WO2024139734A1 - Key updating method and apparatus, electronic device, and computer readable storage medium - Google Patents

Abstract

The present application provides a key updating method and apparatus, an electronic device, and a computer readable storage medium, applied to an Internet of things system. The method comprises: synchronizing key updating actions of a device end and a serving end of an Internet of things system on the basis of a preset challenge response mechanism; updating keys of the device end and the serving end on the basis of a preset trigger condition; and performing communication of encrypted information of the device end and the serving end by means of the updated keys. The keys of the device end and the serving end of the Internet of things system are updated on the basis of the challenge response mechanism without issuing a key updating instruction, and the risk of being eavesdropped due to leakage of transmission channels does not exist, such that the security of key updating can be improved.

Description

Key updating method, device, electronic device and computer readable storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to Chinese patent application No. 202211686973.6, filed on December 27, 2022, and entitled “Key update method, device, electronic device and computer-readable storage medium”, which is incorporated herein by reference in its entirety.

Technical Field

The present application relates to the technical field of Internet of Things, and in particular to a key updating method, device, electronic device and computer-readable storage medium.

Background technique

Internet of Things technology has been widely used in industrial automation, smart home, smart medical care, connected cars and other fields. A typical Internet of Things system consists of many Internet of Things devices, a cloud service end, and a console.

Summary of the invention

In view of this, the purpose of the present application is to provide a key update method, device, electronic device and computer-readable storage medium to improve the security of key update in an Internet of Things system.

In a first aspect, an embodiment of the present application provides a key update method, which is applied to an Internet of Things system, and the method includes: synchronizing the key update actions of a device and a server of the Internet of Things system based on a pre-set challenge response mechanism; updating the keys of the device and the server based on pre-set trigger conditions; and communicating encrypted information between the device and the server through the updated keys.

In the second aspect, an embodiment of the present application also provides a key update device, which is applied to an Internet of Things system. The device includes: a key update synchronization module, which is used to synchronize the key update actions of the device and server sides of the Internet of Things system based on a pre-set challenge response mechanism; a key update module, which is used to update the keys of the device and server sides based on pre-set trigger conditions; and an encrypted information communication module, which is used to communicate encrypted information between the device and server sides through the updated key.

In a third aspect, an embodiment of the present application further provides an electronic device, comprising a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor The computer executable instructions are executed to implement the key updating method.

In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the above-mentioned key update method.

In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, wherein the computer program implements the above-mentioned key updating method when executed by a processor.

The embodiments of the present application bring the following beneficial effects:

The embodiments of the present application provide a key update method, device, electronic device, and computer-readable storage medium, which synchronize the key update actions of the device and server of the IoT system based on a pre-set challenge response mechanism; update the key of the device and server based on trigger conditions; and communicate encrypted information between the device and server through the updated key. The key of the device and server of the IoT system is updated based on the challenge response mechanism, without issuing a key update instruction, and there is no risk of eavesdropping due to leakage of the transmission channel, which can improve the security of key update.

Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by implementing the above-mentioned technology of the present disclosure.

In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a flow chart of a key updating method provided in an embodiment of the present application;

FIG2 is a flow chart of another key updating method provided in an embodiment of the present application;

FIG3 is a schematic diagram of a device-side and a server-side shared key provided in an embodiment of the present application;

FIG4 is a schematic diagram of a challenge response mechanism provided in an embodiment of the present application;

FIG. 5 is a method for determining whether a trigger condition is met by a counter according to an embodiment of the present application. Schematic diagram;

FIG6 is a schematic diagram of a key update component provided in an embodiment of the present application;

FIG7 is a schematic diagram of the structure of a key updating device provided in an embodiment of the present application;

FIG8 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

At present, IoT technology has been widely used in industrial automation, smart home, smart medical care, connected cars and other fields. A typical IoT system consists of many IoT devices, a cloud service, and a console. Before the cloud service and IoT devices communicate data, keys need to be set separately to ensure the security of the communication link. There are two typical processing methods:

(1) Preset the public and private keys of the device. The IoT device and the cloud service establish a session connection by exchanging information before communication. That is, the session key is generated by means of key negotiation, and the session key generated each time is different, thereby ensuring secure communication. (2) In order to save resources, the IoT device and the cloud service preset symmetric key information for direct encrypted communication.

