Cross-node data transmission method and related device

Abstract

The embodiment of the invention provides a cross-node data transmission method and a related device, which are applied to a relay node of a centerless network. Receiving a routing diffusion message sent by the adjacent node, authenticating the routing diffusion message according to node one-way authentication information in the routing diffusion message, and if an authentication result is that the routing diffusion message is sent by the adjacent node, establishing a corresponding relationship between the adjacent node and the challenge information; and a data message sent by the adjacent node is received subsequently, the data message is verified according to the challenge information corresponding to the node, if the data message is sent by the adjacent node, the data message is updated, a forwarding message is obtained, and the forwarding message is sent to the next hop node. In the process, two adjacent nodes do not need to be subjected to bidirectional authentication, the number of times of bidirectional authentication is reduced, the relay node forwarding the data message does not need to decrypt and encrypt the forwarded data, and energy consumption and transmission delay of the nodes are reduced.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a cross-node data transmission method and related devices. Background Art

[0002] In a decentralized network (such as an ad hoc network), the interconnection function between devices can expand the connection range of devices and save network deployment costs. For example, a smart screen in the network needs to communicate with a smart watch. The smart screen and the smart watch cannot be connected directly, but the smart screen and the smartphone are connected through a mobile hotspot (such as WiFi), and the smartphone and the smart watch are connected through Bluetooth. The data transmitted between the smart watch and the smart screen can be forwarded by the smartphone, thereby realizing the communication between the smart screen and the smart watch.

[0003] However, the devices that undertake data forwarding functions in the network are usually not routers or switches. Taking smartphones as an example, using smartphones as forwarding devices will break the original network security model of smartphones and bring security risks. In order to ensure the security of forwarding devices, before smartphones forward data as forwarding devices, they need to authenticate the nodes at the link source and link destination and only forward the data of the nodes that have completed the authentication. The authentication process produces the following problems: since data forwarding is often transmitted across relay nodes, each relay node needs to authenticate the data sending node before forwarding data. The authentication process is relatively long, which increases the communication delay. When smartphones act as forwarding nodes, they need to decrypt the received data using the key corresponding to the sender, and then encrypt it using the key corresponding to the receiver. The encryption and decryption operations increase the energy consumption and data transmission delay of smartphones. Summary of the invention

[0004] The present application provides a cross-node data transmission method and related devices. When networking, adjacent nodes send routing diffusion messages to each other, and determine that the routing diffusion message is sent by the adjacent node through the security diffusion information written in the routing diffusion message. After the networking is completed, when a data message is received from the adjacent node, the challenge response information in the data message is verified based on the challenge information, so as to determine that the data message is sent by the adjacent node, thereby avoiding two-way identity authentication of the adjacent nodes, and the relay node does not need to decrypt and encrypt the data message, reducing the energy consumption of the node. Transmission delay.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a cross-node data transmission method is provided, which is applied to a relay node of a decentralized network, wherein the decentralized network includes at least three nodes, and the at least three nodes include the relay node and at least two adjacent nodes of the relay node. The method includes: after the relay node and the adjacent node complete neighbor discovery, the relay node receives a route diffusion message sent by the adjacent node, and the route diffusion message carries node unidirectional authentication information and challenge information; the relay node authenticates the route diffusion message according to the node unidirectional authentication information to obtain an authentication result; if the authentication result is that the route diffusion message is sent by the adjacent node, then establishes a relationship between the adjacent node and the challenge information. The relay node receives the data message sent by the adjacent node, and the data message carries the challenge response information corresponding to the adjacent node; the relay node determines the challenge information corresponding to the adjacent node according to the corresponding relationship; verifies the challenge response information according to the challenge information to obtain a verification result; if the verification result is to determine that the data message is sent by the adjacent node, the relay node obtains the challenge response information corresponding to the relay node; the relay node updates the data message according to the challenge response information corresponding to the relay node to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to the relay node; and sends the forwarding message to the next hop node.

[0007] In this way, after completing the neighbor discovery of the adjacent nodes, the adjacent nodes are networked by sending route diffusion messages to each other. The route diffusion messages carry one-way authentication information and challenge information. The receiving node of the route diffusion message performs identity authentication on the sending node of the route diffusion message by performing one-way authentication information to authenticate whether the route diffusion message is sent by the adjacent node; if it is determined that the route diffusion message is sent by the adjacent node based on the authentication result, the relay node establishes a corresponding relationship between the sending node and the challenge information; after the networking is completed, the adjacent node sends a data message to the destination node through the relay node, and the data message carries the challenge response information corresponding to the adjacent node. The relay node receives the data message sent by the adjacent node, and the relay node verifies the challenge response message based on the challenge information. If the verification result shows that the forwarding message is sent by the adjacent node, the relay node updates the data message to obtain the forwarding message, and then sends the forwarding message to the next hop node. In the above data transmission process, the relay node does not need to perform two-way authentication with the adjacent node, which reduces the number of two-way authentications. In the process of forwarding the data message by the relay node, it is not necessary to encrypt and decrypt the forwarded data message, which reduces the energy consumption of the relay node.

[0008] In some embodiments of the first aspect, the one-way authentication information includes signature information corresponding to the routing diffusion message; the identity authentication of the routing diffusion message based on the node one-way authentication information to obtain an authentication result includes: obtaining the public key of the adjacent node; verifying the signature information based on the public key to obtain an authentication result.

[0009] In this way, since the public key is unique, the relay node authenticates the adjacent node through the public key to determine the identity of the adjacent node; then the signature information in the route diffusion message corresponding to the adjacent node is verified based on the public key to verify that the route diffusion message is sent by the adjacent node and not forged by other nodes, that is, the route diffusion message is authenticated.

[0010] In some embodiments of the first aspect, the challenge information includes a challenge random value, and the challenge response message includes a response random value; the challenge response information is verified based on the challenge information to obtain a verification result, including: if the challenge random value is equal to the response random value, it is determined that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value, it is determined that the data message is not sent by the adjacent node.

[0011] In this way, by comparing the challenge random number in the challenge information and the response random number in the challenge response information, it is detected whether the data message is sent by the adjacent node, thereby realizing the verification of the data message.

[0012] In some embodiments of the first aspect, the challenge information includes a key negotiation parameter corresponding to the adjacent node, and the challenge response information includes a response information verification code; verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameter; if the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0013] In this way, by comparing the challenge information verification code in the challenge information and the response information verification code in the challenge response information, it is detected whether the data message is sent by the adjacent node, thereby realizing the verification of the data message.

[0014] In some embodiments of the first aspect, the challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; the verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameter; if the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value or\and the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0015] In this way, by comparing the challenge information verification code in the challenge information and the response information verification code in the challenge response information, the challenge random number and the response random number, it is detected whether the data message is sent by the adjacent node, thereby realizing the verification of the data message.

[0016] In some embodiments of the first aspect, the challenge information also includes a valid time of the challenge random value; before verifying the challenge response information based on the challenge information, the method also includes: if it is determined based on the valid time that the challenge random value is within the valid time, then verifying the challenge response information based on the challenge information.

[0017] In this way, the validity period of the challenge random number is limited by the validity period to improve the security of the challenge random number.

[0018] In some embodiments of the first aspect, the route diffusion message further carries a timestamp, where the timestamp is used to indicate a time corresponding to the route diffusion message.

[0019] In this way, since the timestamp has the characteristic of being non-repetitive, anti-replay attack can be achieved by adding the timestamp.

[0020] In some embodiments of the first aspect, the data message carries bidirectional authentication information, and the neighboring node performs bidirectional authentication with a destination node of the data message through the bidirectional authentication information.

[0021] In this way, the two-way authentication information carried in the data message can realize cross-node authentication to ensure the security of cross-node data transmission.

[0022] In a second aspect, a cross-node data transmission method is provided, which is applied to a sending node in a decentralized network, wherein the decentralized network includes at least three nodes, and the method includes: after the sending node and the adjacent node complete neighbor discovery, sending a routing diffusion message to the adjacent node, wherein the routing diffusion message carries node one-way authentication information and challenge information, so that the adjacent node authenticates the routing diffusion message sent by the adjacent node based on the node one-way authentication information to obtain an authentication result; when the authentication result is that the routing diffusion message is sent by the sending node, the adjacent node establishes a corresponding relationship between the sending node and the challenge information; sending a data packet to the adjacent node, wherein the data packet carries the corresponding The challenge response information of the data message is transmitted to the adjacent node, the sending node is the source node of the data message and the adjacent node is not the destination node of the data message, so that the adjacent node determines the challenge information corresponding to the sending node according to the corresponding relationship; the adjacent node verifies the challenge response information according to the challenge information to obtain a verification result; if the verification result is that the adjacent node determines that the data message is sent by the sending node, the adjacent node obtains the challenge response information corresponding to the relay node; the adjacent node updates the data message according to the challenge response information corresponding to the sending node to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to the adjacent node; the adjacent node sends the forwarding message to the next-hop node.

