Method and device for realizing cross-network equipment authentication in distributed soft bus

Abstract

The invention provides a method and a device for realizing cross-network equipment authentication in a distributed soft bus, and belongs to the field of encrypted communication. The method comprises the following steps: in a local area network, equipment configures an authentication mode, a central node address and an authentication strategy of an authentication list according to different service scenes to realize authentication; for a cross-network scene, the leaf node realizes cross-network authentication through the proxy node, specifically, the leaf node and the proxy node in a local area network where the leaf node is located are authenticated; cross-network authentication is carried out among the proxy nodes in different local area networks through a Hichain module based on a distributed soft bus; after the authentication of the two levels is completed, trust is considered to be established between the leaf nodes; and cross-network communication is carried out among the leaf nodes through a key rate generated by one-time mask encryption. According to the scheme, the limitation that the existing distributed soft bus technology is only limited to equipment authentication in a local area network is broken through, and safety authentication between cross-network equipment is realized.

Description

Technical Field

[0001] The present invention belongs to the field of encrypted communications, and in particular relates to a method and a device for implementing cross-network device authentication in a distributed soft bus. Background Art

[0002] Distributed soft bus is an important system service that supports self-discovery, self-connection, self-organizing network and message transmission between devices under the new generation of distributed operating systems such as Hongmeng and Euler operating systems. Through the distributed soft bus, devices can achieve secure and reliable communication and interaction within the local area network.

[0003] However, the existing distributed soft bus technology has some defects and limitations in cross-network authentication:

[0004] Limited to device authentication within the local area network: Existing distributed soft bus technology only supports mutual authentication between devices within the local area network based on security credentials, and cannot achieve self-organizing network authentication of cross-network devices. This limits its application in wide area networks and heterogeneous network environments.

[0005] The number of authenticated devices is limited: The device authentication function of the existing distributed soft bus is limited by system resources and configuration complexity, and cannot support the authentication needs of large-scale devices. This does not conform to the trend of massive device access in the future Internet of Things.

[0006] Lack of dynamic and flexible authentication mechanism: Existing solutions usually use static device information presetting, which cannot adapt to complex changes in network environment and business needs. A more dynamic and flexible authentication mechanism is needed.

[0007] Therefore, there is an urgent need for an innovative technical solution that can achieve secure authentication of cross-network devices under a distributed soft bus architecture, support large-scale device access, and have good dynamics and scalability to meet the needs of the future booming development of the Internet of Things. Summary of the invention

[0008] In view of this, the present invention provides a method for implementing cross-network device authentication in a distributed soft bus, comprising:

[0009] Step 1: In a local area network, authentication is implemented between devices by configuring authentication modes, central node addresses, and authentication lists according to different business scenarios; the devices are configured as leaf nodes and proxy nodes according to their locations;

[0010] Step 2, for cross-network scenarios, the leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in its local area network; cross-network authentication between proxy nodes in different local area networks through the Hichain module based on the distributed soft bus; after completing the above two levels of authentication, it is deemed that trust has been established between the leaf nodes;

[0011] Step 3: Leaf nodes generate keys through a one-time masked encrypted key rate for cross-network communication.

[0012] In particular, in step 1, a full-chain authentication mode or a star authentication mode is adopted for device authentication in the local area network.

[0013] In particular, the cross-network authentication between the proxy nodes through the Hichain module based on the distributed soft bus includes:

[0014] The networking module initiates the authentication operation and opens the authentication channel Socket connection; the local proxy node packs its own device information and sends it to the peer proxy node; after receiving the device information, the peer proxy node saves it and sends its own device information back; after receiving the device information of the peer proxy node, the local proxy node calls the Hichain module to start the authentication process; the local proxy node sends the authentication data to the peer proxy node, and the peer proxy node returns its own authentication data after processing; both parties complete mutual authentication in the Hichain module.

