WO2023184262A1 - 一种数据帧安全传输方法、装置、电子设备及存储介质 - Google Patents

一种数据帧安全传输方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2023184262A1
WO2023184262A1 PCT/CN2022/084174 CN2022084174W WO2023184262A1 WO 2023184262 A1 WO2023184262 A1 WO 2023184262A1 CN 2022084174 W CN2022084174 W CN 2022084174W WO 2023184262 A1 WO2023184262 A1 WO 2023184262A1
Authority
WO
WIPO (PCT)
Prior art keywords
data frame
user identification
identification
cloud server
terminal device
Prior art date
Application number
PCT/CN2022/084174
Other languages
English (en)
French (fr)
Inventor
李书珍
Original Assignee
北京小米移动软件有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京小米移动软件有限公司 filed Critical 北京小米移动软件有限公司
Priority to CN202280000847.2A priority Critical patent/CN115280725A/zh
Priority to PCT/CN2022/084174 priority patent/WO2023184262A1/zh
Publication of WO2023184262A1 publication Critical patent/WO2023184262A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/163—In-band adaptation of TCP data exchange; In-band control procedures

Definitions

  • the present disclosure relates to the technical field of the Internet of Things, and in particular to a data frame secure transmission method, device, electronic equipment and storage medium.
  • TCP Transmission Control Protocol
  • the present disclosure provides a data frame secure transmission method, device, electronic device and storage medium to at least solve the problem in related technologies that as the number of terminal devices increases, the pressure on TCP long connections between terminal devices and cloud servers increases. Reduced network service quality and low transmission security may lead to privacy leakage risks.
  • a data frame secure transmission method is provided, which is suitable for proxy devices, including: obtaining the device identification of a terminal device in the same Internet of Things and the user identification bound to the terminal device; based on the The device identification and the user identification are obtained, and the key corresponding to the user identification is obtained from the cloud server; based on the key corresponding to the user identification, the data frame required when the terminal device communicates with the cloud server is processed. transmission.
  • a data frame secure transmission method is provided, which is suitable for terminal devices, including: sending the device identification of the terminal device and its own bound user identification to a proxy device in the same Internet of Things; Based on the key corresponding to the user identification, data frames are transmitted between the proxy device and the cloud server.
  • a data frame secure transmission device suitable for proxy equipment, including: a first acquisition module configured to obtain the device identification of a terminal device in the same Internet of Things and the terminal The user identification bound to the device; the second acquisition module is configured to obtain the key corresponding to the user identification from the cloud server based on the device identification and the user identification; the transmission module is configured to perform the execution based on the user identification.
  • the key corresponding to the user identification is used to transmit the data frame required when the terminal device communicates with the cloud server.
  • a device for secure transmission of data frames suitable for terminal equipment, including: a third acquisition module configured to perform, in response to receiving the data frame, from the data frame Extract the timestamp, and obtain the time difference based on the timestamp and the current time; the first determination module is configured to perform, in response to the time difference being less than or equal to the window time, determining that the data frame is a valid frame, and the valid frame is The frame is transmitted; the second determination module is configured to determine that the data frame is an invalid frame in response to the time difference being greater than the window time, and discard the invalid frame.
  • an electronic device including: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to execute the instructions to Implement the data frame secure transmission method as described in the first aspect of this disclosure embodiment or the second aspect of this disclosure embodiment.
  • a computer-readable storage medium which when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to execute the steps of the first embodiment of the present disclosure.
  • the technical solution provided by the embodiments of the present disclosure at least brings the following beneficial effects: the corresponding key can be obtained through the device identification of the terminal device and the bound user identification, and the key based on the user identification is used when the terminal device communicates with the cloud server.
  • the required data frames are transmitted, which improves the security of transmission, eliminates the risk of privacy leakage, realizes the proxy for terminal device traffic, reduces the pressure of TCP connections between terminal devices and cloud servers, and improves network service quality. .
  • Figure 1 is a flow chart of a data frame secure transmission method according to an exemplary embodiment.
  • Figure 2 is a flow chart of another data frame secure transmission method according to an exemplary embodiment.
  • Figure 3 is a flow chart of another data frame secure transmission method according to an exemplary embodiment.
  • Figure 4 is a flow chart of another data frame secure transmission method according to an exemplary embodiment.
  • Figure 5 is a flow chart of another data frame secure transmission method according to an exemplary embodiment.
  • Figure 6 is a flow chart of another data frame secure transmission method according to an exemplary embodiment.
  • Figure 7 is a schematic diagram of communication between a proxy device, a terminal device and a cloud server according to an exemplary embodiment.
  • Figure 8 is a block diagram of a device for secure transmission of data frames according to an exemplary embodiment.
  • Figure 9 is a block diagram of another device for secure transmission of data frames according to an exemplary embodiment.
  • FIG. 10 is a block diagram of an electronic device according to an exemplary embodiment.
  • Figure 1 is a flow chart of a data frame secure transmission method according to an exemplary embodiment, which is suitable for proxy devices. As shown in Figure 1, the data frame secure transmission method according to an embodiment of the present disclosure may include the following steps.
  • S101 Obtain the device identification of the terminal device in the same Internet of Things and the user identification bound to the terminal device.
  • the execution subject of the data frame secure transmission method in the embodiment of the present disclosure is a proxy device, where the proxy device includes but is not limited to mobile phones, tablet computers, notebooks, desktop computers, vehicle-mounted terminals, smart home appliances, etc.
  • the data frame secure transmission method of the embodiment of the present disclosure can be executed by the data frame secure transmission device of the embodiment of the present disclosure.
  • the secure transmission device of the data frame of the embodiment of the present disclosure can be configured in any proxy device to execute the data frame of the embodiment of the present disclosure. Secure transmission method.
  • optical modems or fiber-to-the-home routers need to perform NAT (Network Address Translation) conversion for the TCP (Transmission Control Protocol, Transmission Control Protocol) long connections corresponding to all terminal devices connected to the router. Operators have limited equipment hardware resources. The more terminal devices users connect to the Internet in smart home scenarios, the greater the NAT conversion pressure on optical modems or home routers, thereby reducing network quality and affecting users' online experience.
  • NAT Network Address Translation
  • embodiments of the present disclosure propose a method for secure transmission of data frames.
  • the data frames required for communication between the terminal device and the cloud server are processed.
  • the terminal device whose traffic is proxied no longer creates a separate TCP connection channel, thereby eliminating the NAT conversion pressure on the operator's equipment, breaking through the limit on the number of terminal devices connected to the network, improving network service quality, and enhancing transmission security.
  • the proxy device obtains the device identification of the terminal device in the same Internet of Things and the user identification bound to the terminal device for subsequent processing.
  • the terminal device is the WiFi (Wireless Fidelity, Wireless Fidelity) device in the Internet of Things.
  • the Internet of Things is a connection network that provides functions such as communication and sharing between devices.
  • the agent device is the terminal device in the Internet of Things.
  • the central device for the device to securely transmit data frames.
  • the user identification is the UID (User Identity, user identification code) of the user account to which the terminal device belongs, and the device identification is the unique DID (Device Identity, device identification code) of the terminal device.
  • UID User Identity, user identification code
  • the device identification is the unique DID (Device Identity, device identification code) of the terminal device.
  • one user account corresponds to a user ID, and the user IDs of different user accounts are different.
  • the number of terminal devices may be one or more.
  • the specific categories of terminal devices are not too limited and can be set according to the actual situation.
  • the terminal devices may include but are not limited to air purifiers, curtain controllers, smart phones, etc. Door locks etc.
  • the proxy device obtains the key corresponding to the user identification from the cloud server based on the device identification and user identification obtained in step S101.
  • the cloud server is a cloud host that provides basic services and configurations to connected devices.
  • the key is a Token generated by the cloud server and issued to the terminal device when the terminal device binds the user account. It should be noted that one terminal device has and has only one corresponding key, and different user accounts and/or different terminal devices have different keys.
  • the proxy device transmits the data frame required when the terminal device communicates with the cloud server based on the key corresponding to the user identification obtained in step S102.
  • the data frame is the data unit of communication data between the terminal device and the cloud server. It should be noted that data frames can be divided into uplink data frames and downlink data frames.
  • the agent device obtains the device identification of the terminal device in the same Internet of Things and the user identification bound to the terminal device, and obtains the user identification correspondence from the cloud server based on the device identification and the user identification.
  • the key based on the key corresponding to the user ID, transmits the data frames required when the terminal device communicates with the cloud server.
  • the corresponding key can be obtained through the device identification of the terminal device and the bound user identification, and the data frames required for communication between the terminal device and the cloud server are transmitted based on the key corresponding to the user identification, thereby improving the security of the transmission. , eliminates the risk of privacy leakage, realizes the proxy for terminal device traffic, reduces the pressure on TCP connections between terminal devices and cloud servers, and improves network service quality.
  • Figure 2 is a flow chart of another data frame secure transmission method according to an exemplary embodiment. As shown in Figure 2, the data frame secure transmission method according to the embodiment of the present disclosure may include the following steps.
  • step S201 in this embodiment please refer to the relevant content recorded in the above embodiment, and will not be described again here.
  • Step S102 in the above embodiment may include the following steps S202-S202:
  • S202 Send a key acquisition request to the cloud server based on the device identification and user identification.
  • the proxy device sends a key acquisition request to the cloud server based on the device identification and user identification obtained in step S201 for subsequent reception of the key.
  • the key acquisition request is a request sent by the proxy device to the cloud server to obtain the key.