[0023] In some embodiments of the second aspect, the one-way authentication information includes signature information corresponding to the route diffusion message.

[0024] In some embodiments of the second aspect, the challenge information includes a challenge random value, and the challenge response message includes at least one of a response random value and a key negotiation parameter.

[0025] In some embodiments of the second aspect, the data message further carries bidirectional authentication information, and the sending node performs bidirectional authentication with a destination node of the data message through the bidirectional authentication information.

[0026] In a third aspect, a cross-node data transmission method is provided, which is applied to a receiving node of a decentralized network, wherein the decentralized network includes at least three nodes, and the method includes: after the receiving node and the adjacent node complete neighbor discovery, receiving a routing diffusion message sent by the adjacent node, the routing diffusion message carrying node unidirectional authentication information and challenge information; authenticating the routing diffusion message according to the node unidirectional authentication information to obtain an authentication result; if the authentication result is that the routing diffusion message is sent by the adjacent node, establishing a corresponding relationship between the adjacent node and the challenge information; receiving a forwarding message sent by the adjacent node, the forwarding message carrying challenge response information corresponding to the adjacent node, the receiving node being the destination node of the forwarding message and the adjacent node being not the source node of the forwarding message; determining the challenge information corresponding to the adjacent node according to the corresponding relationship; verifying the challenge response information according to the challenge information to obtain a verification result; if the verification result is that the challenge information matches the challenge response information, thereby determining that the forwarding message is sent by the adjacent node, parsing the load information of the forwarding message.

[0027] In some embodiments of the third aspect, the one-way authentication information includes signature information corresponding to the routing diffusion message; the receiving node performs identity authentication on the routing diffusion message based on the node one-way authentication information to obtain an authentication result, including: the receiving node obtains the public key of the adjacent node; the receiving node verifies the signature information based on the public key to obtain an authentication result.

[0028] In some embodiments of the third aspect, the challenge information includes a challenge random value, and the challenge response message includes a response random value; the challenge response information is verified based on the challenge information to obtain a verification result, including: if the challenge random value is equal to the response random value, then the challenge information matches the challenge response information, thereby determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value, then the challenge information does not match the challenge response information, thereby determining that the data message is not sent by the adjacent node.

[0029] In some embodiments of the third aspect, the challenge information includes the key negotiation parameters corresponding to the adjacent node, and the challenge response information includes a response information verification code; verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameters; if the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0030] In some embodiments of the third aspect, the challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; the verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameters; if the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value or\and the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0031] In some embodiments of the third aspect, the challenge information also includes a valid time of the challenge random value; before verifying the challenge response information based on the challenge information, the method also includes: if it is determined based on the valid time that the challenge random value is within the valid time, then verifying the challenge response information based on the challenge information.

[0032] In some embodiments of the third aspect, the route diffusion message further carries a timestamp, where the timestamp is used to indicate a time corresponding to the route diffusion message.

[0033] In some embodiments of the third aspect, the data message carries bidirectional authentication information, and the receiving node performs bidirectional authentication with a source node of the data message through the bidirectional authentication information.

[0034] In a fourth aspect, a cloud cross-node data transmission method is provided, which is applied to a decentralized network, wherein the decentralized network includes at least three nodes, and the method includes: after the at least three nodes complete neighbor discovery, the adjacent nodes among the at least three nodes send routing diffusion messages to each other, and the routing diffusion messages carry node one-way authentication information and challenge information; the at least three nodes authenticate the routing diffusion messages sent by the adjacent nodes based on the node one-way authentication information to obtain authentication results; if the authentication result is that the routing diffusion message is sent by the adjacent node, the at least three nodes establish a corresponding relationship between the adjacent node and the challenge information; the sending node among the at least three nodes sends a data message to a relay node, the source node of the data message is the sending node, and the relay node is The relay node is an adjacent node of the sending node and is not the destination node of the data message; the relay node receives the data message sent by the sending node, and the data message carries the challenge response information corresponding to the sending node; the relay node determines the challenge information corresponding to the sending node based on the corresponding relationship; the relay node verifies the challenge response information based on the challenge information to obtain a verification result; if the verification result is that the relay node determines that the data message is sent by the sending node, the relay node obtains the challenge response information corresponding to the relay node; the relay node updates the data message based on the challenge response information corresponding to the relay node to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to the relay node; the relay node sends the forwarding message to the next-hop node.

[0035] In some embodiments of the fourth aspect, the one-way authentication information includes signature information corresponding to the routing diffusion message; the relay node performs identity authentication on the routing diffusion message based on the node one-way authentication information to obtain an authentication result, including: the relay node obtains the public key of the adjacent node; the relay node verifies the signature information based on the public key to obtain an authentication result.

[0036] In some embodiments of the fourth aspect, the challenge information includes a challenge random value, and the challenge response message includes a response random value; the relay node verifies the challenge response information based on the challenge information to obtain a verification result, including: if the challenge random value is equal to the response random value, the relay node determines that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value, the relay node determines that the data message is not sent by the adjacent node.

[0037] In some embodiments of the fourth aspect, the challenge information includes the key negotiation parameters corresponding to the adjacent node, and the challenge response information includes a response information verification code; the relay node verifies the challenge response information based on the challenge information to obtain a verification result, including: the relay node determines the challenge information verification code based on the key negotiation parameters; if the challenge information verification code is equal to the response information verification code, the relay node determines that the data message is sent by the adjacent node; if the challenge information verification code is not equal to the response information verification code, the relay node determines that the data message is not sent by the adjacent node.

[0038] In some embodiments of the fourth aspect, the challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; the relay node verifies the challenge response information based on the challenge information to obtain a verification result, including: the relay node determines the challenge information verification code based on the key negotiation parameter; if the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, then the relay node determines that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value or\and the challenge information verification code is not equal to the response information verification code, then the relay node determines that the data message is not sent by the adjacent node.

[0039] In some embodiments of the fourth aspect, the challenge information also includes a valid time of the challenge random value; before the relay node verifies the challenge response information based on the challenge information, the method also includes: if it is determined based on the valid time that the challenge random value is within the valid time, the relay node verifies the challenge response information based on the challenge information.

[0040] In some embodiments of the fourth aspect, the route diffusion message further carries a timestamp, and the timestamp is used to indicate a time corresponding to the route diffusion message.

[0041] In some embodiments of the fourth aspect, the data message carries bidirectional authentication information, and the sending node performs bidirectional authentication with a destination node of the data message through the bidirectional authentication information.

[0042] In a fifth aspect, a node is provided, comprising: a memory, wherein the memory comprises computer-readable instructions;

[0043] A processor in communication with the memory, the processor being configured to execute the computer-readable instructions so that the node executes the cross-node data transmission method described in any one of the first aspect, the second aspect, or the third aspect.

[0044] In a sixth aspect, a computer-readable storage medium is provided, comprising a program or an instruction, which when executed by a processor implements the cross-node data transmission method as described in any one of the first aspect, the second aspect, or the third aspect.

[0045] The beneficial effects brought about by each possible implementation method of the cross-node data transmission method provided in the second aspect of the embodiment of the present application, the cross-node data transmission method provided in the third aspect, the cross-node data transmission method provided in the fourth aspect, the node provided in the fifth aspect, and the computer-readable storage medium provided in the sixth aspect can all be referred to the description of the various possible implementation methods in the first aspect, and will not be repeated here one by one. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a schematic diagram of a heterogeneous network;

[0047] Figure 2 for Figure 1 Schematic diagram of end-to-end cross-hop authentication in heterogeneous networks;

[0048] Figure 3 A schematic diagram of a scenario of a cross-node data transmission method provided in an embodiment of the present application;

[0049] Figure 4 A schematic diagram of a flow chart of a cross-node data transmission method provided in an embodiment of the present application;

[0050] Figure 5 A schematic diagram of a flow chart of another cross-node data transmission method provided in an embodiment of the present application;

[0051] Figure 6 A schematic diagram of the structure of a routing diffusion message provided in an embodiment of the present application;

[0052] Figure 7 A schematic diagram of a flow chart of another cross-node data transmission method provided in an embodiment of the present application;

[0053] Figure 8 A schematic diagram of the structure of a node provided in an embodiment of the present application; DETAILED DESCRIPTION

[0054] The technical solution in the present application will be described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, rather than all the embodiments.

