CN115622719B - A method, device and system for processing data of Internet of Things - Google Patents

Abstract

The invention provides a method, a device and a system for processing data of the Internet of things, wherein the method comprises the following steps: receiving an access request for requesting to access the internet of things data of a second service end from a first service end, wherein the access request carries a temporary certificate of the second service end, and the temporary certificate adopts an identity private key of the first service end to carry out digital signature; decrypting the temporary certificate by adopting a decryption private key and verifying the digital signature of the first service end through a blockchain system so as to verify the validity of the first service end; after verifying that the first service end is legal, acquiring target Internet of things data corresponding to the temporary certificate through a blockchain system and an interstellar file system IPFS; and sending the acquired target internet of things data to a first service end.

Description

A method, device and system for processing data of Internet of Things

Technical Field

The present invention relates to the field of data processing technology, and in particular to an Internet of Things data processing method, device and system.

Background technique

With the development of IoT technology, various IoT data have surged, and the amount of data is getting larger and larger, and the requirements for data storage, data sharing and data security are getting higher and higher. Currently, blockchain technology, InterPlanetary File System (IPFS), electronic signature technology, Hyperledger Fabric database and other methods are commonly used for data storage, data sharing and data security.

Regarding blockchain, blockchain is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. In a narrow sense, blockchain is a distributed ledger that combines data blocks in a sequential manner in chronological order to form a chain data structure, and is cryptographically guaranteed to be tamper-proof and unforgeable. In a broad sense, blockchain technology is a new distributed infrastructure and computing method that uses block chain data structures to verify and store data, uses distributed node consensus algorithms to generate and update data, uses cryptography to ensure the security of data transmission and access, and uses smart contracts composed of automated script codes to program and operate data. From a data perspective, blockchain combines data blocks in a sequential manner in chronological order to form a chain data structure, and the data structure is cryptographically guaranteed to be tamper-proof and unforgeable. From a technical perspective, blockchain technology integrates a variety of different technologies. By building a blockchain network, each node in the network is allowed to obtain a complete copy of the data block, and the update of the data block based on the blockchain is maintained based on the consensus mechanism and competitive computing. As a result, the decentralization and trustlessness of data storage and management are achieved through an end-to-end network composed of multi-node communication.

About IPFS, IPFS is a network transmission protocol designed to create persistent and distributed storage and sharing of files. It is a content-addressable peer-to-peer hypermedia distribution protocol. Nodes in the IPFS network will form a distributed file system. IPFS is a peer-to-peer distributed file system that attempts to connect the same file system to all computing devices. In some ways, IPFS is similar to the World Wide Web, but it can also be seen as an independent BitTorrent group, exchanging objects in the same Git repository. IPFS provides a high-throughput, content-addressed block storage model, as well as hyperlinks associated with the content. This forms a generalized Merkle directed acyclic graph (DAG). IPFS combines a distributed hash table, encourages block exchange, and a self-certified namespace. IPFS has no single point of failure, and nodes do not need to trust each other. Distributed content delivery can save bandwidth and prevent DDoS attacks that HTTP schemes may encounter.

Regarding electronic signatures, the implementation of electronic signature technology requires the use of asymmetric encryption (such as RSA algorithm) and message digests (such as HASH algorithm). Asymmetric encryption means that the user has two keys, one is a public key and the other is a private key. The public key is public and can be used by anyone, and the private key is confidential and can only be used by the user himself. The public key and the private key are in a corresponding relationship. The user can encrypt information with the other party's public key and send it to the other party. The other party uses his private key to decrypt the ciphertext. The public and private keys are mutually decrypted, and absolutely no third party can insert it. The message digest uses the HASH algorithm to calculate any information to be transmitted and generate a 128-bit message digest. Information with different contents will definitely generate different message digests, so the message digest becomes the "fingerprint" of electronic information.

For asymmetric encryption algorithms, asymmetric encryption algorithms require two keys: a public key (publickey: referred to as public key) and a private key (privatekey: referred to as private key). The public key and the private key are a pair. If the data is encrypted with the public key, it can only be decrypted with the corresponding private key. Because encryption and decryption use two different keys, this algorithm is called an asymmetric encryption algorithm. The basic process of asymmetric encryption algorithms to achieve confidential information exchange is: Party A generates a pair of keys and makes the public key public. Other roles (Party B) who need to send information to Party A use the key (Party A's public key) to encrypt the confidential information and then send it to Party A; Party A then uses its own private key to decrypt the encrypted information. When Party A wants to reply to Party B, it is just the opposite. It uses Party B's public key to encrypt the data. Similarly, Party B uses its own private key to decrypt. Characteristics of asymmetric cryptographic systems: The algorithm strength is complex and security depends on the algorithm and key. However, due to the complexity of the algorithm, the encryption and decryption speed is not as fast as that of symmetric encryption and decryption. There is only one key in the symmetric cryptographic system, and it is non-public. If you want to decrypt, you have to let the other party know the key. Therefore, to ensure its security is to ensure the security of the key. The asymmetric key system has two keys, one of which is public. In this way, there is no need to transmit the other party's key like in symmetric encryption, which makes the security much greater.

Regarding Hyperledger Fabric databases, Fabric has two types of databases: one is the ledger and the other is the state database. Among them, the ledger is the actual "blockchain", which is a file-based ledger that stores serialized blocks. Each block has one or more transactions, and each transaction contains a read-write set that modifies one or more key/value pairs. The ledger is the ultimate source of authority and is immutable. The state database holds the last known committed value for any given key, and it is populated when each peer verifies and commits the transaction. The state database can always be rebuilt by reprocessing the ledger, and there are currently two state database options: embedded LevelDB or external CouchDB.

