according to the same algorithm, compares H and H', if they are consistent, the message is considered correct, otherwise the message is directly discarded

Example 3: In order to avoid the API key being cracked due to a large number of repeated use of the API key, the session key can be generated by using the API key and the key generation parameters are sent for the first time to avoid the API key being leaked. Therefore, the message body Specifically:

The first time: Message(Device ID, Payload, Para||KDF_p, HMAC(Payload, f(API key, KDF_p), Para||KDF_p))

Not the first time: Message(Device ID, Payload, Para, HMAC(Payload, f(API key, KDF_p), Para))

That is, when the IoT terminal generates the first message, it first generates a random parameter KDF_p and saves it, and then uses the API key and KDF_p to calculate and generate a new key f (API key, KDF_p), and writes the Device ID in the message to generate The specific parameter Para, and the randomly generated random parameter KDF_p. The terminal generates summary information H through the HMAC function according to the API key, Para, KDF_p, and the message Payload to be transmitted. The terminal then combines the above information together with the payload into a new message.

When the network side receives the first message, it takes out KDF_p and saves it, and then calculates f(API key, KDF_p) to calculate H according to the same algorithm, and compares H and H'. If they are consistent, the message is considered correct, otherwise it is discarded directly. the message.

Subsequently, when the IoT terminal sends other messages, it uses the saved KDF_p to calculate and generate the key f (API key, KDF_p) and calculate H.

When the network side receives the message, it determines whether it is the first message according to whether the message has KDF_p. If not, it directly takes out the stored KDF_p of the corresponding terminal to calculate H', and compares H and H'. If they are consistent, the message is considered correct. Otherwise, the message is directly discarded.

The parameter design for anti-replay attack can have different embodiments:

Example 1: The M2M terminal and the OneNet cloud platform each keep a fixed-length list for storing the sent parameters Para, and compare the new Para with the reserved parameters when they are received. If they are the same, it is considered a replay attack . When the reserved Para of the list is full, the newly received Para will cover the earliest received Para in the list, as shown below:

OneNet platform (assuming a list length of 5):

Before receiving the message: list(NULL,NULL,NULL,NULL,NULL)

Received the first message: list(Para1,NULL,NULL,NULL,NULL)

Received the second message: first judge Para2<>Para1, otherwise judge playback and reject the message. Then list becomes (Para1,Para2,NULL,NULL,NULL)

Received the third message: list(Para1,Para2,Para3,NULL,NULL)

and so on

The fifth message received: list(Para1,Para2,Para3,Para4,Para5)

Received the sixth message: list(Para6,Para2,Para3,Para4,Para5)

Received the seventh message: list(Para6,Para7,Para3,Para4,Para5)

And so on, and will not be repeated here.

Example 2: The M2M terminal and the OneNet cloud platform each keep a list for storing the sent parameter Para and keep it for a certain period of time, and compare the new Para and the reserved parameters when they are received. Let go of the attack. When the list retention Para time expires, it is removed from the list. As follows:

OneNet platform (assuming a list setting time of 60 seconds):

Before receiving a message: list()

Received the first message: list(Para1:60)

The second message is received after 2 seconds: First judge Para2<>Para1, otherwise judge playback and reject the message. Then the list becomes (Para1:58,Para2:60,)

and so on

Received the nth message in the 59th second: list(Para1:1,Para2:3,…,Para_n:60)

Delete expired parameters after 60 seconds: list(Para2:2,...,Para_n:59)

Delete expired parameters after 62 seconds: list(Para3:x,…,Para_n:57)

And so on, and will not be repeated here.

Example 3: The parameter Para increases synchronously according to the time or the number of times, and the parameter is reserved and used for comparison, and when the new Para is received, it is compared with the reserved parameter. Let go of the attack. As follows:

OneNet platform (assuming a list setting time of 60 seconds):

Before receiving a message: list()

First message received: list(1)

When receiving the second message, first determine whether Para is greater than 1, and if not, replay the attack. If yes, list(2)

And so on, and will not be repeated here.

The technical solutions provided by the embodiments of the present invention can implement the use of the API key to provide message security in the communication process, and can ensure that the API key will not be leaked.