[0055] A decentralized network (or heterogeneous network) consisting of multiple nodes, such as a terminal ad hoc network, where two nodes that are not directly connected in the network can communicate across nodes through other nodes. For example, see Figure 1 , Figure 1A schematic diagram of a heterogeneous network. Figure 1 The heterogeneous network includes smart screens (i.e. smart screens), smartphones and smart watches. Since the performance of smart screens and smart watches themselves does not support or are not within each other's signal range, smart screens and smart watches cannot communicate directly, but need to rely on smartphones as relay forwarding devices to achieve this.

[0056] Specifically, the smartphone and the smart screen are connected through a wireless hotspot, and the smartphone and the smart watch are connected through Bluetooth; when the smart screen and the smart watch communicate, the smart screen sends a data message to the smartphone, and the smartphone acts as a forwarding device to forward the data message to the smart watch, thereby realizing communication between the smart watch and the smart screen.

[0057] Since the product positioning of most nodes in the network is not forwarding devices but data sources, when a node is used as a forwarding device, it will destroy the original network security model of the node. At the same time, the node will consume its energy when performing data forwarding services. For energy saving and security considerations, before the intermediate node forwards data, the sending node corresponding to the data message needs to be authenticated. Only after the authentication is successful can it be forwarded.

[0058] See also Figure 2 , Figure 2 for Figure 1 The schematic diagram of end-to-end cross-hop authentication of the heterogeneous network shown is that before the smart screen and the smart watch communicate, the smart watch and the smart phone perform two-way authentication, and a secure channel is established after the two-way authentication is successful. The smart phone and the smart screen perform two-way authentication, and a secure channel is established after the two-way authentication is successful. Then the smart watch and the smart screen can communicate through the secure channel.

[0059] Figure 2 After a user of a smartphone, smart screen or smart watch in a heterogeneous network logs in, the user's account sends the network identification, public and private key information, etc. to the smartphone, smart screen or smart watch.

[0060] Before the smart screen communicates with the smart watch, the user can select the device (i.e., smart watch) that needs to communicate in the heterogeneous network on the smart screen interface. At this time, the smart screen initiates a cross-node connection with the smart watch:

[0061] First, the smart screen initiates a two-way authentication connection with the smartphone to establish a secure channel between the smart screen and the smartphone. The two-way authentication can adopt two-way authentication protocols such as Password-based Authentication and Key Agreement Protocol (PAKE) and Transport Layer Security Protocol (TLS). Through two-way authentication, the authenticity of the identities of the smart screen and the smartphone can be authenticated.

[0062] Then, after the two-way authentication between the smart screen and the smart phone is completed, the smart phone initiates a two-way authentication connection with the smart watch to establish a secure channel between the smart phone and the smart watch;

[0063] Then, after the two-way authentication between the smartphone and the smartwatch is completed, the smartwatch and the smart screen transmit data messages through the secure channel between the smart screen and the smartphone, and the secure channel between the smartphone and the smartwatch, that is, the data message is forwarded through the application layer of the smartphone, realizing two-way cross-hop authentication between the smartwatch and the smart screen. Thus, end-to-end application layer security is achieved.

[0064] Figure 2 The above cross-hop authentication process has the following problems:

[0065] First, the above cross-hop authentication process includes multiple two-way authentications, which increases the node authentication overhead and the delay of cross-hop communication between nodes. Figure 2 Before the smartwatch and smart screen can communicate, the heterogeneous network needs to perform three mutual authentications, which involves a lot of processes.

[0066] Secondly, since each security channel corresponds to a different encryption key, when the relay node is forwarding data, the forwarded data needs to go through different security channels. When the intermediate node forwards the data received through one of the security channels to another security channel, it needs to decrypt the forwarded data using the key corresponding to the security channel on the sending side, and then encrypt the forwarded data using the key of the security channel on the receiving side. The encryption and decryption operations consume a lot of energy for the intermediate nodes and increase the data transmission delay.

[0067] Based on the above problems, an embodiment of the present application provides a cross-node data transmission method, which is applied to nodes in a decentralized network. After completing neighbor discovery of adjacent nodes, adjacent nodes are networked by sending routing diffusion messages to each other. The routing diffusion messages carry one-way authentication information and challenge information. The receiving node of the routing diffusion message authenticates the sending node of the routing diffusion message through the one-way authentication information to authenticate whether the routing diffusion message is sent by the adjacent node; if it is determined based on the authentication result that the routing diffusion message is sent by the adjacent node, the receiving node of the routing diffusion message establishes a corresponding relationship between the sending node and the challenge information; after the networking is completed, the sending node sends a data message to the destination node through the relay node, and the data message carries the challenge response information corresponding to the sending node. The sending node is the source node of the data message, and the receiving node is the destination node of the data message. There is at least one relay node between the sending node and the receiving node, and the relay node is used to forward the data message from the sending node to the receiving node. The sending node sends a data message to the adjacent relay node, and the relay node receives the data message sent by the adjacent sending node. The relay node verifies the challenge response message based on the challenge information. If the verification result is that the challenge information matches the challenge response message, and it is determined that the data message is sent by the sending node, the relay node updates the data message, obtains the forwarding message, and then sends the forwarding message to the next-hop node. During the above data transmission process, the relay node does not need to perform two-way authentication with the sending node or the previous-hop relay node of the data message, thereby reducing the number of two-way authentications. During the process of forwarding data messages by the relay node, there is no need to encrypt and decrypt the forwarded data messages, thereby reducing the energy consumption of the relay node and the data transmission delay.

[0068] First, the application scenarios of the cross-node data transmission method provided in this application are described.

[0069] Below through Figure 3 For an explanation of the application scenario shown, see Figure 3 , Figure 3 A schematic diagram of a cross-node data transmission method provided in an embodiment of the present application is provided. Figure 3 The network includes three nodes, and the three nodes form a decentralized network. The decentralized network can be an ad hoc network or other types of networks. It can be understood that in other embodiments, the number of nodes can be set according to the actual application scenario, such as four, five or more than five, that is, the number of nodes in the decentralized network is at least three;

[0070] Figure 3 In the example, the number of relay nodes between the source node and the destination node of the transmitted data message is one. It can be understood that the number of relay nodes between the source node and the destination node of the transmitted data message may be two or more than two.

[0071] Figure 3Node A needs to communicate with node C, and the data packets transmitted between nodes A and C need to be forwarded by node B. In order to ensure data security, before node B forwards the data packet, it needs to authenticate the data packet to confirm that the data packet is sent by node A, that is, to ensure that the forwarded data packet is not forged.

[0072] because Figure 3 The decentralized network is a distributed temporary network where all nodes can join or leave the network at any time. Figure 3 Before the multiple nodes of the decentralized network shown in the figure are networked, mutual trust is completed at the user level by default, that is, each node in the decentralized network is trustworthy.

[0073] In some possible implementations, each node has a user account and the user of all nodes is the same. After the user logs in to the corresponding node, since all nodes in the network are used through the same account, the user can discover other nodes in the decentralized network through the interface of the application in the node, and then determine that all nodes in the decentralized network are trustworthy nodes. In this way, the user interfaces of all nodes in the decentralized network are mutually trusted through the same user account.

[0074] In some possible implementations, the user account of at least one node in the decentralized network is different from the user accounts of other nodes, and the user account of the node authorizes other users to use the node, so that all nodes in the decentralized network are used by the same user, and it can be determined that all nodes in the decentralized network are trusted nodes.

[0075] In some possible implementations, all nodes in the decentralized network are in a preset area when networking, for example, a decentralized network composed of nodes in the same office, then it can be determined that all nodes in the decentralized network are trustworthy.

[0076] Optionally, Figure 3 The decentralized network can be a heterogeneous self-organizing network (or heterogeneous network), where a heterogeneous network is composed of computers, network equipment and systems produced by different manufacturers. The nodes of the heterogeneous network run on different protocols to support different functions or applications. Through heterogeneous connections, the interconnection capabilities between nodes are improved, the connection range is expanded, and the network deployment cost is saved.

[0077] Figure 3 The nodes in the network can be nodes with data forwarding function such as mobile terminals and routers.

