A MESH network authentication method, a MESH network node and a MESH network

Abstract

The application relates to a MESH network authentication method, a MESH network node and a MESH network, which comprises the following steps: acquiring a root key corresponding to the MESH network; adding a first random number sequence to the root key to generate a corresponding Kmesh; generating an encryption key and an integrity key based on a key derivation function and the Kmesh; generating broadcast information according to the encryption key and the integrity key and sending the broadcast information to a corresponding slave node, so that the slave node extracts the encryption key and the integrity key. The application makes the key management of the network very simple.

Description

Technical Field

[0001] This invention relates to wireless communication technology, and more specifically, to a MESH network authentication method, a MESH network node, and a MESH network. Background Technology

[0002] In current LTE, the authentication process occurs between the UE and the core network. After authentication, data between the UE and the base station, and between the UE and the core network, is encrypted. However, in a mesh network, air interface data transmission does not occur solely between the UE and the base station as in LTE. Data can also be transmitted between any two nodes. For example, in a mesh network consisting of Node0, Node1, Node2, and Node3, Node0 can communicate with both Node2 and Node1. Furthermore, encrypted data from Node0 may be forwarded from Node2 to Node3, requiring Node3 to decrypt the data from Node0.

[0003] The current point-to-point authentication method can only ensure that the connection between the two authenticated points is secure. If the above-mentioned mesh network also adopts this method, then authentication is required for every two nodes. Assuming there are N nodes in the network, then n*(n-1) / 2 point-to-point authentications are needed, each node needs to maintain n-1 keys, and all broadcast messages cannot be protected for integrity. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a MESH network authentication method, MESH network nodes, and MESH network, addressing the technical defects of the complex MESH network authentication process in the prior art.

[0005] The technical solution adopted by this invention to solve its technical problem is: constructing a MESH network authentication method, applied to the master node, including:

[0006] Obtain the root key corresponding to the MESH network;

[0007] Add the first random number sequence to the root key to generate the corresponding Kmesh;

[0008] The encryption key and integrity key are generated based on the key derivation function and the Kmesh;

[0009] A broadcast message is generated based on the encryption key and the integrity key and sent to the corresponding slave node, so that the slave node can extract the encryption key and the integrity key.

[0010] Preferably, the step of generating broadcast information based on the encryption key and the integrity key and sending it to the corresponding slave node, so that the slave node can extract the encryption key and the integrity key, includes:

[0011] The encryption key and the integrity key are concatenated to generate a plaintext stream;

[0012] Add a second random number sequence to the root key to generate a master node key stream of the same length as the plaintext stream;

[0013] The plaintext stream and the master node key stream are processed by a first algorithm to generate a ciphertext stream, and the plaintext stream and the master node key stream are processed by a second algorithm to generate a third random number sequence.

[0014] The second random number sequence, the ciphertext stream, and the third random number sequence are concatenated to generate the broadcast information and sent to the corresponding slave node, so that the slave node obtains the ciphertext stream and, after processing the ciphertext stream and the slave node key stream based on the first algorithm to obtain the plaintext stream, decomposes the plaintext stream to obtain the encryption key and the integrity key, wherein the slave node generates the slave node key stream according to the root key and the second random number sequence.

[0015] Preferably, the key derivation function is a KDF function;

[0016] The first algorithm is the XOR algorithm; and / or

[0017] The second algorithm is the MD5 algorithm.

[0018] This invention also constructs a MESH network authentication method, applied to slave nodes, comprising:

[0019] Obtain the root key corresponding to the MESH network;

[0020] The encryption key and integrity key generated by the master node based on Kmesh and key derivation function are extracted from the broadcast information according to the root key, wherein the master node generates the Kmesh according to the root key and the first random number sequence.

[0021] Preferably, the step of extracting the encryption key and integrity key generated by the master node based on Kmesh and key derivation function from the broadcast information according to the root key includes:

[0022] Extract the ciphertext stream generated by the master node based on the encryption key and the integrity key from the broadcast information, wherein the master node concatenates the encryption key and the integrity key to generate a plaintext stream, and adds a second random number sequence to the root key to generate a master node key stream of the same length as the plaintext stream, and processes the plaintext stream and the master node key stream through a first algorithm to generate the ciphertext stream;

[0023] Extract the second random number sequence from the broadcast information to generate a slave node key stream based on the root key and the second random number sequence;

[0024] The plaintext stream is obtained by processing the slave node key stream and the ciphertext stream using the first algorithm;

[0025] The plaintext stream is decomposed to obtain the encryption key and the integrity key.