However, in the existing data processing methods, IPFS usually stores the plain text of IoT data files, and the blockchain stores the encrypted ciphertext of the data file Hash. Since the entire system does not encrypt and store the IoT data itself, this results in poor data security.

Summary of the invention

The purpose of the present invention is to provide an Internet of Things data processing method, device and system to solve the problem of poor Internet of Things data security in the prior art.

To achieve the above object, an embodiment of the present invention provides an Internet of Things data processing method, which is applied to a server, comprising:

Receiving, from the first service end, an access request for accessing IoT data of the second service end, the access request carrying a temporary certificate of the second service end, the temporary certificate being digitally signed using an identity private key of the first service end;

Decrypting the temporary certificate using the decryption private key and verifying the digital signature of the first business end through the blockchain system to verify the legitimacy of the first business end;

After verifying the legitimacy of the first business end, the target IoT data corresponding to the temporary certificate is obtained through the blockchain system and the Interstellar File System IPFS system;

The acquired target IoT data is sent to the first service end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity identification ID of the second business end, identity identification ID of the first business end, and signature of the second business end.

Optionally, obtaining target IoT data corresponding to the temporary certificate through the blockchain system and the InterPlanetary File System (IPFS) system includes:

Reading a file hash Hash corresponding to the data type described in the temporary certificate from the blockchain system;

Read the IoT data ciphertext corresponding to the file Hash from the IPFS system;

The decryption private key in the temporary certificate is used to decrypt the IoT data ciphertext to obtain the target IoT data in plaintext.

Optionally, before receiving an access request for accessing IoT data of a second service end from a first service end, the method further includes:

A data sharing agreement is established between the first business end and the second business end, and a temporary certificate of the second business end is issued to the first business end.

Optionally, before receiving an access request for accessing IoT data of a second service end from a first service end, the method further includes:

Obtaining a server-side encryption and decryption public and private key pair, wherein the encryption and decryption public and private key pair includes a decryption private key and an encryption public key;

The decryption private key is stored locally, and the encryption public key is sent to the first service end and the second service end.

Optionally, before receiving an access request for accessing IoT data of a second service end from a first service end, the method further includes:

Receive IoT data of an IoT device corresponding to the second service end, wherein the IoT data is digitally signed using the identity private key of the second service end;

Verifying the digital signature of the second business end through the blockchain system to verify the legitimacy of the second business end;

After verifying that the second service end is legitimate, the IoT data is cached into a corresponding data sequence according to the type of the IoT data.

Optionally, according to the type of the IoT data, after caching the IoT data into a corresponding data sequence, the method further includes:

After a predetermined interval or after a predetermined cache capacity is reached, reading the encryption public key of the second service end for the type of the IoT data from the blockchain system;

The IoT data is encrypted using the read encryption public key and stored in the IPFS system to obtain the corresponding file Hash;

The file Hash is stored in the blockchain system.

Optionally, the decryption private key for the type of IoT data corresponding to the encryption public key for the type of IoT data is stored in the second service end.

To achieve the above object, an embodiment of the present invention provides an Internet of Things data processing method, which is applied to a first service end and includes:

Sending an access request for accessing IoT data of the second service end to the service end, wherein the access request carries a temporary certificate of the second service end, and the temporary certificate is digitally signed with the identity private key of the first service end;

The target IoT data corresponding to the temporary certificate is received from the server. The target IoT data is obtained by the server through the blockchain system and the Interstellar File System IPFS system after verifying the legitimacy of the first business end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity identification ID of the second business end, identity identification ID of the first business end, and signature of the second business end.

Optionally, before sending an access request for accessing IoT data of the second service end to the service end, the method further includes:

Establishing a data sharing agreement with the second service end;

Receive the temporary certificate of the second service end.

Optionally, before sending an access request for accessing IoT data of the second service end to the service end, the method further includes:

An encrypted public key is received from a server, and a decryption private key corresponding to the encrypted public key of the server is stored in the server.

Optionally, before sending an access request for accessing IoT data of the second service end to the service end, the method further includes:

Obtaining the public and private key pair of the first service end, wherein the public and private key pair includes: an identity verification public key and an identity signature private key;

Storing the identity signature private key locally and sending the identity signature private key to the server;

Send the identity verification public key to the blockchain system.

To achieve the above object, an embodiment of the present invention provides an Internet of Things data processing device, which is applied to a server, including:

A first receiving module is used to receive an access request for accessing IoT data of a second business end from a first business end, where the access request carries a temporary certificate of the second business end, and the temporary certificate is digitally signed with an identity private key of the first business end;

A first verification module, used to decrypt the temporary certificate using a decryption private key and verify the digital signature of the first business end through the blockchain system to verify the legitimacy of the first business end;

The first acquisition module is used to obtain the target IoT data corresponding to the temporary certificate through the blockchain system and the InterPlanetary File System IPFS system after verifying the legitimacy of the first business end;

The first sending module is used to send the acquired target Internet of Things data to the first service end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity identification ID of the second business end, identity identification ID of the first business end, and signature of the second business end.

Optionally, the first acquisition module includes:

A first reading unit, configured to read a file hash Hash corresponding to the data type described in the temporary certificate from the blockchain system;

A second reading unit is used to read the IoT data ciphertext corresponding to the file Hash from the IPFS system;

The first decryption unit is used to decrypt the IoT data ciphertext using the decryption private key in the temporary certificate to obtain the target IoT data in plain text.

Optionally, the Internet of Things data processing device further includes:

A first establishing module is used to establish a data sharing agreement between the first service end and the second service end.

The second sending module is used to issue the temporary certificate of the second service end to the first service end.