  • the proxy device after sending a key acquisition request to the cloud server, the proxy device receives the key corresponding to the user ID returned by the cloud server.
  • the proxy device in the process of establishing a UDP local communication channel with the terminal device, obtains the device identity and user identity proxy, sends a key acquisition request to the cloud server based on the device identity and user identity, and receives the return from the cloud server. Based on the key corresponding to the user ID, the data frame required for communication between the terminal device and the cloud server is transmitted.
  • the corresponding key can be obtained through the device identification of the terminal device and the bound user identification, and the data frames required for communication between the terminal device and the cloud server are transmitted based on the key corresponding to the user identification, thereby improving the security of the transmission. , eliminates the risk of privacy leakage, realizes the proxy for terminal device traffic, reduces the pressure on TCP connections between terminal devices and cloud servers, and improves network service quality.
  • step S204 in the above embodiment may include the following steps:
  • the proxy device responds to receiving the encrypted uplink data frame sent by the terminal device and obtains the key corresponding to the user identification based on the device identification.
  • the uplink data frame is a type of data frame
  • the encrypted uplink data frame is a data frame that needs to be sent to the proxy device after being encrypted by the terminal device. It should be noted that the terminal device encrypts the uplink data frame based on the key of the user identification.
  • the application layer protocol between the proxy device and the cloud server adopts the MQTT over TLS (Transport Layer Secure Message Queuing Telemetry Transmission Standard Protocol) scheme.
  • TLS Transport Layer Secure Message Queuing Telemetry Transmission Standard Protocol
  • the definition of the upstream data frame in this scheme is as follows: device/$ ⁇ DID ⁇ /up/$ ⁇ method ⁇ : Among them, the method is agreed between the cloud server and the agent device.
  • the DID is the agent device
  • the message is the uplink message of the agent device itself.
  • the DID is the terminal device
  • Agents for upstream messages from terminal devices are possible to be agreed between the cloud server and the agent device.
  • S302 Decrypt the encrypted uplink data frame based on the key corresponding to the user ID to obtain the decrypted uplink data frame.
  • the proxy device decrypts the encrypted uplink data frame to obtain the decrypted uplink data frame.
  • the proxy device encrypts the encrypted upstream data frame based on the key corresponding to the user ID.
  • S303 Encrypt the decrypted uplink data frame based on the proxy device's own key and send it to the cloud server.
  • the proxy device encrypts the decrypted uplink data frame and sends it to the cloud server.
  • the proxy device encrypts the decrypted uplink data frame based on the proxy device's own key, which is different from the terminal device's encryption method for the uplink data frame based on the corresponding key based on the user identity, because the proxy device's own key is different from the user's key.
  • the keys corresponding to the identifiers are different keys. It should be noted that the proxy device has a one-to-one correspondence with its own key, and different proxy devices have different keys.
  • the proxy device can decrypt the encrypted uplink data frame based on the key corresponding to the user ID, and encrypt the decrypted uplink data frame based on the proxy device's own key, further improving the security of the transmission.
  • step S304 in the above embodiment may include the following steps:
  • the proxy device responds to receiving the encrypted downlink data frame sent by the cloud server and decrypts the encrypted downlink data frame based on the proxy device's own key to obtain the decrypted downlink data frame.
  • the downlink data frame is a type of data frame
  • the encrypted downlink data frame is the data frame encrypted by the cloud server
  • the decrypted downlink data frame is the data frame decrypted by the proxy device.
  • the cloud server encrypts the downlink data frame based on the proxy device's own key.
  • downlink data frames in the MQTT over TLS solution is as follows: device/$ ⁇ DID ⁇ /down/$ ⁇ method ⁇ : Among them, the method is agreed between the cloud server and the proxy device.
  • DID is the proxy
  • the message is a downlink data frame sent by the cloud server to the proxy device.
  • the message is a downlink data frame of other terminal devices that the proxy device needs to process or forward on its behalf.
  • the proxy device obtains the device identification of the terminal device from the decrypted downlink data frame obtained in step S401 for subsequent processing.
  • S403 Obtain the key corresponding to the user ID based on the device ID.
  • the proxy device further obtains the key corresponding to the user identification based on the device identification of the terminal device obtained in step S402 for subsequent processing.
  • S404 Encrypt the decrypted downlink data frame based on the key corresponding to the user ID, and send it to the terminal device.
  • the proxy device encrypts the decrypted downlink data frame based on the key corresponding to the user ID obtained in step S403 and sends it to the terminal device.
  • the proxy device can decrypt the encrypted downlink data frame based on its own key, and can encrypt the decrypted downlink data frame based on the obtained key corresponding to the user ID, further enhancing the security of the transmission.
  • the proxy device needs to determine the validity of the data frames, that is, the uplink data frames and the downlink data frames, and process them accordingly.
  • the proxy device responds to receiving the data frame, extracts a timestamp from the data frame, obtains a time difference based on the timestamp and the current time, and determines that the data frame is a valid frame in response to the time difference being less than or equal to the window time. Valid frames are transmitted. In response to the time difference being greater than the window time, the data frame is determined to be an invalid frame and the invalid frame is discarded. It is not difficult to see that the data frame received by the proxy device is valid only when the time difference is less than or equal to the window time.
  • timestamps are used to deduplicate messages and prevent replay attacks.
  • the timestamp (timestamp, ts for short) can be an international standard UNIX timestamp, and the byte length of the timestamp is 4.
  • FIG. 5 is a schematic flowchart of a data frame secure transmission method provided by another embodiment of the present disclosure.
  • the data frame secure transmission method in the embodiment of the present disclosure can be executed by the data frame secure transmission device provided in the embodiment of the present disclosure, and the data frame secure transmission device can be applied to terminal equipment.
  • the data frame secure transmission method according to the embodiment of the present disclosure may specifically include the following steps:
  • S501 Send the device identification of the terminal device and the user identification bound to itself to the agent device in the same Internet of Things.
  • S502 Transmit the data frame between the proxy device and the cloud server based on the key corresponding to the user ID.
  • the terminal device sends the device identification of the terminal device and the user identification bound to itself to the proxy device in the same Internet of Things, and based on the key corresponding to the user identification, the proxy device Transmit data frames to and from the cloud server.
  • data frames can be transmitted between the proxy device and the cloud server based on the key corresponding to the user ID, which improves the security of the transmission, eliminates the risk of privacy leakage, realizes the proxy for terminal device traffic, and reduces
  • the pressure of TCP connections between end devices and cloud servers improves network service quality.
  • FIG. 6 is a schematic flowchart of a data frame secure transmission method provided by another embodiment of the present disclosure. As shown in Figure 6, the data frame secure transmission method according to the embodiment of the present disclosure may specifically include the following steps:
  • S601 Based on the TCP connection channel with the cloud server, synchronously send the key corresponding to the user ID, the user ID and the device ID of the terminal device to the cloud server.
  • the terminal device directly establishes a TCP connection channel with the cloud server before establishing transmission with the proxy device, and synchronously sends the key corresponding to the user ID, the user ID, and the device ID of the terminal device through the TCP connection channel with the cloud server. to the cloud server.
  • S602 In the process of establishing a UDP local communication channel with the proxy device, the terminal device sends the device identification and user identification to the proxy device.
  • the terminal device and the proxy device establish a UDP (User Datagram Protocol) local communication channel
  • the device ID and user ID are sent to the proxy device.
  • UDP User Datagram Protocol
  • S603 Encrypt the uplink data frame based on the key corresponding to the user ID, and send the encrypted uplink data frame to the proxy device.
  • S604 Receive the encrypted downlink data frame sent by the proxy device, and decrypt the encrypted downlink data frame based on the key corresponding to the user ID to obtain the downlink data frame.
  • the terminal device synchronously sends the key corresponding to the user identification, the user identification and the device identification of the terminal device to the cloud server based on the TCP connection channel with the cloud server.
  • the device ID and user ID are sent to the proxy device, and based on the key corresponding to the user ID, data frames are transmitted between the proxy device and the cloud server.
  • data frames are transmitted between the proxy device and the cloud server based on the key corresponding to the user ID, which improves the security of the transmission, eliminates the risk of privacy leakage, and realizes the proxying of terminal device traffic. It reduces the pressure on TCP connections between terminal devices and cloud servers and improves network service quality.
  • FIG. 7 a schematic diagram of communication between the agent device, the terminal device and the cloud server is provided.
  • the communication method shown in Figure 7 is applicable to any of the above embodiments.
  • the information exchange between the agent device and the cloud server is through the TCP connection channel, and the information exchange between the terminal device and the agent device is through the UDP local transmission channel.
  • each terminal device and the proxy device establish a local transmission channel of User Datagram Protocol UDP. Then the terminal device no longer directly establishes a TCP connection channel with the cloud server. All terminal devices and the cloud server The data frames required for communication are forwarded by the proxy device.
  • UDP packets are used to exchange information between the proxy device and the terminal device where the traffic is proxied.
  • the terminal device synchronously sends the key corresponding to the user ID, the user ID and the device ID of the terminal device to the cloud server through the TCP connection channel with the cloud server. After the terminal device establishes a UDP local communication channel with the proxy device, it closes the TCP connection channel with the cloud server.
  • the terminal device sends the device ID and user ID to the proxy device.
  • the UDP local communication channel is established between the proxy device and the terminal device through the interaction of the detection request frame and the detection response frame.
  • the regular interaction of detection request frames and detection response frames is maintained after the address of the agent device and/or terminal device is updated, and the UDP local communication channel is rebuilt to maintain continuous connectivity between the terminal device and the agent device and avoid data loss.
  • the terminal device When the terminal device sends an uplink data frame, it encrypts the uplink data frame based on the key corresponding to the user ID and sends it to the proxy device. After the proxy device decrypts the corresponding key based on the user ID, it encrypts it with its own key and sends it to the cloud server.
