A method and device for MACSec communication based on PSK

Abstract

The embodiment of the present application provides a method for MACSec communication based on PSK, wherein the first communication device can derive a first MACSec key based on the first PSK within the aging period of the first PSK. The first communication device can update the first PSK to a second PSK, and derive a second MACSec key based on the second PSK within the aging period of the second PSK. The first PSK is used to process messages exchanged between the first communication device and the second communication device within the aging period of the first PSK; the second PSK is used to process messages exchanged between the first communication device and the second communication device based on the second PSK within the aging period of the second PSK. It can be seen that the PSK stored in the first communication device is no longer immutable, and the first communication device can derive MACSec keys using different PSKs within different communication periods, thereby reducing the possibility of the PSK in the first communication device being cracked, and correspondingly reducing the risk of the MACSec key derived from the PSK being cracked.

Description

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on July 25, 2020, with application number 202010740829.0 and invention name “A secure communication method, device and system”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of security technology, and in particular to a method and apparatus for media access control security (MACSec) communication based on a pre-shared key (PSK). Background Art

[0003] Currently, when two communication devices perform MACSec communication, in order to ensure data security, MACSec keys can be used to process messages exchanged between the two communication devices.

[0004] In some embodiments, a PSK can be used to derive a MACSec key. For example, when a first communication device and a second communication device engage in MACSec communication, the first communication device and the second communication device can each store a PSK, and the first and second communication devices can store the same PSK. In this way, the first and second communication devices can each use their stored PSKs to derive MACSec keys.

[0005] In some embodiments, the PSK in the first communication device and the second communication device is immutable. Therefore, once the PSK is cracked, the MACSec key derived from the PSK is at risk of being cracked, thereby bringing certain security risks. Summary of the Invention

[0006] The embodiments of the present application provide a method for MACSec communication based on PSK, which can reduce the risk of PSK being cracked and correspondingly reduce the risk of MACSec keys derived from PSK being cracked, thereby reducing security risks.

[0007] In a first aspect, embodiments of the present application provide a method for MACSec communication based on a PSK, which can be performed by a first communication device. In one example, the first communication device stores a first PSK, which is used to process messages exchanged between the first communication device and a second communication device during an aging period of the first PSK. Both the first communication device and the second communication device can process messages exchanged between the first communication device and the second communication device based on the first PSK during the aging period of the first PSK. In the present application, the first communication device can derive a first MACSec key based on the first PSK during the aging period of the first PSK. The first communication device can also update the first PSK to a second PSK and derive a second MACSec key based on the second PSK during the aging period of the second PSK. The second PSK is used to process messages exchanged between the first communication device and the second communication device during the aging period of the second PSK. Both the first communication device and the second communication device can process messages exchanged between the first communication device and the second communication device based on the second PSK during the aging period of the second PSK. With this solution, the PSK stored in the first communication device is no longer static. The first communication device can use different PSKs to derive MACSec keys during different communication cycles. For example, during the communication cycle corresponding to the aging cycle of the first PSK, the first MACSec key is derived using the first PSK, while during the communication cycle corresponding to the aging cycle of the second PSK, the second MACSec key is derived using the second PSK. This reduces the possibility of the PSK in the first communication device being cracked, and accordingly reduces the risk of the MACSec key derived from the PSK being cracked.

[0008] In one implementation, a first communication device may receive a first protocol message sent by a second communication device within the aging period of the first PSK, wherein the first protocol message includes a first PSK key material, and the first PSK key material is used to generate a second PSK. After the first communication device obtains the first PSK key material, it may obtain a second PSK based on the first PSK key material. Thus, it can be seen that, using the solution of the embodiment of the present application, the first communication device may use the first PSK key material carried in the first protocol message to update the first PSK to the second PSK. In this way, the first communication device can update the PSK based on the first PSK key material, and therefore, the PSK stored in the first communication device is no longer static, thereby reducing the possibility of the PSK in the first communication device being cracked, and correspondingly reducing the risk of the MACSec key derived from the PSK being cracked, thereby reducing security risks.