Optionally, the Internet of Things data processing device further includes:

A second acquisition module is used to obtain a public-private key pair for encryption and decryption from the server, wherein the public-private key pair for encryption and decryption includes a decryption private key and an encryption public key;

A first storage module is used to store the decryption private key locally.

The third sending module is used to send the encrypted public key to the first service end and the second service end.

Optionally, the Internet of Things data processing device further includes:

A second receiving module is used to receive IoT data of an IoT device corresponding to a second service end, wherein the IoT data is digitally signed using an identity private key of the second service end;

A second verification module, used to verify the digital signature of the second business end through the blockchain system to verify the legitimacy of the second business end;

A cache module is used to cache the IoT data into a corresponding data sequence according to the type of the IoT data after verifying that the second service end is legitimate.

Optionally, the Internet of Things data processing device further includes:

A first reading module, configured to read, from the blockchain system, an encrypted public key of the second service end for the type of the IoT data after a predetermined interval or after a predetermined cache capacity is reached;

An encryption module, used to encrypt the IoT data using the read encryption public key;

The second storage module is used to store the encrypted IoT data in the IPFS system to obtain the corresponding file Hash;

The third storage module is used to store the file Hash in the blockchain system.

Optionally, the decryption private key for the type of IoT data corresponding to the encryption public key for the type of IoT data is stored in the second service end.

To achieve the above object, an embodiment of the present invention provides an Internet of Things data processing device, which is applied to a first service end and includes:

A fourth sending module is used to send an access request for accessing the IoT data of the second business end to the server, where the access request carries a temporary certificate of the second business end, and the temporary certificate is digitally signed with the identity private key of the first business end;

The third receiving module is used to receive the target IoT data corresponding to the temporary certificate from the server. The target IoT data is obtained by the server through the blockchain system and the Interstellar File System IPFS system after verifying the legitimacy of the first business end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity identification ID of the second business end, identity identification ID of the first business end, and signature of the second business end.

Optionally, the Internet of Things data processing device further includes:

A second establishing module, used to establish a data sharing agreement with the second service end;

The fourth receiving module is used to receive the temporary certificate of the second service end.

Optionally, the Internet of Things data processing device further includes:

The fifth receiving module is used to receive the encrypted public key of the server, and the decryption private key corresponding to the encrypted public key of the server is stored in the server.

Optionally, the Internet of Things data processing device further includes:

A third acquisition module is used to obtain the public and private key pair of the identity of the first service end, wherein the public and private key pair of the identity includes: an identity verification public key and an identity signature private key;

The fourth storage module is used to store the identity signature private key locally,

A fifth sending module, used to send the identity signature private key to the server;

The sixth sending module is used to send the identity verification public key to the blockchain system.

To achieve the above-mentioned purpose, an embodiment of the present invention provides an Internet of Things data processing system, including: a server, a first business terminal, a second business terminal, a blockchain system, an InterPlanetary File System IPFS system and an Internet of Things device, wherein:

The first service end sends an access request to the service end for accessing the IoT data of the second service end;

The server receives the access request, which carries the temporary certificate of the second service end, and the temporary certificate is digitally signed with the identity private key of the first service end;

The server uses the decryption private key to decrypt the temporary certificate and verifies the digital signature of the first business end through the blockchain system to verify the legitimacy of the first business end;

After verifying the legitimacy of the first business end, the server obtains the target IoT data corresponding to the temporary certificate through the blockchain system and the IPFS system;

The server sends the acquired target IoT data to the first service end;

The first business end receives target IoT data corresponding to the temporary certificate.

To achieve the above-mentioned purpose, an embodiment of the present invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps in the IoT data processing method of the above-mentioned server or first business end are implemented.

The beneficial effects of the above technical solution of the present invention are as follows:

The embodiment of the present invention provides data sharing authorization in the form of a temporary certificate, ensuring that only compliant owners who submit temporary certificates to the server can obtain IoT data, and data accessors cannot obtain sensitive and private information such as decryption private keys, thereby improving privacy security.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a method for processing IoT data on a server side according to an embodiment of the present invention;

FIG2 is a schematic diagram of a data sharing process according to an embodiment of the present invention;

FIG3 is a schematic diagram of an authorization process according to an embodiment of the present invention;

FIG4 is a schematic diagram of a data storage process according to an embodiment of the present invention;

FIG5 is a schematic diagram of the data structure of enterprise identity information according to an embodiment of the present invention;

FIG6 is a schematic diagram of a data structure of an IoT device identity information according to an embodiment of the present invention;

7 is a schematic diagram of a flow chart of a method for processing IoT data at a first service end in an embodiment of the present invention;

FIG8 is a schematic diagram of the structure of an Internet of Things data processing device at a server end in an embodiment of the present invention;

9 is a schematic diagram of the structure of an Internet of Things data processing device of a first service end in an embodiment of the present invention;

FIG. 10 is a schematic diagram of the system architecture of a physical network data processing system according to an embodiment of the present invention.

Detailed ways

In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

It should be understood that the references to "one embodiment" or "an embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present invention. Therefore, the references to "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

In various embodiments of the present invention, it should be understood that the size of the serial numbers of the following processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

Additionally, the terms "system" and "network" are often used interchangeably herein.

In the embodiments provided in the present application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined according to A. However, it should also be understood that determining B according to A does not mean determining B only according to A, and B can also be determined according to A and/or other information.

As shown in FIG1 , an IoT data processing method according to an embodiment of the present invention is applied to a server, and includes but is not limited to the following steps:

Step 11: Receive an access request for accessing IoT data of the second business end from the first business end, where the access request carries a temporary certificate of the second business end, and the temporary certificate is digitally signed using the identity private key of the first business end.