[0015] In particular, after the proxy nodes perform cross-network authentication through the Hichain module based on the distributed soft bus,

[0016] A hash tag of length k is generated by a universal hash function family F as the session key between them. The hash function family F satisfies the following conditions:

[0017]

[0018] The session key meets the following conditions:

[0019]

[0020] Where Pr[f(e′)=f(e)] represents the probability that the hash value generated by hash function f is equal to the hash value f(e) of input value e when the input value is e′; Formula (1) describes the probability that for any two different input values ​​e in the minimum probability set T i 、e j The probability of a hash value collision generated by using any hash function f in the universal hash function family F is no more than 1 / |S|; = means that all input values ​​e' except e that belong to set T are put into the probability formula and then summed; |T| represents the size of set T, that is, the size of the minimum probability set; this set includes input values ​​that may produce error patterns; |S| represents the output size of the hash function f, that is, the range of hash values; e i 、e j represents two different input values ​​in the set T; F represents a universal hash function family, that is, a set of hash functions that can be used to generate session keys; formula (2) represents the upper bound of the probability of failure to identify an error pattern as |T| / |S|, where |T| is the size of the minimum probability set; formula (2) indicates that even if there is an error pattern with the minimum probability, the session key generated using this universal hash function family F can still ensure security.

[0021] In particular, the step of generating a key by using a one-time mask encrypted key rate between the leaf nodes includes generating a key by:

[0022]

[0023] Among them, r represents the total key rate that can be obtained in the end, q j represents the probability weight under the jth condition, r j represents the key rate that can be obtained under the jth condition, h({q j} j ) represents the probability weight q under each condition j j The calculated entropy value, n represents the encoding length; represents the joint probability distribution between the ith sub-information and the i'th sub-information under the jth condition and the j'th seed condition; q j represents the probability distribution under the jth condition; It means calculating the conditional entropy between the above joint probability distribution and the j-th conditional probability distribution.

[0024] The present invention also provides a device for implementing cross-network device authentication in a distributed soft bus, comprising:

[0025] A local area network authentication module is used to implement authentication between devices in a local area network by configuring authentication modes, central node addresses, and authentication lists according to different business scenarios; the devices are configured as leaf nodes and proxy nodes according to their locations;

[0026] The cross-network authentication module is used for cross-network scenarios. The leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in the local area network where it is located; cross-network authentication between proxy nodes in different local area networks through the Hichain module based on the distributed soft bus; after completing the above two levels of authentication, it is deemed that trust has been established between the leaf nodes;

[0027] The cross-network communication module is used to generate keys for cross-network communication between leaf nodes through a key rate encrypted by a one-time mask.

[0028] Particularly, in the local area network authentication module, a full-chain authentication mode or a star authentication mode is adopted for authenticating devices in the local area network.

[0029] In particular, the cross-network authentication module of the proxy node includes: the cross-network authentication between the proxy nodes through the Hichain module based on the distributed soft bus includes:

[0030] The networking module initiates the authentication operation and opens the authentication channel Socket connection; the local proxy node packs its own device information and sends it to the peer proxy node; after receiving the device information, the peer proxy node saves it and sends its own device information back; after receiving the device information of the peer proxy node, the local proxy node calls the Hichain module to start the authentication process; the local proxy node sends the authentication data to the peer proxy node, and the peer proxy node returns its own authentication data after processing; both parties complete mutual authentication in the Hichain module.

[0031] In particular, after the proxy nodes perform cross-network authentication through the Hichain module based on the distributed soft bus, a hash tag with a length of k is generated through a general hash function family F as the session key between them. The hash function family F satisfies the following conditions:

[0032]

[0033] The session key meets the following conditions:

[0034]

[0035] Where Pr[f(e′)=f(e)] represents the probability that the hash value generated by hash function f is equal to the hash value f(e) of input value e when the input value is e′; Formula (1) describes the probability that for any two different input values ​​e in the minimum probability set T i 、e j The probability of a hash value collision generated by using any hash function f in the universal hash function family F is no more than 1 / |S|; = means that all input values ​​e' except e that belong to set T are put into the probability formula and then summed; |T| represents the size of set T, that is, the size of the minimum probability set; this set includes input values ​​that may produce error patterns; |S| represents the output size of the hash function f, that is, the range of hash values; e i 、e j represents two different input values ​​in the set T, represents the minimum probability set, which contains the input values ​​that may produce the error pattern; represents a universal hash function family, i.e., a set of hash functions that can be used to generate session keys; Formula (2) represents the upper bound of the probability of failure to identify an error pattern as |T| / |S|, where |T| is the size of the minimum probability set; Formula (2) indicates that even in the presence of an error pattern with a minimum probability, the session key generated using this universal hash function family F can still ensure security.