[0026] Preferably, the following steps are performed before decomposing the plaintext stream to obtain the encryption key and the integrity key:

[0027] The plaintext stream and the slave node key stream are processed by a second algorithm to obtain a fourth random number sequence.

[0028] Extract the third random number sequence from the broadcast information, and when the fourth random number sequence matches the third random number sequence, perform the step of decomposing the plaintext stream to obtain the encryption key and the integrity key, wherein the third random number sequence is generated by the master node through processing the plaintext stream and the master node key stream using a second algorithm.

[0029] Preferably,

[0030] The key derivation function is a KDF function;

[0031] The first algorithm is the XOR algorithm; and / or

[0032] The second algorithm is the MD5 algorithm.

[0033] The present invention also constructs a MESH network node, which is selected as the master node, comprising:

[0034] The first acquisition unit is used to acquire the root key corresponding to the MESH network;

[0035] The first execution unit is used to add a first random number sequence to the root key to generate the corresponding Kmesh;

[0036] The second execution unit is used to process the Kmesh through a key derivation function to generate an encryption key and an integrity key;

[0037] The third execution unit is used to generate broadcast information based on the encryption key and the integrity key and send it to the corresponding slave node so that the slave node can extract the encryption key and the integrity key.

[0038] The present invention also constructs a MESH network node, selected as a slave node, comprising:

[0039] The second acquisition unit is used to acquire the root key corresponding to the MESH network;

[0040] The fourth execution unit is used to extract the encryption key and integrity key generated by the master node based on Kmesh and key derivation function in the broadcast information according to the root key, wherein the master node generates the Kmesh according to the root key and the first random number sequence.

[0041] The present invention also constructs a MESH network, including a MESH network node selected as the master node as described above, and several MESH network nodes selected as slave nodes as described above.

[0042] The MESH network authentication method, MESH network node, and MESH network of the present invention have the following beneficial effects: the key management of the network becomes very simple. Attached Figure Description

[0043] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings:

[0044] Figure 1 This is a flowchart of an embodiment of a MESH network authentication method according to the present invention;

[0045] Figure 2 This is a flowchart illustrating an embodiment of a MESH network authentication method according to the present invention;

[0046] Figure 3 This is a flowchart of another embodiment of a MESH network authentication method of the present invention;

[0047] Figure 4 This is a flowchart illustrating another embodiment of a MESH network authentication method according to the present invention;

[0048] Figure 5 This is a flowchart of another embodiment of a MESH network authentication method of the present invention;

[0049] Figure 6 This is a flowchart of another embodiment of a MESH network authentication method of the present invention;

[0050] Figure 7 This is a flowchart illustrating another embodiment of a MESH network authentication method according to the present invention;

[0051] Figure 8 This is a flowchart of another embodiment of a MESH network authentication method of the present invention;

[0052] Figure 9 This is a logical block diagram of an embodiment of a MESH network node according to the present invention;

[0053] Figure 10 This is a logical block diagram of another embodiment of a MESH network node according to the present invention;

[0054] Figure 11 This is a logical block diagram of an embodiment of a MESH network according to the present invention. Detailed Implementation