Among them, the first business terminal corresponds to the first enterprise, and the second business terminal corresponds to the second enterprise. Each enterprise has its own business terminal, and the enterprise can apply to access the IoT data of other enterprises through the business terminal. Both the first business terminal and the second business terminal can be used as data access parties or data sharing parties. This embodiment only takes the first business terminal as a data access party and the second business terminal as a data sharing party as an example for explanation. The identities of the first business terminal and the second business terminal can be interchangeable, and the first business terminal and the second business terminal are any two business terminals in the IoT data processing system and are not specific.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity identification ID of the second business end, identity identification ID of the first business end, and signature of the second business end, so that the temporary certificate can specify the data type and time period; and the usage time or number of times can be limited by specifying the validity period of the temporary certificate to improve data access flexibility.

Step 12: Decrypt the temporary certificate using the decryption private key and verify the digital signature of the first business end through the blockchain system to verify the legitimacy of the first business end.

By verifying the legitimacy of the first business end, only compliant owners are allowed to submit temporary certificates to the server to obtain IoT data, which can improve the security of data access.

Step 13: After verifying the legitimacy of the first business end, obtain the target IoT data corresponding to the temporary certificate through the blockchain system and the Interstellar File System IPFS system.

By jointly storing IoT data through the blockchain system and the IPFS system, data security can be improved.

Optionally, step 13 includes: reading the file hash Hash corresponding to the data type described in the temporary certificate from the blockchain system; reading the IoT data ciphertext corresponding to the file hash from the IPFS system; decrypting the IoT data ciphertext using the decryption private key in the temporary certificate to obtain the target IoT data in plain text. In this way, the IoT data file ciphertext is stored in IPFS, which fundamentally improves data security.

Step 14: Send the acquired target IoT data to the first service end.

Optionally, before step 11, the method further includes: establishing a data sharing agreement between the first business end and the second business end, and issuing a temporary certificate of the second business end to the first business end.

The above introduces the data sharing process in the IoT data processing method. The following will further illustrate a more complete data sharing process with reference to the accompanying drawings.

As shown in Figure 2, the data sharing process includes but is not limited to the following steps:

Step 21: Each enterprise has a business end, and the enterprise applies to the server for access to other enterprises' IoT data, such as access to IoT data of a certain data type or time period.

Step 22: After the other enterprise and the enterprise reach an agreement, the other enterprise generates a temporary certificate through the business end and issues the temporary certificate to the enterprise. The temporary certificate contains the data type, time period, decryption private key, data sharing party ID, data access party ID, data sharing party signature, etc.

Step 23: The enterprise submits the temporary certificate to the server and digitally signs it using the identity private key.

Step 24: The server uses blockchain to verify the legitimacy of the enterprise identity, parse and verify the temporary certificate, such as using the server's decryption private key to decrypt the temporary certificate, and use blockchain to verify the digital signature of the issuer in the temporary certificate.

Step 25: The server reads the file Hash corresponding to the data type described in the temporary certificate from the blockchain.

Step 26: The server reads the IoT data ciphertext corresponding to the file Hash from the IPFS system.

Step 27: The server uses the decryption private key in the temporary certificate to decrypt the ciphertext and obtain the original plaintext IoT data.

Step 28: The server returns the plaintext original IoT data to the enterprise.

Optionally, in addition to the data sharing process, the IoT data processing method of the embodiment of the present invention also includes an authorization process to ensure that only authorized devices and service terminals can access the system, thereby improving the security of the system.

Optionally, before step 11, the method further includes: obtaining a public-private key pair for encryption and decryption from the server, the public-private key pair for encryption and decryption including a decryption private key and an encryption public key; storing the decryption private key locally, and sending the encryption public key to the first service end and the second service end. In this way, the decryption private key is only stored on the server and not on the data access party (the first service end), thereby ensuring privacy and security.

The above briefly introduces the authorization process of the present invention. The following will further illustrate a more complete authorization process with reference to the accompanying drawings.

As shown in Figure 3, the authorization process includes but is not limited to the following steps:

Step 31: Use a third-party security agency, blockchain or server to generate public and private key pairs for IoT devices, enterprise business terminals and servers.

Step 32: The IoT device, enterprise business end, and server end store the private key locally, and the blockchain stores the corresponding public key.

Step 33: Use a third-party security agency, blockchain or server to generate a server-side encryption and decryption public and private key pair.

Step 34: The server saves the decryption private key locally and distributes the encryption public key to all enterprise business terminals.

Step 35: Use a third-party security agency, blockchain or server to generate public and private key pairs for encryption and decryption of each data type for the enterprise business end.

Step 36: The enterprise business end saves the decryption private key locally, and the blockchain stores the corresponding encryption public key.

In this embodiment, blockchain is used to store the identity information of IoT devices and enterprise business terminals and provide an identity authentication mechanism, which ensures that only authorized devices and business terminals can access the system, thereby improving system security.

Optionally, in addition to the data sharing process and the authorization process, the IoT data processing method of the embodiment of the present invention also includes a data storage process to ensure that only authorized devices can store data, thereby improving the security of the system.

Optionally, before step 11, the method also includes: receiving IoT data of the IoT device corresponding to the second business end, and digitally signing the IoT data using the identity private key of the second business end; verifying the digital signature of the second business end through the blockchain system to verify the legitimacy of the second business end; after verifying the legitimacy of the second business end, caching the IoT data to a corresponding data sequence according to the type of the IoT data.

Optionally, according to the type of IoT data, after caching the IoT data into a corresponding data sequence, the method further includes:

After a predetermined time interval or when the predetermined cache capacity is reached, the encryption public key of the second business end for the type of IoT data is read from the blockchain system; the IoT data is encrypted using the read encryption public key and stored in the IPFS system to obtain the corresponding file Hash; the file Hash is stored in the blockchain system. In this way, the ciphertext of the IoT data file is saved in IPFS, which fundamentally improves data security.