[0036] In particular, the step of generating a key by using a one-time mask encrypted key rate between the leaf nodes includes generating a key by:

[0037]

[0038] Among them, r represents the total key rate that can be obtained in the end, q j represents the probability weight under the jth condition, r j represents the key rate that can be obtained under the jth condition, h({q j} j ) represents the probability weight q under each condition j j The calculated entropy value, n represents the encoding length; represents the joint probability distribution between the ith sub-information and the i'th sub-information under the jth condition and the j'th seed condition; q j represents the probability distribution under the jth condition; It means calculating the conditional entropy between the above joint probability distribution and the j-th conditional probability distribution.

[0039] Beneficial effects:

[0040] The present invention proposes a cross-network device authentication method based on a distributed soft bus, which has the following significant technical effects:

[0041] 1. Realize the self-organizing network authentication of cross-network devices. The present invention breaks through the limitation of the existing distributed soft bus technology that is limited to the device authentication within the local area network, and realizes the security authentication between cross-network devices.

[0042] 2. The proxy node can dynamically discover and authenticate other devices in the heterogeneous network through the Hichain module of the distributed soft bus, forming a cross-network self-organizing network topology.

[0043] 3. Supporting large-scale device access, the present invention adopts an authentication mechanism based on key negotiation, which can flexibly support the authentication requirements of large-scale devices without being limited by system resources and configuration complexity.

[0044] 4. Authentication strategies can be dynamically configured to meet authentication requirements in different business scenarios.

[0045] 5. With good dynamics and scalability, the authentication mechanism of the present invention does not rely on static device information preset, but dynamically negotiates to generate session keys, and can adapt to complex changes in network environment and changes in business needs, and has strong scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram of a method for implementing cross-network device authentication in a distributed soft bus proposed in the present invention;

[0047] Figure 2 It is a schematic diagram of the apparatus for realizing cross-network device authentication in a distributed soft bus proposed in the present invention. DETAILED DESCRIPTION

[0048] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0049] The present invention provides a method for implementing cross-network device authentication in a distributed soft bus, such as Figure 1 As shown, including:

[0050] Step 1: In the local area network, authentication is implemented between devices according to different business scenarios by configuring authentication modes, central node addresses, and authentication lists; the devices are configured as leaf nodes and proxy nodes according to their locations; in step 1, full-chain authentication mode or star authentication mode is used for device authentication in the local area network. In the local area network, existing distributed soft bus technologies usually use the following two authentication modes to implement authentication between devices:

[0051] Full-chain authentication mode: In this mode, all devices authenticate each other to form a complete authentication chain.

[0052] The advantage is that the authentication process is more secure and reliable, but the disadvantage is that the authentication complexity increases exponentially with the number of devices.

[0053] Star authentication mode: In this mode, the device is authenticated by the authentication center node, which is responsible for managing authentication policies and keys.

[0054] The advantage is that the authentication process is relatively simple and the central node can flexibly configure the authentication strategy. However, the disadvantage is that the central node becomes a system bottleneck and a single point of failure.

[0055] Step 2, for cross-network scenarios, the leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in its local area network; cross-network authentication between proxy nodes in different local area networks through the Hichain module based on the distributed soft bus; after completing the above two levels of authentication, it is deemed that trust has been established between the leaf nodes; cross-network authentication between proxy nodes through the Hichain module based on the distributed soft bus includes:

[0056] The networking module initiates the authentication operation and opens the authentication channel Socket connection; the local proxy node packages its own device information and sends it to the peer proxy node; after receiving the device information, the peer proxy node saves it and sends its own device information back; after receiving the device information of the peer proxy node, the local proxy node calls the Hichain module to start the authentication process; the local proxy node sends the authentication data to the peer proxy node, and the peer proxy node returns its own authentication data after processing; the two parties complete mutual authentication in the Hichain module. After the proxy nodes perform cross-network authentication through the Hichain module based on the distributed soft bus, a hash tag of length k is generated through the general hash function family F as the session key between them. The hash function family F meets the following conditions:

[0057]

[0058] The session key meets the following conditions:

[0059]