[0009] In one implementation, after obtaining the second PSK based on the first PSK key material, the first communication device may store the second PSK in a non-volatile storage area of ​​the first communication device to ensure that the second PSK is not lost if the first communication device experiences a sudden failure or power outage. When the aging period of the second PSK begins, the first communication device may read the second PSK from the non-volatile storage area, thereby using the second PSK to process messages exchanged between the first and second communication devices and to derive a second MACSec key using the second PSK.

[0010] In one implementation, the first communication device uses the second PSK to derive a MACSec key. In a specific implementation, the second PSK may be used as a secure connection association key CAK to derive the MACSec key.

[0011] In one implementation, the first communication device derives the second MACSec key using the second PSK. In a specific implementation, the first communication device can generate a master session key MSK based on the second PSK, derive a secure connection association key CAK using the MSK, and derive the second MACSec key using the CAK.

[0012] In one implementation, when the first communication device is capable of using an asymmetric key algorithm, the first communication device may derive the second PSK based on the first PSK key material and the second PSK key material of the first communication device. For example, the first PSK key material may be a public value of the second communication device, and the second PSK key material may be a private value of the first communication device. The first communication device may utilize the asymmetric key algorithm to calculate the second PSK based on the public value of the second communication device and the private value of the first communication device.

[0013] In one implementation, if the first communication device obtains the second PSK based on the aforementioned first and second PSK key materials, the second communication device may also obtain the second PSK using an asymmetric key algorithm. In this case, the first communication device may send the third PSK key material to the second communication device, so that the second communication device can calculate the second PSK based on the third PSK key material. For example, the third PSK material may be the public value of the first communication device, and the second communication device may calculate the second PSK using the public value of the first communication device and the private value of the second communication device.

[0014] In one implementation, the second communication device can pre-acquire the second PSK and send the second PSK to the first communication device by including it in the aforementioned first protocol message. In this case, the first PSK key material included in the first protocol message received by the first communication device is the second PSK. Therefore, in one example, after receiving the first protocol message, the first communication device can parse the first protocol message to obtain the first PSK key material included in the first protocol message, and determine the first PSK key material as the second PSK.

[0015] In one implementation, the first communication device may derive the second PSK based on the first PSK key material. In a specific implementation, for example, the second PSK may be derived based on the first PSK key material and a first key derivation algorithm. The first key derivation algorithm mentioned herein may be, for example, a KDF or a PRF. For details on KDF and PRF, please refer to the relevant descriptions in IEEE 802.1x-2010 and are not repeated here.

[0016] In one implementation, the first communication device obtains the second PSK based on the first PSK key material and the first key derivation algorithm. In a specific implementation, for example, the first PSK key material can be first processed using the first algorithm to obtain an intermediate value, and then the intermediate value and the first key derivation algorithm can be used to obtain the second PSK. The embodiment of the present application does not specifically limit the first algorithm. The first algorithm can be a key derivation algorithm or other algorithms. In this way, the second PSK can only be cracked if the first algorithm, the first PSK key material, and the first key derivation algorithm are all cracked, thereby reducing the risk of the second PSK being cracked and further improving the security of the second PSK.

[0017] In one implementation, the aforementioned first PSK key material can be a random number. The second communication device can generate a random number and send it to the first communication device as the first PSK key material within the first protocol message. Using a random number as the first PSK key material reduces the likelihood of the random number being cracked compared to the second communication device generating the first PSK key material using a specific pattern. Therefore, using a random number as the first PSK key material can reduce the likelihood of the first PSK key material being cracked, and accordingly reduces the likelihood of the second PSK being cracked.

[0018] In one implementation, the first protocol message is an EAP-PSK-based Extended Authentication Protocol (EAP-PSK) message. In this case, the second communication device may reconstruct the message structure of the EAP-PSK-based message and send the reconstructed EAP-PSK-based message carrying the first PSK key material to the first communication device.

[0019] In one implementation, when the first protocol message is an EAP-PSK-based message, the first protocol message may include an extended TLV field, and the aforementioned first PSK key material may be carried in the extended TLV field.

[0020] In one implementation, the security of the first PSK key material is particularly important, as it is used to obtain the second PSK. Once the first PSK key material is cracked, the risk of cracking the second PSK increases. To avoid this, in one example, the first PSK key material can be encrypted using the first key, and the encrypted first PSK key material can be carried in the first protocol message.