[0055] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0056] like Figure 1 and Figure 2As shown, in the first embodiment of the MESH network authentication method of the present invention, the method is applied to the master node and specifically includes the following steps: A1, obtaining the root key shared Key corresponding to the MESH network; A2, adding a first random number sequence RAND to the root key shared Key to generate the corresponding Kmesh; A3, generating an encryption key Kenc and an integrity key Kint based on the key derivation function and the Kmesh; A4, generating broadcast information based on the encryption key Kenc and the integrity key Kint and sending it to the corresponding slave node so that the slave node can extract the encryption key Kenc and the integrity key Kint. Specifically, the same root key shared Key is configured for the entire MESH network, and this root key shared Key is used to encrypt the entire MESH network. That is, in a MESH network that establishes a communication connection, the root key shared Key of all MESH nodes is the same. The first random number sequence RAND is added to this root key shared Key to generate the corresponding Kmesh (key of mesh, i.e., the master key of the MESH network). The addition process involves concatenating the root key (shared key) with a first random number sequence (RAND). This concatenation can occur either before or after the root key (shared key). The resulting Kmesh can then generate an encryption key (Kenc) and an integrity key (Kint) using a key derivation function. After obtaining these keys, the master node generates a corresponding broadcast message and sends them to the corresponding slave node. Essentially, in a MESH network, any node can be configured as the master node, and other nodes establishing communication connections can be configured as slave nodes. Upon receiving the broadcast message, the slave node extracts the encryption key (Kenc) and integrity key (Kint), thus ensuring that the same encryption and integrity keys are used for network data processing within the MESH network. The encryption key (Kenc) is used to encrypt and decrypt node communication data, while the integrity key (Kint) is used to verify the integrity of the node communication data.

[0057] like Figure 3 and Figure 4As shown, in one embodiment, a broadcast message is generated based on the encryption key Kenc and the integrity key Kint and sent to the corresponding slave node so that the slave node can extract the encryption key Kenc and the integrity key Kint. This includes: A41, concatenating the encryption key Kenc and the integrity key Kint to generate a plaintext stream plaintext; A42, adding a second random number sequence SEQ1 to the root key shared Key to generate a master node keystream keyStream of the same length as the plaintext stream plaintext; A43, processing the plaintext stream plaintext and the master node keystream keyStream using a first algorithm to generate a ciphertext stream CipherText, and processing the plaintext stream plaintext and the master node keystream keyStream using a second algorithm to generate a third random number sequence SEQ2; A44, concatenating the second random number sequence SEQ1, the ciphertext stream CipherText, and the third random number sequence SEQ2 to generate a broadcast message and send it to the corresponding slave node so that the slave node can obtain the ciphertext stream CipherText and process the ciphertext stream CipherText based on the first algorithm. After obtaining the plaintext stream `plaintext` from the `text` and `keyStream` from the slave nodes, the plaintext stream `plaintext` is decomposed to obtain the encryption key `Kenc` and the integrity key `Kint`. The slave nodes generate their own keystream `keyStream` based on the root key `shared Key` and the second random number sequence `SQE1`. Specifically, the encryption key `Kenc` and the integrity key `Kint` are concatenated to generate the plaintext stream `plaintext`. This concatenation can be done by placing the encryption key `Kenc` before the integrity key `Kint`. Then, a keystream `keyStream` of the same length as the plaintext stream `plaintext` is generated based on the length of the generated plaintext stream `plaintext` and the root key `shared Key`. The keystream `keyStream` is generated by concatenating the root key `shared Key` with a random number sequence. This concatenation can occur before or after the root key `shared Key`. After obtaining the plaintext stream (plaintext) and the master node keystream (keyStream), the ciphertext stream (CipherText) is obtained through a first algorithm. This algorithm can employ common algorithms used in communication data processing. In one embodiment, the XOR algorithm is used to process the plaintext stream (plaintext) and the master node keystream (keyStream) to obtain the ciphertext stream (CipherText). Simultaneously, the plaintext stream (plaintext) and the master node keystream (keyStream) are then processed through a second algorithm to obtain a third random number sequence (SEQ2). That is, some corresponding hash values, i.e., the third random data sequence, are generated according to the cryptographic hash function-related algorithm, i.e., the second algorithm. The second algorithm can be the MD5 algorithm.

[0058] In the broadcast message, the concatenated second random number sequence SEQ1, the ciphertext stream Cipher Text, and the third random number sequence SEQ2 are sent to the corresponding slave node. The slave node extracts the ciphertext stream Cipher Text from the broadcast message and processes it and the slave node keystream keyStream using a first algorithm to obtain the plaintext stream plaintext. Decomposing the plaintext stream plaintext yields the encryption key Kenc and the integrity key Kint. The slave node keystream keyStream is generated by the slave node based on the root key shared Key and the second random number sequence SQE1. It is the same as the master node keystream keyStream, except that it is generated by the master node and the slave node respectively. The technical solution of this invention can greatly simplify the key management process of the network and has been supported by the Sichuan Science and Technology Program (2019YFS0068), showing significant market potential.