[0060] Where Pr[f(e′)=f(e)] represents the probability that the hash value generated by hash function f is equal to the hash value f(e) of input value e when the input value is e′; Formula (1) describes the probability that for any two different input values ​​e in the minimum probability set T i 、e j The probability of a hash value collision generated by using any hash function f in the universal hash function family F is no more than 1 / |S|; = means that all input values ​​e' except e that belong to set T are put into the probability formula and then summed; |T| represents the size of set T, that is, the size of the minimum probability set; this set includes input values ​​that may produce error patterns; |S| represents the output size of the hash function f, that is, the range of hash values; e i 、e jrepresents two different input values ​​in the set T, F represents a universal hash function family, that is, a set of hash functions that can be used to generate session keys; formula (2) represents the upper bound of the probability of failure to identify an error pattern as |T| / |S|, where |T| is the size of the minimum probability set; formula (2) indicates that even if there is an error pattern with a minimum probability, the session key generated using this universal hash function family F can still ensure security because the collision probability is very low.

[0061] Step 3: Leaf nodes generate keys through a one-time masked encrypted key rate for cross-network communication.

[0062] The step of generating a key by using a one-time mask encrypted key rate between leaf nodes comprises generating a key by:

[0063]

[0064] Among them, r represents the total key rate that can be obtained in the end, q j represents the probability weight under the jth condition, r j represents the key rate that can be obtained under the jth condition, h({q j} j ) represents the probability distribution q under each condition j j The calculated entropy value, n represents the encoding length; represents the joint probability distribution between the ith sub-information and the i'th sub-information under the jth condition and the j'th seed condition; q j represents the probability distribution under the jth condition; It means calculating the conditional entropy between the above joint probability distribution and the j-th conditional probability distribution.

[0065] The present invention also discloses a device for implementing cross-network device authentication in a distributed soft bus, such as Figure 2 As shown, including:

[0066] The LAN authentication module is used to implement authentication between devices in the LAN according to different business scenarios, configuring authentication modes, central node addresses, and authentication lists; the devices are configured as leaf nodes and proxy nodes according to their locations; in the LAN authentication module, the full-chain authentication mode or the star authentication mode is used for device authentication in the LAN. In the LAN, the existing distributed soft bus technology usually uses the following two authentication modes to implement authentication between devices:

[0067] Full-chain authentication mode: In this mode, all devices authenticate each other to form a complete authentication chain.

[0068] The advantage is that the authentication process is more secure and reliable, but the disadvantage is that the authentication complexity increases exponentially with the number of devices.

[0069] Star authentication mode: In this mode, the device is authenticated by the authentication center node, which is responsible for managing authentication policies and keys.

[0070] The advantage is that the authentication process is relatively simple and the central node can flexibly configure the authentication strategy. However, the disadvantage is that the central node becomes a system bottleneck and a single point of failure.

[0071] The cross-network authentication module is used for cross-network scenarios. The leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in the local area network where it is located; cross-network authentication between proxy nodes in different local area networks through the Hichain module based on the distributed soft bus; after completing the above two levels of authentication, it is considered that trust has been established between the leaf nodes;

[0072] For cross-network scenarios, the leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in its local area network; cross-network authentication between proxy nodes in different local area networks through the Hichain module based on the distributed soft bus; after completing the above two levels of authentication, it is deemed that trust has been established between the leaf nodes; cross-network authentication between proxy nodes through the Hichain module based on the distributed soft bus includes:

[0073] The networking module initiates the authentication operation and opens the authentication channel Socket connection; the local proxy node packages its own device information and sends it to the peer proxy node; after receiving the device information, the peer proxy node saves it and sends its own device information back; after receiving the device information of the peer proxy node, the local proxy node calls the Hichain module to start the authentication process; the local proxy node sends the authentication data to the peer proxy node, and the peer proxy node returns its own authentication data after processing; the two parties complete mutual authentication in the Hichain module. After the proxy nodes perform cross-network authentication through the Hichain module based on the distributed soft bus, a hash tag of length k is generated through the general hash function family F as the session key between them. The hash function family F meets the following conditions:

[0074]

[0075] The session key meets the following conditions:

[0076]

[0077] Where Pr[f(e′)=f(e)] represents the probability that the hash value generated by hash function f is equal to the hash value f(e) of input value e when the input value is e′; Formula (1) describes the probability that for any two different input values ​​e in the minimum probability set T i 、e j The probability of a hash value collision generated by using any hash function f in the universal hash function family F is no more than 1 / |S|; = means that all input values ​​e' except e that belong to set T are put into the probability formula and then summed; |T| represents the size of set T, that is, the size of the minimum probability set; this set includes input values ​​that may produce error patterns; |S| represents the output size of the hash function f, that is, the range of hash values; e i 、e j represents two different input values ​​in the set T; F represents a universal hash function family, that is, a set of hash functions that can be used to generate session keys; formula (2) represents the upper bound of the probability of failure to identify an error pattern as |T| / |S|, where |T| is the size of the minimum probability set; formula (2) represents that even if there is an error pattern with the minimum probability, the session key generated using this universal hash function family F can still ensure security because the collision probability is very low.

