Method for secure communication between nodes and network node

Abstract

A method for inter-node secure communication, a network node processes a data packet according to its role in a communication path in the current inter-node secure communication. When the node is a source node of the communication, the node encrypts and sends the data packet after obtaining a key for encryption according to a node identifier in an identification quadruple; when the node is a first switching device of the communication path or a last switching device of the communication path and an end-to-end secure communication strategy is valid, the node directly forwards the data packet, and if the end-to-end secure communication strategy is invalid, the node first receives and decrypts the data packet after obtaining a key for decryption according to the node identifier in the identification quadruple, and then encrypts and sends the data packet after obtaining a key for encryption according to the node identifier in the identification quadruple; when the node is an intermediate switching device of the communication path, the node directly forwards the data packet; and when the node is a destination node of the communication, the node receives and decrypts the data packet after obtaining a key for decryption according to the node identifier in the identification quadruple. The application also discloses a network node.

Description

Technical Field

[0001] This application relates to the field of communication and Internet technology, and in particular to a secure communication method between nodes and a network node. Background Technology

[0002] With the development of information technology, network security has become a major concern. In a network, nodes communicate with each other, and to prevent data leakage, encrypted data transmission requires encryption using keys. Previously, local area networks (LANs) used two methods for secure communication: end-to-end and hop-by-hop. End-to-end secure communication, due to the complexity of the LAN topology and the large number of nodes involved, requires each node to store a large number of keys established with the peer node, placing high demands on storage resources. Hop-by-hop secure communication, because the switching equipment in the LAN needs to decrypt and then encrypt each received data packet before forwarding, places a huge computational burden on the switching equipment and is also vulnerable to attacks. Therefore, neither method is ideal in terms of security and transmission efficiency.

[0003] For widely used local area networks (LANs), the industry provides a LAN security protocol based on a three-element peer-to-peer architecture (TePA-based LAN Security, TLSec).

[0004] The TLSec protocol, a security scheme in the national standard GB / T 15629.3-2014, provides authentication services, port-based access control services, and secure communication services for local area networks (LANs), effectively ensuring LAN security. The TLSec protocol employs a three-segment inter-node secure communication method. Compared to end-to-end secure communication methods, this method eliminates the need to establish a key pair for each end-to-end node, significantly reducing storage resource requirements. Compared to hop-by-hop secure communication methods, this method involves encryption and decryption operations in at most three data transmission segments: source node and the first switching device, the first switching device and the last switching device, and the last switching device and the destination node, resulting in relatively lower computational overhead. Therefore, from the perspective of secure communication methods, the three-segment inter-node secure communication method adopted by the TLSec protocol has greater advantages.

[0005] The TLSec protocol mainly includes two sub-protocols: the TePA-based LAN Authentication Protocol (TLA) and the TLA-based LAN Privacy Protocol (TLP). The TLA sub-protocol ensures legitimate access between network nodes, while the TLP sub-protocol ensures confidential data communication between network nodes.

[0006] The TLA sub-protocol defines methods for neighbor node discovery, security policy negotiation, authentication and unicast key management, multicast key announcement, inter-site key establishment, and key exchange establishment.

[0007] After a new node joins the network, it needs to obtain information about all neighboring nodes through a neighbor discovery process, and also informs its own information to surrounding neighboring nodes. Before a new node attempts to join the network or an existing node initiates re-access authentication, the new node or the node initiating re-access authentication, acting as the access requester, and the node with authentication and access control functions, acting as the access authenticator, first negotiate security policies such as authentication and key suites through a security policy negotiation process. After the security policy negotiation process is completed, the access requester and the access authenticator verify the legitimacy of network access through an authentication and unicast key management process based on the authentication and key suite selected in the security policy negotiation process. This verifies the legitimacy of the access requester and the legitimacy of network access, and establishes a secure path between the access requester and the access authenticator's adjacent nodes, including establishing unicast keys for the two adjacent nodes. At this point, the access requester successfully joins the wired LAN. After the access requester successfully joins the network, the multicast key announcement process completes the distribution of multicast keys from the access authenticator to the access requester. Inter-site key establishment establishes secure paths for user terminals requiring inter-site keys. This includes establishing inter-site keys between directly connected user terminals on the same switching device and between neighboring user terminals. If the new node's node type is a user terminal, the inter-site key establishment process can establish inter-site keys between the new node and directly connected user terminals or neighboring user terminals on the same switching device. Exchange key establishment establishes secure paths between all switching devices on the local area network. If the new node is a switching device, exchange keys will be established between the new node and all switching devices in the network.

[0008] In summary, the TLA sub-protocol provides security for new nodes to access the network. After a new node securely accesses the network, it ensures that effective secure paths are established between adjacent nodes and between pairs of switching devices, providing the necessary prerequisites for the implementation of the TLP sub-protocol. Thus, after a new node securely accesses the network, unicast keys exist between adjacent nodes and exchange keys exist between pairs of switching devices. The TLP sub-protocol uses the unicast and exchange keys established during the TLA process to complete secure communication between nodes. Although the establishment of inter-site keys belongs to the TLA sub-protocol, the generation of inter-site keys is triggered during the implementation of the TLP sub-protocol. Inter-site keys are also used for secure communication between nodes according to the actual network connection situation. This also indicates that the exchange keys between adjacent switching devices are essentially unicast keys between adjacent nodes.

[0009] The TLP sub-protocol defines a three-stage secure communication method between nodes, specifically involving a method for finding exchange paths between nodes and a secure communication method between nodes. The TLP sub-protocol connects the communication source node Node... Source To the communication destination node Destination The path information exchanged between nodes is defined as an identifier quadruple, which can be specifically represented as [ID] Source ID SW-first ID SW-last ID Destination ]. Among them, ID Source Represents the communication source node. Source Node identifier, ID SW-first This represents the first switching device (SW) through which data packets pass in the communication path from the source node to the destination node. first Node identifier, ID SW-last This represents the last switching device (SW) through which data packets pass in the communication path from the source node to the destination node. last Node identifier, ID Destination Indicates the destination node of the communication. Destination The node identifier. The communication source node initiates a switch path discovery request to obtain switch path information from the communication source node to the communication destination node. Figure 1 The complete path structure for secure communication between three nodes is described, such as... Figure 1 As shown, a switching device that receives data packets from the source node to the destination node but does not appear in the switching path information identifier quadtuple is called an intermediate switching device, specifically denoted as SW. M In this case, data packets from the source node to the destination node may not pass through an intermediate switching device (SW) during transmission. M It may also be through multiple intermediate switching devices (SW) M In the communication path, only network nodes whose node identifiers are in the four-tuple of the exchange path information identifier are involved in the encryption and decryption of data packets for secure communication. Other network nodes, if they exist, simply forward data packets directly.

[0010] It should also be noted that the communication source node (Node) Source and the communication destination node Destination The node type can be either a user terminal or a switching device. When the communication source node... Source When switching equipment, SW first That is, Node Source It itself; when the communication destination node Node Destination When switching equipment, SW last That is, Node Destination itself.

[0011] Secure communication between nodes includes data communication between any two nodes within a local area network (LAN). The basic framework of a LAN is shown below. Figure 2 All adjacent nodes share a unicast key, such as adjacent switching devices SW. A and SW B Switching equipment SW between and adjacent E There is an exchange key between the user terminal STA2 and each other; for example, adjacent switching devices SW have exchange keys. B With SW E Switching equipment SW between and not adjacent to each other E and SW G Inter-station keys can be established between directly connected user terminals under the same switching equipment, such as between user terminals STA1 and STA2, or between user terminals STA7 and STA9; inter-station keys can also be established between neighboring user terminals, such as between user terminals STA9 and STA2. 10 Between these two nodes, the unicast key and the exchange key are established when a node successfully accesses the network, while the inter-node key is established when communication occurs. It should be noted that if a key exists between any two nodes, regardless of the key type, only one key pair exists.

[0012] Based on the local area network architecture and its components, starting from the communication source node Node Source To the communication destination node Destination Secure communication between nodes is based on the node Source With Node Destination The physical connections between them and their node types can be divided into the following 8 types. The TLP sub-protocol defines the corresponding confidential communication strategies for each of these 8 communication types:

[0013] Type 1: Communication between switching devices, including communication between switching devices and adjacent switching devices and communication between switching devices and non-adjacent switching devices;

[0014] For example: Figure 2 SW in A To the adjacent SW B SW E To non-adjacent SW G Data communication.

[0015] Type 2: Communication from switching equipment to directly connected user terminals;

[0016] For example: Figure 2 SW in E To STA1, SW G Data communication to STA7.

[0017] Type 3: Communication from switching equipment to user terminals that are not directly connected;

[0018] For example: Figure 2 SW in A To STA1, SW D Data communication to STA6.

[0019] Type 4: Communication from user terminal to directly connected switching equipment;

[0020] For example: Figure 2 STA2 to SW E STA5 to SW F Data communication.

[0021] Type 5: Communication from user terminals to non-directly connected switching devices;

[0022] For example: Figure 2 STA2 to SW F STA5 to SW B Data communication.

[0023] Type 6: Communication between a user terminal and other directly connected user terminals under the same switching equipment;

[0024] For example: Figure 2 Data communication between STA2 and STA3, and between STA5 and STA6.

[0025] Type 7: Communication between user terminals and user terminals directly connected to different switching devices;

[0026] For example: Figure 2 Data communication between STA2 and STA6, and between STA5 and STA9.

[0027] Type 8: Communication between neighboring user terminals;

[0028] For example: Figure 2 STA9 to STA 10 Data communication.

[0029] The specific secure communication strategies corresponding to these eight communication types are as follows:

[0030] Type 1: Switching device-to-switching device communication strategy, see Figure 3A and Figure 3B .

[0031] In a network, each pair of switching devices exchanges a key. The secure communication strategy used for Type 1 data communication is as follows:

[0032] a) Communication source node Source(At this point, it is a switching device, and the communication source node is Node.) Source It was also the first switching device SW first Using the target node for communication Destination (At this point, the switching device and the communication destination node are Node) Destination It is also the last switching device SW last The exchange of keys between them encrypts data packets;

[0033] b) If an intermediate switching device exists, the intermediate switching device will directly forward communication data packets of type Type1.

[0034] c) Communication Destination Node Destination Use with the communication source node Node Source The key is exchanged between them to decrypt data packets.

[0035] Type 2: Communication strategy from switching equipment to directly connected user terminals, see Figure 4 .

[0036] In a network, a unicast key exists between the switching equipment and the directly connected user terminal. The secure communication strategy used for Type 2 data communication is as follows:

[0037] a) Communication source node Source (At this point, it is a switching device, and the communication source node is Node.) Source It was also the first switching device SW first The last switching device SW last Using the target node for communication Destination Unicast key encryption data packets between (user terminals at this time);

[0038] b) Communication Destination Node Destination Use with the communication source node Node Source The unicast key between them decrypts the data packets.

[0039] Type 3: Communication strategy from switching equipment to user terminals that are not directly connected, see Figure 5 .

[0040] In a network, there is a unicast key between the switching equipment and the directly connected user terminal, and there is an exchange key between the switching equipment. The confidentiality strategy used for Type 3 data communication is as follows:

[0041] a) Communication source node Source (At this point, it is a switching device, and the communication source node is Node.) Source It was also the first switching device SW first Using the last switching device SW lastThe exchange of keys between them encrypts data packets;

[0042] b) If an intermediate switching device exists, the intermediate switching device directly forwards packets of type 3;

[0043] c) The last switching device SW last Use with the communication source node Node Source The exchanged key is used to decrypt the data packet, and then used with the communication destination node. Destination The unicast key is used to encrypt data packets between (the user terminal at this time) and then forward them.

[0044] d) Communication destination node Destination Use with the last switching device SW last The unicast key between them decrypts the data packets.

[0045] Type 4: Communication strategy from user terminal to directly connected switching equipment, see Figure 6 .

[0046] In a network, user terminals and directly connected switching equipment share a unicast key. Data communication of type Type 4 uses the following secure communication strategy:

[0047] a) Communication source node Source (At this point, the user terminal) uses the communication destination node Node Destination (At this point, the switching device and the communication destination node are Node) Destination It was also the first switching device SW first The last switching device SW last Unicast key encryption of data packets between ( )

[0048] b) Communication Destination Node Destination Use with the communication source node Node Source The unicast key between them decrypts the data packets.

[0049] Type 5: Communication strategy from user terminals to non-directly connected switching equipment, see Figure 7 .

[0050] In a network where user terminals and directly connected switching equipment share unicast keys, and switching equipment itself shares exchange keys, the secure communication strategy employed for Type 5 data communication is as follows:

[0051] a) Communication source node Source (At this point, the user terminal) uses the first switching device SW first Unicast key encryption of data packets between them;

[0052] b) The first switching device SWfirst Use with the communication source node Node Source The unicast key between the nodes decrypts the data packets, and then uses the key to communicate with the destination node. Destination (At this point, the switching device and the communication destination node are Node) Destination It is also the last switching device SW last They exchange keys to encrypt data packets and then forward them;

[0053] c) If an intermediate switching device exists, the intermediate switching device will directly forward packets of type Type 5;

[0054] d) Communication destination node Destination Use with the first switching device SW first The key is exchanged between them to decrypt data packets.

[0055] Type 6: Communication strategy between a user terminal and other directly connected user terminals under the same switching device, see Figure 8 .

[0056] In a network, user terminals and directly connected switching equipment share a unicast key, and inter-station keys can be established between directly connected user terminals within the same switching equipment. The secure communication strategy employed for Type 6 data communication is as follows:

[0057] a) Communication source node Source (At this point, the user terminal) uses the communication destination node Node Destination (At this point, the user terminal) encrypts data packets using inter-station keys;

[0058] b) The first switching device SW first (At this time, the first switching device SW) first It is also the last switching device SW last For Type 6 data packets, forward them directly;

[0059] c) Communication Destination Node Destination Use with the communication source node Node Source Inter-station key decryption of data packets.

[0060] Type 7: Communication strategy for user terminals directly connected to different switching devices, see... Figure 9 .