  • the proxy device When the cloud server sends a downlink data frame to the terminal device, the proxy device receives the downlink data frame encrypted by the cloud server based on the proxy device's key. After the proxy device decodes it based on its own key, it then encrypts it using the key corresponding to the user device and sends it to Terminal Equipment.
  • Figure 8 is a block diagram of a device for secure transmission of data frames according to an exemplary embodiment.
  • the data frame secure transmission device 800 in the embodiment of the present disclosure includes a first acquisition module 801, a second acquisition module 802 and a transmission module 803.
  • the first acquisition module 801 is configured to acquire the device identification of a terminal device in the same Internet of Things and the user identification bound to the terminal device.
  • the second obtaining module 802 is configured to obtain the key corresponding to the user identification from the cloud server based on the device identification and the user identification.
  • the transmission module 803 is configured to execute the key based on the user identification and transmit the data frames required when the terminal device communicates with the cloud server.
  • the second acquisition module 802 is further configured to: send a key acquisition request to the cloud server based on the device identity and the user identity; and receive the key corresponding to the user identity returned by the cloud server.
  • the first acquisition module 801 is further configured to: acquire the device identity and the user identity during the process of establishing a UDP local communication channel with the terminal device.
  • the transmission module 803 is also configured to perform: in response to receiving the encrypted uplink data frame sent by the terminal device, obtain the key corresponding to the user identification based on the device identification; based on the key corresponding to the user identification, Decrypt the encrypted upstream data frame to obtain the decrypted upstream data frame; encrypt the decrypted upstream data frame based on the proxy device's own key and send it to the cloud server.
  • the transmission module 803 is also configured to perform: in response to receiving the encrypted downlink data frame sent by the cloud server, decrypt the encrypted downlink data frame based on the proxy device's own key to obtain the decrypted downlink data frame. data frame; obtain the device identification of the terminal device from the decrypted downlink data frame; obtain the key corresponding to the user identification based on the device identification; encrypt the decrypted downlink data frame based on the key corresponding to the user identification and send it to the terminal device.
  • the data frame secure transmission device 800 further includes: a third acquisition module configured to respond to receiving the data frame, extract the timestamp from the data frame, and based on the timestamp and the current time, Obtain the time difference; the first determination module is configured to execute in response to the time difference being less than or equal to the window time, determine the data frame as a valid frame, and transmit the valid frame; the second determination module is configured to execute in response to the time difference being greater than the window time, Determine the data frame to be an invalid frame and discard the invalid frame.
  • a third acquisition module configured to respond to receiving the data frame, extract the timestamp from the data frame, and based on the timestamp and the current time, Obtain the time difference
  • the first determination module is configured to execute in response to the time difference being less than or equal to the window time, determine the data frame as a valid frame, and transmit the valid frame
  • the second determination module is configured to execute in response to the time difference being greater than the window time, Determine the data frame to be an invalid frame and discard the invalid frame.
  • the agent device obtains the device identification of the terminal device in the same Internet of Things and the user identification bound to the terminal device, and obtains the user identification correspondence from the cloud server based on the device identification and the user identification.
  • the key based on the key corresponding to the user ID, transmits the data frames required when the terminal device communicates with the cloud server.
  • the corresponding key can be obtained through the device identification of the terminal device and the bound user identification, and the data frames required for communication between the terminal device and the cloud server are transmitted based on the key corresponding to the user identification, thereby improving the security of the transmission. , eliminates the risk of privacy leakage, realizes the proxy for terminal device traffic, reduces the pressure on TCP connections between terminal devices and cloud servers, and improves network service quality.
  • FIG 9 is a block diagram of a data frame secure transmission device according to an exemplary embodiment.
  • a data frame secure transmission device 900 according to an embodiment of the present disclosure includes a sending module 901 and a transmission module 902.
  • the sending module 901 is configured to send the device identification of the terminal device and the user identification bound to itself to the proxy device in the same Internet of Things.
  • the transmission module 902 is configured to perform data frame transmission between the proxy device and the cloud server based on the key corresponding to the user identification.
  • the sending module 901 is further configured to perform: in the process of establishing a UDP local communication channel with the proxy device, send the device identification and the user identification to the proxy device.
  • the sending module 901 is also configured to perform: before sending the device identification of the terminal device and the bound user identification to the proxy device in the same Internet of Things, based on the TCP connection with the cloud server Channel, the key corresponding to the user ID, the user ID and the device ID of the terminal device are synchronously sent to the cloud server.
  • the transmission module 902 is further configured to: encrypt the uplink data frame based on the key corresponding to the user identification, and send the encrypted uplink data frame to the proxy device.
  • the transmission module 902 is further configured to: receive the encrypted downlink data frame sent by the proxy device, and decrypt the encrypted downlink data frame based on the key corresponding to the user ID to obtain the downlink data frame.
  • the data frame secure transmission device 900 also includes: an acquisition module configured to perform each received data frame, extract the timestamp from the received data frame, and extract the timestamp based on the timestamp and the current time. , obtain the time difference; the first determination module is configured to execute in response to the time difference being less than or equal to the window time, determine the data frame as a valid frame, and process the valid frame; the second determination module is configured to execute in response to the time difference being greater than the window time , determine that the data frame is an invalid frame, and discard the invalid frame.
  • the terminal device sends the device identification of the terminal device and the user identification bound to itself to the proxy device in the same Internet of Things, based on the key corresponding to the user identification, through the proxy device Transmit data frames to and from the cloud server.
  • data frames can be transmitted between the proxy device and the cloud server based on the key corresponding to the user ID, which improves the security of the transmission, eliminates the risk of privacy leakage, realizes the proxy for terminal device traffic, and reduces
  • the pressure of TCP connections between end devices and cloud servers improves network service quality.
  • FIG. 10 is a block diagram of an electronic device 1000 according to an exemplary embodiment.
  • the above-mentioned electronic device 1000 includes:
  • the memory 1001 and the processor 1002 are connected to the bus 1003 of different components (including the memory 1001 and the processor 1002).
  • the memory 1001 stores a computer program.
  • the processor 1002 executes the program, the above-mentioned data frame secure transmission method in the embodiment of the present disclosure is implemented.
  • Bus 1003 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics accelerated port, a processor, or a local bus using any of a variety of bus structures.
  • these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect ( PCI) bus.
  • ISA Industry Standard Architecture
  • MAC Micro Channel Architecture
  • VESA Video Electronics Standards Association
  • PCI Peripheral Component Interconnect
  • Electronic device 1000 typically includes a variety of electronic device-readable media. These media can be any available media that can be accessed by electronic device 1000, including volatile and nonvolatile media, removable and non-removable media.
  • Memory 1001 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1004 and/or cache memory 1005.
  • Electronic device 1000 may further include other removable/non-removable, volatile/non-volatile computer system storage media.
  • storage system 1006 may be used to read and write to non-removable, non-volatile magnetic media (not shown in Figure 10, often referred to as a "hard drive”).
  • a disk drive for reading and writing removable non-volatile disks (e.g., "floppy disks"), and removable non-volatile optical disks (e.g., CD-ROM, DVD-ROM) may be provided. or other optical media) that can read and write optical disc drives.
  • each drive may be connected to bus 1003 through one or more data media interfaces.
  • the memory 1001 may include at least one program product having a set of (eg, at least one) program modules configured to perform the functions of embodiments of the present disclosure.
  • Program modules 1012 generally perform functions and/or methods in the embodiments described in this disclosure.
  • Electronic device 1000 may also communicate with one or more external devices 1009 (e.g., keyboard, pointing device, display 1010, etc.), with one or more devices that enable a user to interact with electronic device 1000, and/or with Any device (eg, network card, modem, etc.) that enables the electronic device 1000 to communicate with one or more other computing devices. This communication may occur through input/output (I/O) interface 1012.
  • the electronic device 1000 can also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 1013. As shown in FIG. 10 , the network adapter 1013 communicates with other modules of the electronic device 1000 through the bus 1003 .
  • the processor 1002 executes various functional applications and data processing by running programs stored in the memory 1001 .
  • the electronic device provided by the embodiment of the present disclosure can perform the data frame secure transmission method as described above, and obtain the corresponding key through the device identification of the terminal device and the bound user identification, thereby obtaining the terminal device in the same Internet of Things.
  • the key corresponding to the user identification is obtained from the cloud server based on the device identification and the user identification.
  • the key used when the terminal device communicates with the cloud server is Data frames are required for transmission.
  • the data frames required when the terminal device communicates with the cloud server can be transmitted, which improves the security of the transmission, eliminates the risk of privacy leakage, realizes the proxy for the terminal device traffic, and reduces the communication between the terminal device and the cloud server. This improves the quality of network service by reducing the pressure on TCP connections.
  • the present disclosure also proposes a computer-readable storage medium.
  • the electronic device when the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device can perform the data frame secure transmission method as described above.
  • the computer-readable storage medium may be ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开关于一种数据帧安全传输方法、装置、电子设备及存储介质，属于物联网技术领域。其中，该方法包括：获取处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识，基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。由此，可通过终端设备的设备标识和绑定的用户标识获取对应的密钥，基于用户标识对应的密钥对终端设备与云服务器通信时所需数据帧进行传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。