Among them, the first processing method is relatively more resource-intensive and can be used on IoT devices with strong processing capabilities. The security of the symmetric session key established each time will also be high and not easily subject to information theft. The second processing method is a static symmetric session key, which consumes less resources and is easy to use. It is widely used in many IoT systems, especially in devices with weak processing capabilities and battery-powered devices. However, it also provides convenience for attackers. As long as they obtain the session key, they can permanently monitor device communications and even send malicious commands. Therefore, in order to improve the security of communication, the device and server can set up a shared key update mechanism.

The traditional shared key update mechanism is dominated by one end, and the shared key instruction is triggered by one end and issued by the other end. However, there is a problem with the above shared key update mechanism. If the transmission channel itself has been leaked, the newly updated key is also at risk of being eavesdropped, which violates the security principle that sensitive information is not allowed to be transmitted through untrusted channels, and has poor security.

Based on this, the embodiments of the present application provide a key update method, device, electronic device and computer-readable storage medium, which can be used for updating shared keys between the device side and the cloud service side. A security key update mechanism based on challenge response, self-synchronization, no need for device-side triggering, and issued by the cloud service side is proposed, which specifically involves the fields of information security, cryptography, Internet of Things security, and shared keys.

The key update mechanism proposed in this embodiment performs challenge response between the device and the server, synchronizes the key update action, and performs the same key processing mechanism on each side, and updates the shared key by inputting the update conditions. The above key update mechanism can not only solve the problem of sensitive information not being transmitted, but also trigger the refresh of the shared key information of the device and the server according to a variety of update conditions, and has the characteristics of being synchronizable, controllable, and securely updateable.

To facilitate understanding of this embodiment, a key updating method disclosed in an embodiment of the present application is first introduced in detail.

Embodiment 1:

The present application provides a key update method, which is applied to an Internet of Things system. Referring to FIG. 1 , a flowchart of a key update method is shown. The key update method includes the following steps:

Step S102: Synchronizing the key update actions of the device and the server of the IoT system based on a preset challenge response mechanism.

The IoT system in this embodiment may include a device side, a server side, and a console. The device side may refer to an IoT device with networking communication functions, such as smart home devices, industrial sensors, smart cars, smart cameras, smart robots, medical equipment, fitness equipment, etc. The server side may be a physical server or a cloud server, which is not limited in this embodiment. The server side and the device side are connected in communication.

The challenge response mechanism is that the authentication server sends a different "challenge" string to the device each time the authentication is performed. After the client program receives the "challenge" string, it makes a corresponding "response". For example, the device can send a challenge message to the server, and the server sends a response message to the device after receiving the challenge message.

In this embodiment, the key update actions of the device and the server of the IoT system can be synchronized through the challenge response mechanism. That is, if the device receives the response information returned by the server after sending the challenge information, it can be determined that the device has synchronized the key update action. The device can then return a confirmation message to the server, and the server can determine that the server has synchronized the key update action after receiving the confirmation message. The end also synchronizes the key update action.

Step S104: updating the keys of the device and the server based on the preset triggering conditions.

The triggering conditions in this embodiment can be pre-set, and after the triggering conditions are met, the device and the server can update the key. Among them, the device and the server can both be provided with key update components with the same parameters, so that various key update components can update their respective keys, thereby ensuring that the updated keys can match each other.

Step S106, communicating encrypted information between the device and the server using the updated key.

After completing the key update, for the target information that needs to be encrypted, the device or server can use the updated key to encrypt the information to obtain encrypted information, transmit the encrypted information to the server or device, and then the server or device decrypts the encrypted information to obtain the above-mentioned target information.