[0061] In the network, there is a unicast key between the user terminal and the directly connected switching equipment, and there is an exchange key between the switching equipment. The confidentiality communication strategy adopted for Type 7 data communication is as follows:

[0062] a) Communication source node Source(At this point, the user terminal) uses the first switching device SW first Unicast key encryption of data packets between them;

[0063] b) The first switching device SW first Use with the communication source node Node Source The unicast key between them decrypts the data packets, and then uses it with the last switching device SW. last They exchange keys to encrypt data packets before forwarding them;

[0064] c) If an intermediate switching device exists, the intermediate switching device will directly forward packets of type 7;

[0065] d) The last switching device SW last Use with the first switching device SW first The exchange of keys between them decrypts the data packets, and then uses them with the communication destination node. Destination The unicast key is used to encrypt data packets between (user terminals) and then forward them.

[0066] e) Communication Destination Node Destination Use with the last switching device SW last The unicast key between them decrypts the data packets.

[0067] Type 8: Communication strategy between neighboring user terminals, see Figure 10 .

[0068] Inter-station keys can be established between neighboring user terminals in a network. The secure communication strategy used for Type 8 data communication is as follows:

[0069] a) Communication source node Source (At this point, the user terminal) uses the communication destination node Node Destination (At this point, the user terminal) encrypts data packets using inter-station keys;

[0070] b) Communication Destination Node Destination Use with the communication source node Node Source Inter-station key decryption of data packets.

[0071] It should also be noted that the TLP sub-protocol defines the packet encapsulation format. For Type 6 and Type 8 communication types, the exchange path information identifier quadtuple in the packet only contains the ID. Source and ID Destination Identification information, and the secure communication policy is set to end-to-end secure communication policy. Other communication types include an exchange path information identifier quadruple [ID]. Source ID SW-first IDSW-last ID Destination All identification information is included, and the secure communication policy is set to a three-stage secure communication policy. Typically, the enabled secure communication policy can be indicated by the identifier carried in the data packet; this identifier can be represented by the Encrypt Policy field. Network nodes in the communication path can extract the exchange path information identifier quadruple from the data packet.

[0072] In existing methods for secure communication between nodes, the source node first obtains a four-tuple of exchange path information identifiers from the source node to the destination node through an exchange path discovery process. Then, it determines the communication type based on the identifier four-tuple information and implements the corresponding secure communication strategy to complete the secure communication. The method for determining the communication type using the exchange path information identifier four-tuple is as follows:

[0073] a) If ID SW-first ID SW-last If all values ​​are F, then it belongs to type Type8; otherwise, check the ID. SW-first =ID Source If true, then the communication source node (Node) is considered true. Source If it is a switching device, proceed to step b); otherwise, the communication source node (Node) Source If it is a user terminal, proceed to step d);

[0074] b) Determine ID SW-last =ID Destination Is it true? If true, then the communication destination node (Node) Destination It is a switching device, from the communication source node Node Source To the communication destination node Destination Data communication is communication between switching devices, belonging to Type 1; otherwise, the communication destination node is Node. Destination If it is a user terminal, proceed to step c);

[0075] c) Determine ID SW-last =ID SW-first Whether it is true or false, if true, then from the communication source node Node Source To the communication destination node Destination The data passes through only one switching device from the communication source node. Source To the communication destination node Destination Data communication is communication from the switching device to the directly connected user terminal, belonging to Type 2; otherwise, it originates from the communication source node. Source To the communication destination node DestinationData passes through two or more switching devices from the communication source node. Source To the communication destination node Destination Data communication is communication between switching devices and user terminals that are not directly connected, and belongs to Type 3;

[0076] d) Determine ID SW-last =ID Destination Is it true? If true, then the communication destination node (Node) Destination If it is a switching device, proceed to step e); otherwise, the communication destination node. Destination If it is a user terminal, execute step f);

[0077] e) Determine ID SW-last =ID SW-first Whether it is true or false, if true, then from the communication source node Node Source To the communication destination node Destination The data passes through only one switching device from the communication source node. Source To the communication destination node Destination Data communication is communication from the user terminal to the directly connected switching equipment, belonging to Type 4; otherwise, it originates from the communication source node. Source To the communication destination node Destination Data passes through two or more switching devices from the communication source node. Source To the communication destination node Destination Data communication is communication from a user terminal to a non-directly connected switching device, which belongs to Type 5.

[0078] f) Determine ID SW-last =ID SW-first Whether it is true or false, if true, then from the communication source node Node Source To the communication destination node Destination The data passes through only one switching device from the communication source node. Source To the communication destination node Destination Data communication refers to communication between a user terminal and other directly connected user terminals on the same switching device, belonging to Type 6; otherwise, it originates from the communication source node. Source To the communication destination node Destination Data passes through two or more switching devices from the communication source node. Source To the communication destination node Destination Data communication refers to communication between a user terminal and a user terminal directly connected to different switching devices, which belongs to Type 7.

[0079] Therefore, in existing secure communication methods between nodes, the communication source node needs to determine the communication type through a complex judgment process, and different communication types correspond to different secure communication strategies. In addition, different key types are also involved, which increases the complexity of the process and is not conducive to communication efficiency. Summary of the Invention

[0080] In view of this, this application provides a secure communication method between nodes. By storing keys using node identifiers as indexes and determining the corresponding secure communication strategy based on the node's communication path role, when a node needs to encrypt or decrypt, it directly queries the key based on the node identifier in the four-tuple of the exchange path information identifier. This enables all nodes to complete secure communication using a unified process. Using this method, there is no need to determine the node type, communication type, or key type of the network nodes, simplifying the implementation of secure communication between nodes and improving communication efficiency. Correspondingly, this application also provides a network node.

[0081] The first aspect of this application provides a secure communication method between nodes. The communication path roles in the secure communication include a source node, a first switching device in the communication path, an intermediate switching device in the communication path, a last switching device in the communication path, and a destination node. After establishing a key with a peer network node, any network node in the network stores the key using the node identifier of the peer network node as an index. The secure communication method is applied to the sending node and includes:

[0082] When a node plays the role of a communication source node in the secure communication path between current nodes, it obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it.

[0083] If a node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid, then the data packet to be sent is sent directly. If a node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid, then the key for encryption is obtained according to the node identifier in the identifier quadruple, and the data packet is sent after encryption.

[0084] When a node acts as an intermediate switching device in the communication path of secure communication between current nodes, it directly sends the data packets to be sent.

[0085] The communication path role of the sending node in the current secure communication between nodes is determined according to the node identifier of the sending node, and the identifier quadruple is determined according to the exchange path information between nodes.

[0086] A second aspect of this application provides a secure communication method between nodes. The communication path roles in this secure communication include a source node, a first switching device in the communication path, an intermediate switching device in the communication path, a last switching device in the communication path, and a destination node. After establishing a key with a peer network node, any network node in the network stores the key using the node identifier of the peer network node as an index. The secure communication method is applied to a receiving node and includes:

[0087] When a node plays the role of the communication destination node in the secure communication path between current nodes, it obtains the key for decryption based on the node identifier in the identifier quadruple, and receives and decrypts the data packet.

[0088] If a node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is valid, then the data packet to be received is received directly. If a node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is invalid, then the key for decryption is obtained according to the node identifier in the identifier quadruple, and the data packet is received and decrypted.

[0089] When a node acts as an intermediate switching device in the communication path of secure communication between current nodes, it directly receives the data packets to be received.

[0090] The communication path role of the receiving node in the current secure communication between nodes is determined based on the node identifier of the receiving node, and the identifier quadruple is determined based on the exchange path information between nodes.

[0091] A third aspect of this application provides a secure communication method between nodes. The communication path roles in this secure communication include a source node, a first switching device in the communication path, an intermediate switching device in the communication path, a last switching device in the communication path, and a destination node. After establishing a key with a peer network node, any network node stores the key using the peer network node's node identifier as an index. The secure communication method includes:

[0092] When a node plays the role of a communication source node in the secure communication path between current nodes, it obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it.

[0093] When a node plays the role of the communication destination node in the secure communication path between current nodes, it obtains the key for decryption based on the node identifier in the identifier quadruple, and receives and decrypts the data packet.

[0094] If a node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid, then the data packet is forwarded directly. If a node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid, then first, the key for decryption is obtained according to the node identifier in the identifier quadruple, the data packet is received and decrypted, and then the key for encryption is obtained according to the node identifier in the identifier quadruple, the data packet is encrypted, and then the data packet is sent.

[0095] When a node acts as an intermediate switching device in the secure communication path between current nodes, it directly forwards data packets.

[0096] The role of a node in secure communication between current nodes is determined based on the node's identifier, and the identifier quadruple is determined based on the exchange path information between nodes.

[0097] A fourth aspect of this application provides a network node applied to a terminal, the node comprising:

[0098] A storage module is used to store the key with the node identifier of the peer network node as an index after a key is established with the peer network node.

[0099] The node also includes:

[0100] An encryption module is used to encrypt data packets when the node's role in the secure communication path between current nodes is the communication source node, by obtaining the encryption key based on the node identifier in the identifier quadruple; the communication path role is determined based on the node identifier, and the identifier quadruple is determined based on the exchanged path information between nodes; a sending module is used to send the encrypted data packets.

[0101] And / or,

[0102] The receiving module is used to receive data packets;

[0103] The decryption module is used to decrypt the data packet by obtaining the key from the node identifier in the identifier quadruple when the node's role in the secure communication path between current nodes is the communication destination node.

[0104] A fifth aspect of this application provides a network node for use in a switching device, the node comprising:

[0105] A storage module is used to store the key with the node identifier of the peer network node as an index after a key is established with the peer network node.

[0106] The node also includes:

[0107] The encryption module is used to encrypt data packets when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid. The encryption module obtains the encryption key based on the node identifier in the identifier quadruple and encrypts the data packets. The communication path role is determined based on the node identifier of the node, and the identifier quadruple is determined based on the exchange path information between nodes.

[0108] The sending module is configured to send encrypted data packets when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid; directly send the data packets to be sent when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid; and directly send the data packets to be sent when the node's role in the secure communication path between current nodes is an intermediate switching device in the communication path.

[0109] And / or,

[0110] The receiving module is configured to directly receive data packets when the node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is valid; receive data packets for decryption when the node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is invalid; and directly receive data packets when the node's role in the secure communication path between current nodes is an intermediate switching device in the communication path.

[0111] The decryption module is used when the node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is invalid. In this case, the node identifier in the identifier quadruple is used to obtain the key for decryption and decrypt the data packet.

[0112] Therefore, this method determines the communication path role of a node based on its node identifier and the processing method based on that role. This allows all nodes to complete the entire secure communication process using a unified procedure, eliminating the need to determine the communication type, thus reducing process complexity and improving the efficiency of secure communication between nodes. Furthermore, this method uses the node identifier as an index to store the key and configures a corresponding key lookup method based on the node's communication path role. This means that key queries can be performed solely based on the node identifier, eliminating the need to determine the key type between nodes, thereby improving key lookup efficiency and ultimately enhancing the efficiency of secure communication between nodes.

[0113] Furthermore, the device manufactured according to the inter-node secure communication method provided in this application has good compatibility and is compatible with devices manufactured according to the TLSec protocol. For example, when the sender is a device manufactured according to the method provided in this application, the receiver can be either a device manufactured according to the method provided in this application or a device manufactured based on the TLSec protocol. Similarly, when the receiver is a device manufactured according to the method provided in this application, the sender can be either a device manufactured according to the method provided in this application or a device manufactured based on the TLSec protocol. Attached Figure Description

[0114] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0115] Figure 1 This is a schematic diagram of the network structure corresponding to one type of interactive path information in an embodiment of this application;

[0116] Figure 2 A schematic diagram of the basic framework of a local area network;

[0117] Figure 3A This is a schematic diagram of communication between adjacent switching devices.

[0118] Figure 3B This is a schematic diagram of communication between non-adjacent switching devices.

[0119] Figure 4 This is a schematic diagram of communication between a switching device and a directly connected user terminal.

[0120] Figure 5 A schematic diagram illustrating communication between a switching device and a user terminal that is not directly connected.

[0121] Figure 6This is a schematic diagram illustrating the communication between a user terminal and a directly connected switching device.

[0122] Figure 7 A schematic diagram illustrating communication between a user terminal and a non-directly connected switching device;

[0123] Figure 8 This is a schematic diagram illustrating communication between a user terminal and other directly connected user terminals on the same switching device.

[0124] Figure 9 This is a schematic diagram illustrating communication between a user terminal and a user terminal directly connected to different switching devices.

[0125] Figure 10 This is a diagram illustrating communication between neighboring user terminals.

[0126] Figure 11A This is a flowchart of a secure communication method between nodes according to an embodiment of this application;

[0127] Figure 11B This is a flowchart of a secure communication method between nodes according to an embodiment of this application;

[0128] Figure 12 This is a schematic diagram of a network structure in this application embodiment where the source node and destination node are directly connected to the same switching device for user terminals;

[0129] Figure 13A This is a flowchart of a secure communication method between nodes according to an embodiment of this application;

[0130] Figure 13B This is a flowchart of a secure communication method between nodes according to an embodiment of this application;

[0131] Figure 14A This is a flowchart of a secure communication method between nodes according to an embodiment of this application;

[0132] Figure 14B This is a flowchart of a secure communication method between nodes according to an embodiment of this application;

[0133] Figure 15 This is a schematic diagram illustrating an application scenario of a secure inter-node communication method in this application embodiment;

[0134] Figure 16 This is a schematic diagram of the structure of a network node in an embodiment of this application;

[0135] Figure 17 This is a schematic diagram of the structure of a network node in an embodiment of this application. Detailed Implementation

[0136] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0137] To make the technical solution of this application easier to understand, the background of this application and the technical terms involved will be explained below.

[0138] For any network node, such as a communication source node, a communication destination node, the first switching device in a communication path, the last switching device in a communication path, or an intermediate switching device in a communication path, its node identifier can be any identifier that can uniquely represent the node's identity.

[0139] In a specific implementation, the node identifier can be the node's Medium Access Control (MAC) address. Of course, in other possible implementations of this application, the node identifier can also be the node's sequence number in the communication network or a randomly generated Universally Unique Identifier (UUID), etc. The following description uses ID as the node identifier, which does not constitute a limitation on the technical solution of this application.

[0140] However, the implementation of the three-stage secure communication method between nodes mentioned in the background technology is complicated because its implementation method is based on multiple judgment processes such as communication type judgment and node type judgment, which affects the execution efficiency. Furthermore, it does not have a unified execution process for user terminals and switching equipment, which greatly affects the practical application of the three-stage secure communication method between nodes.

[0141] To address this, this application proposes an optimized implementation method for a three-stage secure communication method between nodes. This method does not distinguish between key types between nodes, but instead uses node identifiers as indexes to store keys between nodes. The communication path role of a node in the current secure communication between nodes is determined by comparing node identifiers, and the corresponding secure communication strategy is determined based on the communication path role.