[0078] The cross-network communication module is used for generating a key through a one-time mask-encrypted key rate between leaf nodes for cross-network communication. The step of generating a key through a one-time mask-encrypted key rate between leaf nodes includes generating a key through the following method:

[0079]

[0080] Among them, r represents the total key rate that can be obtained in the end, q j represents the probability weight under the jth condition, r j represents the key rate that can be obtained under the jth condition, h({q j} j ) represents the probability distribution q under each condition j j The calculated entropy value, n represents the encoding length; represents the joint probability distribution between the ith sub-information and the i'th sub-information under the jth condition and the j'th seed condition; q j represents the probability distribution under the jth condition; It means calculating the conditional entropy between the above joint probability distribution and the j-th conditional probability distribution.

[0081] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0082] It is obvious to those skilled in the art that the embodiments of the present invention are not limited to the details of the above exemplary embodiments, and that the embodiments of the present invention can be implemented in other specific forms without departing from the spirit or basic features of the embodiments of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the embodiments of the present invention is limited by the attached claims rather than the above description, so it is intended to include all changes that fall within the meaning and scope of the equivalent elements of the claims in the embodiments of the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units, modules or devices stated in the system, device or terminal claims can also be implemented by the same unit, module or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0083] Finally, it should be noted that the above implementation modes are only used to illustrate the technical solutions of the embodiments of the present invention and are not intended to limit them. Although the embodiments of the present invention have been described in detail with reference to the above preferred implementation modes, those skilled in the art should understand that the technical solutions of the embodiments of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for implementing cross-network device authentication in a distributed soft bus, characterized in that: include: Step 1: In a local area network, authentication modes, central node addresses, and authentication lists are configured between devices according to different business scenarios to implement authentication; the devices are configured as leaf nodes and proxy nodes according to their locations; Step 2, for the cross-network scenario, the leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in the local area network where it is located; The proxy nodes in different LANs perform cross-network authentication through the Hichain module based on the distributed soft bus; after completing the two-level authentication, it is considered that trust has been established between the leaf nodes; Step 3: Leaf nodes generate keys through a one-time masked encrypted key rate to communicate across the network.

2. The method according to claim 1, characterized in that In step 1, a full-chain authentication mode or a star authentication mode is adopted for device authentication in the local area network.

3. The method according to claim 2, characterized in that The proxy nodes in different local area networks perform cross-network authentication through the Hichain module based on the distributed soft bus; including: The networking module initiates the authentication operation and opens the authentication channel Socket connection; the local proxy node packs its own device information and sends it to the peer proxy node; after receiving the device information, the peer proxy node saves it and sends its own device information back; after receiving the device information of the peer proxy node, the local proxy node calls the Hichain module to start the authentication process; the local proxy node sends the authentication data to the peer proxy node, and the peer proxy node returns its own authentication data after processing; both parties complete mutual authentication in the Hichain module.

4. The method according to claim 3, characterized in that After the proxy nodes perform cross-network authentication through the Hichain module based on the distributed soft bus, a hash tag with a length of k is generated as the session key through the general hash function family F. The hash function family F satisfies the following conditions: The session key meets the following conditions: Where Pr[f(e′)=f(e)] represents the probability that the hash value generated by hash function f is equal to the hash value f(e) of input value e when the input value is e′; Formula (1) describes the probability that for any two different input values ​​e in the minimum probability set T i 、e j The probability of a hash value collision generated by using any hash function f in the universal hash function family F is no more than 1 / |S|; = means that all input values ​​e' except e that belong to set T are put into the probability formula and then summed; |T| represents the size of set T, that is, the size of the minimum probability set; this set includes input values ​​that may produce error patterns; |S| represents the output size of the hash function f, that is, the range of hash values; e i 、e j represents two different input values ​​in the set T; F represents a universal hash function family, that is, a set of hash functions that can be used to generate session keys; formula (2) represents the upper bound of the probability of failure to identify an error pattern as |T| / |S|, where |T| is the size of the minimum probability set; formula (2) indicates that even if there is an error pattern with the minimum probability, the session key generated using this universal hash function family F can still ensure security.