Optionally, a decryption private key for the type of IoT data corresponding to the encryption public key for the type of IoT data is stored in the second service end.

The above briefly introduces the data storage process. The following is a further introduction to a more complete data storage process with reference to the accompanying drawings.

As shown in FIG4 , the data storage process includes but is not limited to:

Step 41: Each enterprise has a number of IoT devices, and the IoT devices upload IoT data to the server and use the identity private key attachment to digitally sign.

Step 42: The server uses the blockchain to verify the legitimacy of the IoT device identity. That is, the server obtains the IoT device identity public key from the blockchain and uses the public key to verify the digital signature.

Step 43: If the signature verification is successful, the server caches the legal data into different sequences according to the data type.

Step 44: After the predetermined time interval or the predetermined cache capacity is reached, the server reads the encryption public key of the corresponding enterprise and the corresponding data type from the blockchain and encrypts the cached data series.

Step 45: The server stores the ciphertext in the IPFS system and obtains the file Hash.

Step 46: The server stores the file Hash in the blockchain.

In the embodiment of the present invention, when the IoT device uploads data, the identity authentication only uses the blockchain query type operation (without consensus verification). Only when the server writes the cached data to IPFS will the blockchain invoke type operation (for consensus verification) be used. This improves the system security while ensuring the system concurrency capability.

Among them, in the embodiment of the present invention, the data structure of the blockchain stores two types of identity information data structures: enterprise identity information data structure and device identity information data structure.

A feasible enterprise identity information data structure is shown in Figure 5. The "Enterprise Description" describes the enterprise introduction; the "Enterprise Identity Public Key" describes the enterprise identity authentication information; the "Data Type and Encryption Public Key, File Hash Mapping Relationship" describes a list, each unit of the list is a map, the key of the map is the data type, the value is a map and the map includes the encryption public key and the file Hash.

A feasible device identity information data structure is shown in Figure 6. The "device description" describes the device introduction; the "enterprise identity ID" describes which enterprise the device belongs to; and the "device identity public key" describes the device identity authentication information.

In addition, the temporary certificate in the embodiment of the present invention is an encrypted information encrypted using the server encryption public key, and the encrypted content includes the data type, time period, decryption private key, data sharing party ID, data access party ID, data sharing party signature, etc.

In an embodiment of the present invention, enterprise A applies to access the IoT data of enterprise B, and needs a temporary certificate provided by enterprise B. After receiving the temporary certificate, the server first uses the server's decryption private key to decrypt the encrypted information, thereby obtaining plain text including data type, time period, decryption private key, data sharing party ID, data access party ID, data sharing party signature, etc.; then the data sharing party signature is verified by the data sharing party identity public key stored in the blockchain; after the verification is passed, the plain text corresponding to the IoT data ciphertext in the corresponding IPFS is obtained according to the data type, time period, and decryption private key. In this way, it can be ensured that only compliant owners who submit temporary certificates to the server can obtain IoT data. Temporary certificates can specify data types and time periods to improve the flexibility of data sharing.

In the IoT data processing method of the embodiment of the present invention, data sharing authorization is provided in the form of a temporary certificate, ensuring that only compliant owners who submit temporary certificates to the server can obtain IoT data, and data accessors cannot obtain sensitive and private information such as decryption private keys, which improves privacy security.

The above describes the IoT data processing method of the embodiment of the present invention from the perspective of the service end. The IoT data processing method of the first service end will be further described below with reference to the accompanying drawings.

As shown in FIG. 7 , an IoT data processing method according to an embodiment of the present invention is applied to a first service end, and includes but is not limited to the following steps:

Step 71: Send an access request for accessing IoT data of the second business end to the server, where the access request carries a temporary certificate of the second business end, and the temporary certificate is digitally signed using the identity private key of the first business end.

Step 72: Receive the target IoT data corresponding to the temporary certificate from the server, where the target IoT data is obtained by the server through the blockchain system and the InterPlanetary File System IPFS system after verifying the legitimacy of the first business end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity ID of the second business end, identity ID of the first business end, and signature of the second business end.

Optionally, before step 71, the method further includes: establishing a data sharing agreement with the second business end; and receiving a temporary certificate from the second business end.

Optionally, before step 71, the method further includes: receiving an encrypted public key from the server, wherein a decryption private key corresponding to the encrypted public key from the server is stored on the server.

Optionally, before step 71, the method also includes: obtaining the identity public-private key pair of the first business end, the identity public-private key pair including: an identity verification public key and an identity signature private key; storing the identity signature private key locally, and sending the identity signature private key to the server; and sending the identity verification public key to the blockchain system.

The embodiment of the first business end side corresponds to the method embodiment of the above-mentioned server side. All implementation methods of the above-mentioned server side method embodiment are applicable to this embodiment and can achieve similar technical effects. The embodiment of the present invention uses a temporary certificate to provide data sharing authorization, ensuring that only compliant owners can obtain IoT data by submitting a temporary certificate to the server. Data accessors cannot obtain sensitive and private information such as decryption private keys, which improves privacy security.

The above introduces the IoT data processing method of the service end and the first business end. The following embodiment will further introduce its corresponding device in conjunction with the accompanying drawings.