The embodiment of the present application provides a key update method, which synchronizes the key update actions of the device and the server of the Internet of Things system based on a pre-set challenge response mechanism; updates the key of the device and the server based on the trigger condition; and communicates the encrypted information between the device and the server through the updated key. The key of the device and the server of the Internet of Things system is updated based on the challenge response mechanism, without issuing a key update instruction, and there is no risk of eavesdropping due to leakage of the transmission channel, which can improve the security of key update.

Embodiment 2:

This embodiment provides another key update method, which is implemented on the basis of the above embodiment. As shown in FIG2 , there is a flow chart of another key update method. The key update method in this embodiment includes the following steps:

Step S202: Synchronize the key update actions of the device and the server of the IoT system based on a preset challenge response mechanism.

Specifically, the device side of the Internet of Things system in this embodiment sends a challenge message to the server side of the Internet of Things system; the server side returns a response message to the device side based on the challenge message; the device side synchronizes the key update action based on the response message and sends a confirmation message to the server side; the server side synchronizes the key update action based on the confirmation message.

Referring to FIG. 3, a schematic diagram of a device and a server sharing a key, a challenge response component can be set. If the server feeds back a normal response information to the device, the device will The synchronization satisfaction of the key update component is set to 1, and the device synchronizes the key update action. At the same time, the device feeds back a confirmation message to the server, and the server also sets the synchronization satisfaction of the key update component to 1, and also synchronizes the key update action.

Referring to the schematic diagram of a challenge response mechanism shown in FIG4 , the device uses a shared key to encrypt "hello" as a challenge message, and the server uses a shared key to decrypt the challenge message. If "hello" is obtained, a response message is returned. The device receives the response message, sets the synchronization satisfaction of the key update component to 1, and the device synchronizes the key update action. At the same time, the device encrypts "ok" as confirmation information and feeds it back to the server. The server decrypts the confirmation information and obtains "ok", sets the synchronization satisfaction of the key update component to 1, and the server also synchronizes the key update action.

In this embodiment, 1. a challenge response mechanism can be used to determine whether the device and the server trigger the same key update action, thereby avoiding the problem of asynchrony.

Step S204: updating the keys of the device and the server based on the preset triggering conditions.

Specifically, the triggering condition of this embodiment includes: the number of times the device and the server communicate reaches a preset number threshold, wherein the number of times the device and the server communicate can be recorded by a counter.

Referring to FIG5 , a schematic diagram of determining whether a trigger condition is met through a counter is shown. The device side uses a key to encrypt “Trigger 100”; the server side uses a key to decrypt. If “Trigger 100” is obtained, “Trigger begin” is returned to the device side, and 100 is entered into the counter to start decrementing. When the device side receives “Trigger begin”, 100 is also entered into the counter to start decrementing.

Perform normal data communication. After the communication is completed, the server continues to jump into the counter and perform a decrement operation. When the count reaches 0, it returns "Trigger end" to the device. The device receives "Trigger end" and determines whether the counter value is 1 at this time. If it is 1, it determines that the device meets the trigger condition and sends "Trigger ok" to the server. The server receives "Trigger ok" and sets the trigger condition of the key update component to 1 to determine that the server meets the trigger condition.

In addition, in this embodiment, different trigger conditions can be input to meet the key update in different scenarios. The trigger conditions of this embodiment can set other trigger modes according to the actual needs of the business, such as receiving certain special instructions, and directly executing the trigger conditions.

In this embodiment, the device side is provided with a first key update component, and the server side is provided with a second key update component. The parameters of the first key update component and the second key update component are the same. In this embodiment, the same parameters can be input into the key update component to determine the input parameters of the device side and the server side. Output the same key to avoid the situation where one end cannot decrypt.

Specifically, this embodiment can update the key of the device side based on the first key update component; and update the key of the device side based on the second key update component. Referring to the schematic diagram of a key update component shown in FIG6, when the device side and the server side have synchronized the key update action, and the device side and the server side both meet the triggering conditions, the key update can be performed. In addition, the key update component of this embodiment can also set different input information, and different generation logics can be used inside the component, and different security strengths can be determined according to the actual application scenario.