5. The method according to claim 4, characterized in that The step of generating a key by using a one-time mask encrypted key rate between leaf nodes comprises generating a key by: Among them, r represents the total key rate that can be obtained in the end, q j represents the probability weight under the jth condition, r j represents the key rate that can be obtained under the jth condition, h({q j } j ) represents the probability weight q under each condition j j The calculated entropy value, n represents the encoding length; represents the joint probability distribution between the ith sub-information and the i'th sub-information under the jth condition and the j'th seed condition; q j represents the probability distribution under the jth condition; It means calculating the conditional entropy between the above joint probability distribution and the j-th conditional probability distribution.

6. A device for implementing cross-network device authentication in a distributed soft bus, characterized in that: include: The LAN authentication module is used to implement authentication between devices in the LAN according to different business scenarios by configuring authentication modes, central node addresses, and authentication lists; The devices are configured as leaf nodes and proxy nodes according to their locations; The cross-network authentication module is used for cross-network scenarios. The leaf node implements cross-network authentication through the proxy node, specifically including: authentication between the leaf node and the proxy node in the local area network where it is located; cross-network authentication between proxy nodes in different local area networks through the Hichain module based on the distributed soft bus; after completing the above two levels of authentication, it is considered that trust has been established between the leaf nodes; The cross-network communication module is used to generate keys for cross-network communication between leaf nodes through a key rate encrypted by a one-time mask.

7. The device according to claim 6, characterized in that In the local area network authentication module, a full-chain authentication mode or a star authentication mode is adopted for device authentication in the local area network.

8. The device according to claim 7, characterized in that The cross-network authentication between the proxy nodes in different local area networks through the Hichain module based on the distributed soft bus includes: The networking module initiates the authentication operation and opens the authentication channel Socket connection; the local proxy node packs its own device information and sends it to the peer proxy node; after receiving the device information, the peer proxy node saves it and sends its own device information back; after receiving the device information of the peer proxy node, the local proxy node calls the Hichain module to start the authentication process; the local proxy node sends the authentication data to the peer proxy node, and the peer proxy node returns its own authentication data after processing; both parties complete mutual authentication in the Hichain module.

9. The device according to claim 8, characterized in that After the proxy nodes perform cross-network authentication through the Hichain module based on the distributed soft bus, a hash tag with a length of k is generated through a general hash function family F as the session key between them. The hash function family F satisfies the following conditions: The session key meets the following conditions: Where Pr[f(e′)=f(e)] represents the probability that the hash value generated by hash function f is equal to the hash value f(e) of input value e when the input value is e′; Formula (1) describes the probability that for any two different input values ​​e in the minimum probability set T i 、e j The probability of a hash value collision generated by using any hash function f in the universal hash function family F is no more than 1 / |S|; = means that all input values ​​e' except e that belong to set T are put into the probability formula and then summed; |T| represents the size of set T, that is, the size of the minimum probability set; this set includes input values ​​that may produce error patterns; |S| represents the output size of the hash function f, that is, the range of hash values; e i 、e j represents two different input values ​​in the set T; F represents a universal hash function family, that is, a set of hash functions that can be used to generate session keys; formula (2) represents the upper bound of the probability of failure to identify an error pattern as |T| / |S|, where |T| is the size of the minimum probability set; formula (2) indicates that even if there is an error pattern with the minimum probability, the session key generated using this universal hash function family F can still ensure security.

10. The device according to claim 9, characterized in that The step of generating a key by using a one-time mask encrypted key rate between leaf nodes comprises generating a key by: Among them, r represents the total key rate that can be obtained in the end, q j represents the probability weight under the jth condition, r j represents the key rate that can be obtained under the jth condition, h({q j } j ) represents the probability weight q under each condition j j The calculated entropy value, n represents the encoding length; represents the joint probability distribution between the ith sub-information and the i'th sub-information under the jth condition and the j'th seed condition; q j represents the probability distribution under the jth condition; It means calculating the conditional entropy between the above joint probability distribution and the j-th conditional probability distribution.

Images