[0078] For ease of explanation, in the following embodiments, node B acts as a relay node, and node A and node C act as adjacent nodes of node B respectively. It can be understood that in other embodiments, node A and node C can also act as relay nodes, and node B can also act as a source node or destination node of the data message.

[0079] See also Figure 4 , Figure 4 A schematic diagram of a cross-node data transmission method provided in an embodiment of the present application is shown below. Figure 4 Application Figure 3 The decentralized network shown in is used as an example to illustrate. Figure 4 As shown, the cross-node data transmission method includes: S401-S408.

[0080] S401, networking process.

[0081] The networking process includes: before a node joins the decentralized network, the node conducts neighbor discovery with at least one node in the decentralized network; after neighbor discovery is completed between adjacent nodes in the decentralized network, adjacent nodes send routing diffusion messages to each other, establish routing relationships between adjacent nodes through routing diffusion messages, build routing tables, and establish routing relationships between cross-hop nodes. Among them, the routing diffusion message carries the one-way authentication information and challenge information of the corresponding node.

[0082] like Figure 4 As shown, Figure 4 Node A and node B, node B and node C are all adjacent nodes. After completing neighbor discovery, node A sends a routing diffusion message to its adjacent node (node ​​B), and the routing diffusion message carries the one-way authentication information and challenge information corresponding to node A; node B sends diffusion messages to its adjacent nodes (node ​​A and node C) respectively, and the routing diffusion message carries the one-way authentication information and challenge information corresponding to node B; node C sends a diffusion message to its adjacent node (node ​​B), and the routing diffusion message carries the one-way authentication information and challenge information corresponding to node C.

[0083] Among them, neighbor discovery is the process of adjacent nodes discovering each other, such as the terminal detecting the Bluetooth information sent by the smart watch, or the terminal detecting the channel signal, etc., to confirm the adjacent nodes that can be connected.

[0084] Among them, the route diffusion message can be a route message transmitted by Link-State Advertisement (LSA) or a route message transmitted by Open Shortest Path First (OSPF), and the route diffusion message is used to form a network between adjacent nodes through route diffusion messages after completing neighbor discovery between adjacent nodes. That is, route diffusion is performed by sending route diffusion messages between adjacent nodes to build a routing table and establish a routing relationship between cross-hop nodes, thereby realizing networking.

[0085] S402: Authentication process.

[0086] The authentication process includes: after receiving the route diffusion message sent by the adjacent node, authenticating the route diffusion message according to the one-way authentication information in the route diffusion message to determine whether the route diffusion message is sent by the adjacent node; if the authentication result is that the route diffusion message is sent by the adjacent node, then establishing a corresponding relationship between the challenge information and the adjacent node. If the authentication result is that the route diffusion message is not sent by the adjacent node, then discarding the route diffusion message.

[0087] like Figure 4 As shown, Figure 4 Node A authenticates the route diffusion message according to the one-way authentication information in the route diffusion message sent by node B to determine that the route diffusion message is sent by node B, and establishes a corresponding relationship between node B and the challenge information in the corresponding route diffusion message, and then stores the corresponding relationship in node A;

[0088] Figure 4 Node B authenticates the route diffusion message based on the one-way authentication information in the route diffusion message sent by node A and node C to determine whether the route diffusion message is sent by node A or node C, and then establishes a corresponding relationship between node A or node C and the challenge information in the corresponding route diffusion message, and stores the corresponding relationship.

[0089] Optionally, the correspondence relationship may be stored in the corresponding node in a table format. For example, node A stores the correspondence relationship of node B in a challenge mapping table in node A, and the challenge mapping table includes the correspondence relationships of multiple nodes.

[0090] Optionally, the corresponding relationship includes a node identifier and challenge information corresponding to the node, wherein the node identifier may be a device identifier, such as a unique device identifier (UDID) of a smart phone.

[0091] In some possible implementations, if the nodes in the decentralized network have the function or configuration to perform two-way authentication on adjacent nodes, the nodes in the decentralized network unload (or cancel) the two-way authentication of neighboring devices through routing diffusion messages, thereby avoiding the increase in the number of authentication times and authentication delays for the two-way authentication of adjacent nodes during cross-node communication.

[0092] In some possible implementations, after neighbor discovery is completed between adjacent nodes, route diffusion messages are periodically sent between adjacent nodes. After a relay node receives a new route diffusion message sent by an adjacent node, the route diffusion message is authenticated based on the one-way authentication information in the most recently received route diffusion message to determine whether the route diffusion message is sent by the adjacent node. If the authentication result is that the route diffusion message is sent by the adjacent node, the corresponding relationship between the adjacent node and the challenge information is updated. If the authentication result is that the route diffusion message is not sent by the adjacent node, the route diffusion message is discarded.

[0093] S403: Node A sends a data message to node B.

[0094] Among them, the data message carries challenge response information, and the challenge response information corresponds to the challenge information in the route diffusion message sent by node A to node B. The source node corresponding to the data message is node A, and the destination node is node C. Node B is not the destination node of the data message but acts as a relay node for forwarding the data message.

[0095] Understandably, Figure 4 This is only an example provided in the present application, in which Node B is the only relay node. In other embodiments, the number of relay nodes between the source node and the destination node of the data message may be other numbers, such as two or more than two.

[0096] Optionally, after node A sends a route diffusion message to its adjacent nodes, node A stores the corresponding challenge information, determines the challenge response information corresponding to node A according to the challenge information before forming the data message, and then forms the data message according to the challenge response information.

[0097] Exemplarily, since the challenge information and the challenge response information satisfy the challenge response mechanism, that is, the challenge information in the route diffusion message sent by node A to node B and the challenge response information carried in the data packet sent by node A to node B can be exactly the same, or the challenge information and the challenge response information after processing are exactly the same.

[0098] In some possible implementations, when node A needs to communicate with other adjacent nodes in a decentralized network, node A forms a data message, which carries challenge response information, and the challenge response information corresponds to the challenge information in the routing diffusion message sent by node A to the adjacent nodes; then node A queries the routing table, obtains the node information of the next hop, and then sends the data message to the next hop node.

[0099] S404. Node B receives the data message sent by node A, and determines the challenge information corresponding to node A according to the corresponding relationship.

[0100] Optionally, multiple correspondences are stored in node B. Node B receives a data message sent by node A, queries the correspondence corresponding to node A based on the node identifier of node A (e.g., UDID of node A), and thereby determines the challenge information corresponding to node A based on the correspondence corresponding to node A.

[0101] S405: Verify the challenge response information according to the challenge information. If the verification result is that the challenge information matches the challenge response information, thereby determining that the data message is sent by node A, then obtain the challenge response information corresponding to node B.

[0102] The challenge response information corresponding to the node B matches the challenge information carried in the route diffusion message sent by the node B to its neighboring nodes.

[0103] Specifically, node B uses a challenge response mechanism to verify the data message, wherein during the networking process, the route diffusion message sent by node A to node B carries the challenge information corresponding to node A, and after the networking is completed, the data message sent by node A to node B carries the challenge response information corresponding to node A; node B verifies the challenge response information based on the challenge information, if the challenge information and the challenge response information are the same, or the verification information formed based on the challenge information and the challenge response information are the same, then node B determines that the challenge information and the challenge response information of node A match, and further determines that the data message is sent by node A to node B.

[0104] Furthermore, if the challenge information and the challenge response information are not the same, or the verification information formed based on the challenge information and the challenge response information are not the same, node B determines that the challenge information and the challenge response information of node A do not match, and then determines that the data message is not sent by node A to node B, and then discards the data message.

[0105] S406: Node B updates the data message according to the challenge response information corresponding to Node B to obtain a forwarding message.

[0106] In some optional implementations, node B replaces the challenge response information corresponding to node A in the data message with the challenge response message corresponding to node B to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to node B.

[0107] Further, the challenge response information corresponding to node A is located in the extended header of the data message, and node B replaces the challenge response information corresponding to node A in the extended header of the data message with the challenge response message corresponding to node B.

[0108] S407: Node B sends a forwarding message to node C.

[0109] Specifically, node B searches for the next-hop node information in a routing table or in a data message, and then sends a forwarding message to the next-hop node (eg, node C).

[0110] S408 , node C receives the forwarded message, determines the challenge information corresponding to node B according to the corresponding relationship, and verifies the forwarded message according to the challenge information corresponding to node B.