Step S206, updating the key identifiers of the device and the server; wherein the key identifier represents the number of times the key is updated; caching the key and key identifier of the device to the key synchronization table of the device; caching the key and key identifier of the server to the key synchronization table of the server.

In this embodiment, in addition to updating the key, the key identifier corresponding to the key can also be updated. The device side and the server side respectively establish their own key synchronization tables. The key synchronization table of the device side can be Request/Key; the key synchronization table of the server side can be Response/key. At this time, the initial key identifier and the corresponding key are placed in the key synchronization table, for example: device side: Request 0 Key0; cloud service side: Response0 key0.

After that, the device and the server can execute the normal business communication process. In the normal communication business process, the device request and the server response can be selected as the triggering condition of the key synchronization mechanism: when the device makes an application, it is recorded as Request 1, and the key of the device is updated to key1. When the server responds, it is recorded as Response 1, and the key is updated to key1. At this time, the key synchronization table can be refreshed as: device: Request 0 Key0 Request 1 Key1; cloud server: Response0 key0 Response1 key1. And so on, Request x Keyx and Requestx Keyx can be generated.

In addition, to ensure synchronization between the two ends and to give priority to storage space resources of the device, the key synchronization tables at both ends can ensure a certain cache volume, for example, maintaining 10 groups of data; at this time, the shared key is refreshed and the two ends are synchronized.

Step S208: The device and the server communicate encrypted information using the updated key.

The next time the target information that needs to be encrypted is communicated, the device can send a challenge message; the server returns a response message and enables the cached Request and Response keys as new shared keys; this iterative process continuously updates the shared key.

If you need to encrypt the target information for transmission, you can do it by following the steps below: Obtain target information; the device side determines the first key corresponding to the key identifier with the largest number of updates from the key synchronization table of the device side, encrypts the target information with the first key, and obtains encrypted information; the device side sends the encrypted information to the server side; the server side determines the second key corresponding to the key identifier with the largest number of updates from the key synchronization table of the server side, decrypts the encrypted information with the second key, and obtains the target information.

When communicating target information, the device side may first use the first key that was most recently updated (i.e., the one with the largest number of updates) for encryption, and the server side may first use the second key that was most recently updated (i.e., the one with the largest number of updates) for decryption.

In addition, if the server fails to decrypt the encrypted information using the second key, the encrypted information is decrypted using other keys other than the second key cached in the key synchronization table of the server in descending order of update times.

If the server fails to decrypt using the second key, it can use other keys cached in the key synchronization table except the first key for decryption. Generally speaking, other keys can be used in descending order of the number of updates.

If decryption of the encrypted information by other keys cached in the key synchronization table of the server fails, the server sends an error message to the device; based on the error message, the device encrypts the target information by other keys except the first key cached in the key synchronization table of the device in order of the number of updates from large to small, to obtain encrypted information.

If the server fails to decrypt the encrypted information using all the keys cached in the key synchronization table, the server may return an error message to the device. The device may re-encrypt the target information using other keys except the first key cached in the key synchronization table, and send the re-encrypted encrypted information to the server. The server may decrypt the re-encrypted encrypted information.

The above method provided in the embodiment of the present application does not have a complicated key negotiation mechanism, and achieves the same effect through a simple challenge response and a symmetric algorithm that consumes less resources. For IoT devices with weak processing capabilities, the burden of device resources can be reduced while ensuring security.

In this method, the device and the server do not have key update instructions or key transmission actions. They perform synchronization operations through some trigger conditions and common components to achieve synchronous update of shared keys, which can solve the security problem of direct transmission of key information. In this method, the input information in the key update component has the predicted initial key information and the random data packet, which is controllable, random, and reliable. The key update mechanism runs throughout the life cycle of the device. Provide sufficient resilience mechanisms to improve the unguessability of shared keys throughout the life cycle of the device.

The key update mechanism provided in this embodiment exists throughout the life cycle of the entire communication, and triggers the same update action through a challenge response mechanism, thereby avoiding the problem of shared key inconsistency caused by inconsistent updates. At the same time, throughout the entire life cycle, the shared key is dynamically adjusted, has randomness and timeliness, and can effectively improve the security of the key.