To sum up, the technical solutions provided by the embodiments of the present invention can prevent malicious attackers from illegally obtaining the API key, at the same time, can identify the corresponding device, and can also prevent replay attacks.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (16)

1. a kind of communication security protection method, which is characterized in that be applied to Internet of Things, which comprises

Terminal generates specific parameter Para according to preset first rule；

It is plucked according to application programming interface key A PI Key, the message Payload to be transmitted and the Para, generation Want message；

According to mark Device ID of the terminal, the Payload, the Para and the summary information, first is generated Information is simultaneously sent to server；

The server obtains the API Key prestored according to the Device ID in the first information；

According to the Payload and the Para in API Key prestored, the first information, verifying is calculated Value；

The validation value and the summary information in the first information are compared；

When the validation value is matched with the summary information, determine that the authentication is passed for the first information.

2. the method according to claim 1, wherein the method also includes:

The server judges whether the Para in the first information meets preset condition；

When the Para is unsatisfactory for preset condition, determine that the first information is the information reset；

When the Para meets preset condition, prestored according to the Device ID acquisition in the first information API Key the step of.

3. method according to claim 1 or 2, which is characterized in that the method also includes:

The terminal generates the first random parameter RAND according to preset Second Rule；

Correspondingly, the generation summary information includes:

According to API Key, the message Payload to be transmitted, the Para and the RAND, summary information is generated；

The generation first information includes:

Disappeared according to mark Device ID of the terminal, the Payload, the Para, the RAND and the abstract Breath generates the first information；

The validation value that is calculated includes:

According to the Payload, the Para and the RAND in API Key prestored, the first information, calculate It is verified value.

4. method according to claim 1 or 2, which is characterized in that the method also includes:

Detect the state of the terminal；

When the terminal is in first state, the second random parameter KDF_p is generated according to preset third rule；

According to API Key and the KDF_p, key is generated；

Correspondingly, the generation summary information includes:

According to the key, the message Payload to be transmitted, the Para and the KDF_p, summary information is generated；

The generation first information includes:

Disappeared according to mark Device ID of the terminal, the Payload, the Para, the KDF_p and the abstract Breath generates the first information；

The validation value that is calculated includes:

According to the API Key and the KDF_p prestored, authentication secret is generated；

According to the Payload, the Para and the KDF_p in the authentication secret, the first information, it is calculated Validation value.

5. method according to claim 1 or 2, which is characterized in that the generation summary information includes:

Summary information is generated by HMAC function.

6. a kind of communication security protection method, which is characterized in that be applied to Internet of Things, which comprises

Terminal generates specific parameter Para according to preset first rule；

It is plucked according to application programming interface key A PI Key, the message Payload to be transmitted and the Para, generation Want message；

According to mark Device ID of the terminal, the Payload, the Para and the summary information, first is generated Information is simultaneously sent to server；So that the server reflects to the first information according to the information in the first information Power.

7. according to the method described in claim 6, it is characterized in that, the method also includes:

The terminal generates the first random parameter RAND according to preset Second Rule；

Correspondingly, the generation summary information includes:

According to API Key, the message Payload to be transmitted, the Para and the RAND, summary information is generated；

The generation first information includes:

Disappeared according to mark Device ID of the terminal, the Payload, the Para, the RAND and the abstract Breath generates the first information；So that the server can according to API Key prestored, in the first information described in Payload, the Para and the RAND, are calculated validation value, to authenticate to the first information.

8. according to the method described in claim 6, it is characterized in that, the method also includes:

Detect the state of the terminal；

When the terminal is in first state, the second random parameter KDF_p is generated according to preset third rule；

According to API Key and the KDF_p, key is generated；

Correspondingly, the generation summary information includes:

According to the key, the message Payload to be transmitted, the Para and the KDF_p, summary information is generated；

The generation first information includes:

Disappeared according to mark Device ID of the terminal, the Payload, the Para, the KDF_p and the abstract Breath generates the first information；So that the server can generate authentication secret according to the API Key and the KDF_p prestored； And according to the Payload, the Para and the KDF_p in the authentication secret, the first information, it is calculated and tests Card value, to be authenticated to the first information.