[0142] In any pair of network nodes that establish a key, each node stores the key using the node identifier of the peer node as an index. Examples include unicast keys established by adjacent nodes, exchange keys established between pairs of switching devices, and inter-station keys established between user terminals. The stored keys do not need to be distinguished by their key type; each key is stored using only the node identifier of the peer node as an index.

[0143] According to the definition of the inter-node switching path in the TLP sub-protocol, the inter-node switching path from the communication source node to the communication destination node includes five communication path roles: the communication source node, the first switching device of the communication path, the intermediate switching device of the communication path, the last switching device of the communication path, and the communication destination node.

[0144] In actual communication, the two communication path roles of the communication source node and the communication destination node are always present. The three communication path roles of the first switching device, the intermediate switching device, and the last switching device may all exist, none of them may exist, or any combination of the three communication path roles may exist, depending on the actual network connection.

[0145] The inter-node exchange path discovery process yields the inter-node exchange path information identifier quadruple [ID]. Source ID SW-first ID SW-last ID Destination The IDs in the four-tuple represent the communication source node, the first switching device in the communication path, the last switching device in the communication path, and the communication destination node in the communication path, respectively, and are the node identifiers of the corresponding network nodes in the communication path.

[0146] Therefore, for a network node, upon receiving a data packet, the network node first determines its role in the secure communication path during the current node-to-node communication process based on the identifier quadruple information carried in the data packet. According to the eight communication types determined by the local area network architecture and its composition, when the network node's role in the secure communication path during the current node-to-node communication process is that of a source node, in communication types Type 5 and Type 7, its next switching node is the first switching device; in communication type Type 3, its next switching node is the last switching device; and in communication types Type 1, Type 2, Type 4, Type 6, and Type 8, its next switching node is the destination node. When the network node's role in the secure communication path during the current node-to-node communication process is that of the first switching device in the communication path, in communication type Type 5, its previous switching node is the source node, and its next switching node is the destination node; and in communication type Type 7, its previous switching node... When a network node is the source node in a secure communication path between current nodes, its next switching node is the last switching device. In communication type Type 3, its previous switching node is the source node, and its next switching node is the destination node; in communication type Type 7, its previous switching node is the first switching device, and its next switching node is the destination node. When a network node is the destination node in a secure communication path between current nodes, in communication types Type 1, Type 2, Type 4, Type 6, and Type 8, its previous switching node is the source node; in communication types Type 3 and Type 7, its previous switching node is the last switching device; in communication type Type 5, its previous switching node is the first switching device. When a network node is an intermediate switching device in a secure communication path between current nodes, it directly forwards data packets. It should be noted that when the source node is a switching device, its communication path role is that of a source node; when the destination node is a switching device, its communication path role is that of a destination node.

[0147] When a network node decrypts a data packet encrypted by a previous switching node, it looks up the node identifier of the previous switching node in the key stored in the network node and then decrypts the data packet. Similarly, when a network node encrypts a data packet that the next switching node will decrypt, it looks up the node identifier of the next switching node in the key stored in the network node and then encrypts the data packet. A switching node is a network node whose node identifier is located in the four-tuple of the switching path information identifier.

[0148] Specifically, after any network node in the network establishes a key with the peer network node, it stores the key using the node identifier of the peer network node as an index. When a node's role in the secure communication path between current nodes is that of a source node, it obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it. When a node's role in the secure communication path between current nodes is that of the first or last switching device in the communication path, and the end-to-end secure communication policy is valid, it directly forwards the data packet. When a node's role in the secure communication path between current nodes is that of the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid, it first obtains the decryption key based on the node identifier in the identifier quadruple, receives and decrypts the data packet, then obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it. When a node's role in the secure communication path between current nodes is that of an intermediate switching device in the communication path, it directly forwards the data packet. When a node's role in the secure communication path between current nodes is that of a destination node, it obtains the decryption key based on the node identifier in the identifier quadruple, receives and decrypts the data packet, thereby achieving secure communication between the source node and the destination node.

[0149] In this way, each node can complete the entire secure communication process using a unified procedure, eliminating the need to determine the communication type, thus reducing process complexity and improving the efficiency of secure communication between nodes. Furthermore, this method uses node identifiers as indexes to store keys and configures corresponding key lookup methods based on the node's communication path role. Therefore, when querying keys, only the node identifier needs to be searched, eliminating the need to determine the key type between nodes, improving key lookup efficiency and consequently enhancing the efficiency of secure communication between nodes.

[0150] Specifically, if a node's role in the secure communication path between current nodes is that of a communication source node, then obtaining the key for encryption based on the node identifier in the identifier quadruple includes: determining whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple in the order of the communication destination node, the last switching device, and the first switching device, or in the order of the communication destination node, the first switching device, and the last switching device.

[0151] If a node's role in the secure communication path between current nodes is that of a communication destination node, then obtaining the key for decryption based on the node identifier in the identifier quadruple includes: determining whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple in the order of communication source node, first switching device, and last switching device or in the order of communication source node, last switching device, and first switching device.

[0152] If a node's role in the secure communication path between current nodes is the last switching device in the communication path, then obtaining the key for decryption based on the node identifier in the identifier quadruple includes: determining whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple, either in the order of the communication source node and the first switching device or in the order of the first switching device and the communication source node; obtaining the key for encryption based on the node identifier in the identifier quadruple includes: determining whether the node stores a key indexed by the node identifier of the communication destination node in the identifier quadruple.

[0153] If a node's role in the secure communication path between current nodes is the first switching device in the communication path, then obtaining the key for decryption based on the node identifier in the identifier quadruple includes: determining whether the node stores a key indexed by the node identifier of the communication source node in the identifier quadruple; obtaining the key for encryption based on the node identifier in the identifier quadruple includes: determining whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple in the order of the communication destination node and the last switching device or in the order of the last switching device and the communication destination node.

[0154] It is understood that the secure inter-node communication method provided in this application embodiment can be applied to network nodes. A network node refers to a network communication entity connected to a communication network. Specifically, a network node can be a switching device, such as a switch, router, etc., or a user terminal (UE), such as a mobile phone, tablet computer, laptop computer, desktop computer, etc., which can interact with other nodes through any form of wired connection.

[0155] To make the technical solution of this application clearer and easier to understand, the secure communication method between nodes provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0156] First, the transmission process is described from the perspective of the sending node. The roles in the secure communication path between nodes include the source node, the first switching device in the communication path, intermediate switching devices in the communication path, the last switching device in the communication path, and the destination node. After establishing a key with the peer network node, any network node stores the key using the peer network node's node identifier as an index. See also... Figure 11A The flowchart shown illustrates a secure communication method between nodes, which includes:

[0157] S1101: The sending node determines its communication path role based on its own node identifier. If the sending node's communication path role is a communication source node, then execute S1102; if the sending node's communication path role is the first or last switching device in the communication path, then execute S1103; if the sending node's communication path role is an intermediate switching device in the communication path, then execute S1104.

[0158] The communication path role of the sending node refers to the role it plays in secure communication between current nodes. Specifically, the communication path role can include the source node, the first switching device in the communication path, intermediate switching devices in the communication path, the last switching device in the communication path, and the destination node. The communication path role is determined based on the sending node's node identifier. In a specific implementation, the sending node can obtain its own node identifier and compare it with the identifier quadtuple carried in the data packet to be sent. If its own node identifier matches the node identifier of a communication path role in the identifier quadtuple, then the sending node is determined to be that communication path role. In practical applications, the source node can first check if it has the identifier quadtuple stored locally. If so, it adds the identifier quadtuple to the data packet so that each network node in the communication path can determine its communication path role based on the identifier quadtuple carried in the data packet. If not, it initiates a TLP (Transmission Path Exploration) request to obtain the identifier quadtuple.

[0159] For a sending node, its communication path role cannot be the communication destination node. Therefore, when comparing the sending node's own node identifier with the identifier quadruple, it can only be compared with the node identifiers of the communication source node, the first switching device, and the last switching device in the identifier quadruple to determine the sending node's communication path role.

[0160] Specifically, the sending node can determine its role in the communication path during secure communication between current nodes through the following steps:

[0161] S11011: The sending node determines whether the node identifier of the communication source node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the sending node, and obtains a first determination result. If the first determination result is yes, then the sending node is determined to be the communication source node in the communication path of the current secure communication between nodes.

[0162] S11012: If the first judgment result is negative, then determine whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the sending node, and obtain the second judgment result. If the second judgment result is positive, then determine that the sending node's role in the communication path in the current inter-node secure communication is the first switching device of the communication path.

[0163] S11013: If the second judgment result is negative, then determine whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the sending node, and obtain a third judgment result. If the third judgment result is positive, then determine that the sending node's role in the communication path in the current inter-node secure communication is the last switching device in the communication path; if the third judgment result is negative, then determine that the sending node's role in the communication path in the current inter-node secure communication is an intermediate switching device in the communication path.

[0164] It should be noted that, regarding S11012 and S11013 above, when the first judgment result is negative, the sending node can also first determine whether the node identifier of the last switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the sending node, to obtain the fourth judgment result. If the fourth judgment result is positive, then the communication path role of the sending node in the current secure communication between nodes is determined to be the last switching device in the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the sending node, to obtain the fifth judgment result. If the fifth judgment result is positive, then the communication path role of the sending node in the current secure communication between nodes is determined to be the first switching device in the communication path. If the fifth judgment result is negative, then the communication path role of the sending node in the current secure communication between nodes is determined to be the intermediate switching device in the communication path.

[0165] In other words, when determining its role in a communication path, the sending node first checks if its role is that of a communication source node, and then checks if its role is the first or last switching device in the communication path. In other words, the sending node can determine its role based on its ID. Source ->ID SW-last ->ID SW-first Or ID Source ->ID SW-first ->ID SW-lastThe local ID is compared sequentially with the sending node's own ID to determine the sending node's role in the secure communication path between nodes. It's important to note that if the communication path role is determined, the step of comparing with subsequent node identifiers is unnecessary. For example, if the sending node has already determined its role as the communication source node, the step of comparing its local ID with the local ID is not required. SW-first Or ID SW-last The steps of comparison.

[0166] Correspondingly, after determining the communication path role of the sending node, the sending node can perform the sending processing operation corresponding to its communication path role in the current secure communication path between nodes. Specifically, when the node's communication path role is the communication source node, S1102 is executed; when the node's communication path role is the first switching device or the last switching device in the communication path, S1103 is executed; when the node's communication path role is an intermediate switching device in the communication path, S1104 is executed.

[0167] S1102: The sending node obtains the key for encryption based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it.

[0168] If the sending node plays the role of a communication source node in the secure communication path between current nodes, then the system determines whether the sending node possesses a key indexed by the node identifiers of the aforementioned nodes in the identifier tuple, following the order of the communication destination node, the last switching device, and the first switching device, or the order of the communication destination node, the first switching device, and the last switching device. That is, for the communication source node, the system checks whether it stores a key indexed by the node identifiers of the aforementioned nodes in the identifier tuple. Destination ->ID SW-last ->ID SW-first Sequence or ID Destination ->ID SW-first ->ID SW-last Key lookups are performed sequentially to obtain the encryption key. It's important to note that the key lookup only needs to retrieve the key according to the order of the lookups; once the key is obtained, the step of looking up subsequent key keys indexed by the node identifier is unnecessary. For example, if the sending node has already obtained the key from the ID... Destination If the node identifier is the key indexed, then the process of using the ID is no longer required. SW-first and ID SW-last The key lookup step is indexed by the node identifier.

[0169] If the sending node has a key indexed by the node identifier of the aforementioned node in the identification quadruple, it encrypts the data packet to be sent using the key and then sends the data packet. If it does not have a key indexed by the node identifier of the aforementioned node in the identification quadruple, the data packet is discarded.

[0170] S1103: If the end-to-end secure communication strategy is effective, the sending node directly sends the data packet to be sent; if the end-to-end secure communication strategy is ineffective, the sending node obtains the key for encryption based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it.

[0171] End-to-end secure communication refers to a strategy that uses a key between the source and destination nodes for secure communication. The source node is the communication origin node, and the destination node is the communication destination node. Data packets, such as those in the packet header, can carry an identifier indicating whether the end-to-end secure communication strategy is enabled. In one example, a value of 1 indicates that the end-to-end secure communication strategy is effective and enabled; a value other than 1 indicates that the end-to-end secure communication strategy is ineffective and disabled.

[0172] When both the source node and the destination node are user terminals and the end-to-end secure communication strategy is effective, the first and last switching devices in the communication path can directly send the data packets to be sent without any further processing.

[0173] Specifically, please see Figure 12 When the communication source node is user terminal STA1 and the communication destination node is the same switching device SW E When other directly connected user terminals STA3 are used, which is also communication type 6 among the eight communication types defined in TLP, if the sending node is a switching device SW where the communication source node and the communication destination node are directly connected. E And if the end-to-end secure communication policy corresponding to the data packet to be sent is valid, then the switching device SW E The data packets to be sent can be directly sent to the communication destination node directly connected to the switching device. In this way, the communication destination node can use the key established with the communication source node (this key is often referred to as the inter-station key), STAkey. 1-3 Decrypt the data packet to achieve secure communication between the source node STA1 and the destination node STA3.

[0174] If the end-to-end secure communication strategy is invalid, the sending node obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it. The specific implementation of obtaining the key is as follows:

[0175] If the sending node is the first switching device in the communication path of the current node secure communication, then determine whether the sending node has a key indexed by the node identifier of the above-mentioned node in the identifier quadruple in the order of communication destination node and last switching device or in the order of last switching device and communication destination node.

[0176] If the sending node plays the role of the last switching device in the secure communication path between current nodes, then determine whether the sending node has a key indexed by the node identifier of the communication destination node in the identification quadruple.

[0177] That is, the sending node targets the first switching device in the communication path, based on the ID. Destination ->ID SW-last Sequence or ID SW-last ->ID Destination Key queries are performed sequentially, starting with the last switching device in the communication path, based on its ID. Destination Perform a key lookup. If a key is found, encrypt the data packet using the key indexed by the node identifier of the aforementioned node in the tuple, and then send the data packet. If no key is found, discard the data packet.

[0178] S1104: The sending node directly sends the data packet to be sent.