Description

一种数据帧安全传输方法、装置、电子设备及存储介质 技术领域
本公开涉及物联网技术领域，尤其涉及一种数据帧安全传输方法、装置、电子设备及存储介质。
背景技术
目前，随着物联网技术的蓬勃发展，在普通家庭宽带下连网的终端设备的数量也越来越多。
随着终端设备的数量的增多，相应地终端设备与云服务器之间进行TCP(Transmission Control Protocol，传输控制协议)长连接的网络压力会增大，往往会降低网络服务质量，且传输安全性较低，可能产生隐私泄露风险。
发明内容
本公开提供一种数据帧安全传输方法、装置、电子设备及存储介质，以至少解决相关技术中随着终端设备的数量的增多，终端设备和云服务器之间进行TCP长连接的压力增大，降低网络服务质量，且传输安全性较低，可能产生隐私泄露风险的问题。
本公开的技术方案如下：
根据本公开实施例的第一方面，提供一种数据帧安全传输方法，适用于代理设备，包括：获取处于同一物联网中终端设备的设备标识和所述终端设备绑定的用户标识；基于所述设备标识和所述用户标识，从云服务器处获取所述用户标识对应的密钥；基于所述用户标识对应的密钥，对所述终端设备与所述云服务器通信时所需数据帧进行传输。
根据本公开实施例的第二方面，提供一种数据帧安全传输方法，适用于终端设备，包括：向处于同一物联网中代理设备发送所述终端设备的设备标识和自身绑定的用户标识；基于所述用户标识对应的密钥，通过所述代理设备与所述云服务器之间进行数据帧的传输。
根据本公开实施例的第三方面，提供一种数据帧安全传输装置，适用于代理设备，包括：第一获取模块，被配置为执行获取处于同一物联网中终端设备的设备标识和所述终端设备绑定的用户标识；第二获取模块，被配置为执行基于所述设备标识和所述用户标识，从云服务器处获取所述用户标识对应的密钥；传输模块，被配置为执行基于所述用户标识对应的密钥，对所述终端设备与所述云服务器通信时所需数据帧进行传输。
根据本公开实施例的第四方面，提供一种数据帧安全传输装置，适用于终端设备，包括：第三获取模块，被配置为执行响应于接收到所述数据帧，从所述数据帧中提取时间戳，并基于所述时间戳和当前时间，获取时间差；第一确定模块，被配置为执行响应于所述时间差小于或者等于窗口时间，确定所述数据帧为有效帧，对所述有效帧进行传输；第二确定模块，被配置为执行响应于所述时间差大于所述窗口时间，确定所述数据帧为无效帧，对所述无效帧进行丢弃。
根据本公开实施例的第五方面，提供一种电子设备，包括：处理器；用于存储所述处理器的可执行指令的存储器；其中，所述处理器被配置为执行所述指令，以实现如本公开实施例第一方面或者本公开实施例第二方面所述的数据帧安全传输方法。
根据本公开实施例的第六方面，提供一种计算机可读存储介质，当所述计算机可读存储介质中的指令由电子设备的处理器执行时，使得电子设备能够执行如本公开实施例第一方面或者本公开实施例第二 方面所述的数据帧安全传输方法。
本公开的实施例提供的技术方案至少带来以下有益效果：可通过终端设备的设备标识和绑定的用户标识获取对应的密钥，基于用户标识对应的密钥对终端设备与云服务器通信时所需数据帧进行传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理，并不构成对本公开的不当限定。
图1是根据一示例性实施例示出的一种数据帧安全传输方法的流程图。
图2是根据一示例性实施例示出的另一种数据帧安全传输方法的流程图。
图3是根据一示例性实施例示出的另一种数据帧安全传输方法的流程图。
图4是根据一示例性实施例示出的另一种数据帧安全传输方法的流程图。
图5是根据一示例性实施例示出的另一种数据帧安全传输方法的流程图。
图6是根据一示例性实施例示出的另一种数据帧安全传输方法的流程图。
图7是根据一示例性实施例示出的一种代理设备、终端设备与云服务器之间的通信示意图。
图8是根据一示例性实施例示出的一种数据帧安全传输装置的框图。
图9是根据一示例性实施例示出的另一种数据帧安全传输装置的框图。
图10是根据一示例性实施例示出的一种电子设备的框图。
具体实施方式
为了使本领域普通人员更好地理解本公开的技术方案，下面将结合附图，对本公开实施例中的技术方案进行清楚、完整地描述。
需要说明的是，本公开的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本公开的实施例能够以除了在这里图示或描述的那些以外的顺序实施。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
图1是根据一示例性实施例示出的一种数据帧安全传输方法的流程图，适用于代理设备，如图1所示，本公开实施例的数据帧安全传输方法，可以包括以下步骤。
S101，获取处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识。
需要说明的是，本公开实施例的数据帧安全传输方法的执行主体为代理设备，其中，代理设备包括但不限于手机、平板电脑、笔记本、台式电脑、车载终端、智能家电等。本公开实施例的数据帧安全传输方法可以由本公开实施例的数据帧安全传输装置执行，本公开实施例的数据帧安全传输装置可以配置在任意代理设备中，以执行本公开实施例的数据帧安全传输方法。
本领域可以理解的是，光猫或光纤入户路由器需要为所有接入路由器的终端设备对应的TCP(Transmission Control Protocol，传输控制协议)长连接进行NAT(Network Address Translation，网络地址转换)转换，而运营商的设备硬件资源有限，智能家居场景下用户连网的终端设备越多，光猫或入户路由器的NAT转换压力就越大，从而降低了网络质量，影响用户的上网体验。
基于此，本公开实施例提出了一种数据帧安全传输方法，通过通过终端设备的设备标识和绑定的用户标识获取对应的密钥，从而对终端设备与云服务器通信时所需数据帧进行传输，能够使流量被代理的终端设备不再单独创建TCP连接通道，从而消除运营商设备的NAT转换压力，突破终端设备连网数量限制，提高网络服务质量，增强了传输安全。
本公开的实施例中，代理设备对处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识进行获取，以进行后续处理。其中，终端设备即物联网中的WiFi(Wireless Fidelity，无线保真)设备，物联网即为设备之间的通信、共享等功能提供的一种连接网络，代理设备即对处于物联网中的终端设备进行数据帧安全传输的中枢设备，用户标识为终端设备所属的用户账户的UID(User Identity，用户识别码)，设备标识为终端设备唯一的DID(Device Identity，设备识别码)。需要说明的是，一个用户账户对应一个用户标识，不同的用户账号的用户标识是不同的。可选地，终端设备的数量可以为一个或者多个。
还需要说明的是，本公开实施例中，对终端设备的具体类别不做过多限定，可根据实际情况进行设置，例如，终端设备具体可包括但不限于空气净化器、窗帘控制器、智能门锁等。
S102，基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥。
本公开的实施例中，代理设备基于步骤S101获取的设备标识和用户标识，从云服务器处获取用户标识对应的密钥。其中，云服务器即对连接的设备提供基础服务和配置的云端主机，密钥为终端设备绑定用户账户时由云服务器生成并下发到终端设备的Token(令牌)。需要说明的是，一个终端设备有且只有一个对应的密钥，不同用户账户和/或不同终端设备均有着不同的密钥。
S103，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。
本公开的实施例中，代理设备基于步骤S102获取的用户标识对应的密钥对终端设备与云服务器通信时所需数据帧进行传输。其中，数据帧为终端设备与云服务器通信数据的数据单元。需要说明的是，数据帧可以分为上行数据帧和下行数据帧。
本公开的实施例提供的数据帧安全传输方法，代理设备获取处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识，基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。由此，可通过终端设备的设备标识和绑定的用户标识获取对应的密钥，基于用户标识对应的密钥对终端设备与云服务器通信时所需数据帧进行传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
图2是根据一示例性实施例示出的另一种数据帧安全传输方法的流程图，如图2所示，本公开实施 例的数据帧安全传输方法，可以包括以下步骤。
S201，在与终端设备建立UDP本地通信通道的过程中，获取设备标识和用户标识。
本实施例中的步骤S201的介绍可参见上述实施例中相关内容的记载，此处不再赘述。
上述实施例中的步骤S102“基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥”可包括以下步骤S202-S202：
S202，基于设备标识和用户标识，向云服务器发送密钥获取请求。
本公开的实施例中，代理设备基于步骤S201获取的设备标识和用户标识，向云服务器发送密钥获取请求，以进行后续对密钥的接收。其中，密钥获取请求即代理设备对云服务器发送的对密钥进行获取的请求。
S203，接收云服务器返回的用户标识对应的密钥。
本公开的实施例中，在向云服务器发送密钥获取请求后，代理设备对云服务器返回的用户标识对应的密钥进行接收。
S204，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。