[0111] Optionally, node C receives a forwarding message sent by node B, queries the challenge information corresponding to node B based on the identification information and corresponding relationship of node B stored in node C, and then verifies whether the challenge information corresponding to node B matches the challenge response information in the forwarding message; if the challenge information does not match the challenge response information in the forwarding message, it is determined that the forwarding message is not sent by node B and the forwarding message is discarded; if the challenge information matches the challenge response information, it is determined that the forwarding message is sent by node B.

[0112] Furthermore, since node C is the destination node of the forwarded message, after receiving the forwarded message, node C does not need to forward the forwarded message again, and node C analyzes the load information of the forwarded message.

[0113] In this way, during the cross-node data transmission process, the relay node (such as node B) authenticates the route diffusion message through the one-way authentication information in the route diffusion message sent by the adjacent node received during networking, and determines through authentication that the route diffusion message is sent by the adjacent node, and then realizes networking through the route diffusion message; after the networking is completed, after receiving the data message sent by the adjacent node, the relay node verifies the challenge response information in the data message according to the challenge information corresponding to the adjacent node, and when the challenge response information matches the challenge information, it is determined that the data message is sent by the adjacent node, and then the data message is updated according to the challenge response information corresponding to the relay node to obtain the forwarding message, and then the forwarding message is forwarded to the next hop node. In the above data transmission process, the relay node does not need to perform two-way authentication with the adjacent node, saving the interactive process of two-way authentication. The relay node verifies the forwarded data message through the challenge information of the corresponding adjacent node, and does not need to decrypt and encrypt the forwarded data message, reducing the energy consumption of the relay node and the data transmission delay.

[0114] When a node joins a decentralized network or the decentralized network begins to be networked, two adjacent nodes that have completed neighbor discovery send routing diffusion messages to each other. When receiving a routing diffusion message sent by an adjacent node, the routing diffusion message needs to be authenticated to determine whether the routing diffusion message is sent by the adjacent node. Since the private key of the node is unique and private (only the node itself knows it), the adjacent node uses the private key to form the signature information of the routing diffusion message, and other nodes verify the signature information through the public key of the adjacent node to verify whether the routing diffusion message is sent by the adjacent node or forged by other nodes.

[0115] In some possible implementations, the one-way authentication information includes signature information, which is obtained by encrypting the route diffusion message by the sending node (or source node) of the route diffusion message using the private key corresponding to the sending node. Figure 5 , Figure 5 A schematic diagram of a cross-node data transmission method provided in an embodiment of the present application, after node B receives a route diffusion message sent by node A, the route diffusion message is authenticated according to the one-way authentication information in the route diffusion message, including:

[0116] S501, node B obtains the public key corresponding to node A;

[0117] In some possible implementations, after the user logs in to the account at node B, the network side where the account is located (for example, the business cloud side) will send the public key of the node that has completed user-level mutual trust with node B to the relay node. Node B can form a correspondence between the public key and the corresponding node and store it locally, such as the correspondence between the identifier of node A and its corresponding public key, and the correspondence between the identifier of node C and its corresponding public key. In this way, the node queries the correspondence between the public keys based on the identifier of node A to find the public key of the node.

[0118] In some possible implementations, the one-way authentication information also includes a public key corresponding to the node. After receiving the route diffusion message, node B determines the public key corresponding to node A by parsing the one-way authentication information in the route diffusion message.

[0119] S502: Node B verifies the signature information according to the public key.

[0120] Optionally, since the signature information is obtained by node A encrypting the route diffusion message using the private key corresponding to node A, node B uses the public key corresponding to node A to decrypt the signature information in the route diffusion message, and determines whether the data obtained after decryption is the same as the route diffusion message. If they are the same, it is determined that the route diffusion message is sent by the sending node; if they are not the same, it is determined that the route diffusion message is not sent by the sending node, and the route diffusion message is discarded.

[0121] In this way, node B obtains the public key corresponding to node A. Since the public key is unique, node B authenticates node A through the public key to determine the identity of node A; then the signature information in the route diffusion message corresponding to node A is verified based on the public key to verify that the route diffusion message is sent by node A and not forged by other nodes, that is, the route diffusion message is authenticated.

[0122] Authentication of route diffusion messages based on public keys, private keys and signature information is an authentication method based on asymmetric keys. It can be understood that in other embodiments, source authentication of route diffusion messages can also be performed by symmetric keys; optionally, if the users of all nodes in the decentralized network are the same, then in the scenario where the user logs in to the account through the node, the user account cloud can periodically send the corresponding node key parameters to each node (different nodes have different node key parameters). When the node sends a route diffusion message to an adjacent node, it forms key information based on the node key parameters, calculates the integrity protection information of the route diffusion information based on the key information, and uses the integrity protection information and the node key parameters as the one-way authentication information corresponding to the node. When the adjacent node receives the route diffusion message, it determines the identity of the node based on the node key parameters. Then, the key information is formed based on the node key parameters, the integrity protection information of the route diffusion information is calculated based on the key information, and then the integrity protection information calculated is compared with the integrity protection information in the route diffusion message to see if they are the same. If they are the same, it is determined that the route diffusion message is sent by the corresponding node; if they are not the same, it is determined that the route diffusion message is not sent by the corresponding node, and the route diffusion message is discarded.

[0123] After receiving the route diffusion message sent by node A, node B authenticates node A based on the one-way authentication information, and performs message authentication on the route diffusion message to determine that the route diffusion message is sent by node A; after completing the above authentication, node B forms a corresponding relationship between node A and its corresponding challenge information. After the networking is completed, node B receives the data message sent by node A, and verifies the data message based on the challenge information corresponding to node A to determine that the data message is sent by node A. After the authentication is completed, node B can forward the data message. The above verification process adopts a challenge response mechanism. It only needs to match the challenge information and the challenge response information to determine that the data message is sent by node A. If the challenge information and the challenge response information do not match, it is determined that the data message is not sent by node A.

[0124] Further, node B verifies the data message according to the challenge information. If the challenge information includes the challenge random number, the challenge response information also includes the response random number. If the challenge random number and the response random number are equal, the challenge information and the challenge response information match, thereby determining that the data message is sent by node A; if the challenge random number and the response random number are not equal, the challenge information and the challenge response information do not match, and it is determined that the data message is not sent by node A, then the challenge response information is verified according to the challenge information to obtain a verification result, including:

[0125] If the challenge random number and the response random number are equal, the challenge information and the challenge response information match, and it is determined that the data message is sent by node A;

[0126] If the challenge random number and the response random number are not equal, the challenge information and the challenge response information do not match, and it is determined that the data message is not sent by node A.

[0127] In this way, by comparing the challenge random number in the challenge information and the response random number in the challenge response information, it is detected whether the data message is sent by node A, thereby realizing verification of the data message.

[0128] It can be understood that in order to improve the security of the challenge response mechanism, each challenge random number has a corresponding validity period. When the challenge random number corresponding to the adjacent node stored in the node is within the validity period, the challenge random number is determined to be valid, and the data message can be verified; if the challenge random number is not within the validity period, the challenge random number cannot be used for the verification of the data message, which can trigger the update of the challenge random number. Therefore, the challenge information also includes the validity period. Before verifying the data message according to the challenge information, it also includes:

[0129] Verify whether the challenge information is within the validity period according to the validity period, and if the challenge information is within the validity period, verify the data message according to the challenge information;

[0130] If the challenge information is not within the validity period, the data message is discarded, that is, the data message is not verified and does not need to be forwarded.

[0131] In this way, before verifying the data message based on the challenge information, it is also necessary to detect the validity of the challenge information and verify the data message based on the challenge information within the validity period. If the challenge information is not within the validity period, the verification of the data message will not be performed. By verifying the validity period of the challenge information, the security of the challenge information can be improved.

[0132] In some possible implementations, when verifying a data message based on challenge information, it can also be implemented through a message authentication code, that is, the challenge information includes a first temporary key negotiation parameter, the first temporary key negotiation parameter is the challenge value corresponding to node A, node B has its corresponding second temporary key negotiation parameter, and the node can calculate the challenge information authentication code through the first temporary key negotiation parameter and the second temporary key negotiation parameter, wherein Diffie-Hellman key exchange (Diffie-Hellman key Exchange, DHE) or elliptic curve Diffie-Hellman key exchange (Elliptic Curve Diffie-Hellman key Exchange, ECDHE) can be used to construct a security authentication key; the challenge response information also includes a response information authentication code, and then by comparing whether the challenge information authentication code and the response information authentication code are equal, if the two are equal, it is determined that the data message is sent by node A; if the two are not equal, it is determined that the data message is not sent by node A.