[0179] When the sending node acts as an intermediate switching device in the secure communication path between current nodes, the data packet has already been encrypted using the key between the source node and the last switching device in the communication path, the key between the source node and the destination node, the key between the first switching device and the last switching device in the communication path, or the key between the first switching device and the destination node. Therefore, the sending node does not need to encrypt the data packet again and can send the data packet directly.

[0180] In practical applications, the following situation may also exist: the end-to-end secure communication strategy is effective, but the data packet only contains the node identifiers of the communication source node and the communication destination node. In this case, when the data packet passes through the first or last switching device in the communication path, since the data packet does not contain the node identifiers of the first or last switching device in the communication path, when the role of the communication path is determined, the first or last switching device in the communication path is judged as an intermediate switching device in the communication path and the data packet is directly forwarded.

[0181] In this embodiment, S1102 to S1104 are not in any particular order. For each node in the communication path, it performs corresponding operations based on its own communication path role, thereby realizing the transmission process of secure communication between nodes.

[0182] Based on the above embodiments, the sending node processing can be divided into two types: direct sending processing, where the sending node directly sends the data packet, and encrypted sending processing, which requires encrypting the data packet before sending. Thus, in some implementations, the sending node can first determine whether the conditions for direct sending processing are met. If they are met, the data packet is sent directly; if not, the corresponding processing procedure is performed based on the sending node's communication path role.

[0183] For the sending node, the conditions for direct transmission can include the following: One condition is that the end-to-end secure communication policy is effective, and the sending node's role in the communication path is not that of a communication source node; another condition is that the end-to-end secure communication policy is ineffective, and the sending node's role in the communication path is neither that of a communication source node nor the first or last switching device in the communication path, meaning the sending node is an intermediate switching device in the communication path. If the sending node determines that it meets any of the above conditions for direct transmission, it can directly send the data packet.

[0184] It should be noted that the secure inter-node communication method provided in this application embodiment is proposed to be implemented in the form of an application or software. The application or software may be implemented using machine-oriented programming languages ​​such as assembly language, or it may be implemented using high-level programming languages ​​such as C language.

[0185] If machine-oriented programming languages ​​such as assembly language are used, the compilation result can directly present the comparison results between the sending node's node identifier and the node identifiers of the communication source node, the first switching device in the communication path, and the last switching device in the communication path. Therefore, the communication path role of the sending node can be directly presented. When the sending node does not meet the conditions for direct transmission processing, the corresponding processing procedure can be directly executed based on this communication path role. For specific implementation details, please refer to [reference needed]. Figure 11A The embodiment shown describes that, at this point, it is only necessary to perform the corresponding encrypted transmission process according to the communication path role of the sending node.

[0186] If this method is implemented using a high-level programming language such as C, the compilation result can only show whether the direct transmission processing conditions are met, but not the communication path role of the sending node. Therefore, when the sending node determines that the direct transmission processing conditions are not met, it is necessary to further determine the sending node's communication path role and then execute the corresponding processing procedure based on that role. For a detailed implementation, please refer to [reference needed]. Figure 11B , Figure 11B The flowchart illustrates one implementation of a secure communication method between nodes, which includes the following steps:

[0187] S1110: The sending node determines whether it meets the conditions for direct sending. If yes, it executes S1120; otherwise, it executes S1130.

[0188] In practice, the sending node compares its own node identifier with the node identifiers of the communication source node, the first switching device in the communication path, and the last switching device in the communication path in the identifier quadruple, and determines whether the end-to-end confidential communication strategy is effective, in order to determine whether it meets the conditions for direct transmission.

[0189] Specifically, when the end-to-end secure communication strategy is effective, and the sending node's own node identifier is not equal to the node identifier of the communication source node, it can be determined that it meets the conditions for direct transmission. Alternatively, when the end-to-end secure communication strategy is ineffective, and the sending node's own node identifier is not equal to the node identifier of the communication source node, nor is it equal to the node identifiers of the first and last switching devices in the communication path, it can also be determined that it meets the conditions for direct transmission.

[0190] When the sending node determines that it meets the conditions for direct sending, it can directly execute S1120, that is, directly send the data packet; when the sending node determines that it does not meet the conditions for direct sending, it executes S1130, that is, redetermines the communication path role of the sending node, and performs additional encryption processing on the data packet based on the communication path role.

[0191] It should be noted that when the sending node determines that the above direct transmission processing conditions are not met, i.e., when the sending node's communication path role is an intermediate switching device, the determination of the end-to-end secure communication strategy is actually redundant. This is because the intermediate switching device does not care about the end-to-end secure communication strategy, and this approach in this embodiment is to facilitate engineering implementation using high-level programming languages ​​such as C.

[0192] S1120: Send data packets directly.

[0193] S1130: The sending node determines the communication path role of the sending node based on its own node identifier and the node identifiers of each communication path role in the identifier quadruple, and obtains the key for encryption based on the node identifier in the identifier quadruple to encrypt the data packet before sending the data packet.

[0194] The process of obtaining the encryption key based on the node identifier in the identifier quadruple and using the obtained key for encryption can be found in the relevant description above, and will not be repeated here.

[0195] As can be seen from the above, this application provides a secure communication method between nodes. This secure communication method mainly addresses the transmission process of secure communication between nodes. In this method, the sending node performs corresponding operations based on its communication path role. Specifically, if the communication path role is the communication source node, the node obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it. If the communication path role is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid, the data packet is sent directly. If the communication path role is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid, the node obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it. When the node's communication path role is an intermediate switching device, the data packet to be sent is sent directly. In this way, each node can complete the entire secure communication process using a unified procedure, without needing to determine the communication type, reducing the complexity of the process and improving the efficiency of secure communication between nodes.

[0196] Furthermore, this method uses node identifiers as indexes to store keys and configures corresponding key lookup methods based on the communication path roles of nodes. Thus, when querying keys, only the node identifier needs to be searched, eliminating the need to determine the key types between nodes, thereby improving key lookup efficiency and consequently enhancing the efficiency of secure communication between nodes.

[0197] Next, the receiving process will be described from the perspective of the receiving node. The communication path roles in secure communication between nodes include the source node, the first switching device in the communication path, intermediate switching devices in the communication path, the last switching device in the communication path, and the destination node. After establishing a key with the peer network node, any network node stores the key using the peer network node's node identifier as an index. See also... Figure 13A The flowchart shown illustrates a secure communication method between nodes, which includes:

[0198] S1301: The receiving node determines its communication path role based on its own node identifier. If the receiving node's communication path role is the communication destination node, then S1302 is executed; if the receiving node's communication path role is the first or last switching device in the communication path, then S1303 is executed; if the receiving node's communication path role is an intermediate switching device in the communication path, then S1304 is executed.

[0199] The communication path role of a receiving node refers to the role that the receiving node plays in secure communication between current nodes. The communication path role of a receiving node is determined based on its node identifier. In specific implementations, the receiving node can obtain its own node identifier and compare it with the identifier quadruple carried in the data packet to be received. If its own node identifier matches the node identifier of a certain communication path role in the identifier quadruple, then the receiving node is determined to be that communication path role.

[0200] For a receiving node, its communication path role cannot be that of a communication source node. Therefore, when comparing the receiving node's own node identifier with the identifier quadruple, it can only compare with the node identifiers of the first switching device, the last switching device, and the communication destination node in the identifier quadruple to determine the receiving node's communication path role.

[0201] Specifically, the receiving node can determine its role in the communication path during secure communication between current nodes through the following steps:

[0202] S13011: The receiving node determines whether the node identifier of the communication destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the receiving node, and obtains a first determination result. If the first determination result is yes, then the receiving node is determined to be the communication destination node in the communication path of the current secure communication between nodes.

[0203] S13012: If the first judgment result is negative, then determine whether the node identifier of the last switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the receiving node, and obtain the second judgment result. If the second judgment result is positive, then determine that the receiving node's communication path role in the current node secure communication is the last switching device in the communication path.

[0204] S13013: If the second judgment result is negative, then determine whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the receiving node, and obtain a third judgment result. If the third judgment result is positive, then determine that the receiving node's role in the communication path in the current inter-node secure communication is the first switching device in the communication path; if the third judgment result is negative, then determine that the receiving node's role in the communication path in the current inter-node secure communication is an intermediate switching device in the communication path.

[0205] It should be noted that, regarding S13012 and S13013 above, when the first judgment result is negative, the receiving node can also first determine whether the node identifier of the first switching device in the identifier quadruple of the current secure communication between nodes is equal to the node identifier of the receiving node, to obtain the fourth judgment result. If the fourth judgment result is positive, then the communication path role of the receiving node in the current secure communication between nodes is determined to be the first switching device in the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple of the current secure communication between nodes is equal to the node identifier of the receiving node, to obtain the fifth judgment result. If the fifth judgment result is positive, then the communication path role of the receiving node in the current secure communication between nodes is determined to be the last switching device in the communication path. If the fifth judgment result is negative, then the communication path role of the receiving node in the current secure communication between nodes is determined to be an intermediate switching device in the communication path.

[0206] In other words, when determining its communication path role, the receiving node first checks if its communication path role is that of the destination node, and then checks if its communication path role is the first or last switching device in the communication path. In other words, the receiving node can determine its role based on its ID. Destination ->ID SW-last ->ID SW-first Or ID Destination ->ID SW-first ->ID SW-last The local ID is compared sequentially with the receiving node's own ID to determine the receiving node's role in the secure communication path during current node communication. It's important to note that if the communication path role is determined, the step of comparing with subsequent node identifiers is unnecessary. For example, if the receiving node has already determined its communication path role as the communication destination node, it doesn't need to perform the comparison between its local ID and the local ID. SW-first Or ID SW-last The steps of comparison.

[0207] It should also be noted that for the case where the first judgment result is negative, that is, the local ID of the receiving node is not equal to the ID... Destination If the receiving node is a user terminal, and the user terminal cannot act as an intermediate device to forward data, then no further judgment steps are needed, and the receiving node will discard the data packet.

[0208] In practical applications, each node can determine its communication path role by comparing its node identifier with the node identifier in the identifier quadtuple. For any node, if its communication path role has been determined during the sending process, it does not need to be re-determined during the receiving process. Conversely, if its communication path role has been determined during the receiving process, it does not need to be re-determined during the sending process.

[0209] Correspondingly, after determining the communication path role of the receiving node, the receiving node can perform the receiving processing operation corresponding to its communication path role in the current secure communication path between nodes. Specifically, when the node's communication path role is the communication destination node, S1302 is executed; when the node's communication path role is the first switching device or the last switching device in the communication path, S1303 is executed; when the node's communication path role is an intermediate switching device in the communication path, S1304 is executed.

[0210] S1302: The receiving node obtains the key for decryption based on the node identifier in the identifier quadruple, and receives and decrypts the data packet.

[0211] If the receiving node's role in the secure communication path between current nodes is that of the communication destination node, then the receiving node is checked sequentially according to either the order of the communication source node, the first switching device of the communication path, and the last switching device of the communication path, or the order of the communication source node, the last switching device of the communication path, and the first switching device of the communication path; that is, for the communication destination node, according to ID... Source ->ID SW-last ->ID SW-first Sequence or ID Source ->ID SW-first ->ID SW-last The keys are retrieved sequentially to obtain the keys used for decryption.

[0212] If the receiving node has a key indexed by the node identifier in the identifier quadruple, it will decrypt the data packet using the key after receiving it. If it does not have a key indexed by the node identifier in the identifier quadruple, the data packet will be discarded.

[0213] S1303: If the end-to-end secure communication strategy is effective, the receiving node directly receives the data packet to be received; if the end-to-end secure communication strategy is ineffective, the receiving node obtains the key for decryption according to the node identifier in the identifier quadruple, and receives and decrypts the data packet.

[0214] The details regarding the end-to-end secure communication strategy can be found on the sending processing side. When the receiving node is the first or last switching device in the communication path, and the end-to-end secure communication strategy corresponding to the data packet to be received is valid, the receiving node directly receives the data packet.

[0215] Still with Figure 12 Taking the receiving node SW as an example, let's illustrate this. E As the first and last switching device in the communication path, SW (Switching Switch) activates when the end-to-end communication policy identifier corresponding to the data packet to be received is valid. E The system directly receives the data packets to be received, specifically those sent by the communication source node STA1, without requiring additional decryption. Thus, SW... E When performing subsequent transmission processing, the data packet is sent directly without any additional encryption operations.

[0216] When the end-to-end secure communication policy corresponding to the data packet to be received is invalid, the receiving node needs to receive the data packet and decrypt it. In specific implementation, the receiving node obtains the corresponding key based on the node identifier in the identifier quadruple and uses this key to decrypt the data packet. The specific implementation method for obtaining the key is as follows:

[0217] If the receiving node is the last switching device in the communication path of the current node secure communication, then determine whether the receiving node has a key indexed by the node identifier in the identifier quadtuple in the order of communication source node and first switching device or the order of first switching device and communication source node.

[0218] If the receiving node plays the role of the first switching device in the communication path of the current node secure communication, then it is determined whether the receiving node stores a key indexed by the node identifier of the communication source node in the identification quadruple.

[0219] That is, the receiving node, based on the ID of the last switching device in the communication path, Source ->ID SW-first Sequence or ID SW-first ->ID Source Key lookups are performed sequentially, starting with the first switching device in the communication path, based on its ID. Source Perform a key lookup. If a key is found, the data packet is decrypted using the key indexed by the node identifier of the aforementioned node in the quaternion after it is received. If no key is found, the data packet is discarded.

[0220] S1304: The receiving node directly receives the data packets to be received.

[0221] When the receiving node acts as an intermediate switching device in the secure communication path between current nodes, the data packet has already been encrypted using the key between the source node and the last switching device in the communication path, the key between the source node and the destination node, the key between the first switching device and the last switching device in the communication path, or the key between the first switching device and the destination node. Therefore, the receiving node does not need to decrypt the data packet again and can directly receive the data packet.

[0222] In this embodiment, S1302 to S1304 are not in any particular order. For each node in the communication path, it performs the corresponding operation based on its own communication path role, thereby realizing the receiving process of secure communication between nodes.

[0223] Similar to the sending node, the receiving node's processing can also be divided into two types: direct reception processing, where the receiving node only performs a receiving operation on the data packet, and decryption processing, which requires performing a receiving operation followed by a decryption operation. Thus, in some implementations, the receiving node can first determine whether it meets the conditions for direct reception processing. If it does, it directly receives the data packet; if it does not, it performs the corresponding processing based on the receiving node's communication path role.