本实施例中的步骤S202-S204的介绍可参见上述实施例中相关内容的记载，此处不再赘述。
本公开的实施例中，代理设备在与终端设备建立UDP本地通信通道的过程中，获取设备标识和用户标识代理，基于设备标识和用户标识，向云服务器发送密钥获取请求，接收云服务器返回的用户标识对应的密钥，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。由此，可通过终端设备的设备标识和绑定的用户标识获取对应的密钥，基于用户标识对应的密钥对终端设备与云服务器通信时所需数据帧进行传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
进一步地，如图3所示，上述实施例中的步骤S204“基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输”，可以包括以下步骤：
S301，响应于接收终端设备发送的加密上行数据帧，基于设备标识获取用户标识对应的密钥。
本公开的实施例中，代理设备响应于接收终端设备发送的加密上行数据帧，基于设备标识获取用户标识对应的密钥。其中，上行数据帧为数据帧的一种，加密上行数据帧即经过终端设备进行加密后的需要发送至代理设备的数据帧。需要说明的是，终端设备基于用户标识的密钥对上行数据帧进行加密。
还需要说明的是，代理设备与云服务器的应用层协议采用MQTT over TLS(传输层安全的消息队列遥测传输标准协议)方案，该方案中对上行数据帧的定义如下：device/${DID}/up/${method}：其中，method由云服务器与代理设备约定而成，当DID为代理设备时，该消息为代理设备自身的上行消息，当DID为终端设备时，该消息为代理设备代理终端设备的上行消息。
S302，基于用户标识对应的密钥，对加密上行数据帧进行解密，得到解密上行数据帧。
本公开的实施例中，代理设备对加密上行数据帧进行解密，得到解密上行数据帧。其中，代理设备对加密上行数据帧的加密是基于用户标识对应的密钥进行。
S303，基于代理设备自身的密钥对解密上行数据帧进行加密，并发送给云服务器。
本公开的实施例中，代理设备对解密上行数据帧进行加密，并发送给云服务器。其中，代理设备对 解密上行数据帧的加密基于代理设备自身的密钥进行加密，与终端设备对上行数据帧基于用户标识的对应的密钥的加密方式不同，因为代理设备自身的密钥与用户标识对应的密钥是不同的密钥。需要说明的是，代理设备和自身的密钥一一对应，不同的代理设备具有不同的密钥
由此，代理设备可基于用户标识对应的密钥对加密上行数据帧进行解密，并基于代理设备自身的密钥对解密上行数据帧进行加密，进一步提高了传输的安全性。
进一步地，如图4所示，上述实施例中的步骤S304“基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输”，可以包括以下步骤：
S401，响应于接收云服务器发送的加密下行数据帧，基于代理设备自身的密钥，对加密下行数据帧进行解密，得到解密下行数据帧。
本公开的实施例中，代理设备响应于接收云服务器发送的加密下行数据帧，基于代理设备自身的密钥，对加密下行数据帧进行解密，得到解密下行数据帧。其中，下行数据帧为数据帧的一种，加密下行数据帧即经过云服务器进行加密后的数据帧，解密下行数据帧即经过代理设备解密后的数据帧。需要说明的是，云服务器基于代理设备自身的密钥对下行数据帧进行加密。
还需要说明的是，MQTT over TLS方案中对下行数据帧的定义如下：device/${DID}/down/${method}：其中，method由云服务器与代理设备约定而成，当DID为代理设备时，该消息为云服务器发给代理设备的下行数据帧，当DID为终端设备时，该消息为代理设备需要代为处理或转发的其他终端设备的下行数据帧。
S402，从解密下行数据帧中获取终端设备的设备标识。
本公开的实施例中，代理设备从步骤S401获取的解密下行数据帧中获取终端设备的设备标识，以进行后续处理。
S403，基于设备标识获取用户标识对应的密钥。
本公开的实施例中，代理设备基于步骤S402获取的终端设备的设备标识进一步对用户标识对应的密钥进行获取，以进行后续处理。
S404，基于用户标识对应的密钥，对解密下行数据帧进行加密，并发送给终端设备。
本公开的实施例中，代理设备基于步骤S403获取的用户标识对应的密钥，基于用户标识对应的密钥对解密下行数据帧进行加密，并发送给终端设备。
由此，代理设备可基于自身的密钥对加密下行数据帧进行解密，并可基于获取的用户标识对应的密钥，对解密下行数据帧进行加密，进一步增强了传输的安全性。
进一步地，代理设备需对数据帧即上行数据帧和下行数据帧的有效性进行判断和相应的处理。
在一些实施方式中，代理设备响应于接收到数据帧，从数据帧提取时间戳，并基于时间戳和当前时间，获取时间差，响应于时间差小于或者等于窗口时间，确定数据帧为有效帧，对有效帧进行传输，响应于时间差大于窗口时间，确定数据帧为无效帧，对无效帧进行丢弃。不难看出，只有当时间差小于或者等于窗口时间时，代理设备接收到的数据帧才是有效的。
本领域人员可以理解的是，时间戳用于进行消息去重及防重放攻击。可选地，时间戳(timestamp，简称ts)可为国际标准UNIX时间戳，该时间戳的字节长度为4。
图5为本公开另一实施例提供的数据帧安全传输方法的流程示意图。本公开实施例的数据帧安全传输方法，可由本公开实施例提供的数据帧安全传输装置执行，该数据帧安全传输装置可适用于终端设备。如图5所示，本公开实施例的数据帧安全传输方法具体可包括以下步骤：
S501，向处于同一物联网中代理设备发送终端设备的设备标识和自身绑定的用户标识。S502，基于用户标识对应的密钥，通过代理设备与云服务器之间进行数据帧的传输。具体的，关于步骤501至步骤502的具体介绍，可参加上述实施例中相关内容的记载，此处不再赘述。
在本公开的实施例提供的数据帧安全传输方法中，终端设备向处于同一物联网中代理设备发送终端设备的设备标识和自身绑定的用户标识，基于用户标识对应的密钥，通过代理设备与云服务器之间进行数据帧的传输。由此，可基于用户标识对应的密钥通过代理设备与云服务器之间进行数据帧的传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
图6为本公开另一实施例提供的数据帧安全传输方法的流程示意图。如图6所示，本公开实施例的数据帧安全传输方法具体可包括以下步骤：
S601，基于与云服务器之间的TCP连接通道，将用户标识对应的密钥、用户标识和终端设备的设备标识同步发送给云服务器。
其中，终端设备在与代理设备建立传输之前，与云服务器直接建立TCP连接通道，通过与云服务器之间的TCP连接通道，将用户标识对应的密钥、用户标识和终端设备的设备标识同步发送给云服务器。
S602，终端设备在与代理设备建立UDP本地通信通道的过程中，向代理设备发送设备标识和用户标识。
其中，当终端设备与代理设备建立UDP(User Datagram Protocol，用户数据报协议)本地通信通道，则向代理设备发送设备标识和用户标识。
S603，基于用户标识对应的密钥，对上行数据帧进行加密，并将加密上行数据帧发送给代理设备。
S604，接收代理设备发送的加密下行数据帧，并基于用户标识对应的密钥对加密下行数据帧进行解密，得到下行数据帧。
关于终端设备与代理设备传输数据帧的具体过程，可参见上述实施例中相关内容的记载，此处不再赘述。
此处需要说明的是，上述对数据帧安全传输方法实施例的解释说明，也适用于本公开实施例的数据帧安全传输方法，具体过程此处不再赘述。
本公开的实施例提供的数据帧安全传输方法中，终端设备基于与云服务器之间的TCP连接通道，将用户标识对应的密钥、用户标识和终端设备的设备标识同步发送给云服务器，在与代理设备建立UDP本地通信通道的过程中，向代理设备发送设备标识和用户标识，基于用户标识对应的密钥，通过代理设备与云服务器通之间进行数据帧的传输。由此，通过基于用户标识对应的密钥，通过代理设备与云服务 器通之间进行数据帧的传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
如图7所示，提供了一种代理设备、终端设备与云服务器之间的通信示意图。图7所示的通信方式适用于上述任一实施例。代理设备与云服务器之间通过TCP连接通道进行信息交互，终端设备与代理设备之间通过UDP本地传输通道进行信息交互。
需要说明的是，在传输层上，每个终端设备与代理设备之间各自建立用户数据报协议UDP本地传输通道，则终端设备不再与云服务器直接建立TCP连接通道，所有终端设备与云服务器通信所需的数据帧由代理设备进行代理转发。在应用层上，代理设备与被代理流量的终端设备之间交换信息使用UDP报文。
终端设备预先通过与云服务器之间的TCP连接通道，将用户标识对应的密钥、用户标识和终端设备的设备标识同步发送给云服务器。终端设备在与代理设备建立UDP本地通信通道后，关闭与云服务器之间的TCP连接通道。
终端设备在与代理设备建立UDP本地通信通道的过程中，向代理设备发送设备标识和用户标识。需要说明的是，代理设备和终端设备之间通过探测请求帧和探测响应帧的交互，实现UDP本地通信通道的建立。而且定时交互探测请求帧和探测响应帧，维持在代理设备和/或终端设备发生地址更新后，对UDP本地通信通道进行重建，保持终端设备和代理设备的持续联通，避免数据的丢失。
终端设备发送上行数据帧时，基于用户标识对应的密钥对上行数据帧进行加密，并发送给代理设备。代理设备基于用户标识对对应的密钥解密后，通过代理设备自身的密钥加密后发送给云服务器。
云服务器向终端设备发送下行数据帧时，代理设备接收云服务器基于代理设备的密钥加密的下行数据帧，代理设备基于自身的密钥解码后，再利用用户设备对应的密钥加密，发送给终端设备。