[0059] like Figure 5As shown, in one embodiment, a MESH network authentication method of the present invention is applied to a slave node. The specific process includes the following steps: B1, obtaining the root key (shared Key) corresponding to the MESH network; B2, extracting the encryption key (Kenc) and integrity key (Kint) generated by the master node based on Kmesh and a key derivation function from the broadcast information according to the root key (shared Key), wherein the master node generates the Kmesh according to the root key (shared Key) and a first random number sequence (RAND). Specifically, the same root key (shared Key) is configured for the entire MESH network, and this root key (shared Key) is used to encrypt the entire MESH network. That is, in a MESH network that establishes a communication connection, the root key (shared Key) of all MESH nodes is the same. The master node adds the first random number sequence (RAND) to the root key (shared Key) to generate the corresponding Kmesh (key of mesh, i.e., the master key of the MESH network). The addition process involves concatenating the root key (shared Key) with a first random number sequence (RAND). This concatenation can occur either before or after the root key (shared Key). The resulting Kmesh can then generate an encryption key (Kenc) and an integrity key (Kint) using a key derivation function. After obtaining the encryption and integrity keys, the master node broadcasts them to the slave nodes. The slave nodes then extract the encryption and integrity keys from the broadcast message based on the root key (shared Key) corresponding to the acquired MESH network. This ensures that the same encryption and integrity keys (Kenc and Kint) are used for network data processing within the MESH network. The encryption key (Kenc) is used to encrypt and decrypt node communication data, while the integrity key (Kint) is used to verify the integrity of the node communication data.

[0060] like Figure 6 and Figure 7 As shown, in one embodiment, the extraction of the encryption key Kenc and integrity key Kint generated by the master node based on Kmesh and key derivation functions from the broadcast information according to the root key shared key includes:

[0061] B21. Extract the ciphertext stream Cipher Text generated by the master node based on the encryption key Kenc and the integrity key Kint from the broadcast information. The master node concatenates the encryption key Kenc and the integrity key Kint to generate the plaintext stream plaintext, and adds a second random number sequence SEQ1 to the root key shared Key to generate a master node key stream keyStream of the same length as the plaintext stream plaintext. Process the plaintext stream plaintext and the master node key stream keyStream using a first algorithm to generate the ciphertext stream Cipher Text; B22. Extract the second random number sequence SEQ1 from the broadcast information to generate a slave node key stream keyStream based on the root key shared Key and the second random number sequence SEQ1; B23. Process the slave node key stream keyStream and the ciphertext stream Cipher Text using a first algorithm to obtain the plaintext stream plaintext; B24. Decompose the plaintext stream plaintext to obtain the encryption key Kenc and the integrity key Kint. The specific process is as follows: The node extracts the ciphertext stream (Cipher Text) sent by the master node from the received broadcast information. The generation of this Cipher Text involves the master node concatenating the encryption key (Kenc) and the integrity key (Kint) to generate a plaintext stream (plaintext). This concatenation can be done by placing the encryption key (Kenc) before the integrity key (Kint). Based on the length of the generated plaintext stream and the root key (shared key), the master node generates a keystream (keyStream) of the same length as the plaintext stream. This keystream can be concatenated before or after the root key (shared key). After obtaining the plaintext stream (plaintext) and the keystream (keyStream), the ciphertext stream (Cipher Text) is obtained through a first algorithm. This algorithm can employ common algorithms used in communication data processing; in one embodiment, the XOR algorithm is used to process the plaintext stream (plaintext) and the keystream (keyStream) to obtain the ciphertext stream (Cipher Text). The slave node extracts the ciphertext stream Cipher Text from the broadcast information, processes it and the slave node's keystream keyStream using the first algorithm to obtain the plaintext stream plaintext. Decomposing the plaintext stream plaintext yields the encryption key Kenc and the integrity key Kint. The slave node's keystream keyStream is generated by the slave node based on the root key shared Key and the second random number sequence SEQ1.