[0224] For the receiving node, the conditions for direct reception processing can include the following: One condition is that the end-to-end secure communication strategy is effective, and the receiving node's role in the communication path is not that of the communication destination node; another condition is that the end-to-end secure communication strategy is ineffective, and the receiving node's role in the communication path is neither that of the communication destination node, nor the first or last switching device in the communication path, meaning the receiving node is an intermediate switching device in the communication path. If the receiving node determines that any of the above conditions for direct reception processing are met, it can directly receive the data packet without performing any additional decryption operations.

[0225] It should be noted that the secure inter-node communication method provided in this application embodiment is proposed to be implemented in the form of an application or software. The application or software may be implemented using machine-oriented programming languages ​​such as assembly language, or it may be implemented using high-level programming languages ​​such as C language.

[0226] If machine-oriented programming languages ​​such as assembly language are used, the compilation result can directly present the comparison results between the node identifier of the receiving node and the node identifiers of the destination node, the first switching device in the communication path, and the last switching device in the communication path. Therefore, the communication path role of the receiving node can be directly presented. When the receiving node does not meet the conditions for direct reception processing, the corresponding processing procedure can be directly executed based on this communication path role. For specific implementation details, please refer to [reference needed]. Figure 13A The description of the relevant content in the illustrated embodiment shows that, at this time, it is only necessary to perform the corresponding receiving and decryption processes according to the communication path role of the receiving node.

[0227] If this method is implemented using a high-level programming language such as C, the compilation result can only show whether the receiving node meets the direct reception processing conditions, but not the communication path role of the receiving node. Therefore, if the receiving node does not meet the direct reception processing conditions, it is necessary to further determine the communication path role of the receiving node and then execute the corresponding processing procedure based on the communication path role. For a detailed implementation, please refer to [reference needed]. Figure 13B , Figure 13B The flowchart illustrates one implementation of a secure communication method between nodes, which includes the following steps:

[0228] S1310: The receiving node determines whether it meets the conditions for direct reception and processing. If yes, it executes S1320; otherwise, it executes S1330.

[0229] In practice, the receiving node compares its own node identifier with the node identifiers of the communication destination node, the first switching device in the communication path, and the last switching device in the communication path in the identifier quadruple, and determines whether the end-to-end secure communication strategy is effective, in order to determine whether it meets the conditions for direct reception processing.

[0230] Specifically, when the end-to-end secure communication strategy is effective, and the receiving node's own node identifier is not equal to the node identifier of the communication destination node, it can be determined that it meets the conditions for direct reception processing. When the end-to-end secure communication strategy is ineffective, and the receiving node's own node identifier is not equal to the node identifier of the communication destination node, nor is it equal to the node identifiers of the first and last switching devices in the communication path, it can also be determined that it meets the conditions for direct reception processing.

[0231] When the receiving node determines that it meets the conditions for direct reception, it can directly execute S1320, that is, directly receive the data packet; when the receiving node determines that it does not meet the conditions for direct reception, it can execute S1330, that is, redetermine the communication path role of the receiving node, and perform additional decryption processing on the data packet based on the communication path role.

[0232] It should be noted that when the receiving node determines that the above direct reception processing conditions are not met, i.e., when the receiving node's communication path role is that of an intermediate switching device, the determination of the end-to-end secure communication strategy is actually redundant. This is because intermediate switching devices do not care about the end-to-end secure communication strategy, and this approach in this embodiment is to facilitate engineering implementation using high-level programming languages ​​such as C.

[0233] S1320: Directly receive data packets.

[0234] S1330: The receiving node determines the communication path role of the receiving node based on its own node identifier and the node identifiers of each communication path role in the identifier quadruple, and obtains the key for decryption based on the node identifiers in the identifier quadruple. After receiving the data packet, the receiving node uses the key to decrypt the data packet.

[0235] The process of obtaining the decryption key based on the node identifier in the identifier quadruple and using the obtained key for decryption can be found in the relevant description above, and will not be repeated here.

[0236] As can be seen from the above, this application provides a secure communication method between nodes. This secure communication method mainly addresses the receiving process of secure communication between nodes. In this method, the receiving node performs corresponding operations based on its communication path role. Specifically, when the communication path role is the destination node, the receiving node obtains the key for decryption according to the node identifier in the identifier quadruple, and receives and decrypts the data packet; when the communication path role is the last or first switching device in the communication path, and the end-to-end secure communication policy is valid, the receiving node directly receives the data packet to be received; when the communication path role is the last or first switching device in the communication path, and the end-to-end secure communication policy is invalid, the receiving node obtains the key for decryption according to the node identifier in the identifier quadruple, and receives and decrypts the data packet; when the node's communication path role is an intermediate switching device in the communication path, the receiving node directly receives the data packet to be received.

[0237] In this way, each node can complete the entire secure communication process using a unified procedure, eliminating the need to determine the communication type, thus reducing process complexity and improving the efficiency of secure communication between nodes. Furthermore, when querying keys, only the node identifier needs to be searched, without needing to determine the key types between nodes, improving key lookup efficiency and further enhancing the efficiency of secure communication between nodes.

[0238] Furthermore, the secure communication method between nodes provided in this application will be described from the perspective that nodes may simultaneously have sending and receiving functions during secure communication.

[0239] In this method, the communication path roles for secure inter-node communication include the source node, the first switching device in the communication path, the intermediate switching device in the communication path, the last switching device in the communication path, and the destination node. After establishing a key with the peer network node, any network node stores the key using the peer network node's node identifier as an index. See also... Figure 14A The flowchart shown illustrates a secure communication method between nodes, which includes:

[0240] S1401: The node determines its communication path role based on its own node identifier. If the current node's communication path role is a communication source node, then execute S1402; if the current node's communication path role is a communication destination node, then execute S1403; if the current node's communication path role is the first or last switching device in the communication path, then execute S1404; if the current node's communication path role is an intermediate switching device in the communication path, then execute S1405.

[0241] A node's role in the communication path can be any one of the following: source node, first switching device in the communication path, intermediate switching device in the communication path, last switching device in the communication path, or destination node.

[0242] In practice, a node can compare its own node identifier with the node identifiers of the communication source node, the communication destination node, the first switching device, and the last switching device in the identifier quadruple. If there is a node identifier in the identifier quadruple that is equal to the local node identifier, then the communication path role corresponding to that node identifier in the identifier quadruple is the communication path role of the local node. If there is no node identifier that is equal to the local node identifier, the communication path role of the local node is the intermediate switching device in the communication path.

[0243] Specifically, a node can determine its role in the communication path during secure communication between current nodes through the following steps:

[0244] S14011: The node determines whether the node identifier of the communication source node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtains a first determination result. If the first determination result is yes, then the node is determined to be the communication source node in the communication path of the current secure communication between nodes.

[0245] S14012: If the first judgment result is negative, then determine whether the node identifier of the communication destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain the second judgment result. If the second judgment result is positive, then determine that the node's communication path role in the current secure communication between nodes is the communication destination node.

[0246] It should be noted that, for the above S14011 and S14012, it is also possible to first determine whether the node identifier of the destination node in the identifier quadruple of the current inter-node secure communication is equal to the node identifier of the current node, and obtain a third determination result. If the third determination result is yes, then the communication path role of the current node in the inter-node secure communication is determined to be the communication destination node; if the third determination result is no, then it is determined whether the node identifier of the source node in the identifier quadruple of the current inter-node secure communication is equal to the node identifier of the current node, and obtain a fourth determination result. If the fourth determination result is yes, then the communication path role of the current node in the inter-node secure communication is determined to be the communication source node.

[0247] S14013: If the second judgment result is negative or the fourth judgment result is negative, then determine whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and obtain the fifth judgment result. If the fifth judgment result is positive, then determine that the node's communication path role in the current inter-node secure communication is the first switching device of the communication path.

[0248] S14014: If the fifth judgment result is negative, then determine whether the node identifier of the last switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain the sixth judgment result. If the sixth judgment result is positive, then determine that the node's role in the secure communication between current nodes is the last switching device in the communication path; if the sixth judgment result is negative, then determine that the node's role in the secure communication between current nodes is the intermediate switching device in the communication path.

[0249] It should be noted that, regarding S14013 and S14014 above, when the second judgment result is negative or the fourth judgment result is negative, the node can also first determine whether the node identifier of the last switching device in the identifier quadruple of the current inter-node secure communication is equal to the node identifier of the node, to obtain the seventh judgment result. If the seventh judgment result is positive, then the node's role in the communication path of the current inter-node secure communication is determined to be the last switching device in the communication path. If the seventh judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple of the current inter-node secure communication is equal to the node identifier of the node, to obtain the eighth judgment result. If the eighth judgment result is positive, then the node's role in the communication path of the current inter-node secure communication is determined to be the first switching device in the communication path. If the eighth judgment result is negative, then the node's role in the communication path of the current inter-node secure communication is determined to be an intermediate switching device in the communication path.

[0250] In other words, when determining its role in a communication path, a node first checks whether its role is that of a source node or a destination node, and then checks whether its role is that of the first or last switch in the communication path. In other words, a node can determine its role based on its ID. Source ->ID Destination ->ID SW-last ->ID SW-first Or ID Source ->ID Destination ->ID SW-first ->ID SW-last Or ID Destination ->ID Source ->ID SW-last ->ID SW-first Or ID Destination ->ID Source ->ID SW-first ->ID SW-last The nodes are compared with their own IDs, i.e., local IDs, in order to determine the role of each node in the communication path during secure communication between current nodes.

[0251] Correspondingly, after determining the communication path role of a node, the node can perform processing operations corresponding to that communication path role based on its role in the current secure communication path between nodes. Specifically, when the node's communication path role is a communication source node, S1402 is executed; when the node's communication path role is a communication destination node, S1403 is executed; when the node's communication path role is the first or last switching device in the communication path, S1404 is executed; and when the node's communication path role is an intermediate switching device in the communication path, S1405 is executed.

[0252] S1402: The node obtains the key for encryption based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it.

[0253] When a node acts as a communication source node in the communication path, it obtains the encryption key in the following way for encryption:

[0254] Determine whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple, either in the order of the communication destination node, the last switching device, and the first switching device, or in the order of the communication destination node, the first switching device, and the last switching device.

[0255] If a node finds the key, it uses the key to encrypt the data packet and then sends the data packet; if it does not find the key, it discards the data packet.

[0256] S1403: The node obtains the key for decryption based on the node identifier in the identifier quadruple, and receives and decrypts the data packet.

[0257] When a node's communication path role is that of a communication destination node, it obtains the key for decryption in the following way, and uses it for decryption:

[0258] Determine whether a node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple, either in the order of the communication source node, the first switching device, and the last switching device in the identifier quadruple or in the order of the communication source node, the last switching device, and the first switching device.

[0259] If a node finds the key, it will use the key to decrypt the data packet after receiving it; if it does not find the key, it will discard the data packet.

[0260] S1404: If the end-to-end secure communication strategy is effective, the data packet is forwarded directly. If the end-to-end secure communication strategy is ineffective, the key for decryption is first obtained according to the node identifier in the identifier quadruple, the data packet is received and decrypted, and then the key for encryption is obtained according to the node identifier in the identifier quadruple, the data packet is encrypted and then sent.

[0261] When the end-to-end secure communication strategy is effective, the first or last switching device in the communication path does not need to perform encryption or decryption processing and can directly forward data packets. It achieves secure communication based on the key between the communication source node and the communication destination node.

[0262] When the end-to-end secure communication strategy is invalid, the node first obtains the key for decryption based on the node identifier in the identifier quadruple, receives and decrypts the data packet, and then obtains the key for encryption based on the node identifier in the identifier quadruple, encrypts the data packet and then sends it.

[0263] Specifically, when a node's communication path role is the last switching device in the communication path, the key for decryption is obtained as follows: The node is checked sequentially according to the order of the source node and the first switching device in the identifier quadruple, or the order of the first switching device and the source node, to determine whether it stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple. Furthermore, the key for encryption is obtained as follows: The node is checked to determine whether it stores a key indexed by the node identifier of the communication destination node in the identifier quadruple.

[0264] When a node's communication path role is the first switching device in the communication path, the key for decryption is obtained as follows: It is determined whether the node stores a key indexed by the node identifier of the communication source node in the identifier quadruple. Furthermore, the key for encryption is obtained as follows: It is determined whether the node stores a key indexed by the node identifier of the aforementioned nodes in the identifier quadruple, sequentially according to the order of the communication destination node and the last switching device in the identifier quadruple, or the order of the last switching device and the communication destination node.

[0265] If a decryption key is found, the data packet is decrypted using that key. Then, a encryption key is searched for; if found, the data packet is encrypted using that key before being sent. If neither a decryption nor encryption key is found, the data packet is discarded.

[0266] S1405: Nodes directly forward data packets.

[0267] When the node acts as an intermediate switching device in the secure communication path between current nodes, the data packets have already been encrypted using the keys between the source node and the last switching device in the communication path, the source node and the destination node, the first switching device and the last switching device in the communication path, or the first switching device and the destination node. Therefore, the node does not need to decrypt the data packets and then encrypt and forward them; it can simply forward the data packets directly.

[0268] In this embodiment, S1402 to S1405 are not in any particular order. For each node in the communication path, it performs corresponding operations based on its own communication path role, thereby achieving secure communication between nodes.

[0269] Based on the above embodiments, the node processing can be divided into two types: direct forwarding, where the node forwards data packets, and encryption and / or decryption of data packets. Thus, in some implementations, the node can first determine whether the conditions for direct forwarding are met. If they are met, the data packet is forwarded directly; otherwise, the node performs the corresponding processing based on its communication path role.

[0270] In this embodiment, the direct forwarding conditions include a first forwarding condition and a second forwarding condition. The first forwarding condition specifically states that the end-to-end secure communication policy is valid, and the node's role in the communication path is neither the source node nor the destination node. The second forwarding condition specifically states that the end-to-end secure communication policy is invalid, and the node's role in the communication path is neither the source node nor the destination node, nor the first or last switching device in the communication path; that is, the node is an intermediate switching device in the communication path. If a node determines that it meets any of the above direct forwarding conditions, it can directly forward the data packet.

[0271] It should be noted that the secure inter-node communication method provided in this application is proposed to be implemented in the form of an application program or software. This application program or software can be implemented using machine-oriented programming languages ​​such as assembly language, or it can be implemented using high-level programming languages ​​such as C language.