[0133] In this way, by comparing the challenge random number in the challenge information and the response random number in the challenge response information, it is detected whether the data message is sent by node A, thereby realizing verification of the data message.

[0134] In the above embodiment, when node B verifies the data message based on the challenge information, the challenge information may include a challenge random value or a temporary key negotiation parameter. It can be understood that the challenge information may include a challenge random value and a first temporary key negotiation parameter. Node B calculates the challenge information verification code based on the first temporary key negotiation parameter and the second temporary key negotiation parameter, and then compares the challenge random number and the response random number, the challenge information verification code and the response information verification code respectively. If they are all equal, it is determined that the data message is sent by node A; if one of them is not equal, it is determined that the data message is not sent by node A.

[0135] In this way, by comparing the challenge random number in the challenge message and the response random number in the challenge response message, as well as the challenge message verification code and the response message verification code, it is detected whether the data message is sent by node A, thereby realizing verification of the data message.

[0136] In some possible implementations, the route diffusion message also carries a timestamp, and the timestamp is used to identify the time of the current route diffusion message. The characteristics of the timestamp itself are used to prevent replay attacks.

[0137] Furthermore, the sending node and the receiving node of the route diffusion message both store the corresponding timestamp, and construct a timer based on the timestamp. When the timer expires, the sending node resends the route diffusion message to update the route diffusion message, that is, the route diffusion message is periodically sent through the timestamp to realize the real-time update of the corresponding relationship.

[0138] See also Figure 6 , Figure 6 A schematic diagram of the structure of a routing diffusion message provided in an embodiment of the present application. Figure 6 The routing diffusion message includes UDID, NetworkID, UserID, RandValue, Lifetime, Timestamp, KeyShare, PK and Sig.

[0139] Among them, UDID is the unique identifier of the node; NetworkID is the network identifier of the node, which can be the Media Access Control Address (MAC address) or Internet Protocol Address (IP address) of the network where the node is located. UserID is the account identifier of the node currently logged in; RandValue is the challenge random number, that is, the random number is used as the challenge value; Lifetime is used to identify the validity period of the challenge random number; Timestamp is used to identify the time of the current route diffusion message; KeyShare is a temporary key negotiation parameter, which is used to establish a fast and secure verification code between adjacent nodes; Param (PK) is the public key corresponding to the node, and the identity verification between adjacent nodes is completed through this parameter; Sig is the signature information. The source node of the route diffusion message signs the route diffusion message through the private key (Private Key) to form the signature information. The signature information is used to ensure the authenticity of the route diffusion message.

[0140] The following example shows that node B receives the data sent by node A. Figure 6 The following is an example of the route diffusion message shown:

[0141] First, node B determines the public key of node A based on the UDID and UserID in the route diffusion message, and authenticates node A based on the public key.

[0142] If the identifier (UDID and UserID) of node A matches the corresponding public key, it is determined that the identity authentication of node A is successful; if the identifier (UDID and UserID) of node A does not match the corresponding public key, it is determined that the identity authentication of node A fails.

[0143] Then, if the identity authentication of node A is successful, the signature data is verified according to the public key to implement message authentication of the route diffusion message, so as to authenticate that the route diffusion message is sent by node A.

[0144] If the verification result of the public key verifying the signature data is successful, it is determined that the route diffusion message is sent by node A, and a corresponding relationship between the challenge information and node A is established. The challenge information includes; RandValue, Lifetime and KeyShare.

[0145] If the verification result of the public key verifying the signature data is failure, it is determined that the route diffusion message is not sent by node A, and the route diffusion message is discarded.

[0146] Optionally, the corresponding relationship of node A maintained by node B includes node A's UDID, node A's UserID, NetworkID, node A's PK, node A's RandValue, Lifetime, node A's KeyShare, Timestamp, key AB， Among them, key AB It is a security verification key formed based on the KeyShare of node A and the KeyShare of node B. The formation method can be DHE or ECDHE, or other key derivation methods. The security verification key is generated by combining the temporary key parameters provided by two adjacent nodes, and the security verification key is used as one of the challenge values.

[0147] Optionally, a neighbor device challenge mapping table is stored in node B, and the neighbor device challenge mapping table has multiple corresponding relationships. For example, in a decentralized network, node B has two adjacent nodes, and the neighbor device challenge mapping table of node B includes the corresponding relationship of node A and the corresponding relationship of node C.

[0148] In a decentralized network, when data is transmitted across nodes, the source node and the destination node need to perform cross-node authentication. Only after the authentication is completed can the two nodes achieve cross-node secure communication. The following takes the cross-node authentication of node A and node C as an example for explanation. After completing neighbor discovery, node A, node B and node C send routing diffusion messages to each other between two adjacent nodes, establish a routing relationship of a decentralized network through routing diffusion messages, complete one-way identity authentication and message authentication of adjacent nodes, and then establish a corresponding relationship between the nodes. Then node A sends a data message to node B. Node B verifies the data message according to the challenge information in the corresponding relationship, and sends the data message after verification to the next hop node. The load includes two-way authentication information. Node C starts the two-way authentication process with node A based on the two-way authentication information. During the two-way authentication process, node C can send a data message to node B. Node B verifies the data message and forwards the verified data message to node A. That is, the data messages exchanged between node A and node C during the two-way authentication process are forwarded via node B. The two-way authentication process between node A and node C requires multiple interactions between node A and node C to be completed, that is, node A needs to send a data message to node C via node B, and node C also needs to send a data message to node A via node B. The following is combined with Figure 7 Provide explanation.

[0149] See also Figure 7 , Figure 7 This is a flow chart of a cross-node data transmission method according to an embodiment of the present application. After completing neighbor discovery between nodes in a decentralized network and sending routing diffusion messages to each other, the method further includes:

[0150] S701: Node A sends a data message to node B.

[0151] The data message carries a security extension header and a payload, the security extension header includes challenge response information, and the challenge response information includes a response random number corresponding to node A, a response random number corresponding to node B, and a security verification code.

[0152] Optionally, when node A initiates cross-hop authentication to node C, node A queries the routing table to determine that the next hop is node B, and then forms a data message according to the corresponding relationship of node B.

[0153] S702, Node B verifies the data message according to the corresponding relationship of Node A, and if the verification is successful, updates the data message to obtain a forwarding message.

[0154] After node B receives the data message sent by node A, it verifies the data message according to the corresponding relationship of node A, that is, firstly determines the challenge information corresponding to node A according to the identification information and the corresponding relationship of node A, and obtains whether the challenge random value in the challenge information of node A exceeds the valid time. If it exceeds the valid time, the data message is discarded; if it does not exceed the valid time, it determines whether the challenge random value and the response random value of the challenge response information are equal. If they are not equal, the data message is discarded; if they are equal, the security verification code is calculated according to the temporary key parameters in the challenge information, and then the calculated security verification code is compared with the security verification code in the data message to see if they are equal. If they are not equal, the data message is discarded; if they are equal, the challenge response information corresponding to node B is obtained, and the challenge response information corresponding to node A in the data message is replaced with the challenge response information corresponding to node B to obtain a forwarding message.

[0155] S703: Node B sends a forwarding message to node C.

[0156] Node B queries the routing table, determines that the next hop is node C, and then sends a forwarding message to node C.

[0157] S704, after receiving the forwarding message, node C verifies the forwarding message according to the corresponding relationship of node B. After the verification is completed, node C is determined to be the destination node of the forwarding message and the load information is parsed.

[0158] Node C parses the load information and then triggers a two-way authentication process between node C and node A.

[0159] Among them, due to the two-way authentication process between nodes, the two nodes need to interact multiple times, and node C can also send two-way authentication information to node A through node B.

[0160] S705: Node C sends a data message to node B.

[0161] S706. Node B verifies the data message according to the corresponding relationship of node C. If the verification is successful, the data message is updated to obtain a forwarding message.

[0162] S707: Node B sends a forwarding message to node A.

[0163] Thus, through the above process, node A and node C realize cross-node data transmission, wherein the relay node between node A and node C can be one or more than one. If the number of relay nodes is two or more than two, the processing method of data messages by other nodes is the same as that of node B, which will not be traced here. Through the forwarding of relay nodes, node A and node C realize cross-node data transmission, and multiple data transmissions can complete the cross-node authentication between node A and node C.

[0164] The two-way authentication between node A and node C includes but is not limited to the authentication protocol based on public and private keys, and can also be based on the Password-Authenticated Key Exchange (PAKE) protocol or the Transport Layer Security (TLS) protocol. In the cross-node authentication process, the data packets exchanged between node A and node C are forwarded after verification by node B.