Embodiment three:

Corresponding to the above method embodiment, the embodiment of the present application provides a key update device, which is applied to the Internet of Things system. Referring to the structural schematic diagram of a key update device shown in FIG. 7, the key update device includes:

A key update synchronization module 71, used to synchronize the key update actions of the device side and the server side of the Internet of Things system based on a preset challenge response mechanism;

A key update module 72, used to update the keys of the device and the server based on a preset trigger condition;

The encrypted information communication module 73 is used to communicate encrypted information between the device and the server using the updated key.

The embodiment of the present application provides a key update device, which synchronizes the key update actions of the device and the server of the IoT system based on a pre-set challenge response mechanism; updates the key of the device and the server based on trigger conditions; and communicates encrypted information between the device and the server through the updated key. The key of the device and the server of the IoT system is updated based on the challenge response mechanism, without issuing a key update instruction, and there is no risk of eavesdropping due to leakage of the transmission channel, which can improve the security of key update.

The above-mentioned key update synchronization module is used for the device side of the Internet of Things system to send challenge information to the server side of the Internet of Things system; the server side returns response information to the device side based on the challenge information; the device side determines the synchronization key update action based on the response information and sends confirmation information to the server side; the server side synchronizes the key update action based on the confirmation information.

The trigger condition includes: the number of times the device and the server communicate reaches a preset number threshold.

The device is provided with a first key update component, and the server is provided with a second key update component, and the parameters of the first key update component and the second key update component are the same;

The key updating module is used to update the key of the device side based on the first key updating component; and to update the key of the device side based on the second key updating component.

The above-mentioned device includes: a key synchronization table cache module, which is used to update the key identifier of the device side and the server side; wherein the key identifier represents the number of times the key is updated; cache the key and key identifier of the device side to the key synchronization table of the device side; cache the key and key identifier of the server side to the key synchronization table of the server side.

The above-mentioned encrypted information communication module is used for the device side to obtain the target information; the device side determines the first key corresponding to the key identifier with the largest number of updates from the key synchronization table of the device side, encrypts the target information by the first key, and obtains the encrypted information; the device side sends the encrypted information to the server side; the server side determines the second key corresponding to the key identifier with the largest number of updates from the key synchronization table of the server side, decrypts the encrypted information by the second key, and obtains the target information.

The encrypted information communication module is also used to decrypt the encrypted information by using other keys other than the second key cached in the key synchronization table of the server in descending order of update times if the server fails to decrypt the encrypted information by using the second key.

The above-mentioned encrypted information communication module is also used to send an error message to the device side if the decryption of the encrypted information by other keys cached in the key synchronization table of the server side fails; based on the error information, the device side encrypts the target information by other keys except the first key cached in the key synchronization table of the device side in order of the number of updates from large to small, so as to obtain encrypted information.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the key updating device described above can refer to the corresponding process in the aforementioned embodiment of the key updating method, which will not be repeated here.

Embodiment 4:

An embodiment of the present application also provides an electronic device for running the above-mentioned key update method; referring to the structural diagram of an electronic device shown in FIG8 , the electronic device includes a memory 100 and a processor 101, wherein the memory 100 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor 101 to implement the above-mentioned key update method.

Furthermore, the electronic device shown in FIG. 8 further includes a bus 102 and a communication interface 103 , and the processor 101 , the communication interface 103 and the memory 100 are connected via the bus 102 .

The memory 100 may include a high-speed random access memory (RAM). Access Memory), and may also include non-volatile memory, such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 103 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. Bus 102 can be ISA bus, PCI bus or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one bidirectional arrow is used in Figure 8, but it does not mean that there is only one bus or one type of bus.

The processor 101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 101 or the instruction in the form of software. The above processor 101 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 100, and the processor 101 reads the information in the memory 100 and completes the steps of the method of the above embodiment in combination with its hardware.

An embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the above-mentioned key update method. The specific implementation can be found in the method embodiment, which will not be repeated here.