图8是根据一示例性实施例示出的一种数据帧安全传输装置的框图。如图8所示，本公开实施例的数据帧安全传输装置800，包括第一获取模块801、第二获取模块802和传输模块803。
第一获取模块801，被配置为执行获取处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识。
第二获取模块802，被配置为执行基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥。
传输模块803，被配置为执行基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。
在本公开的一个实施例中，第二获取模块802，还被配置为执行：基于设备标识和用户标识，向云服务器发送密钥获取请求；接收云服务器返回的用户标识对应的密钥。
在本公开的一个实施例中，第一获取模块801，还被配置为执行：在与终端设备建立UDP本地通信通道的过程中，获取设备标识和用户标识。
在本公开的一个实施例中，传输模块803，还被配置为执行：响应于接收终端设备发送的加密上行数据帧，基于设备标识获取用户标识对应的密钥；基于用户标识对应的密钥，对加密上行数据帧进行解密，得到解密上行数据帧；基于代理设备自身的密钥对解密上行数据帧进行加密，并发送给云服务器。
在本公开的一个实施例中，传输模块803，还被配置为执行：响应于接收云服务器发送的加密下行数据帧，基于代理设备自身的密钥，对加密下行数据帧进行解密，得到解密下行数据帧；从解密下行数据帧中获取终端设备的设备标识；基于设备标识获取用户标识对应的密钥；基于用户标识对应的密钥，对解密下行数据帧进行加密，并发送给终端设备。
在本公开的一个实施例中，数据帧安全传输装置800还包括：第三获取模块，被配置为执行响应于接收到数据帧，从数据帧中提取时间戳，并基于时间戳和当前时间，获取时间差；第一确定模块，被配置为执行响应于时间差小于或者等于窗口时间，确定数据帧为有效帧，对有效帧进行传输；第二确定模块，被配置为执行响应于时间差大于窗口时间，确定数据帧为无效帧，对无效帧进行丢弃。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
本公开的实施例提供的数据帧安全传输装置，代理设备获取处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识，基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。由此，可通过终端设备的设备标识和绑定的用户标识获取对应的密钥，基于用户标识对应的密钥对终端设备与云服务器通信时所需数据帧进行传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
图9是根据一示例性实施例示出的一种数据帧安全传输装置的框图。如图9所示，本公开实施例的数据帧安全传输装置900，包括发送模块901和传输模块902。
发送模块901，被配置为执行向处于同一物联网中代理设备发送终端设备的设备标识和自身绑定的用户标识。
传输模块902，被配置为执行基于用户标识对应的密钥，通过代理设备与云服务器通之间进行数据帧的传输。
在本公开的一个实施例中，发送模块901，还被配置为执行：在与代理设备建立UDP本地通信通道的过程中，向代理设备发送设备标识和用户标识。
在本公开的一个实施例中，发送模块901，还被配置为执行：向处于同一物联网中代理设备发送终端设备的设备标识和绑定的用户标识之前，基于与云服务器之间的TCP连接通道，将用户标识对应的密钥、用户标识和终端设备的设备标识同步发送给云服务器。
在本公开的一个实施例中，传输模块902，还被配置为执行：基于用户标识对应的密钥，对上行数据帧进行加密，并将加密上行数据帧发送给代理设备。
在本公开的一个实施例中，传输模块902，还被配置为执行：接收代理设备发送的加密下行数据帧，并基于用户标识对应的密钥对加密下行数据帧进行解密，得到下行数据帧。
在本公开的一个实施例中，数据帧安全传输装置900，还包括：获取模块，被配置为执行每接收到数据帧，从接收到的数据帧中提取时间戳，并基于时间戳和当前时间，获取时间差；第一确定模块，被配置为执行响应于时间差小于或者等于窗口时间，确定数据帧为有效帧，对有效帧进行处理；第二确定模块，被配置为执行响应于时间差大于窗口时间，确定数据帧为无效帧，对无效帧进行丢弃。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
在本公开的实施例提供的数据帧安全传输装置中，终端设备向处于同一物联网中代理设备发送终端设备的设备标识和自身绑定的用户标识，基于用户标识对应的密钥，通过代理设备与云服务器之间进行数据帧的传输。由此，可基于用户标识对应的密钥通过代理设备与云服务器之间进行数据帧的传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
图10是根据一示例性实施例示出的一种电子设备1000的框图。
如图10所示，上述电子设备1000包括：
存储器1001及处理器1002，连接不同组件(包括存储器1001和处理器1002)的总线1003，存储器1001存储有计算机程序，当处理器1002执行程序时实现本公开实施例上述的数据帧安全传输方法。
总线1003表示几类总线结构中的一种或多种，包括存储器总线或者存储器控制器，***总线，图形加速端口，处理器或者使用多种总线结构中的任意总线结构的局域总线。举例来说，这些体系结构包括但不限于工业标准体系结构(ISA)总线，微通道体系结构(MAC)总线，增强型ISA总线、视频电子标准协会(VESA)局域总线以及***组件互连(PCI)总线。
电子设备1000典型地包括多种电子设备可读介质。这些介质可以是任何能够被电子设备1000访问的可用介质，包括易失性和非易失性介质，可移动的和不可移动的介质。
存储器1001还可以包括易失性存储器形式的计算机***可读介质，例如随机存取存储器(RAM)1004和/或高速缓存存储器1005。电子设备1000可以进一步包括其它可移动/不可移动的、易失性/非易失性计算机***存储介质。仅作为举例，存储***1006可以用于读写不可移动的、非易失性磁介质(图10未显示，通常称为“硬盘驱动器”)。尽管图10中未示出，可以提供用于对可移动非易失性磁盘(例如“软盘”)读写的磁盘驱动器，以及对可移动非易失性光盘(例如CD-ROM,DVD-ROM或者其它光介质)读写的光盘驱动器。在这些情况下，每个驱动器可以通过一个或者多个数据介质接口与总线1003相连。存储器1001可以包括至少一个程序产品，该程序产品具有一组(例如至少一个)程序模块，这些程序模块被配置以执行本公开各实施例的功能。
具有一组(至少一个)程序模块1007的程序/实用工具1008，可以存储在例如存储器1001中，这样的程序模块1007包括——但不限于——操作***、一个或者多个应用程序、其它程序模块以及程序数据，这些示例中的每一个或某种组合中可能包括网络环境的实现。程序模块1012通常执行本公开所描述的实施例中的功能和/或方法。
电子设备1000也可以与一个或多个外部设备1009(例如键盘、指向设备、显示器1010等)通信，还可与一个或者多个使得用户能与该电子设备1000交互的设备通信，和/或与使得该电子设备1000能与一个或多个其它计算设备进行通信的任何设备(例如网卡，调制解调器等等)通信。这种通信可以通过输入/输出(I/O)接口1012进行。并且，电子设备1000还可以通过网络适配器1013与一个或者多个网络(例如局域网(LAN)，广域网(WAN)和/或公共网络，例如因特网)通信。如图10所示， 网络适配器1013通过总线1003与电子设备1000的其它模块通信。应当明白，尽管图中未示出，可以结合电子设备1000使用其它硬件和/或软件模块，包括但不限于：微代码、设备驱动器、冗余处理单元、外部磁盘驱动阵列、RAID***、磁带驱动器以及数据备份存储***等。
处理器1002通过运行存储在存储器1001中的程序，从而执行各种功能应用以及数据处理。
需要说明的是，本实施例的电子设备的实施过程和技术原理参见前述对本公开实施例的数据帧安全传输方法的解释说明，此处不再赘述。
本公开实施例提供的电子设备，可以执行如前所述的数据帧安全传输方法，通过终端设备的设备标识和绑定的用户标识获取对应的密钥，从而对终端设获取处于同一物联网中终端设备的设备标识和终端设备绑定的用户标识，基于设备标识和用户标识，从云服务器处获取用户标识对应的密钥，基于用户标识对应的密钥，对终端设备与云服务器通信时所需数据帧进行传输。由此，可通过终端设备与云服务器通信时所需数据帧进行传输，提高了传输的安全性，消除了隐私泄露的风险，实现了对终端设备流量的代理，减少了终端设备和云端服务器之间进行TCP连接的压力，提高了网络服务质量。
为了实现上述实施例，本公开还提出一种计算机可读存储介质。
其中，该计算机可读存储介质中的指令由电子设备的处理器执行时，使得电子设备能够执行如前所述的数据帧安全传输方法。可选的，计算机可读存储介质可以是ROM、随机存取存储器(RAM)、CD-ROM、磁带、软盘和光数据存储设备等。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其它实施方案。本公开旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由下面的权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。