[0021] In one implementation, to ensure the security of the first PSK key material, the first protocol message may further include first integrity verification information, which is used to perform integrity verification on the first protocol message. In this case, the first integrity verification information can be used to preliminarily determine the security of the first PSK key material. Using this first integrity verification information, it can be determined whether the first protocol message has been erroneously transmitted or tampered with during transmission. If the first protocol message has been erroneously transmitted or tampered with during transmission, the security of the first PSK key material in the first protocol message cannot be ensured.

[0022] In one implementation, when the first protocol message includes first integrity verification information, after the first communication device receives the first protocol message, it can first perform integrity verification on the first protocol message based on the first integrity verification information. If the first protocol message passes the integrity verification, it can obtain the first PSK key material in the first protocol message and perform integrity verification on the first protocol message based on the first integrity verification information.

[0023] In one implementation, the first protocol message may include an identifier of a first key used to encrypt the first PSK key material. In this case, the first communication device may parse the first protocol message to obtain the identifier of the first key. The first communication device may then obtain the first key based on the identifier of the first key, decrypt the encrypted first PSK key material in the first protocol message using the first key, and obtain the second PSK based on the decrypted first PSK key material. In one example, the first communication device may store a correspondence between the identifier of the first key and the first key. After obtaining the identifier of the first key, the first communication device may use this correspondence to obtain the first key.

[0024] In one implementation, when a first protocol message includes first integrity verification information, the first integrity verification information may be calculated by a second communication device using a second key. In one example, the first protocol message may include an identifier of the second key, where the identifier of the second key is used to identify the second key. In this case, when the first communication device uses the first integrity verification information to perform integrity verification on the first protocol message, it may obtain the second key based on the identifier of the second key, and then perform integrity verification on the first protocol message using the second key and the first integrity verification information. In one example, the first integrity verification information may be carried in the ICV field of the first protocol message. The first communication device may use the second key to calculate other fields of the first protocol message, excluding the ICV field, to obtain third integrity verification information, and then perform matching verification on the third integrity verification information and the first integrity verification information. In one example, when the third integrity verification information is equal to the first integrity verification information, it may be determined that the first protocol message has passed integrity verification; when the third integrity verification information is not equal to the first integrity verification information, it may be determined that the first protocol message has failed integrity verification.

[0025] In one implementation, before receiving the first protocol message, the first communication device may also send a second protocol message to the second communication device. The second protocol message may carry an identifier of a third key, where the identifier of the third key is used to identify a third key, and the third key is used to derive the first key. Through the second protocol message, the first communication device and the second communication device can complete negotiation of the third key, thereby determining the first key used to encrypt the first PSK key material in the first protocol message. The second protocol message mentioned here may also be an EAP-PSK-based message. In one example, if the second protocol message includes an identifier of the third key, the first protocol message may not include an identifier of the first key.

[0026] In one implementation, before receiving the first protocol message, the first communication device may also send a second protocol message to the second communication device. The second protocol message carries an identifier of a third key. The identifier of the third key is used to identify the third key. The third key is used to derive a second key. The second key is used to calculate the first integrity verification information. Through the second protocol message, the first communication device and the second communication device can complete the negotiation of the third key, thereby determining the second key used in calculating the first integrity verification information. The second protocol message mentioned here may also be an EAP-PSK-based message. The second key mentioned here and the first key mentioned above may be the same key or different keys, and this is not specifically limited in the embodiments of the present application. In one example, if the second protocol message includes an identifier of the third key, the first protocol message may not include an identifier of the second key.

[0027] In one implementation, the third key may be a first PSK. The first communication device and the second communication device may each locally store the first PSK. The second communication device may use the first PSK to derive the first key and the second key, encrypt the first PSK keying material using the first key, and calculate the first integrity verification information using the second key. The first communication device may use the first PSK to derive the first key and the second key, decrypt the encrypted first PSK keying material in the first protocol message using the first key, and perform integrity verification on the first protocol message using the second key.