As shown in FIG8 , an embodiment of the present invention provides an IoT data processing device 800, which is applied to a server, and includes but is not limited to the following functional modules:

The first receiving module 810 is used to receive an access request for accessing IoT data of a second business end from a first business end, where the access request carries a temporary certificate of the second business end, and the temporary certificate is digitally signed with an identity private key of the first business end;

A first verification module 820, configured to decrypt the temporary certificate using a decryption private key and verify the digital signature of the first business end through the blockchain system to verify the legitimacy of the first business end;

The first acquisition module 830 is used to obtain the target IoT data corresponding to the temporary certificate through the blockchain system and the InterPlanetary File System IPFS system after verifying that the first business end is legitimate;

The first sending module 840 is used to send the acquired target IoT data to the first service end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity ID of the second business end, identity ID of the first business end, and signature of the second business end.

Optionally, the first acquisition module 830 includes:

A first reading unit, used to read a file hash Hash corresponding to the data type described in the temporary certificate from the blockchain system;

The second reading unit is used to read the IoT data ciphertext corresponding to the file Hash from the IPFS system;

The first decryption unit is used to decrypt the Internet of Things data ciphertext using the decryption private key in the temporary certificate to obtain the target Internet of Things data in plain text.

Optionally, the Internet of Things data processing device 800 further includes:

The first establishment module is used to establish a data sharing agreement between the first service end and the second service end.

The second sending module is used to issue the temporary certificate of the second service end to the first service end.

Optionally, the Internet of Things data processing device 800 further includes:

The second acquisition module is used to obtain the encryption and decryption public and private key pair of the server, the encryption and decryption public and private key pair includes a decryption private key and an encryption public key;

The first storage module is used to store the decryption private key locally.

The third sending module is used to send the encrypted public key to the first service end and the second service end.

Optionally, the Internet of Things data processing device 800 further includes:

A second receiving module is used to receive IoT data of an IoT device corresponding to the second service end, where the IoT data is digitally signed using the identity private key of the second service end;

A second verification module is used to verify the digital signature of the second business end through the blockchain system to verify the legitimacy of the second business end;

The cache module is used to cache the IoT data into a corresponding data sequence according to the type of the IoT data after verifying that the second business end is legitimate.

Optionally, the Internet of Things data processing device 800 further includes:

A first reading module is used to read the encryption public key of the second service end for the type of IoT data from the blockchain system after a predetermined interval or after a predetermined cache capacity is reached;

An encryption module, used to encrypt IoT data using the read encryption public key;

The second storage module is used to store the encrypted IoT data in the IPFS system to obtain the corresponding file Hash;

The third storage module is used to store the file Hash in the blockchain system.

Optionally, a decryption private key for the type of IoT data corresponding to the encryption public key for the type of IoT data is stored in the second service end.

As shown in FIG. 9 , an embodiment of the present invention further provides an IoT data processing device 900, which is applied to a first service end and includes but is not limited to the following functional modules:

The fourth sending module 910 is used to send an access request for accessing IoT data of the second service end to the service end, where the access request carries a temporary certificate of the second service end, and the temporary certificate is digitally signed with the identity private key of the first service end;

The third receiving module 920 is used to receive target IoT data corresponding to the temporary certificate from the server, and the target IoT data is obtained by the server through the blockchain system and the Interstellar File System IPFS system after verifying the legitimacy of the first business end.

Optionally, the temporary certificate includes at least one of the following: data type, time period, decryption private key, identity ID of the second business end, identity ID of the first business end, and signature of the second business end.

Optionally, the Internet of Things data processing device 900 further includes:

A second establishing module, used to establish a data sharing agreement with a second service end;

The fourth receiving module is used to receive the temporary certificate of the second service end.

Optionally, the Internet of Things data processing device 900 further includes:

The fifth receiving module is used to receive the encrypted public key of the server, and the decryption private key corresponding to the encrypted public key of the server is stored in the server.

Optionally, the Internet of Things data processing device 900 further includes:

A third acquisition module is used to obtain the public and private key pair of the identity of the first service end, the public and private key pair of the identity includes: an identity verification public key and an identity signature private key;

The fourth storage module is used to store the identity signature private key locally.

The fifth sending module is used to send the identity signature private key to the server;

The sixth sending module is used to send the identity verification public key to the blockchain system.

The above describes the IoT data processing method and device according to the embodiment of the present invention. The IoT data processing system will be further described below with reference to the accompanying drawings.

As shown in FIG10 , the IoT data processing system of the embodiment of the present invention includes: a server, a first service end, a second service end, a blockchain system, an InterPlanetary File System IPFS system, and an IoT device, wherein:

The first service end sends an access request to the service end for accessing the IoT data of the second service end;

The server receives the access request, which carries the temporary certificate of the second service end, and the temporary certificate is digitally signed with the identity private key of the first service end;

The server uses the decryption private key to decrypt the temporary certificate and verifies the digital signature of the first business end through the blockchain system to verify the legitimacy of the first business end;

After verifying the legitimacy of the first business end, the server obtains the target IoT data corresponding to the temporary certificate through the blockchain system and IPFS system;

The server sends the acquired target IoT data to the first service end;

The first business end receives target IoT data corresponding to the temporary certificate.

The embodiment of the present invention proposes an Internet of Things data processing system, which mainly includes a blockchain system, an IPFS system, a server, several business terminals (a first business terminal, a second business terminal, etc.), and several Internet of Things devices, and is mainly used for enterprises to manage massive Internet of Things data and multi-party data sharing. The main process includes a data storage process and a data sharing process, wherein the data storage process is: each enterprise has several Internet of Things devices, and the Internet of Things devices upload Internet of Things data to the server; the server uses the blockchain to verify the legitimacy of the identity of the Internet of Things device, and caches the legitimate data into different sequences according to the data type; after the predetermined time interval or the predetermined cache capacity is reached, the server uses the corresponding business terminal (one business terminal corresponds to one enterprise) stored in the blockchain and the encryption public key of the corresponding data type to encrypt the cached data; the server stores the ciphertext in the IPFS system and obtains the file Hash, and then stores the file Hash in the blockchain. The data sharing process is as follows: each enterprise has a business end, and applies for access to IoT data of a certain data type and a certain time period of other enterprises through the business end; the enterprise first obtains a temporary certificate of the enterprise whose data is applied for access (the temporary certificate contains the data type, time period, decryption private key, data sharing party ID, data access party ID, data sharing party signature, etc.), and submits the temporary certificate to the server; the server uses the blockchain to verify the legitimacy of the business end (or enterprise) identity, parses and verifies the temporary certificate; the server reads the file Hash corresponding to the data type described in the temporary certificate from the blockchain; the server reads the IoT data ciphertext corresponding to the file Hash from the IPFS system; the server uses the decryption private key of the temporary certificate to decrypt the ciphertext and obtain the plaintext original IoT data; the server returns the plaintext original IoT data to the corresponding business end (enterprise).