[0272] If machine-oriented programming languages ​​such as assembly language are used, the compilation result can directly present the comparison results between the current node's node identifier and the node identifiers of the communication source node, communication destination node, the first switching device in the communication path, and the last switching device in the communication path. Therefore, the node's communication path role can be directly presented. When a node does not meet the direct forwarding conditions, the corresponding processing procedure can be directly executed based on this communication path role. For specific implementation details, please refer to [reference needed]. Figure 14A The description of the relevant content in the illustrated embodiment shows that, at this time, it is only necessary to perform the corresponding encryption and / or decryption process according to the communication path role of the node.

[0273] If this method is implemented using a high-level programming language such as C, the compilation result can only show whether the direct forwarding condition is met, but not the node's communication path role. Therefore, if a node does not meet the direct forwarding condition, its communication path role needs to be determined, and then the corresponding processing procedure should be executed based on that role. For a detailed implementation, please refer to [link to implementation details]. Figure 14B , Figure 14B The flowchart illustrates one implementation of a secure communication method between nodes, which includes the following steps:

[0274] S1410: The node determines whether it meets the conditions for direct forwarding. If yes, it executes S1420; otherwise, it executes S1430.

[0275] In practice, a node determines whether it meets the conditions for direct forwarding by comparing its own node identifier with the node identifiers of the source node, destination node, first switching device in the communication path, and last switching device in the communication path in the identifier quadruple, and by judging whether the end-to-end secure communication policy is effective.

[0276] Specifically, when the end-to-end secure communication policy is effective, and the node's own node identifier is not equal to the node identifiers of the source node and the destination node, it can be determined that it meets the direct forwarding condition. When the end-to-end secure communication policy is ineffective, and the node's own node identifier is neither equal to the node identifiers of the source node and the destination node, nor equal to the node identifiers of the first and last switching devices in the communication path, it can also be determined that it meets the direct forwarding condition.

[0277] When a node determines that it meets the conditions for direct forwarding, it can directly execute S1420 to forward the data packet. When a node determines that it does not meet the conditions for direct forwarding, it can execute S1430 to redetermine the node's communication path role and perform additional encryption and / or decryption processing on the data packet based on the communication path role.

[0278] It should be noted that when a node determines that it does not meet the above direct forwarding conditions, i.e., when the node's communication path role is that of an intermediate switching device, the determination of the end-to-end secure communication strategy is actually redundant. This is because intermediate switching devices do not care about the end-to-end secure communication strategy, and this approach in this embodiment is to facilitate engineering implementation using high-level programming languages ​​such as C.

[0279] S1420: Directly forward data packets.

[0280] S1430: The node determines the communication path role of the node based on its own node identifier and the node identifiers of each communication path role in the identifier quadruple; if the communication path role is the communication source node, then execute S1431; if the communication path role is the first switching device or the last switching device of the communication path, then execute S1432; if the communication path role is the communication destination node, then execute S1433.

[0281] In this implementation, S1410 only presents the judgment result of whether the forwarding conditions are met, but not the judgment result of the node's communication path role. Therefore, if the direct forwarding conditions are not met, the node still needs to compare its own node identifier with the node identifiers corresponding to each communication path role in the identifier quadruple to determine its own communication path role in this secure communication process. The specific implementation process is described above and will not be repeated here.

[0282] S1431: The node obtains the key for encryption based on the node identifier in the identifier quadruple, encrypts the data packet, and then sends it.

[0283] S1432: The node obtains the key for decryption based on the node identifier in the identifier quadruple, receives and decrypts the data packet, then obtains the key for encryption based on the node identifier in the identifier quadruple, encrypts the decrypted data packet, and then sends the encrypted data packet.

[0284] S1433: The node obtains the key for decryption based on the node identifier in the identifier quadruple, and receives and decrypts the data packet.

[0285] The process of a node obtaining a key for decryption and a key for encryption based on the node identifier in the identifier quadruple, and then using the obtained keys for encryption and decryption, can be found in the relevant description above and will not be repeated here.

[0286] The secure communication method between nodes provided in this application embodiment has been described above from an interactive perspective. In order to make the technical solution of this application clearer, the secure communication method between nodes provided in this application embodiment will be described below in conjunction with specific application scenarios.

[0287] See Figure 15 The diagram illustrates an application scenario of the secure inter-node communication method. This embodiment primarily describes the specific implementation of the application scenario of Communication Type 7, the secure inter-node communication type defined in the TLSec protocol. Communication Type 7 encompasses all communication path roles in secure inter-node communication, including the source node, the first switching device in the communication path, intermediate switching devices in the communication path, the last switching device in the communication path, and the destination node. According to the definition in the TLSec protocol, in Communication Type 7, both the source node and the destination node are user terminals, and end-to-end secure communication strategies are ineffective. Furthermore, the source node only has a key with the first switching device in the communication path, and the destination node only has a key with the last switching device in the communication path. Only the key between the first and last switching devices in the communication path is applied; no keys exist between the source and last switching devices, between the source and destination nodes, or between the first and destination nodes.

[0288] In this application scenario, node A sends a data packet to node E, meaning node A is the source node and node E is the destination node. Node A first checks if it has stored the exchange path information from node A to node E locally. If it does, it conducts secure communication based on the exchange path information. If not, node A initiates an exchange path discovery request to obtain the exchange path information from node A to node E.

[0289] In this application scenario, the exchange path information of node A is represented by an identifier quadruple, specifically [ID] SourceID SW-first ID SW-last ID Destination ]. Among them, ID Source ID is the node identifier of the communication source node. SW-first ID is the node identifier of the first switching device in the communication path. SW-last ID is the node identifier of the last switching device in the communication path. Destination The node identifier for the communication destination node.

[0290] In this application scenario, node A will display its own node identifier ID. nodeA Compare with the node identifiers in the identifier quadruple, specifically, according to ID. Source -->ID Destination -->ID SW-first -->ID SW-last The order of the nodes is compared with their local IDs to determine their communication path roles. In this example, node A determines its communication path role as a communication source node, which is determined by its ID. Destination -->ID SW-last -->ID SW-first The keys were queried in the order they were used, and finally the key with ID was found. SW-first The key is used as the index. The data packet is encrypted using this key and then sent to the next node, namely node B.

[0291] Node B will display its own node identifier ID. nodeB Compare with the node identifiers in the identifier quadruple, specifically, according to ID. Source -->ID Destination -->ID SW-first -->ID SW-last The order of these IDs is compared with the local ID to determine the node's communication path role. In this example, node B determines its communication path role as the first switching device on the communication path. Since the end-to-end secure communication policy is ineffective, it determines its role based on the ID. Source A key lookup was performed, and the ID was eventually found. Source The key is used to receive data packets, which are then decrypted using this key, and finally processed according to the ID. Destination -->ID SW-last The keys were queried in the order they were used, and finally the key with ID was found. SW-last The key is used as the index. The data packet is encrypted using this key and then sent to the next node, namely node C.

[0292] Node C will display its own node identifier ID. nodeC Compare with the node identifiers in the identifier quadruple, specifically, according to ID.Source -->ID Destination -->ID SW-first -->ID SW-last The order of data packets is compared with the local ID to determine the node's role in the communication path. In this example, node C determines its role as an intermediate switching device in the communication path, and therefore directly forwards the data packets to the next node, node D, without performing any additional encryption or decryption processing.

[0293] Node D will display its own node identifier ID. nodeD Compare with the node identifiers in the identifier quadruple, specifically, according to ID. Source -->ID Destination -->ID SW-first -->ID SW-last The order of events is compared with the local ID to determine its own communication path role. In this example, node D determines its communication path role as the last switching device in the communication path. Since the end-to-end secure communication policy is ineffective, it follows the order of events based on the ID. Source -->ID SW-first The keys were queried in the order they were used, and finally the ID was found. SW-first Using the key as the index, node D decrypts the data packet after receiving it, and then decrypts it according to the ID. Destination A key lookup was performed, and the ID was eventually found. Destination The key is used as the index. The data packet is encrypted using this key and then sent to the next node, namely node E.

[0294] Node E will display its own node identifier ID. nodeE Compare with the node identifiers in the identifier quadruple, specifically, according to ID. Source -->ID Destination -->ID SW-first -->ID SW-last The order of the nodes is compared with their local IDs to determine their communication path roles. In this example, node E determines its communication path role as the communication destination node, which is determined according to its ID. Source -->ID SW-first -->ID SW-last The keys were queried in the order they were used, and finally the key with ID was found. SW-last The key is used as the index. After receiving a data packet, node E uses this key to decrypt the data packet.

[0295] Thus, data packets are transmitted in encrypted form between nodes A and B, B and C, C and D, and D and E, achieving secure communication from node A to node E. For nodes A to E, each node can complete the entire secure communication process using a unified procedure when performing send or receive operations, eliminating the need to determine the communication type, reducing process complexity, and improving the efficiency of secure communication between nodes. Furthermore, this method uses node identifiers as indexes to store keys and configures corresponding key lookup methods based on the node's communication path role. Therefore, key lookup can be performed solely based on the node identifier, without needing to determine the key type between nodes, improving key lookup efficiency and thus enhancing the efficiency of secure communication between nodes.

[0296] The above describes the specific implementation of the secure inter-node communication method provided in this application embodiment. Correspondingly, this application embodiment also provides a network node. It is understood that the network node may be applied to a terminal or a switching device. The network node provided in this application embodiment will be described below from the perspective of functional modularity.

[0297] See Figure 16 The diagram shown illustrates the structure of network node 1600, which is used in a terminal and includes:

[0298] Storage module 1610 is used to store the key with the node identifier of the peer network node as an index after establishing a key with the peer network node.

[0299] The node also includes:

[0300] The encryption module 1620 is used to encrypt data packets when the node's role in the secure communication path during current inter-node communication is that of a communication source node, by obtaining a key for encryption based on the node identifier in the identifier quadtuple; the communication path role is determined based on the node identifier of the node, and the identifier quadtuple is determined based on the exchange path information between nodes.

[0301] The sending module 1630 is used to send encrypted data packets;

[0302] And / or,

[0303] Receiver module 1640 is used to receive data packets;

[0304] The decryption module 1650 is used to decrypt the data packet by obtaining the key for decryption based on the node identifier in the identifier quadtuple when the node's role in the secure communication path between current nodes is the communication destination node.

[0305] Based on the above description, the structure of a node can include the following situations:

[0306] In the first scenario, the node includes a storage module 1610, an encryption module 1620, and a sending module 1630. In this case, the node functions as a sending node and is mainly used to send data packets.

[0307] In the second scenario, the node includes a storage module 1610, a receiving module 1640, and a decryption module 1650. In this case, the node functions as a receiving node and is mainly used to receive data packets.

[0308] The third scenario involves a node comprising a storage module 1610, an encryption module 1620, a sending module 1630, a receiving module 1640, and a decryption module 1650. In this case, the node functions as both a sending and receiving node, primarily used for sending and receiving data packets.

[0309] It should be noted that when a node functions as both a sending node and a receiving node, the encryption module 1620 and the decryption module 1650 can be integrated into one module, such as an encryption / decryption module, and the sending module 1630 and the receiving module 1640 can be integrated into one module, such as a transceiver module.

[0310] The storage module 1610 can be a random access memory (RAM), and the key information is configured and stored in the key RAM. It should be noted that the key information is stored using the node identifier of the peer network node as an index.

[0311] In some possible implementations, the encryption module 1620 is further used for:

[0312] When the node's role in the secure communication path between current nodes is either the first or last switching device in the communication path, and the end-to-end secure communication strategy is invalid, then the key for encryption is obtained based on the node identifier in the identifier quadruple, and the data packet is encrypted.

[0313] The sending module 1630 is further configured to:

[0314] When the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid, the encrypted data packet is sent; when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid, the data packet to be sent is sent directly.

[0315] When the node acts as an intermediate switching device in the communication path of the secure communication between current nodes, it directly sends the data packet to be sent.

[0316] And / or,

[0317] The receiving module 1640 is further configured to:

[0318] When the node's role in the secure communication path between current nodes is either the last or first switching device in the communication path, and the end-to-end secure communication policy is effective, it directly receives the data packet to be received; when the node's role in the secure communication path between current nodes is either the last or first switching device in the communication path, and the end-to-end secure communication policy is ineffective, it receives the data packet to be decrypted.

[0319] When the node acts as an intermediate switching device in the communication path of the secure communication between current nodes, it directly receives the data packets to be received.

[0320] The decryption module 1650 is also used for:

[0321] The node's role in the secure communication path between current nodes is either the last or first switching device in the communication path. When the end-to-end secure communication strategy is invalid, the key for decryption is obtained based on the node identifier in the identifier quadruple, and the data packet is decrypted.

[0322] In some possible implementations, the node further includes a determination module;

[0323] The determining module is used for:

[0324] Determine whether the node identifier of the source node and / or the node identifier of the destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain a first determination result. If the first determination result is yes, then determine that the node's communication path role in the current secure communication between nodes is either a communication source node or a communication destination node.

[0325] In some other possible implementations, the node further includes a determination module;

[0326] The determining module is used for:

[0327] Determine whether the node identifier of the source node and / or the node identifier of the destination node in the identification quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain a first determination result. If the first determination result is yes, then determine that the node's communication path role in the current secure communication between nodes is either a communication source node or a communication destination node.

[0328] If the first judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the first switching device of the communication path.

[0329] If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the last switching device in the communication path.

[0330] If the third judgment result is negative, then the node is determined to be an intermediate switching device in the communication path of the current node secure communication.

[0331] Alternatively, if the first judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the node in the current secure communication between nodes is determined to be the last switching device in the communication path.

[0332] If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the first switching device of the communication path.

[0333] If the fifth judgment result is negative, then the node is determined to be an intermediate switching device in the communication path of the current node secure communication.

[0334] In some possible implementations, the encryption module 1620 is specifically used for:

[0335] If the node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the node stores a key indexed by the node identifier of the above-mentioned nodes in the identifier quadruple according to the order of communication destination node, last switching device, and first switching device in the identifier quadruple or according to the order of communication destination node, first switching device, and last switching device.

[0336] And / or,

[0337] The decryption module 1650 is specifically used for:

[0338] If the node's role in the secure communication path between current nodes is the communication destination node, then determine whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple according to the order of communication source node, first switching device, and last switching device in the identifier quadruple or according to the order of communication source node, last switching device, and first switching device.

[0339] In some other possible implementations, the encryption module 1620 is specifically used for:

[0340] If the node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the node stores a key indexed by the node identifier of the above-mentioned nodes in the identifier quadruple according to the order of communication destination node, last switching device, and first switching device in the identifier quadruple or according to the order of communication destination node, first switching device, and last switching device.