[0028] In one implementation, before sending the second protocol message to the second communication device, the first communication device may also receive a third protocol message from the second communication device, requesting identity authentication for the second communication device. In this case, the second protocol message may indicate to the first communication device that it agrees to identity authentication. This allows negotiation of the third key to be completed during the initial authentication interaction phase, eliminating the need for additional signaling interaction procedures and reducing signaling interactions between the first and second communication devices. The third protocol message mentioned herein may also be an EAP-PSK-based message.

[0029] In one implementation, the third protocol message may carry an identifier of the third key. Because the third protocol message includes the identifier of the third key, after receiving the third protocol message, the first communication device sends a second protocol message to the second communication device, where the second protocol message also includes the identifier of the third key. Through the third protocol message and the second protocol message, the first communication device and the second communication device complete the negotiation of the third key and the interaction in the initial stage of identity authentication.

[0030] In one implementation, after the first and second communication devices complete the exchange of third and second protocol messages, they can enter the identity authentication process. In this case, the first protocol message may include, in addition to the first PSK key material, first identity authentication information, which is used to authenticate the second communication device. In this manner, the first communication device can obtain the first PSK key material while authenticating the second communication device.

[0031] In one implementation, the security of the first identity authentication information is particularly important, given that the first identity authentication information can be used to determine the identity of the second communication device. Therefore, in one example, the first identity authentication information can be encrypted using a first key. In other words, the first protocol message can include the first identity authentication information encrypted using the first key.

[0032] In one implementation, the first identity authentication information may be obtained by the second communication device calculating a target field using a fourth key, wherein the target field may include part or all of the fields of the third protocol message and / or part or all of the fields of the second protocol message.

[0033] In one implementation, after receiving the first protocol message, the first communication device can use the first identity authentication information in the first protocol message to authenticate the second communication device. In one example, after determining that the second communication device has passed identity authentication, the first communication device can then perform the step of obtaining the second PSK based on the first PSK key material. Because the security of the PSK is particularly important, the first communication device cannot update the PSK with an untrusted second communication device.

[0034] In one implementation, the first communication device uses the first identity authentication information to authenticate the second communication device. In a specific implementation, for example, the fourth key can be used to calculate the aforementioned target field to obtain third identity authentication information, and the third identity authentication information is then matched and verified with the first identity authentication information carried in the first protocol message. In one example, if the first and third identity authentication information are the same, it can be determined that the second communication device has passed identity authentication; if the first and third identity authentication information are different, it can be determined that the second communication device has failed identity authentication. It is understood that if the target field includes some or all fields in the third protocol message, the second communication device uses some or all fields in the third protocol message sent by the second communication device when calculating the first identity authentication information, while the first communication device uses some or all fields in the received third protocol message when calculating the third identity authentication information. This approach can also verify the third protocol message to a certain extent to verify whether the third protocol message has been tampered with during transmission. Similarly, if the target field includes some or all fields in the second protocol message, the second communication device uses some or all fields in the second protocol message received by the second communication device when calculating the first identity authentication information, and the first communication device uses some or all fields in the second protocol message sent by the first communication device when calculating the third identity authentication information. This approach can also verify the second protocol message to a certain extent, to verify whether the second protocol message has been tampered with during transmission.

[0035] In one implementation, if the first identity authentication information in the first protocol message is information encrypted using the first key, the first communication device uses the fourth key to calculate the target field to obtain the third identity authentication information. In a specific implementation, the target field can be first calculated using the fourth key to obtain a first calculation result, and then the first calculation result can be encrypted using the first key to obtain the third identity authentication information.

[0036] In one implementation, the aforementioned fourth key can be derived from the third key.

[0037] In one implementation, the fourth key can be derived from a third PSK stored in the first and second communication devices. In this case, the first and second keys are derived using a third key (e.g., the first PSK), and the fourth key is derived using the third PSK. With this approach, an untrusted third-party communication device can only forge first protocol messages if both the first and third PSKs are cracked, thereby enhancing the security of the first protocol messages.

[0038] In one implementation, when the fourth key is derived from the third PSK, the second protocol message may carry an identifier of the third PSK, which is used to identify the third PSK. In this case, the first communication device and the second communication device may complete negotiation of the third PSK via the second protocol message.