The Internet of Things data processing device and system of the embodiment of the present invention correspond to the above-mentioned method embodiment. The implementation methods of the above-mentioned method embodiment can be applied to the embodiments of the device and system and can achieve the same technical effect. Data sharing authorization is provided in the form of a temporary certificate to ensure that only compliant owners can obtain Internet of Things data by submitting a temporary certificate to the server. Data accessors cannot obtain sensitive and private information such as decryption private keys, which improves privacy security.

A readable storage medium according to an embodiment of the present invention stores a program or instruction thereon. When the program or instruction is executed by a processor, the steps in the IoT data processing method as described above are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

It should be further explained that the terminals described in this specification include but are not limited to smart phones, tablet computers, etc., and many of the functional components described are called modules in order to more particularly emphasize the independence of their implementation methods.

In the embodiment of the present invention, the module can be implemented with software so that it can be executed by various types of processors. For example, an executable code module of an identification can include one or more physical or logical blocks of computer instructions, for example, it can be constructed as an object, process or function. Nevertheless, the executable code of the identified module does not need to be physically located together, but can include different instructions stored in different positions, and when these instructions are logically combined together, it constitutes a module and realizes the specified purpose of the module.

In fact, executable code module can be a single instruction or many instructions, and can even be distributed on a plurality of different code segments, distributed among different programs, and distributed across a plurality of memory devices. Similarly, operating data can be identified in the module, and can be implemented and organized in the data structure of any appropriate type according to any appropriate form. The operating data can be collected as a single data set, or can be distributed in different locations (including on different storage devices), and can only be present on a system or network as an electronic signal at least in part.

When a module can be implemented by software, considering the level of existing hardware technology, a person skilled in the art can build a corresponding hardware circuit to implement the corresponding function of the module that can be implemented by software without considering the cost. The hardware circuit includes a conventional very large scale integration (VLSI) circuit or gate array and existing semiconductors such as logic chips, transistors, or other discrete components. The module can also be implemented by a programmable hardware device, such as a field programmable gate array, a programmable array logic, a programmable logic device, etc.

The above exemplary embodiments are described with reference to the accompanying drawings, and many different forms and embodiments are feasible without departing from the spirit and teachings of the present invention. Therefore, the present invention should not be constructed as a limitation of the exemplary embodiments proposed herein. More specifically, these exemplary embodiments are provided so that the present invention will be perfect and complete, and the scope of the present invention will be conveyed to those who are familiar with the technology. In these figures, the component sizes and relative sizes may be exaggerated for clarity. The terms used here are only based on the purpose of describing specific exemplary embodiments and are not intended to be limiting. As used herein, unless the text clearly indicates otherwise, the singular forms "one", "an" and "the" are intended to include these multiple forms. It will be further understood that the terms "including" and/or "comprising" when used in this specification indicate the presence of the features, integers, steps, operations, components and/or components, but do not exclude the presence or increase of one or more other features, integers, steps, operations, components, components and/or their groups. Unless otherwise indicated, when stated, a range of values includes the upper and lower limits of that range and any subranges therebetween.

The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims (17)

1. The data processing method of the Internet of things is applied to a server and is characterized by comprising the following steps:

Receiving an access request for requesting to access Internet of things data of a second service end from a first service end, wherein the access request carries a temporary certificate of the second service end, the temporary certificate is digitally signed by adopting an identity private key of the first service end, and is encrypted by adopting a service end encryption public key;

Decrypting the temporary certificate by adopting a server decryption private key, and obtaining an identity public key of the first service end through a block chain system to verify a digital signature of the first service end so as to verify the validity of the first service end;

after verifying that the first service end is legal, acquiring target Internet of things data corresponding to the temporary certificate through the blockchain system and the interstellar file system IPFS;

and sending the acquired target internet of things data to the first service end.

2. The internet of things data processing method of claim 1, wherein the temporary certificate comprises at least one of: the method comprises the steps of data type, time period, decryption private key, identification ID of the second service end, identification ID of the first service end and signature of the second service end.

3. The method for processing data of the internet of things according to claim 2, wherein obtaining, by the blockchain system and the interstellar file system IPFS, the target internet of things data corresponding to the temporary certificate comprises:

reading a file Hash corresponding to the data type described in the temporary certificate from the blockchain system;

Reading the data ciphertext of the Internet of things corresponding to the file Hash from the IPFS system;

And decrypting the data ciphertext of the Internet of things by adopting a decryption private key in the temporary certificate to obtain target Internet of things data of a plaintext.

4. The method for processing internet of things data according to claim 1, further comprising, before receiving an access request for requesting access to internet of things data of the second service terminal from the first service terminal:

and establishing a data sharing protocol of the first service end and the second service end, and issuing a temporary certificate of the second service end to the first service end.