[0062] like Figure 8As shown, in one embodiment, the following steps are performed before decomposing the plaintext stream to obtain the encryption key Kenc and the integrity key Kint:

[0063] B231. Process the plaintext stream plaintext and obtain the fourth random number sequence SEQ3 from the node keystream keyStream using the second algorithm;

[0064] B232. Extract the third random number sequence SEQ2 from the broadcast information. When the fourth random number sequence SEQ3 matches the third random number sequence SEQ2, perform the step of decomposing the plaintext stream to obtain the encryption key Kenc and the integrity key Kint. The third random number sequence SEQ2 is generated by the master node through processing the plaintext stream and the master node's keystream using the second algorithm. Specifically, after receiving the plaintext stream, the slave node processes it using the second algorithm based on the plaintext stream and the slave node's corresponding keystream to obtain the fourth random number sequence SEQ3. That is, it generates some corresponding hash values, i.e., the fourth random data sequence, according to the cryptographic hash function related algorithm, i.e., the second algorithm. The second algorithm can be the MD5 algorithm. Then, extract the third random number sequence SEQ2 sent by the master node from the broadcast information summary. The third random number sequence SEQ2 is generated by the master node through processing the plaintext stream and the master node's keystream using the second algorithm. Compare the fourth random number sequence SEQ3 with the third random number sequence SEQ2. When the fourth random number sequence SEQ3 matches the third random number sequence SEQ2, perform the step of decomposing the plaintext stream plaintext to obtain the encryption key Kenc and the integrity key Kint.

[0065] like Figure 9 As shown, a MESH network node of the present invention, selected as a master node, specifically includes: a first acquisition unit 110, used to acquire the root key shared Key corresponding to the MESH network; a first execution unit 120, used to add a first random number sequence RAND to the root key shared Key to generate a corresponding Kmesh; a second execution unit 130, used to process the Kmesh through a key derivation function to generate an encryption key Kenc and an integrity key Kint; and a third execution unit 140, used to generate broadcast information based on the encryption key Kenc and the integrity key Kint and send it to the corresponding slave node, so that the slave node can extract the encryption key Kenc and the integrity key Kint. Specifically, the specific cooperative operation process between the units of this MESH network node can be referred to the MESH network authentication method applied to the master node described above, and will not be repeated here.

[0066] like Figure 10 As shown, a MESH network node of the present invention is selected as a master node. A second acquisition unit 210 is used to acquire the root key (shared key) corresponding to the MESH network. A fourth execution unit 220 is used to extract the encryption key Kenc and integrity key Kint generated by the master node based on Kmesh and a key derivation function from the broadcast information according to the root key (shared key). The master node generates the Kmesh based on the root key (shared key) and a first random number sequence RAND. Specifically, the specific cooperative operation process between the units of this MESH network node can be referred to the MESH network authentication method applied to slave nodes described above, and will not be repeated here.

[0067] like Figure 11 As shown, a MESH network according to the present invention includes one MESH network node selected as the master node and several MESH network nodes selected as slave nodes. The specific cooperation operation process between the nodes in this MESH network can be referred to the MESH network authentication method described above, and will not be repeated here.

[0068] It is understood that the above embodiments only illustrate preferred embodiments of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can freely combine the above technical features without departing from the concept of the present invention, and can also make several modifications and improvements, all of which fall within the protection scope of the present invention. Therefore, all equivalent transformations and modifications made with respect to the scope of the claims of the present invention should fall within the scope of the claims of the present invention.

Claims

1. A MESH network authentication method, characterized in that, Applied to the master node, it includes: obtaining the root key corresponding to the MESH network, wherein the entire MESH network is configured with the same root key, and the root key is used to encrypt the entire MESH network; Add the first random number sequence to the root key to generate the corresponding Kmesh, where the Kmesh is the master key of the MESH network; The encryption key and integrity key are generated based on the key derivation function and the Kmesh; Broadcast information is generated based on the encryption key and the integrity key and sent to the corresponding slave node, so that the slave node can extract the encryption key and the integrity key, forming a MESH network where the same encryption key and integrity key are used for network data processing. The step of generating broadcast information based on the encryption key and the integrity key and sending it to the corresponding slave node, so that the slave node can extract the encryption key and the integrity key, includes: The encryption key and the integrity key are concatenated to generate a plaintext stream; Add a second random number sequence to the root key to generate a master node key stream of the same length as the plaintext stream; The plaintext stream and the master node key stream are processed by a first algorithm to generate a ciphertext stream, and the plaintext stream and the master node key stream are processed by a second algorithm to generate a third random number sequence. The second random number sequence, the ciphertext stream, and the third random number sequence are concatenated to generate the broadcast information and sent to the corresponding slave node, so that the slave node obtains the ciphertext stream and, after processing the ciphertext stream and the slave node key stream based on the first algorithm to obtain the plaintext stream, decomposes the plaintext stream to obtain the encryption key and the integrity key, wherein the slave node generates the slave node key stream according to the root key and the second random number sequence.