[0039] In one implementation, after a first communications device obtains a second PSK based on the first PSK keying material, it may notify the second communications device of the result of processing the first PSK keying material. In one example, the first communications device may send a fourth protocol message to the second communications device, the fourth protocol message carrying first indication information indicating that the first communications device has stored the second PSK. The fourth protocol message may be an EAP-PSK-based message. The fact that the first communications device has stored the second PSK indicates that the first communications device has successfully locally updated the PSK.

[0040] In one implementation, the first communication device may extend the EAP-PSK-based message and carry the first indication information in an extended TLV field.

[0041] In one implementation, the fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message. Thus, after receiving the fourth protocol message, the second communication device can use the second integrity verification information to determine whether the fourth protocol message has been erroneously transmitted or tampered with.

[0042] In one implementation, the fourth protocol message may include, in addition to the first indication information, second identity authentication information used to authenticate the first communication device. In this way, using the third and fourth protocol messages, bidirectional identity authentication and PSK update are accomplished between the first and second communication devices.

[0043] In one implementation, similar to the way in which the second communication device processes the first identity authentication information, the first communication device may also encrypt the second identity authentication information using the first key in the fourth protocol message.

[0044] In one implementation, the second identity authentication information is calculated based on a fourth key based on one or more of the following: some or all fields in the second protocol message, and some or all fields in the third protocol message. As described above with respect to the first identity authentication, when the second identity authentication information is calculated based on some or all fields in the second protocol message, it is possible to verify whether the second protocol message has been tampered with during transmission. When the second identity authentication information is calculated based on some or all fields in the third protocol message, it is possible to verify whether the third protocol message has been tampered with during transmission.

[0045] In one implementation, after the first communication device sends the fourth protocol message to the second communication device, the second communication device may use the second identity authentication information to authenticate the first communication device and confirm the first indication information in the fourth protocol message. The second communication device may then send a fifth protocol message to the first communication device, carrying the identity authentication result and the PSK update result. The fifth protocol message may be an EAP-PSK-based message.

[0046] In one implementation, if the identity authentication result in the fifth protocol message indicates an authentication failure, then the first communication device has failed identity authentication. In other words, the second communication device deems the first communication device untrustworthy. At this point, the first and second communication devices cannot update the PSK. Therefore, the first communication device may delete the second PSK. If the PSK update result in the fifth protocol message indicates a PSK update failure, the first communication device may delete the second PSK. There are various reasons for a PSK update failure, such as the second communication device failing to locally update the PSK, or the second communication device determining that the first indication information failed verification during verification of the first indication information.

[0047] In one implementation, after receiving the fifth protocol message, the first communication device may send a sixth protocol message to the second communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message. The sixth protocol message may be an EAP-PSK-based message.

[0048] In one implementation, the fifth protocol message may also include an ICV field. In this case, after receiving the fifth protocol message, the first communication device may perform integrity verification on the fifth protocol message to determine whether the fifth protocol message has been erroneously transmitted or tampered with.

[0049] In one implementation, the first communication device stores a first data key, and the first protocol message also includes data key material. The data key material is used to generate a second data key. The first data key is used to process data messages exchanged between the first and second communication devices within the aging period of the first data key, and the second data key is used to process data messages exchanged between the first and second communication devices within the aging period of the second data key. In this case, the first communication device can obtain the second data key based on the data key material. In this case, the first communication device can use the first protocol message to update both the PSK and the data key.

[0050] In one implementation, the second data key includes: an integrity calculation key and / or an encryption key, the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

[0051] In one implementation, the first communication device stores a first authentication key, and the first protocol message includes authentication key material. The authentication key material is used to generate a second authentication key. The first authentication key is used to process identity authentication messages exchanged between the first and second communication devices within the aging period of the first authentication key, and the second authentication key is used to process identity authentication messages exchanged between the first and second communication devices within the aging period of the second authentication key. In this case, the first communication device can obtain the second authentication key based on the authentication key material. In this case, the first communication device can use the first protocol message to update the PSK and the authentication key.