5. The method for processing internet of things data according to claim 1, further comprising, before receiving an access request for requesting access to internet of things data of the second service terminal from the first service terminal:

obtaining an encryption and decryption public-private key pair of a server, wherein the encryption and decryption public-private key pair comprises a decryption private key and an encryption public key;

And storing the decryption private key locally, and sending the encryption public key to the first service end and the second service end.

6. The method for processing internet of things data according to claim 1, further comprising, before receiving an access request for requesting access to internet of things data of the second service terminal from the first service terminal:

Receiving Internet of things data of Internet of things equipment corresponding to a second service end, wherein the Internet of things data is digitally signed by adopting an identity private key of the second service end;

Verifying the digital signature of the second service end through a block chain system so as to verify the validity of the second service end;

After verifying that the second service end is legal, caching the data of the Internet of things into corresponding data sequences according to the type of the data of the Internet of things.

7. The method for processing data of the internet of things according to claim 6, wherein after caching the data of the internet of things to the corresponding data sequence according to the type of the data of the internet of things, further comprising:

After a preset interval or after a preset cache capacity is reached, reading an encrypted public key of the second service end aiming at the type of the data of the Internet of things from the blockchain system;

encrypting the data of the Internet of things by using the read encryption public key, and storing the encrypted data in a IPFS system to obtain a corresponding file Hash;

storing the file Hash in the blockchain system.

8. The method for processing data of the internet of things according to claim 7, wherein a decryption private key corresponding to the encryption public key for the type of the data of the internet of things is stored in the second service end.

9. The data processing method of the Internet of things is applied to a first service end and is characterized by comprising the following steps:

Sending an access request for requesting to access the internet of things data of a second service end to a service end, wherein the access request carries a temporary certificate of the second service end, and the temporary certificate adopts an identity private key of the first service end to carry out digital signature and adopts a service end encryption public key to carry out encryption;

And receiving target internet of things data corresponding to the temporary certificate from the server, wherein the target internet of things data is obtained by the server through a block chain system and a interstellar file system IPFS after the server decrypts the temporary certificate by adopting a server decryption private key and obtains an identity public key of the first service end through the block chain system to verify the digital signature of the first service end so as to verify that the first service end is legal.

10. The internet of things data processing method of claim 9, wherein the temporary certificate comprises at least one of: the method comprises the steps of data type, time period, decryption private key, identification ID of the second service end, identification ID of the first service end and signature of the second service end.

11. The method for processing internet of things data according to claim 9, further comprising, before sending an access request for requesting access to internet of things data of the second service side to the service side:

establishing a data sharing protocol with the second service end;

and receiving the temporary certificate of the second service end.

12. The method for processing internet of things data according to claim 9, further comprising, before sending an access request for requesting access to internet of things data of the second service side to the service side:

And receiving an encrypted public key of the server, wherein a decryption private key corresponding to the encrypted public key of the server is stored in the server.

13. The method for processing internet of things data according to claim 9, further comprising, before sending an access request for requesting access to internet of things data of the second service side to the service side:

acquiring an identity public-private key pair of the first service end, wherein the identity public-private key pair comprises: an identity public key and an identity private key;

storing the identity private key locally and sending the identity private key to the server;

the identity public key is sent to the blockchain system.

14. The utility model provides a thing networking data processing device, is applied to the server, its characterized in that includes:

The system comprises a first receiving module, a second receiving module and a server side encryption module, wherein the first receiving module is used for receiving an access request for requesting to access Internet of things data of a second service side from a first service side, the access request carries a temporary certificate of the second service side, the temporary certificate adopts an identity private key of the first service side to carry out digital signature, and adopts a server side encryption public key to carry out encryption;

the first verification module is used for decrypting the temporary certificate by adopting a server-side decryption private key, and obtaining an identity public key of the first service side through a block chain system to verify the digital signature of the first service side so as to verify the validity of the first service side;

the first obtaining module is configured to obtain, after verifying that the first service end is legal, target internet of things data corresponding to the temporary certificate through the blockchain system and the interstellar file system IPFS;

the first sending module is used for sending the obtained target internet of things data to the first service end.

15. The utility model provides a thing networking data processing device, is applied to first service end, which is characterized in that includes:

A fourth sending module, configured to send an access request for requesting to access internet of things data of a second service end to a service end, where the access request carries a temporary certificate of the second service end, and the temporary certificate uses an identity private key of the first service end to perform digital signature and uses a service end encryption public key to perform encryption;

The third receiving module is configured to receive, from the server, target internet of things data corresponding to the temporary certificate, where the target internet of things data is obtained by the server through a blockchain system and an interstellar file system IPFS after the server decrypts the temporary certificate by using a server decryption private key and obtains an identity public key of the first service to verify a digital signature of the first service, so that the first service is verified to be legal.

16. An internet of things data processing system, comprising: the system comprises a server side, a first service side, a second service side, a block chain system, an interstellar file system IPFS system and Internet of things equipment, wherein,

The first service end sends an access request for requesting to access the Internet of things data of the second service end to a service end;

The server receives the access request, wherein the access request carries a temporary certificate of the second service end, the temporary certificate is digitally signed by adopting an identity private key of the first service end, and is encrypted by adopting a server encryption public key;

The server decrypts the temporary certificate by adopting a server decryption private key, and obtains an identity public key of the first service end through the blockchain system to verify the digital signature of the first service end so as to verify the validity of the first service end;

after verifying that the first service end is legal, the service end acquires target Internet of things data corresponding to the temporary certificate through the blockchain system and the IPFS system;

the server side sends the acquired target internet of things data to the first service side;

and the first service end receives the target internet of things data corresponding to the temporary certificate.

17. A readable storage medium having stored thereon a program or instructions, which when executed by a processor, implement the steps in the internet of things data processing method of any one of claims 1 to 13.