Claims (26)

  1. 一种数据帧安全传输方法，其特征在于，适用于代理设备，所述方法包括：
    获取处于同一物联网中终端设备的设备标识和所述终端设备绑定的用户标识；
    基于所述设备标识和所述用户标识，从云服务器处获取所述用户标识对应的密钥；
    基于所述用户标识对应的密钥，对所述终端设备与所述云服务器通信时所需数据帧进行传输。
  2. 根据权利要求1所述的方法，其特征在于，所述基于所述设备标识和所述用户标识，从云服务器处获取所述用户标识对应的密钥，包括：
    基于所述设备标识和所述用户标识，向云服务器发送密钥获取请求；
    接收所述云服务器返回的所述用户标识对应的密钥。
  3. 根据权利要求1所述的方法，其特征在于，所述获取处于同一物联网中终端设备的设备标识和所述终端设备绑定的用户标识，包括：
    在与所述终端设备建立UDP本地通信通道的过程中，获取所述设备标识和所述用户标识。
  4. 根据权利要求1所述的方法，其特征在于，所述基于所述用户标识对应的密钥，对所述终端设备与所述云服务器通信时所需数据帧进行传输，包括：
    响应于接收所述终端设备发送的加密上行数据帧，基于所述设备标识获取所述用户标识对应的密钥；
    基于所述用户标识对应的密钥，对所述加密上行数据帧进行解密，得到解密上行数据帧；
    基于所述代理设备自身的密钥对所述解密上行数据帧进行加密，并发送给所述云服务器。
  5. 根据权利要求1所述的方法，其特征在于，所述基于所述用户标识对应的密钥，对所述终端设备与所述云服务器通信时所需数据帧进行传输，包括：
    响应于接收所述云服务器发送的加密下行数据帧，基于所述代理设备自身的密钥，对所述加密下行数据帧进行解密，得到解密下行数据帧；
    从所述解密下行数据帧中获取所述终端设备的设备标识；
    基于所述设备标识获取所述用户标识对应的密钥；
    基于所述用户标识对应的密钥，对所述解密下行数据帧进行加密，并发送给所述终端设备。
  6. 根据权利要求1-5任一项所述的方法，其特征在于，所述方法还包括：
    响应于接收到所述数据帧，从所述数据帧中提取时间戳，并基于所述时间戳和当前时间，获取时间差；
    响应于所述时间差小于或者等于窗口时间，确定所述数据帧为有效帧，对所述有效帧进行传输；
    响应于所述时间差大于所述窗口时间，确定所述数据帧为无效帧，对所述无效帧进行丢弃。
  7. 一种数据帧安全传输方法，其特征在于，适用于终端设备，所述方法包括：
    向处于同一物联网中代理设备发送所述终端设备的设备标识和自身绑定的用户标识；
    基于所述用户标识对应的密钥，通过所述代理设备与所述云服务器之间进行数据帧的传输。
  8. 根据权利要求7所述的方法，其特征在于，所述向处于同一物联网中代理设备发送所述终端设备的设备标识和绑定的用户标识，包括：
    在与所述代理设备建立UDP本地通信通道的过程中，向所述代理设备发送所述设备标识和所述用户标识。
  9. 根据权利要求7所述的方法，其特征在于，所述向处于同一物联网中代理设备发送所述终端设备的设备标识和绑定的用户标识之前，还包括：
    基于与所述云服务器之间的TCP连接通道，将所述用户标识对应的密钥、所述用户标识和所述终端设备的设备标识同步发送给所述云服务器。
  10. 根据权利要求7所述的方法，其特征在于，所述基于所述用户标识对应的密钥，通过所述代理设备与所述云服务器通之间进行数据帧的传输，包括：
    基于所述用户标识对应的密钥，对所述上行数据帧进行加密，并将加密上行数据帧发送给所述代理设备。
  11. 根据权利要求7所述的方法，其特征在于，所述基于所述用户标识对应的密钥，通过所述代理设备与所述云服务器通之间进行数据帧的传输，包括：
    接收所述代理设备发送的加密下行数据帧，并基于所述用户标识对应的密钥对所述加密下行数据帧进行解密，得到下行数据帧。
  12. 根据权利要求7-11任一项所述的方法，其特征在于，所述方法还包括：
    每接收到所述数据帧，从接收到的所述数据帧中提取时间戳，并基于所述时间戳和当前时间，获取时间差；
    响应于所述时间差小于或者等于窗口时间，确定所述数据帧为有效帧，对所述有效帧进行处理；
    响应于所述时间差大于所述窗口时间，确定所述数据帧为无效帧，对所述无效帧进行丢弃。
  13. 一种数据帧安全传输装置，其特征在于，适用于代理设备，所述装置包括：
    第一获取模块，被配置为执行获取处于同一物联网中终端设备的设备标识和所述终端设备绑定的用户标识；
    第二获取模块，被配置为执行基于所述设备标识和所述用户标识，从云服务器处获取所述用户标识 对应的密钥；
    传输模块，被配置为执行基于所述用户标识对应的密钥，对所述终端设备与所述云服务器通信时所需数据帧进行传输。
  14. 根据权利要求13所述的装置，其特征在于，所述第二获取模块，还被配置为执行：
    基于所述设备标识和所述用户标识，向云服务器发送密钥获取请求；
    接收所述云服务器返回的所述用户标识对应的密钥。
  15. 根据权利要求13所述的装置，其特征在于，所述第一获取模块，还被配置为执行：
    在与所述终端设备建立UDP本地通信通道的过程中，获取所述设备标识和所述用户标识。
  16. 根据权利要求13所述的装置，其特征在于，所述传输模块，还被配置为执行：
    响应于接收所述终端设备发送的加密上行数据帧，基于所述设备标识获取所述用户标识对应的密钥；
    基于所述用户标识对应的密钥，对所述加密上行数据帧进行解密，得到解密上行数据帧；
    基于所述代理设备自身的密钥对所述解密上行数据帧进行加密，并发送给所述云服务器。
  17. 根据权利要求13所述的装置，其特征在于，所述传输模块，还被配置为执行：
    响应于接收所述云服务器发送的加密下行数据帧，基于所述代理设备自身的密钥，对所述加密下行数据帧进行解密，得到解密下行数据帧；
    从所述解密下行数据帧中获取所述终端设备的设备标识；
    基于所述设备标识获取所述用户标识对应的密钥；
    基于所述用户标识对应的密钥，对所述解密下行数据帧进行加密，并发送给所述终端设备。
  18. 根据权利要求13-17任一项所述的装置，其特征在于，所述装置还包括：
    第三获取模块，被配置为执行响应于接收到所述数据帧，从所述数据帧中提取时间戳，并基于所述时间戳和当前时间，获取时间差；
    第一确定模块，被配置为执行响应于所述时间差小于或者等于窗口时间，确定所述数据帧为有效帧，对所述有效帧进行传输；
    第二确定模块，被配置为执行响应于所述时间差大于所述窗口时间，确定所述数据帧为无效帧，对所述无效帧进行丢弃。
  19. 一种数据帧安全传输装置，其特征在于，适用于终端设备，所述装置包括：
    发送模块，被配置为执行向处于同一物联网中代理设备发送所述终端设备的设备标识和自身绑定的用户标识；
    传输模块，被配置为执行基于所述用户标识对应的密钥，通过所述代理设备与所述云服务器之间进 行数据帧的传输。
  20. 根据权利要求19所述的装置，其特征在于，所述发送模块，还被配置为执行：
    在与所述代理设备建立UDP本地通信通道的过程中，向所述代理设备发送所述设备标识和所述用户标识。
  21. 根据权利要求19所述的装置，其特征在于，所述发送模块，还被配置为执行：
    所述向处于同一物联网中代理设备发送所述终端设备的设备标识和绑定的用户标识之前，基于与所述云服务器之间的TCP连接通道，将所述用户标识对应的密钥、所述用户标识和所述终端设备的设备标识同步发送给所述云服务器。
  22. 根据权利要求19所述的装置，其特征在于，所述传输模块，还被配置为执行：
    基于所述用户标识对应的密钥，对所述上行数据帧进行加密，并将加密上行数据帧发送给所述代理设备。
  23. 根据权利要求19所述的装置，其特征在于，所述传输模块，还被配置为执行：
    接收所述代理设备发送的加密下行数据帧，并基于所述用户标识对应的密钥对所述加密下行数据帧进行解密，得到下行数据帧。
  24. 根据权利要求19-23任一项所述的装置，其特征在于，所述装置还包括：
    获取模块，被配置为执行每接收到所述数据帧，从接收到的所述数据帧中提取时间戳，并基于所述时间戳和当前时间，获取时间差；
    第一确定模块，被配置为执行响应于所述时间差小于或者等于窗口时间，确定所述数据帧为有效帧，对所述有效帧进行处理；
    第二确定模块，被配置为执行响应于所述时间差大于所述窗口时间，确定所述数据帧为无效帧，对所述无效帧进行丢弃。
  25. 一种电子设备，其特征在于，包括：
    处理器；
    用于存储所述处理器的可执行指令的存储器；
    其中，所述处理器被配置为执行所述指令，以实现如权利要求1-6中任一项所述的方法，或者如权利要求7-12中任一项所述的方法。
  26. 一种计算机可读存储介质，其特征在于，当所述计算机可读存储介质中的指令由电子设备的处理器执行时，使得电子设备能够执行如权利要求1-6中任一项所述的方法，或者如权利要求7-12中任 一项所述的方法。
PCT/CN2022/084174 2022-03-30 2022-03-30 一种数据帧安全传输方法、装置、电子设备及存储介质 WO2023184262A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280000847.2A CN115280725A (zh) 2022-03-30 2022-03-30 一种数据帧安全传输方法、装置、电子设备及存储介质
PCT/CN2022/084174 WO2023184262A1 (zh) 2022-03-30 2022-03-30 一种数据帧安全传输方法、装置、电子设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/084174 WO2023184262A1 (zh) 2022-03-30 2022-03-30 一种数据帧安全传输方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2023184262A1 true WO2023184262A1 (zh) 2023-10-05