[0052] In one implementation, the second authentication key and the first authentication key may each include any one or more of the following: an integrity calculation key, an encryption key, a key derivation key, and an identity authentication key. The integrity calculation key is used to perform integrity calculation on the identity authentication message, the encryption key is used to encrypt the identity authentication message, the key derivation key is used to derive other keys, and the identity authentication key is used to calculate the identity authentication information in the authentication message. Among them, the integrity calculation key in the first authentication key may be the second key mentioned above, the encryption key in the first authentication key may be the first key mentioned above, and the identity authentication key in the first authentication key may be the fourth key mentioned above. The second identity authentication may be performed on the authentication message exchanged between the first communication device and the second communication device when the first communication device and the second communication device perform identity authentication next time. In one example, the first identity authentication key may be updated when the first communication device and the second communication device previously performed identity authentication.

[0053] In one implementation, in an embodiment of the present application, a first communication device and a second communication device can use four EAP-PSK-based messages, namely, a first protocol message, a second protocol message, a third protocol message, and a fourth protocol message, to complete a PSK update. The CAK identifier can be obtained based on the content included in the four protocol messages. In one example, the CAK identifier can be calculated based on a first random number generated by the first communication device, a second random number generated by the second communication device, and a session identifier of the first protocol message. The first random number can be carried in the second protocol message, and the second random number can be carried in the third protocol message.

[0054] In one implementation, the first protocol message includes: an Extensible Authentication Protocol (EAP) header, an EAP extension header, and a keyword field.

[0055] In one implementation, the first PSK key material is carried in the keyword field.

[0056] In one implementation, the keyword field includes any one or more of the following fields: a protocol version number field, a session identification field, a key identification field, an encrypted data field, a random number field, an identity identification field, and an integrity verification field.

[0057] In one implementation, the keyword field includes the encrypted data field, and the first PSK key material is carried in the encrypted data field.

[0058] In one implementation, before receiving the first protocol message, the first communications device may send second indication information to the second communications device, where the second indication information is used to indicate that the first communications device has the capability to automatically update the PSK. After the second communications device determines, based on the second indication information, that the first communications device has the capability to automatically update the PSK, it may send the first PSK key material to the first communications device by including it in the first protocol message.

[0059] In one implementation, the first protocol message is a message based on the Internet Key Exchange protocol IKE.

[0060] In one implementation, when the first protocol message is an IKE-based message, the first PSK key material is carried in a payload field of the first protocol message.

[0061] In one implementation, when the first protocol message is an IKE-based message, the first PSK key material is carried in a notification payload field of the first protocol message.

[0062] In one implementation, when the first protocol message is an IKE-based message, the first PSK key material is carried in an extended TLV field of the first protocol message.

[0063] In one implementation, when the first protocol message is an IKE-based message, the first communications device may further send third indication information to the second communications device, where the third indication information is used to indicate that the first communications device has the capability to automatically update the PSK. After the second communications device determines, based on the third indication information, that the first communications device has the capability to automatically update the PSK, it may carry the first PSK key material in the first protocol message and send it to the first communications device.

[0064] In one implementation, the third indication information is carried in a notification payload field of a message based on the IKE protocol.

[0065] In one implementation, the third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

[0066] In one implementation, after the first communication device obtains the second PSK based on the first PSK key material, it can inform the second communication device of the processing result of the first PSK key material. In one example, the first communication device can send a seventh protocol message to the second communication device, and the seventh protocol message is used to indicate that the first communication device has saved the second PSK.

[0067] In one implementation, the seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second PSK.

[0068] In one implementation, the seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

[0069] In one implementation, the first protocol message is an authentication exchange AUTH exchange message.

[0070] In one implementation, the first protocol message is a Create Child Security Association Exchange (CREATE_CHILD_SAexchange) message.

[0071] In one implementation, the first protocol message is an INFORMATIONAL exchange message.

[0072] In one implementation, the first protocol message is a message based on the Media Access Control Security Key Protocol (MKA).

[0073] In one implementation, when the first protocol message is an MKA-based message, the first PSK key material is carried in an extended parameter set parameter set field of the first protocol message.

[0074] In one implementation, when the first protocol message is an MKA-based message, the first communications device may further send fifth indication information to the second communications device, where the fifth indication information is used to indicate that the first communications device has the capability to automatically update the PSK. After the second communications device determines, based on the fifth indication information, that the first communications device has the capability to automatically update the PSK, it may carry the first PSK key material in the first protocol message and send it to the first communications device.