[0165] Furthermore, after node A and node C complete cross-node authentication, a secure channel is established between node A and node C, but the data transmitted between node A and node C still needs to be forwarded via node B. However, since a secure channel is established between node A and node C, the data transmitted by the extended node can be encrypted by the key negotiated by node A and node C.

[0166] The cross-node data transmission method provided by the present application, after completing the neighbor discovery of adjacent nodes, the adjacent nodes are networked by sending routing diffusion messages to each other, the routing diffusion messages carry one-way authentication information and challenge information, the receiving node of the routing diffusion message performs identity authentication on the sending node of the routing diffusion message by performing one-way authentication information to authenticate whether the routing diffusion message is sent by the adjacent node; if it is determined based on the authentication result that the routing diffusion message is sent by the adjacent node, the relay node establishes a corresponding relationship between the sending node and the challenge information; after the networking is completed, the adjacent node sends a data message to the destination node through the relay node, the data message carries the challenge response information corresponding to the adjacent node, the relay node receives the data message sent by the adjacent node, the relay node verifies the challenge response message based on the challenge information, if the verification result is that the forwarding message is sent by the adjacent node, the relay node updates the data message to obtain the forwarding message, and then sends the forwarding message to the next hop node, in the above data transmission process, the relay node does not need to perform two-way authentication with the adjacent node, thereby reducing the number of two-way authentications, and in the process of forwarding the data message by the relay node, it is not necessary to encrypt and decrypt the forwarded data message, thereby reducing the energy consumption of the relay node.

[0167] It should be understood that the above is only to help those skilled in the art better understand the embodiments of the present application, rather than to limit the scope of the embodiments of the present application. According to the above examples given, those skilled in the art can obviously make various equivalent modifications or changes, for example, some steps in each method of the above method may not be necessary, or some new steps may be added. Or a combination of any two or any multiple embodiments of the above. Such modifications, changes or combined solutions also fall within the scope of the embodiments of the present application.

[0168] It should also be understood that the division of the methods, situations, categories and embodiments in the embodiments of the present application is only for the convenience of description and should not constitute a special limitation. The features of various methods, categories, situations and embodiments can be combined without contradiction.

[0169] It should also be understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0170] It should also be understood that the above description of the embodiments of the present application focuses on emphasizing the differences between the various embodiments. The same or similar points that are not mentioned can be referenced to each other. For the sake of brevity, they will not be repeated here.

[0171] The above combination Figure 1-Figure 7 The embodiments of the method and network provided by the embodiments of the present application are described, and the nodes provided by the embodiments of the present application are described below.

[0172] In this embodiment, each node can be divided into functional modules according to the above method. For example, each function can be divided into functional modules, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0173] It should be noted that the relevant contents of each step involved in the above method embodiment can all be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0174] The node provided in the embodiment of the present application is used to execute the cross-node data transmission method provided in the above method embodiment, so the same effect as the above implementation method can be achieved. In the case of an integrated unit, the node may include a processing module, a storage module and a communication module. Among them, the processing module can be used to control and manage the actions of the node. For example, it can be used to support the node to execute the steps performed by the processing unit. The storage module can be used to support the storage of program codes and data, etc. The communication module can be used to support the communication between the node and other devices.

[0175] Among them, the processing module can be a processor or a controller. It can be a variety of exemplary logic boxes, modules and circuits that implement or execute the contents of the present application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other nodes, such as a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, etc.

[0176] See also Figure 8 , Figure 8 shows a schematic diagram of the structure of an exemplary node of the present application, Figure 8 The node shown can execute the steps in the cross-node data transmission method executed by any node provided in the embodiments of the present application.

[0177] The node 800 includes at least one processor 801 , a memory 803 , and at least one network interface 804 .

[0178] The processor 801 is, for example, a general-purpose CPU, a digital signal processor (DSP), a network processor (NP), a GPU, a neural network processor (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASIC) for implementing the solution of the present application, a programmable logic device (PLD) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute various logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0179] Optionally, the node 800 further includes a bus 802. The bus 802 is used to transmit information between the components of the node 800. The bus 802 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus 802 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0180] The memory 803 is, for example, a read-only memory (ROM) or other types of storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CDROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 803 is, for example, independent and connected to the processor 801 through the bus 802. The memory 803 can also be integrated with the processor 801.

[0181] The network interface 804 uses any transceiver-like device to communicate with other devices or communication networks, and the communication network can be Ethernet, radio access network (RAN) or wireless local area network (WLAN), etc. The network interface 804 may include a wired network interface and may also include a wireless network interface. Specifically, the network interface 804 may be an Ethernet interface, such as a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a WLAN interface, a cellular network interface or a combination thereof. The Ethernet interface may be an optical interface, an electrical interface or a combination thereof. In some embodiments of the present application, the network interface 804 may be used for the node 800 to communicate with other devices.

[0182] In a specific implementation, as some embodiments, the processor 801 may include one or more CPUs. Each of these processors may be a single-core processor or a multi-core processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0183] In a specific implementation, as some embodiments, the node 800 may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0184] In some embodiments, the memory 803 is used to store program instructions for executing the solution of the present application, and the processor 801 can execute the program instructions stored in the memory 803. That is, the node 800 can implement the method provided by the method embodiment shown in the above embodiment through the program instructions in the processor 801 and the memory 803. The program instructions may include one or more software modules. Optionally, the processor 801 itself can also store program instructions for executing the solution of the present application.

[0185] In the specific implementation process, the processor 801 in the node 800 of the present application reads the instruction in the memory 803, so that Figure 8 The node 800 shown is capable of executing all or part of the steps in the cross-node data transmission method executed by the nodes in the above-mentioned embodiments.

[0186] Among them, each step of the method described in the above embodiment is completed by the hardware integrated logic circuit or software instruction in the processor of node 800. The steps of the method embodiment disclosed in the present application can be directly embodied as a hardware processor, or a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method embodiment in combination with its hardware. To avoid repetition, it is not described in detail here.

[0187] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0188] Further, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0189] The memory may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory. Among them, the nonvolatile memory may be a read only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (EPROM), an electrically erasable programmable read only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct memory bus random access memory (DRRAM).

[0190] An embodiment of the present application also provides a decentralized network, comprising at least three nodes, wherein the node can execute the steps of the cross-node data transmission method executed by any node provided in the embodiment of the present application, and the node can execute the steps of the cross-node data transmission method executed by any node provided in the embodiment of the present application.

[0191] In an exemplary embodiment, an embodiment of the present application provides a computer program (product), which includes: computer program code, which, when executed by a computer, enables the computer to execute the steps of the cross-node data transmission method performed by any node provided in the embodiment of the present application.

[0192] In an exemplary embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a program or instruction. When the program or instruction runs on a computer, any one of the cross-node data transmission methods performed by the embodiments of the present application is executed.

[0193] In an exemplary embodiment, an embodiment of the present application provides a chip, including a processor, for calling and executing instructions stored in the memory from a memory, so that a communication device equipped with the chip executes a cross-node data transmission method executed by any node provided in an embodiment of the present application.

[0194] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in this application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk), etc.

[0195] In this application, the terms "first", "second", etc. are used to distinguish between identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limitation on the quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another element.

[0196] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0197] The term "at least one" in this application means one or more, and the term "multiple" in this application means two or more, for example, multiple second devices means two or more second devices. The terms "system" and "network" are often used interchangeably herein.

[0198] It should be understood that the terms used in the description of the various examples herein are only for describing specific examples and are not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0199] It should also be understood that the term "and / or" used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and / or" is a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects before and after are in an "or" relationship.

[0200] It should also be understood that the terms "if" and "if" may be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrases "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted to mean "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0201] The above description is only an embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

[0202] Finally, it should be noted that the above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cross-node data transmission method, characterized in that: A relay node applied to a decentralized network, wherein the decentralized network includes at least three nodes, wherein the at least three nodes include the relay node and at least two adjacent nodes of the relay node, wherein the method includes: After the relay node and the adjacent node complete neighbor discovery, the relay node receives a route diffusion message sent by the adjacent node, where the route diffusion message carries node unidirectional authentication information and challenge information; The relay node authenticates the route diffusion message according to the node unidirectional authentication information to obtain an authentication result; If the authentication result is that the route diffusion message is sent by the adjacent node, the relay node establishes a corresponding relationship between the adjacent node and the challenge information; The relay node receives a data message sent by the adjacent node, where the data message carries challenge response information corresponding to the adjacent node; The relay node determines the challenge information corresponding to the adjacent node according to the corresponding relationship; The relay node verifies the challenge response information according to the challenge information to obtain a verification result; If the verification result is that the challenge information matches the challenge response information, thereby determining that the data message is sent by the neighboring node, the relay node obtains the challenge response information corresponding to the relay node; The relay node updates the data message according to the challenge response information corresponding to the relay node to obtain a forwarding message, wherein the forwarding message carries the challenge response information corresponding to the relay node; The relay node sends the forwarding message to the adjacent node corresponding to the next hop.