[0341] If the node is the first switching device in the communication path of the secure communication between current nodes, then determine whether the node has a key indexed by the node identifier of the above-mentioned node in the identifier quadruple in the order of communication destination node and last switching device or in the order of last switching device and communication destination node.

[0342] If the node's role in the secure communication path between current nodes is the last switching device in the communication path, then determine whether the node stores a key indexed by the node identifier of the communication destination node in the four-tuple.

[0343] And / or,

[0344] The decryption module 1650 is specifically used for:

[0345] If the node plays the role of the communication path in the current secure communication between nodes as the communication destination node, then determine whether the node stores a key indexed by the node identifier of the above nodes in the identification quadruple according to the order of communication source node, first switching device, and last switching device in the identification quadruple or according to the order of communication source node, last switching device, and first switching device.

[0346] If the node's role in the secure communication path between current nodes is the last switching device in the communication path, then determine whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple according to the order of the communication source node and the first switching device in the identifier quadruple or the order of the first switching device and the communication source node.

[0347] If the node plays the role of the first switching device in the communication path of the current node secure communication, then determine whether the node stores a key indexed by the node identifier of the communication source node in the identification quadruple.

[0348] In some possible implementations, the node identifier includes the node's media access control address.

[0349] Next, see Figure 17 The diagram shown illustrates the structure of network node 1700, which is used in switching equipment and includes:

[0350] Storage module 1710 is used to store the key with the node identifier of the peer network node as an index after establishing a key with the peer network node;

[0351] The node also includes:

[0352] The encryption module 1720 is used to encrypt data packets when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid. The encryption module obtains the encryption key based on the node identifier in the identifier quadruple. The communication path role is determined based on the node identifier of the node, and the identifier quadruple is determined based on the exchange path information between nodes.

[0353] The sending module 1730 is configured to send encrypted data packets when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid; directly send the data packets to be sent when the node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid; and directly send the data packets to be sent when the node's role in the secure communication path between current nodes is an intermediate switching device in the communication path.

[0354] And / or,

[0355] The receiving module 1740 is configured to directly receive data packets when the node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is valid; receive data packets for decryption when the node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is invalid; and directly receive data packets when the node's role in the secure communication path between current nodes is an intermediate switching device in the communication path.

[0356] The decryption module 1750 is used to obtain the key for decryption based on the node identifier in the identifier quadtuple when the node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication strategy is invalid.

[0357] Based on the above description, the structure of a node can include the following situations:

[0358] In the first scenario, the node includes a storage module 1710, an encryption module 1720, and a sending module 1730. In this case, the node functions as a sending node and is mainly used to send data packets.

[0359] In the second scenario, the node includes a storage module 1710, a receiving module 1740, and a decryption module 1750. In this case, the node functions as a receiving node and is mainly used to receive data packets.

[0360] The third scenario involves a node comprising a storage module 1710, an encryption module 1720, a sending module 1730, a receiving module 1740, and a decryption module 1750. In this case, the node functions as both a sending and receiving node, primarily used for sending and receiving data packets.

[0361] It should be noted that when a node functions as both a sending node and a receiving node, the encryption module 1720 and the decryption module 1750 can be integrated into one module, such as an encryption / decryption module, and the sending module 1730 and the receiving module 1740 can be integrated into one module, such as a transceiver module.

[0362] The storage module 1710 can be a random access memory (RAM), and the key information is configured and stored in the key RAM. It should be noted that the key information is stored using the node identifier of the peer network node as an index.

[0363] In some possible implementations, the encryption module 1720 is further used for:

[0364] When the node plays the role of a communication source node in the secure communication path between current nodes, it obtains the encryption key based on the node identifier in the identifier quadruple and encrypts the data packet.

[0365] And / or,

[0366] The decryption module 1750 is also used for:

[0367] When the node plays the role of the communication destination node in the secure communication path between current nodes, it obtains the key for decryption based on the node identifier in the identifier quadruple and decrypts the data packet.

[0368] In some possible implementations, the node further includes a determination module;

[0369] The determining module is used for:

[0370] Determine whether the node identifier of the first switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain a second determination result. If the second determination result is yes, then determine that the node's communication path role in the current secure communication between nodes is the first switching device of the communication path.

[0371] If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the last switching device in the communication path.

[0372] If the third judgment result is negative, then the node is determined to be an intermediate switching device in the communication path of the current node secure communication.

[0373] Alternatively, determine whether the node identifier of the last switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain a fourth determination result. If the fourth determination result is yes, then determine that the node's communication path role in the current secure communication between nodes is the last switching device in the communication path.

[0374] If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the first switching device of the communication path.

[0375] If the fifth judgment result is negative, then the node is determined to be an intermediate switching device in the communication path of the current node secure communication.

[0376] In some other possible implementations, the node further includes a determination module;

[0377] The determining module is used for:

[0378] Determine whether the node identifier of the source node and / or the node identifier of the destination node in the identification quadruple in the current secure communication between nodes is equal to the node identifier of the node, and obtain a first determination result. If the first determination result is yes, then determine that the node's communication path role in the current secure communication between nodes is either a communication source node or a communication destination node.

[0379] If the first judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the first switching device of the communication path.

[0380] If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the last switching device in the communication path.

[0381] If the third judgment result is negative, then the node is determined to be an intermediate switching device in the communication path of the current node secure communication.

[0382] Alternatively, if the first judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the node in the current secure communication between nodes is determined to be the last switching device in the communication path.

[0383] If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the node in the current inter-node secure communication is determined to be the first switching device of the communication path.

[0384] If the fifth judgment result is negative, then the node is determined to be an intermediate switching device in the communication path of the current node secure communication.

[0385] In some possible implementations, the encryption module 1720 is specifically used for:

[0386] If the node is the first switching device in the communication path of the secure communication between current nodes, then determine whether the node has a key indexed by the node identifier of the above-mentioned node in the identifier quadruple in the order of communication destination node and last switching device or in the order of last switching device and communication destination node.

[0387] If the node's role in the secure communication path between current nodes is the last switching device in the communication path, then determine whether the node stores a key indexed by the node identifier of the communication destination node in the four-tuple.

[0388] And / or,

[0389] The decryption module 1750 is specifically used for:

[0390] If the node's role in the secure communication path between current nodes is the last switching device in the communication path, then determine whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple according to the order of the communication source node and the first switching device in the identifier quadruple or the order of the first switching device and the communication source node.

[0391] If the node plays the role of the first switching device in the communication path of the current node secure communication, then determine whether the node stores a key indexed by the node identifier of the communication source node in the identification quadruple.

[0392] In some other possible implementations, the encryption module 1720 is specifically used for:

[0393] If the node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the node stores a key indexed by the node identifier of the above-mentioned nodes in the identifier quadruple according to the order of communication destination node, last switching device, and first switching device in the identifier quadruple or according to the order of communication destination node, first switching device, and last switching device.

[0394] If the node is the first switching device in the communication path of the secure communication between current nodes, then determine whether the node has a key indexed by the node identifier of the above-mentioned node in the identifier quadruple in the order of communication destination node and last switching device or in the order of last switching device and communication destination node.

[0395] If the node's role in the secure communication path between current nodes is the last switching device in the communication path, then determine whether the node stores a key indexed by the node identifier of the communication destination node in the four-tuple.

[0396] And / or,

[0397] The decryption module 1750 is specifically used for:

[0398] If the node plays the role of the communication path in the current secure communication between nodes as the communication destination node, then determine whether the node stores a key indexed by the node identifier of the above nodes in the identification quadruple according to the order of communication source node, first switching device, and last switching device in the identification quadruple or according to the order of communication source node, last switching device, and first switching device.

[0399] If the node's role in the secure communication path between current nodes is the last switching device in the communication path, then determine whether the node stores a key indexed by the node identifier of the aforementioned node in the identifier quadruple according to the order of the communication source node and the first switching device in the identifier quadruple or the order of the first switching device and the communication source node.

[0400] If the node plays the role of the first switching device in the communication path of the current node secure communication, then determine whether the node stores a key indexed by the node identifier of the communication source node in the identification quadruple.

[0401] In some possible implementations, the node identifier includes the node's media access control address.

[0402] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0403] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0404] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0405] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0406] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0407] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0408] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An inter-node secure communication method, a communication path role of the inter-node secure communication including a communication source node, a first switching device of a communication path, an intermediate switching device of the communication path, a last switching device of the communication path, and a communication destination node, characterized by, After establishing a key with a peer network node, any network node in the network stores the key using the peer network node's node identifier as an index. The secure communication method is applied to the sending node and includes: The sending node determines its role in the secure communication path between current nodes; the sending node then performs corresponding processing based on its determined role in the secure communication path between current nodes, as follows: If the sending node plays the role of a communication source node in the secure communication path between current nodes, then it obtains the encryption key based on the node identifier in the identifier quadruple, encrypts the data packet using the obtained key, and then sends the encrypted data packet. If the sending node plays the role of the first or last switching device in the secure communication path between current nodes, and the end-to-end secure communication strategy is effective, then the data packet to be sent is sent directly. If the sending node is the first or last switching device in the communication path of the current node secure communication, and the end-to-end secure communication strategy is invalid, then the key for encryption is obtained according to the node identifier in the identifier quadruple, the data packet is encrypted using the obtained key, and then the encrypted data packet is sent. If the sending node acts as an intermediate switching device in the communication path of the current node secure communication, it directly sends the data packet to be sent; The communication path role of the sending node in the current secure communication between nodes is determined according to the node identifier of the sending node, and the identifier quadruple is determined according to the exchange path information between nodes; The communication path role of the sending node in the current secure communication between nodes is determined in the following way: Determine whether the node identifier of the communication source node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the sending node, and obtain a first determination result. If the first determination result is yes, then determine that the communication path role of the sending node in the current secure communication between nodes is the communication source node. If the first judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the sending node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the sending node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the sending node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the sending node in the current node secure communication is determined to be the last switching device in the communication path. If the third judgment result is negative, then the role of the sending node in the secure communication path between current nodes is determined to be an intermediate switching device in the communication path; Alternatively, if the first judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the sending node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the sending node in the current inter-node secure communication is determined to be the last switching device in the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the sending node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the sending node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the fifth judgment result is negative, then the role of the sending node in the secure communication path between current nodes is determined to be an intermediate switching device in the communication path.

2. The method according to claim 1, characterized in that, The step of obtaining the encryption key based on the node identifier in the identifier quadruple includes: If the sending node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the sending node has a key indexed by the node identifiers of the communication destination node, the last switching device, and the first switching device in the identifier quadruple, or in the order of the communication destination node, the first switching device, and the last switching device. If the sending node is the first switching device in the communication path of the current node secure communication, then determine whether the sending node has a key indexed by the node identifiers of the communication destination node and the last switching device in the identifier quadruple or the last switching device and the communication destination node. If the sending node plays the role of the last switching device in the communication path of the current node secure communication, then it is determined whether the sending node has a key indexed by the node identifier of the communication destination node in the identification quadruple.

3. The method according to any one of claims 1 to 2, characterized in that, The node identifier includes the node's media access control address.

4. A secure communication method between nodes, wherein the communication path roles in the secure communication between nodes include a source node, a first switching device in the communication path, an intermediate switching device in the communication path, a last switching device in the communication path, and a destination node, characterized in that, After establishing a key with a peer network node, any network node in the network stores the key using the peer network node's node identifier as an index. The secure communication method is applied to the receiving node and includes: The receiving node determines its role in the secure communication path between current nodes; the receiving node then performs corresponding processing based on its determined role in the secure communication path between current nodes, as follows: If the receiving node's role in the secure communication path between current nodes is the communication destination node, then it obtains the key for decryption based on the node identifier in the identifier quadruple, receives the data packet, and uses the obtained key to decrypt the data packet. If the receiving node plays the role of the last or first switching device in the communication path of the current node secure communication, and the end-to-end secure communication policy is effective, then the data packet to be received will be received directly. If the receiving node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication strategy is invalid, then the key for decryption is obtained according to the node identifier in the identifier quadruple, the data packet is received, and the obtained key is used to decrypt the data packet. If the receiving node acts as an intermediate switching device in the communication path of the current node's secure communication, it directly receives the data packets to be received. The communication path role of the receiving node in the current secure communication between nodes is determined according to the node identifier of the receiving node, and the identifier quadruple is determined according to the exchange path information between nodes; The role of the receiving node in the secure communication path between current nodes is determined in the following way: Determine whether the node identifier of the destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the receiving node, and obtain a first determination result. If the first determination result is yes, then determine that the receiving node's role in the communication path of the current secure communication between nodes is the destination node. If the first judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the receiving node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the receiving node in the current node secure communication is determined to be the last switching device in the communication path. If the second judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the receiving node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the receiving node in the current node secure communication is determined to be the first switching device in the communication path. If the third determination result is negative, then the receiving node is determined to be an intermediate switching device in the communication path of the current node secure communication. Alternatively, if the first judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the receiving node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the receiving node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the receiving node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the receiving node in the current node secure communication is determined to be the last switching device in the communication path. If the fifth judgment result is negative, then the receiving node is determined to be an intermediate switching device in the communication path of the current node secure communication.

5. The method according to claim 4, characterized in that, The step of obtaining the key for decryption based on the node identifier in the identifier quadruple includes: If the receiving node plays the role of the communication destination node in the secure communication between current nodes, then determine whether the receiving node has a key indexed by the node identifiers of the communication source node, the first switching device, and the last switching device in the identifier quadruple, or in the order of the communication source node, the last switching device, and the first switching device. If the receiving node plays the role of the last switching device in the communication path of the current node secure communication, then determine whether the receiving node has a key indexed by the node identifiers of the communication source node and the first switching device in the identifier quadruple or the first switching device and the communication source node. If the receiving node plays the role of the first switching device in the communication path of the current node secure communication, then it is determined whether the receiving node has a key indexed by the node identifier of the communication source node in the identification quadruple.

6. The method according to any one of claims 4 to 5, characterized in that, The node identifier includes the node's media access control address.