[0075] In one implementation, the fifth indication information is carried in a parameter set field of an MKA-based message.

[0076] In one implementation, the MKA-based message may include a parameter set type field, and the fifth indication information may be carried in the parameter set type field of the MKA-based message.

[0077] In one implementation, after the first communication device obtains the second PSK based on the first PSK key material, it can inform the second communication device of the processing result of the first PSK key material. In one example, the first communication device can send an eighth protocol message to the second communication device, and the eighth protocol message is used to indicate that the first communication device has saved the second PSK.

[0078] In one implementation, the eighth protocol message includes sixth indication information, and the sixth indication information is used to indicate that the first communication device has saved the second PSK.

[0079] In one implementation, the eighth protocol message is an MKA-based message, and the sixth indication information is carried in a parameter set type field of the MKA-based message.

[0080] In one implementation, the first communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0081] In one implementation, the second communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0082] In one implementation, both the first communication device and the second communication device are T-BOXs.

[0083] In a second aspect, embodiments of the present application provide a method for MACSec communication based on PSK, which can be performed by a second communication device. In one example, the second communication device can obtain first PSK key material, which is used to generate a second PSK. After obtaining the first PSK key material, the second communication device can generate a first protocol message based on the first PSK key material, the first protocol message including the first PSK key material. After generating the first protocol message, the second communication device can send the first protocol message to the first communication device, so that the first communication device can generate an updated second PSK based on the first PSK key material. In this way, the first communication device can derive a second MACSec key based on the second PSK within the aging period of the second PSK. Thus, using the solution of embodiments of the present application, the first communication device can update the PSK based on the first PSK key material. Therefore, the PSK stored in the first communication device is no longer static, thereby reducing the possibility of the PSK in the first communication device being cracked. This correspondingly reduces the risk of the second MACSec key derived from the PSK being cracked, thereby reducing security risks.

[0084] In one implementation, the second communication device may also store the first PSK key material. In this case, the second communication device can obtain the stored first PSK key material before the aging period of the second PSK begins, and derive the second PSK based on the first PSK key material. In this way, the second communication device can use the second PSK to process messages exchanged between the first and second communication devices during the aging period of the second PSK.

[0085] In one implementation, the method further includes: receiving a third PSK key material sent by the first communication device; and obtaining the second PSK according to the third PSK key material.

[0086] In one implementation, the method further includes: obtaining the second PSK based on the first PSK key material.

[0087] In one implementation, obtaining the second PSK according to the first PSK key material includes: determining the first PSK key material as the second PSK.

[0088] In one implementation, obtaining the second PSK according to the first PSK key material includes: obtaining the second PSK according to the first PSK key material and a first key derivation algorithm.

[0089] In one implementation, obtaining the second PSK based on the first PSK key material and the first key derivation algorithm includes: calculating the first PSK key material using a first algorithm to obtain an intermediate value; and generating the second PSK based on the intermediate value and the first key derivation algorithm.

[0090] In one implementation, the method further includes: saving the second PSK to a non-volatile storage area of ​​the second communication device.

[0091] In one implementation, the first PSK key material includes a random number.

[0092] In one implementation, the first protocol message is a PSK-based Extended Authentication Protocol EAP-PSK message.

[0093] In one implementation, the first protocol message includes an extended type-length-value TLV field, and the extended TLV field includes the first PSK key material.

[0094] In one implementation, in the first protocol message, the first PSK key material is encrypted using a first key.

[0095] In one implementation, the first protocol message further includes first integrity verification information, and the first integrity verification information is used to perform integrity verification on the first protocol message.

[0096] In one implementation, the first protocol message carries an identifier of the first key.

[0097] In one implementation, the first protocol message includes an identifier of a second key, where the identifier of the second key is used to identify the second key, and the second key is used to calculate the first integrity verification information.

[0098] In one implementation, before sending the first protocol message to the first communication device, the method also includes: receiving a second protocol message sent by the first communication device, the second protocol message carrying an identifier of a third key, the identifier of the third key being used to identify a third key, and the third key being used to derive the first key.