2. The MESH network authentication method according to claim 1, characterized in that, The key derivation function is a KDF function; The first algorithm is the XOR algorithm; and / or The second algorithm is the MD5 algorithm.

3. A MESH network authentication method, characterized in that, Applied to slave nodes, it includes: obtaining the root key corresponding to the MESH network, wherein the entire MESH network is configured with the same root key, and the root key is used to encrypt the entire MESH network; Based on the root key, the encryption key and integrity key generated by the master node in the broadcast information based on Kmesh and key derivation function are extracted, and the same encryption key and integrity key are used for network data processing in the MESH network. The master node generates the Kmesh based on the root key and the first random number sequence. Kmesh is the master key of the MESH network. The step of extracting the encryption key and integrity key generated by the master node based on Kmesh and key derivation functions from the broadcast information according to the root key includes: Extract the ciphertext stream generated by the master node based on the encryption key and the integrity key from the broadcast information, wherein the master node concatenates the encryption key and the integrity key to generate a plaintext stream, and adds a second random number sequence to the root key to generate a master node key stream of the same length as the plaintext stream, and processes the plaintext stream and the master node key stream through a first algorithm to generate the ciphertext stream; Extract the second random number sequence from the broadcast information to generate a slave node key stream based on the root key and the second random number sequence; The first algorithm is used to process the slave node key stream and the ciphertext stream to obtain the plaintext stream; the plaintext stream is then decomposed to obtain the encryption key and the integrity key.

4. The MESH network authentication method according to claim 3, characterized in that, Before decomposing the plaintext stream to obtain the encryption key and the integrity key, the following steps are performed: The plaintext stream and the slave node key stream are processed by a second algorithm to obtain a fourth random number sequence. Extract the third random number sequence from the broadcast information, and when the fourth random number sequence matches the third random number sequence, perform the step of decomposing the plaintext stream to obtain the encryption key and the integrity key, wherein the third random number sequence is generated by the master node through processing the plaintext stream and the master node key stream using a second algorithm.

5. The MESH network authentication method according to claim 4, characterized in that, The key derivation function is a KDF function; The first algorithm is the XOR algorithm; and / or the second algorithm is the MD5 algorithm.

6. A MESH network node for implementing the MESH network authentication method of claim 1 or 2, characterized in that, The selected master node includes: a first acquisition unit, used to acquire the root key corresponding to the MESH network; The first execution unit is used to add a first random number sequence to the root key to generate the corresponding Kmesh. The entire MESH network is configured with the same root key, which is used to encrypt the entire MESH network. Kmesh is the master key of the MESH network. The second execution unit is used to process the Kmesh through a key derivation function to generate an encryption key and an integrity key; the third execution unit is used to generate broadcast information based on the encryption key and the integrity key and send it to the corresponding slave node, so that the slave node can extract the encryption key and the integrity key, forming a network data processing in the MESH network using the same encryption key and integrity key.

7. A MESH network node for implementing the MESH network authentication method according to any one of claims 3-5, characterized in that, Selected as a slave node, including: a second acquisition unit, used to acquire the root key corresponding to the MESH network, wherein the entire MESH network is configured with the same root key, and the root key is used to encrypt the entire MESH network; The fourth execution unit is used to extract the encryption key and integrity key generated by the master node based on Kmesh and key derivation function in the broadcast information according to the root key, and to form a MESH network to process network data using the same encryption key and integrity key. The master node generates the Kmesh according to the root key and the first random number sequence. The Kmesh is the master key of the MESH network.

8. A MESH network, characterized in that, It includes one MESH network node as described in claim 6, and several MESH network nodes as described in claim 7.

Images