9. a kind of communication security protection method, which is characterized in that be applied to Internet of Things, which comprises

The first information that server receiving terminal is sent；The first information includes: API Key, specific parameter Para, is wanted The message Payload and summary information of transmitting；The parameter Para is that the terminal is generated according to preset first rule, institute Stating summary information is generated according to API Key, the Payload and the Para；

The API Key prestored is obtained according to the Device ID in the first information；

According to the Payload and Para in API Key prestored, the first information, validation value is calculated；

The validation value and the summary information in the first information are compared；

When the validation value is matched with the summary information, determine that the authentication is passed for the first information.

10. according to the method described in claim 9, it is characterized in that, the method also includes:

The server judges whether the Para in the first information meets preset condition；

When the Para is unsatisfactory for preset condition, determine that the first information is the information reset；

When the Para meets preset condition, prestored according to the Device ID acquisition in the first information API Key the step of.

11. a kind of communication security protection system, which is characterized in that be applied to Internet of Things, the system comprises terminal and servers:

The terminal, for generating specific parameter Para according to preset first rule；It is close according to application programming interface Key API Key, the message Payload to be transmitted and the Para generate summary information；According to the mark of the terminal Device ID, the Payload, the Para and the summary information generate the first information and are sent to the service Device；

The server, for obtaining the API Key prestored according to the Device ID in the first information；According to institute API Key prestored, the Payload and the Para in the first information are stated, validation value is calculated；It is tested described Card value is compared with the summary information in the first information；When the validation value is matched with the summary information, Determine that the authentication is passed for the first information.

12. a kind of terminal, which is characterized in that be applied to Internet of Things, the terminal includes:

First generation unit, for generating specific parameter Para according to preset first rule；

Second generation unit, for according to application programming interface key A PI Key, the message Payload to be transmitted with And the Para, generate summary information；

Third generation unit, for according to mark Device ID of the terminal, the Payload, the Para and described Summary information generates the first information

Transmission unit, for the first information to be sent to server；So that the server is according in the first information Information the first information is authenticated.

13. terminal according to claim 12, which is characterized in that the terminal further include:

4th generation unit, for generating the first random parameter RAND according to preset Second Rule；

Correspondingly, second generation unit: for according to API Key, the message Payload to be transmitted, the Para with And the RAND, generate summary information；

The third generation unit: for according to mark Device ID of the terminal, the Payload, the Para, institute RAND and the summary information are stated, the first information is generated；So that the server can be according to API Key, described prestored The Payload, the Para and the RAND in the first information, are calculated validation value, with to the first information into Row authentication.

14. terminal according to claim 12, which is characterized in that the terminal further include:

Detection unit, for detecting the state of the terminal；

5th generation unit, for it is random to generate second according to preset third rule when the terminal is in first state Parameter KDF_p；According to API Key and the KDF_p, key is generated；

Correspondingly, second generation unit: for according to the key, the message Payload to be transmitted, the Para with And the KDF_p, generate summary information；

The third generation unit: for according to mark Device ID of the terminal, the Payload, the Para, institute KDF_p and the summary information are stated, the first information is generated；So that the server can be according to the API Key and institute prestored KDF_p is stated, authentication secret is generated；And according to the Payload, the Para in the authentication secret, the first information With the KDF_p, validation value is calculated, to authenticate to the first information.

15. a kind of server, which is characterized in that be applied to Internet of Things, the server includes:

Receiving unit, the first information sent for receiving terminal；The first information includes: API Key, specific parameter Para, the message Payload to be transmitted and summary information；The parameter Para is the terminal according to preset first rule It generates, the summary information is generated according to API Key, the Payload and the Para；

Acquiring unit, for obtaining the API Key prestored according to the Device ID in the first information；

Computing unit, API Key for prestoring according to, Payload and Para in the first information, is calculated Validation value；

Comparison unit compares the validation value and the summary information in the first information；

Determination unit, for determining that the authentication is passed for the first information when the validation value is matched with the summary information.

16. server according to claim 15, which is characterized in that the server further include:

Whether judging unit, the Para for judging in the first information meet preset condition；

The determination unit is also used to when the Para is unsatisfactory for preset condition, determines that the first information is to reset Information；When the Para meets preset condition, control acquiring unit is executed according in the first information Device ID obtains the operation of the API Key prestored.