7. A secure communication method between nodes, wherein the communication path roles in the secure communication between nodes include a source node, a first switching device in the communication path, an intermediate switching device in the communication path, a last switching device in the communication path, and a destination node, characterized in that, After establishing a key with a peer network node, any network node in the network stores the key using the peer network node's node identifier as an index. The secure communication method includes: The network node determines its role in the secure communication path between current nodes; the network node then performs corresponding processing based on its determined role in the secure communication path between current nodes, as follows: If the network node plays the role of a communication source node in the secure communication path between current nodes, then the key for encryption is obtained according to the node identifier in the identifier quadruple. The data packet is then encrypted using the obtained key and then sent. If the network node plays the role of the communication destination node in the secure communication path between current nodes, then the key for decryption is obtained according to the node identifier in the identifier quadruple, the data packet is received, and the obtained key is used to decrypt the data packet. If the network node plays the role of the first or last switching device in the secure communication path between current nodes, and the end-to-end secure communication policy is effective, then the data packet is forwarded directly. If the network node plays the role of the first or last switching device in the communication path of the current node secure communication, and the end-to-end secure communication strategy is invalid, then firstly, the key for decryption is obtained according to the node identifier in the identifier quadruple, the data packet is received, and the data packet is decrypted using the obtained key for decryption. Then, the key for encryption is obtained according to the node identifier in the identifier quadruple, and the decrypted data packet is re-encrypted using the obtained key for encryption before the encrypted data packet is sent. If a network node acts as an intermediate switching device in the secure communication path between current nodes, it directly forwards data packets. The role of the network node in the secure communication path between current nodes is determined based on the node identifier of the network node, and the identifier quadruple is determined based on the exchange path information between nodes. The role of a network node in the secure communication path between current nodes is determined in the following way: Determine whether the node identifier of the communication source node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a first determination result. If the first determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is the communication source node. If the first judgment result is negative, then it is determined whether the node identifier of the communication destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the network node in the current secure communication between nodes is determined to be the communication destination node. Alternatively, determine whether the node identifier of the communication destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a third determination result. If the third determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is the communication destination node. If the third judgment result is negative, then it is determined whether the node identifier of the communication source node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the network node in the current secure communication between nodes is determined to be the communication source node. If the second judgment result is negative or the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the network node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the network node in the current node secure communication is determined to be the first switching device of the communication path. If the fifth judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the network node, and a sixth judgment result is obtained. If the sixth judgment result is positive, then the communication path role of the network node in the current node secure communication is determined to be the last switching device in the communication path. If the sixth judgment result is negative, then the network node is determined to be an intermediate switching device in the communication path of the identification quadruple in the current node secure communication. Alternatively, if the second judgment result is negative or the fourth judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the network node, and a seventh judgment result is obtained. If the seventh judgment result is positive, then the communication path role of the network node in the current node secure communication is determined to be the last switching device in the communication path. If the seventh judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and an eighth judgment result is obtained. If the eighth judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the eighth judgment result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node in secure communication between nodes.

8. The method according to claim 7, characterized in that, If the network node plays the role of a communication source node in the secure communication path between current nodes, then obtaining the encryption key based on the node identifier in the identifier quadruple includes: Determine whether the network node stores a key indexed by the node identifiers of the communication destination node, the last switching device, and the first switching device in the identifier quadruple, or in the order of the communication destination node, the first switching device, and the last switching device. If the network node's role in the secure communication path between current nodes is that of the communication destination node, then obtaining the key for decryption based on the node identifier in the identifier quadruple includes: Determine whether the network node stores a key indexed by the node identifiers of the communication source node, the first switching device, and the last switching device in the identifier quadruple, or in the order of the communication source node, the last switching device, and the first switching device. If a network node's role in the secure communication path between current nodes is that of the last switching device in the communication path, then obtaining the key for decryption based on the node identifier in the identifier quadruple includes: determining whether the network node stores a key indexed by the node identifiers of the communication source node and the first switching device in the identifier quadruple, or by the first switching device and the communication source node in the first order of the identifier quadruple; obtaining the key for encryption based on the node identifier in the identifier quadruple includes: determining whether the network node stores a key indexed by the node identifier of the communication destination node in the identifier quadruple. If a network node's role in the secure communication path between current nodes is the first switching device in the communication path, then obtaining the key for decryption based on the node identifier in the identifier quadruple includes: determining whether the network node stores a key indexed by the node identifier of the communication source node in the identifier quadruple; obtaining the key for encryption based on the node identifier in the identifier quadruple includes: determining whether the network node stores a key indexed by the node identifier of the communication source node and the node identifier of the last switching device in the identifier quadruple, either in the order of the communication destination node and the last switching device or in the order of the last switching device and the communication destination node.

9. A network node, characterized in that, Applied to terminals, the network node determines its own role in the secure communication path between current nodes, and performs corresponding processing based on its determined role in the secure communication path between current nodes. The network node includes: A storage module is used to store the key with the node identifier of the peer network node as an index after a key is established with the peer network node. The network node also includes an encryption module for... If the network node's role in the secure communication path between current nodes is that of a communication source node, a key for encryption is obtained based on the node identifier in the identifier quadruple, and the obtained key is used to encrypt the data packet; the communication path role is determined based on the network node's node identifier, and the identifier quadruple is determined based on the exchange path information between nodes; The sending module is used to send encrypted data packets; And / or, The receiving module is used to receive data packets; The decryption module is used to obtain a key for decryption based on the node identifier in the identifier quadruple if the network node plays the role of the communication path in the current node secure communication as the communication destination node, and to decrypt the data packet using the obtained key. The network node also includes a determination module; The determining module is used for: Determine whether the node identifier of the source node and / or the node identifier of the destination node in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a first determination result. If the first determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is either a communication source node or a communication destination node.

10. The network node according to claim 9, characterized in that, The encryption module is also used for: If the network node plays the role of the first or last switching device in the secure communication path between current nodes, and the end-to-end secure communication strategy is invalid, then the key for encryption is obtained according to the node identifier in the identifier quadruple, and the data packet is encrypted. The sending module is also used for: If the network node plays the role of the first or last switching device in the communication path of the current node secure communication, and the end-to-end secure communication strategy is invalid, then an encrypted data packet is sent. If the network node plays the role of the first or last switching device in the communication path of the current node secure communication, and the end-to-end secure communication strategy is effective, the data packet to be sent is sent directly. If the network node acts as an intermediate switching device in the communication path of the current node secure communication, it directly sends the data packet to be sent; And / or, The receiving module is also used for: If the network node plays the role of the last or first switching device in the communication path of the current node secure communication, and the end-to-end secure communication strategy is effective, then the data packet to be received is received directly. If the network node plays the role of the last or first switching device in the communication path of the current node secure communication, and the end-to-end secure communication strategy is invalid, then the received data packet is pending decryption. If the network node acts as an intermediate switching device in the communication path of the secure communication between current nodes, it directly receives the data packets to be received. The decryption module is also used for: If the network node plays the role of the last or first switching device in the communication path of the current node secure communication, and the end-to-end secure communication policy is invalid, then the key for decryption is obtained according to the node identifier in the identifier quadruple, and the data packet is decrypted.

11. The network node according to claim 10, characterized in that, The determining module is also used for: Determine whether the node identifier of the source node and / or the node identifier of the destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a first determination result. If the first determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is either a communication source node or a communication destination node. If the first judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the network node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the network node in the current node secure communication is determined to be the first switching device of the communication path. If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the last switching device in the communication path. If the third determination result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node in the secure communication between nodes. Alternatively, if the first judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the last switching device in the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the fifth judgment result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node's secure communication.

12. The network node according to claim 9, characterized in that, The encryption module is specifically used for: If the network node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifiers of the communication destination node, the last switching device, and the first switching device in the identifier quadruple, or in the order of the communication destination node, the first switching device, and the last switching device. And / or, The decryption module is specifically used for: If the network node plays the role of the communication destination node in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifiers of the communication source node, the first switching device, and the last switching device in the identifier quadruple, or in the order of the communication source node, the last switching device, and the first switching device.

13. The network node according to claim 10, characterized in that, The encryption module is specifically used for: If the network node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifiers of the communication destination node, the last switching device, and the first switching device in the identifier quadruple, or in the order of the communication destination node, the first switching device, and the last switching device. If the network node plays the role of the first switching device in the communication path of the current node secure communication, then determine whether the network node has a key indexed by the node identifier of the communication destination node and the last switching device in the identifier quadruple or the last switching device and the communication destination node. If the network node plays the role of the last switching device in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifier of the communication destination node in the identification quadruple. And / or, The decryption module is specifically used for: If the network node plays the role of the communication path in the current secure communication between nodes as the communication destination node, then determine whether the network node stores a key indexed by the node identifiers of the communication source node, the first switching device, and the last switching device in the identifier quadruple, or in the order of the communication source node, the last switching device, and the first switching device. If the network node plays the role of the last switching device in the communication path of the current node secure communication, then determine whether the network node has a key indexed by the node identifiers of the communication source node and the first switching device in the identifier quadruple or the first switching device and the communication source node. If the network node plays the role of the first switching device in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifier of the communication source node in the identifier quadruple.

14. The network node according to any one of claims 9 to 13, characterized in that, The node identifier includes the node's media access control address.

15. A network node, characterized in that, Applied to switching equipment, the network node determines its own role in the secure communication path between current nodes, and performs corresponding processing based on its determined role in the secure communication path between current nodes. The network node includes: A storage module is used to store the key with the node identifier of the peer network node as an index after a key is established with the peer network node. The network nodes also include: The encryption module is used to encrypt data packets if the network node's role in the communication path during secure communication between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid. The communication path role is determined based on the network node's node identifier, and the identifier quadruple is determined based on the exchange path information between nodes. The sending module is configured to: send encrypted data packets if the network node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is invalid; directly send the data packets to be sent if the network node's role in the secure communication path between current nodes is the first or last switching device in the communication path, and the end-to-end secure communication policy is valid; and directly send the data packets to be sent if the network node's role in the secure communication path between current nodes is an intermediate switching device in the communication path. And / or, The receiving module is configured to: directly receive the data packet to be received if the network node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is valid; receive the data packet to be decrypted if the network node's role in the secure communication path between current nodes is the last or first switching device in the communication path, and the end-to-end secure communication policy is invalid; and directly receive the data packet to be received if the network node's role in the secure communication path between current nodes is an intermediate switching device in the communication path. The decryption module is used to obtain a key for decryption based on the node identifier in the identifier quadtuple if the network node is the last or first switching device in the communication path of the current node secure communication and the end-to-end secure communication policy is invalid, and to decrypt the data packet using the obtained key. The network node further includes a determining module, the determining module being used for: Determine whether the node identifier of the first switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a second determination result. If the second determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is the first switching device of the communication path. If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the last switching device in the communication path. If the third determination result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node in the secure communication between nodes. Alternatively, determine whether the node identifier of the last switching device in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a fourth determination result. If the fourth determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is the last switching device in the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the fifth judgment result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node's secure communication.

16. The network node according to claim 15, characterized in that, The encryption module is also used for: If the network node plays the role of a communication source node in the secure communication path between current nodes, the key used for encryption is obtained according to the node identifier in the identifier quadruple, and the obtained key is used to encrypt the data packet. And / or, The decryption module is also used for: If the network node plays the role of the communication destination node in the secure communication path between current nodes, the key for decryption is obtained according to the node identifier in the identifier quadruple, and the obtained key is used to decrypt the data packet.

17. The network node according to claim 16, characterized in that, The determining module is also used for: Determine whether the node identifier of the source node and / or the node identifier of the destination node in the identifier quadruple in the current secure communication between nodes is equal to the node identifier of the network node, and obtain a first determination result. If the first determination result is yes, then determine that the network node's communication path role in the current secure communication between nodes is either a communication source node or a communication destination node. If the first judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current node secure communication is equal to the node identifier of the network node, and a second judgment result is obtained. If the second judgment result is positive, then the communication path role of the network node in the current node secure communication is determined to be the first switching device of the communication path. If the second judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a third judgment result is obtained. If the third judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the last switching device in the communication path. If the third determination result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node in the secure communication between nodes. Alternatively, if the first judgment result is negative, then it is determined whether the node identifier of the last switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a fourth judgment result is obtained. If the fourth judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the last switching device in the communication path. If the fourth judgment result is negative, then it is determined whether the node identifier of the first switching device in the identifier quadruple in the current inter-node secure communication is equal to the node identifier of the network node, and a fifth judgment result is obtained. If the fifth judgment result is positive, then the communication path role of the network node in the current inter-node secure communication is determined to be the first switching device of the communication path. If the fifth judgment result is negative, then the network node is determined to be an intermediate switching device in the communication path of the current node's secure communication.

18. The network node according to claim 15, characterized in that, The encryption module is specifically used for: If the network node plays the role of the first switching device in the communication path of the current node secure communication, then determine whether the network node has a key indexed by the node identifier of the communication destination node and the last switching device in the identifier quadruple or the last switching device and the communication destination node. If the network node plays the role of the last switching device in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifier of the communication destination node in the identification quadruple. And / or, The decryption module is specifically used for: If the network node plays the role of the last switching device in the communication path of the current node secure communication, then determine whether the network node has a key indexed by the node identifiers of the communication source node and the first switching device in the identifier quadruple or the first switching device and the communication source node. If the network node plays the role of the first switching device in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifier of the communication source node in the identifier quadruple.

19. The network node according to claim 16, characterized in that, The encryption module is specifically used for: If the network node plays the role of a communication source node in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifiers of the communication destination node, the last switching device, and the first switching device in the identifier quadruple, or in the order of the communication destination node, the first switching device, and the last switching device. If the network node plays the role of the first switching device in the communication path of the current node secure communication, then determine whether the network node has a key indexed by the node identifier of the communication destination node and the last switching device in the identifier quadruple or the last switching device and the communication destination node. If the network node plays the role of the last switching device in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifier of the communication destination node in the identification quadruple. And / or, The decryption module is specifically used for: If the network node plays the role of the communication path in the current secure communication between nodes as the communication destination node, then determine whether the network node stores a key indexed by the node identifiers of the communication source node, the first switching device, and the last switching device in the identifier quadruple, or in the order of the communication source node, the last switching device, and the first switching device. If the network node plays the role of the last switching device in the communication path of the current node secure communication, then determine whether the network node has a key indexed by the node identifiers of the communication source node and the first switching device in the identifier quadruple or the first switching device and the communication source node. If the network node plays the role of the first switching device in the secure communication path between current nodes, then determine whether the network node stores a key indexed by the node identifier of the communication source node in the identifier quadruple.

20. The network node according to any one of claims 15 to 19, characterized in that, The node identifier includes the node's media access control address.

Images