The key updating method, device, electronic device and computer program product of a computer-readable storage medium provided in the embodiments of the present application include a computer-readable storage medium storing a program code. The instructions included in the program code can be used to execute the method in the previous method embodiment. For specific implementation, please refer to See the method embodiment, which will not be described here in detail.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and/or device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

In addition, in the description of the embodiments of the present application, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

In the description of the present application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present application. In addition, the terms "first", "second", and "third" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solution of the present application, rather than to limit it. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in this field should understand that any technician familiar with the technical field is within the technical scope disclosed in this application. It is still possible to modify the technical solutions recorded in the aforementioned embodiments or to easily conceive of changes, or to make equivalent replacements for some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should be included in the protection scope of this application. Therefore, the protection scope of this application shall be based on the protection scope of the claims.

Claims (12)

A key updating method, wherein the method is applied to an Internet of Things system, the method comprising: Synchronize the key update actions of the device and the server of the IoT system based on a preset challenge response mechanism; Updating the keys of the device and the server based on a preset trigger condition; The encrypted information between the device and the server is communicated via the updated key. The method according to claim 1, wherein the step of synchronizing the key update actions of the device side and the server side of the Internet of Things system based on a preset challenge response mechanism comprises: The device end of the Internet of Things system sends a challenge message to the server end of the Internet of Things system; The server returns response information to the device based on the challenge information; The device synchronizes the key update action based on the response information and sends a confirmation message to the server; The server synchronizes a key update action based on the confirmation information. The method according to any one of claims 1 to 2, wherein the trigger condition includes: the number of times the device end and the server end communicate reaches a preset number threshold. The method according to any one of claims 1 to 3, wherein the device end is provided with a first key update component, the server end is provided with a second key update component, and the parameters of the first key update component and the second key update component are the same; The step of updating the keys of the device side and the server side includes: updating the key of the device side based on the first key updating component; and updating the key of the device side based on the second key updating component. The method according to any one of claims 1 to 4, wherein after the step of updating the keys of the device and the server based on a preset trigger condition, the method further comprises: Updating the key identifiers of the device and the server; wherein the key identifier represents the number of times the key is updated; caching the key and key identifier of the device end to the key synchronization table of the device end; The key and key identifier of the server are cached in a key synchronization table of the server. The method according to claim 5, wherein the step of communicating the encrypted information between the device and the server using the updated key comprises: The device side obtains target information; The device determines, from the key synchronization table of the device, a first key corresponding to the key identifier with the largest number of updates, and encrypts the target information by using the first key to obtain encrypted information; The device sends the encrypted information to the server; The server determines the second key corresponding to the key identifier with the largest number of updates from the key synchronization table of the server, and decrypts the encrypted information using the second key to obtain the target information. The method according to claim 6, wherein after the step of decrypting the encrypted information by using the second key, the method further comprises: If the server fails to decrypt the encrypted information using the second key, the encrypted information is decrypted using other keys other than the second key cached in the key synchronization table of the server in descending order of update times. The method according to claim 7, wherein after the step of sequentially decrypting the encrypted information using other keys other than the second key cached in the key synchronization table of the server, the method further comprises: If decryption of the encrypted information by the other keys cached in the key synchronization table of the server fails, the server sends an error message to the device; Based on the error information, the device side encrypts the target information using other keys except the first key cached in the key synchronization table of the device side in descending order of update times to obtain encrypted information. A key updating device, wherein the device is applied to an Internet of Things system, and the device comprises: A key update synchronization module, used to synchronize key update actions of the device side and the server side of the Internet of Things system based on a preset challenge response mechanism; A key update module, used to update the keys of the device and the server based on a preset trigger condition; The encrypted information communication module is used to communicate the encrypted information between the device and the server through the updated key. An electronic device, comprising a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the key update method according to any one of claims 1 to 8. A computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to implement the key update method according to any one of claims 1 to 8. A computer program product comprises a computer program, wherein when the computer program is executed by a processor, the key updating method according to any one of claims 1 to 8 is implemented.