Family

ID=83758098

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/084174 WO2023184262A1 (zh) 2022-03-30 2022-03-30 一种数据帧安全传输方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115280725A (zh)
WO (1) WO2023184262A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115766130B (zh) * 2022-11-02 2024-04-19 中国联合网络通信集团有限公司 一种会议加密方法、装置、电子设备及存储介质
CN116881934B (zh) * 2023-06-05 2024-02-23 珠海妙存科技有限公司 一种数据的加解密方法、***、装置及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109639691A (zh) * 2018-12-19 2019-04-16 世纪龙信息网络有限责任公司 监控数据加密的方法、装置、计算机设备及存储介质
CN110856170A (zh) * 2019-11-18 2020-02-28 中国联合网络通信集团有限公司 数据传输方法、装置及物联网通信***
JP2020187247A (ja) * 2019-05-14 2020-11-19 日本放送協会 データ管理装置、ユーザ情報通知装置、ユーザ情報取得装置およびそれらのプログラム
CN112291230A (zh) * 2020-10-26 2021-01-29 公安部第一研究所 一种用于物联网终端的数据安全认证传输方法及装置
CN113722741A (zh) * 2021-09-07 2021-11-30 浙江大华技术股份有限公司 数据加密方法及装置、数据解密方法及装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101141244B (zh) * 2006-09-08 2010-05-26 飞塔公司 网络加密数据病毒检测和消除***和代理服务器及方法
CN104566783A (zh) * 2014-12-05 2015-04-29 广东志高空调有限公司 一种空调控制方法及***
CN109495258B (zh) * 2018-12-19 2022-05-13 天翼数字生活科技有限公司 监控数据解密的方法、装置、计算机设备及存储介质
CN113099443B (zh) * 2019-12-23 2024-05-17 阿里巴巴集团控股有限公司 设备认证方法、装置、设备和***
CN112637344A (zh) * 2020-12-23 2021-04-09 苏州三六零智能安全科技有限公司 物联网设备的监控方法、设备、装置以及存储介质
CN114244886B (zh) * 2021-11-22 2024-04-30 北京小米移动软件有限公司 设备控制方法、设备控制装置及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109639691A (zh) * 2018-12-19 2019-04-16 世纪龙信息网络有限责任公司 监控数据加密的方法、装置、计算机设备及存储介质
JP2020187247A (ja) * 2019-05-14 2020-11-19 日本放送協会 データ管理装置、ユーザ情報通知装置、ユーザ情報取得装置およびそれらのプログラム
CN110856170A (zh) * 2019-11-18 2020-02-28 中国联合网络通信集团有限公司 数据传输方法、装置及物联网通信***
CN112291230A (zh) * 2020-10-26 2021-01-29 公安部第一研究所 一种用于物联网终端的数据安全认证传输方法及装置
CN113722741A (zh) * 2021-09-07 2021-11-30 浙江大华技术股份有限公司 数据加密方法及装置、数据解密方法及装置

Also Published As

Publication number Publication date
CN115280725A (zh) 2022-11-01

Similar Documents

Publication Publication Date Title
WO2023184262A1 (zh) 一种数据帧安全传输方法、装置、电子设备及存储介质
CN110176987B (zh) 一种设备认证的方法、装置、设备和计算机存储介质
US9621543B2 (en) Intercepting encrypted network traffic for internet usage monitoring
TWI545446B (zh) 與一公用雲端網路一同使用之方法及系統
US10237253B2 (en) Private cloud routing server, private network service and smart device client architecture without utilizing a public cloud based routing server
WO2016082371A1 (zh) 一种基于ssh协议的会话解析方法及***
CN102868728B (zh) 在vdi环境下基于虚拟通道的网络代理方法
WO2019062666A1 (zh) 一种实现安全访问内部网络的***、方法和装置
US20100064130A1 (en) Secure host connection
WO2016106560A1 (zh) 一种实现远程接入的方法、装置及***
US11758401B2 (en) Network services in a mesh network
WO2020237880A1 (zh) 基于非对称加密技术的数据交换方法、发送终端和计算机可读存储介质
US11870760B2 (en) Secure virtual personalized network
US20140189343A1 (en) Secure internet protocol (ip) front-end for virtualized environments
WO2020168961A1 (zh) 一种数据处理方法及装置
US20180083777A1 (en) Methods, systems, apparatuses, and devices for securing network communications using multiple security protocols
WO2023184264A1 (zh) 一种流量代理方法、装置、电子设备及存储介质
US20140380038A1 (en) Secure internet protocol (ip) front-end for virtualized environments
CN112968919A (zh) 一种数据处理方法、装置、设备和存储介质
TWI537744B (zh) 不利用公用雲端型路由伺服器之私有雲端路由伺服器、私有網路服務及智慧型裝置客戶端架構
WO2014089968A1 (zh) 虚拟机***数据加密方法及设备
JP7366115B2 (ja) モバイルデバイスへの通知の配信
WO2023184263A1 (zh) 一种建立用户数据报协议udp传输通道的方法及装置
CN110719309B (zh) 虚拟桌面连接方法、代理装置、***、设备及存储介质
CN115622715B (zh) 一种基于令牌的分布式存储***、网关和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22934113

Country of ref document: EP

Kind code of ref document: A1