2. The method according to claim 1, characterized in that The one-way authentication information includes signature information corresponding to the route diffusion message; the relay node performs identity authentication on the route diffusion message according to the node one-way authentication information, and obtains an authentication result, including: The relay node obtains the public key of the adjacent node; The relay node verifies the signature information according to the public key to obtain an authentication result.

3. The method according to claim 1 or 2, characterized in that: The challenge information includes a challenge random value, and the challenge response message includes a response random value; The relay node verifies the challenge response information according to the challenge information to obtain a verification result, including: If the challenge random value is equal to the response random value, the relay node determines that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value, the relay node determines that the data message is not sent by the neighboring node.

4. The method according to claim 1 or 2, characterized in that: The challenge information includes a key negotiation parameter corresponding to the adjacent node, and the challenge response information includes a response information verification code; The relay node verifies the challenge response information according to the challenge information to obtain a verification result, including: The relay node determines a challenge information verification code according to the key negotiation parameter; If the challenge information verification code is equal to the response information verification code, the relay node determines that the challenge information matches the challenge response information, thereby determining that the data message is sent by the neighboring node; If the challenge information verification code is not equal to the response information verification code, the relay node determines that the challenge information and the challenge response information do not match, thereby determining that the data message is not sent by the neighboring node.

5. The method according to claim 1 or 2, characterized in that: The challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; The relay node verifies the challenge response information according to the challenge information to obtain a verification result, including: The relay node determines a challenge information verification code according to the key negotiation parameter; If the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, the relay node determines that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value or the challenge information verification code is not equal to the response information verification code, the relay node determines that the data message is not sent by the adjacent node.

6. The method according to claim 3 or 5, characterized in that: The challenge information also includes the validity period of the challenge random value; Before the relay node verifies the challenge response information according to the challenge information, the method further includes: If it is determined according to the valid time that the challenge random value is within the valid time, the relay node verifies the challenge response information according to the challenge information.

7. The method according to any one of claims 1 to 6, characterized in that: The route diffusion message also carries a timestamp, and the timestamp is used to indicate the time corresponding to the route diffusion message.

8. The method according to any one of claims 1 to 7, characterized in that: The data message carries bidirectional authentication information, and the adjacent node performs bidirectional authentication with the destination node of the data message through the bidirectional authentication information.

9. A cross-node data transmission method, characterized in that: The method is applied to a sending node of a decentralized network, wherein the decentralized network includes at least three nodes, wherein the at least three nodes include the sending node and at least one adjacent node of the sending node, and comprises: After the sending node and the adjacent node complete neighbor discovery, the sending node sends a route diffusion message to the adjacent node, the route diffusion message carrying node unidirectional authentication information and challenge information, so that the adjacent node authenticates the route diffusion message sent by the adjacent node according to the node unidirectional authentication information to obtain an authentication result; when the authentication result is that the route diffusion message is sent by the sending node, the adjacent node establishes a corresponding relationship between the sending node and the challenge information; The sending node sends a data message to the adjacent node, the data message carries the challenge response information corresponding to the sending node, the sending node is the source node of the data message and the adjacent node is not the destination node of the data message, so that the adjacent node determines the challenge information corresponding to the sending node according to the corresponding relationship; the adjacent node verifies the challenge response information according to the challenge information to obtain a verification result; if the verification result is that the adjacent node determines that the data message is sent by the sending node, the adjacent node obtains the challenge response information corresponding to the adjacent node; the adjacent node updates the data message according to the challenge response information corresponding to the sending node to obtain a forwarding message, the forwarding message carries the challenge response information corresponding to the adjacent node; the adjacent node sends the forwarding message to the next-hop node.

10. The method according to claim 9, characterized in that The one-way authentication information includes signature information corresponding to the route diffusion message.

11. The method according to claim 9 or 10, characterized in that: The challenge information includes a challenge random value, and the challenge response message includes at least one of a response random value and a key negotiation parameter.

12. The method according to any one of claims 9 to 11, characterized in that: The data message also carries two-way authentication information, and the sending node performs two-way authentication with the destination node of the data message through the two-way authentication information.

13. A cross-node data transmission method, characterized in that: The method is applied to a receiving node of a decentralized network, wherein the decentralized network includes at least three nodes, and the at least three nodes include the receiving node and at least one adjacent node of the receiving node. After the receiving node and the adjacent node complete neighbor discovery, the receiving node receives a route diffusion message sent by the adjacent node, where the route diffusion message carries node unidirectional authentication information and challenge information; The receiving node authenticates the route diffusion message according to the node unidirectional authentication information to obtain an authentication result; If the authentication result is that the route diffusion message is sent by the adjacent node, the receiving node establishes a corresponding relationship between the adjacent node and the challenge information; The receiving node receives a forwarding message sent by the adjacent node, the forwarding message carries challenge response information corresponding to the adjacent node, the receiving node is a destination node of the forwarding message and the adjacent node is not a source node of the forwarding message; The receiving node determines the challenge information corresponding to the adjacent node according to the corresponding relationship; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result; If the verification result is that the challenge information matches the challenge response information, thereby determining that the forwarded message is sent by the adjacent node, the receiving node parses the load information of the forwarded message.

14. The method according to claim 13, characterized in that The one-way authentication information includes signature information corresponding to the route diffusion message; The receiving node performs identity authentication on the route diffusion message according to the node unidirectional authentication information to obtain an authentication result, including: The receiving node obtains the public key of the adjacent node; The receiving node verifies the signature information according to the public key to obtain an authentication result.

15. The method according to claim 13 or 14, characterized in that The challenge information includes a challenge random value, and the challenge response message includes a response random value; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result, including: If the challenge random value is equal to the response random value, the challenge information matches the challenge response information, thereby determining that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value, the challenge information and the challenge response information do not match, thereby determining that the data message is not sent by the neighboring node.

16. The method according to claim 13 or 14, characterized in that The challenge information includes a key negotiation parameter corresponding to the adjacent node, and the challenge response information includes a response information verification code; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result, including: The receiving node determines a challenge information verification code according to the key negotiation parameter; If the challenge information verification code is equal to the response information verification code, the receiving node determines that the data message is sent by the neighboring node; If the challenge information verification code is not equal to the response information verification code, the receiving node determines that the data message is not sent by the neighboring node.

17. The method according to claim 13 or 14, characterized in that The challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result, including: Determining a challenge information verification code according to the key negotiation parameter; If the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, the receiving node determines that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value or the challenge information verification code is not equal to the response information verification code, the receiving node determines that the data message is not sent by the neighboring node.

18. The method according to claim 15 or 17, characterized in that The challenge information also includes the validity period of the challenge random value; Before the receiving node verifies the challenge response information according to the challenge information, the method further includes: If it is determined according to the valid time that the challenge random value is within the valid time, the receiving node verifies the challenge response information according to the challenge information.

19. The method according to any one of claims 13 to 18, characterized in that The route diffusion message also carries a timestamp, and the timestamp is used to indicate the time corresponding to the route diffusion message.

20. The method according to any one of claims 13 to 19, characterized in that The load information includes bidirectional authentication information, and the receiving node performs bidirectional authentication with the source node of the data message through the bidirectional authentication information.

21. A node, characterized in that: include: a memory including computer-readable instructions; A processor in communication with the memory, the processor being used to execute the computer-readable instructions so that the node executes the cross-node data transmission method described in any one of claims 1-8 or the cross-node data transmission method described in any one of claims 9-12 or the cross-node data transmission method described in any one of claims 13-20.

22. A computer-readable storage medium, characterized in that: The method comprises a program or an instruction, which, when executed by a processor, implements the cross-node data transmission method as described in any one of claims 1 to 8, the cross-node data transmission method as described in any one of claims 9 to 12, or the cross-node data transmission method as described in any one of claims 13 to 20.

Images