[0099] In one implementation, before sending the first protocol message to the first communication device, the method further includes:

[0100] Receive a second protocol message sent by the first communication device, where the second protocol message carries an identifier of a third key, where the identifier of the third key is used to identify the third key, where the third key is used to derive a second key, and where the second key is used to calculate the first integrity verification information.

[0101] In one implementation, the third key includes the first PSK.

[0102] In one implementation, after receiving the second protocol message sent by the first communication device, the method further includes: sending a third protocol message to the first communication device, where the third protocol message is used to request identity authentication of the second communication device.

[0103] In one implementation, the third protocol message carries an identifier of the third key.

[0104] In one implementation, the first protocol message includes first identity authentication information, and the first identity authentication information is used to authenticate the second communication device.

[0105] In one implementation, in the first protocol message, the first identity authentication information is encrypted using the first key.

[0106] In one implementation, the first identity authentication information is calculated based on a fourth key and one or more of the following: part or all of the fields of the third protocol message, and part or all of the fields of the second protocol message.

[0107] In one implementation, the fourth key is derived from the third key.

[0108] In one implementation, the fourth key is derived from the third PSK stored in the first communication device and the second communication device.

[0109] In one implementation, the second protocol message carries an identifier of the third PSK, and the identifier of the third PSK is used to identify the third PSK.

[0110] In one implementation, the method further includes: receiving a fourth protocol message sent by the first communication device, where the fourth protocol message carries first indication information, and the first indication information is used to indicate that the first communication device has saved the second PSK.

[0111] In one implementation, the fourth protocol message includes an extended TLV field, and the extended TLV field includes the first indication information.

[0112] In one implementation, the fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message.

[0113] In one implementation, the fourth protocol message includes second identity authentication information, and the second identity authentication information is used to authenticate the first communication device.

[0114] In one implementation, in the fourth protocol message, the second identity authentication information is encrypted using the first key.

[0115] In one implementation, the second identity authentication information is calculated based on a fourth key using one or more of the following: some or all fields in the second protocol message, and some or all fields in the third protocol message.

[0116] In one implementation, the method further includes: performing identity authentication on the first communication device using the second identity authentication information.

[0117] In one implementation, the use of the second identity authentication information to authenticate the first communication device includes: using the fourth key to calculate the target field to obtain fourth identity authentication information; matching and verifying the fourth identity authentication information and the second identity authentication information carried in the fourth protocol message; wherein the target field includes one or more of the following: part or all of the fields of the third protocol message, part or all of the fields of the second protocol message.

[0118] In one implementation, the using the fourth key to calculate the target field to obtain the fourth identity authentication information includes: using the fourth key to calculate the target field to obtain a second calculation result; and using the first key to encrypt the second calculation result to obtain the fourth identity authentication information.

[0119] In one implementation, the method further includes: sending a fifth protocol message to the first communication device, wherein the fifth protocol message carries an identity authentication result and a PSK update result.

[0120] In one implementation, the method further includes: receiving a sixth protocol message sent by the first communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message.

[0121] In one implementation, the second communication device stores a first data key, and the first protocol message also includes data key material, the data key material is used to instruct the first communication device to generate an updated second data key, the second communication device processes the data messages exchanged between the first communication device and the second communication device based on the first data key within the aging period of the first data key, and the second communication device processes the data messages exchanged between the first communication device and the second communication device based on the second data key within the aging period of the second data key.

[0122] In one implementation, the method further includes: obtaining the second data key based on the data key material.

[0123] In one implementation, the second data key includes: an integrity calculation key and / or an encryption key, the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

[0124] In one implementation, the second communication device stores a first authentication key, and the first protocol message also includes authentication key material, the authentication key material is used to instruct the first communication device to generate an updated second authentication key, the second communication device processes the identity authentication message exchanged between the first communication device and the second communication device based on the first authentication key within the aging period of the first authentication key, and the second communication device processes the identity authentication message exchanged between the first communication device and the second communication device based on the second authentication key within the aging period of the second authentication key.

[0125] In one implementation, the method further includes: obtaining the second authentication key based on the authentication key material.

[0126] In one implementation, the second authentication key includes any one or more of the following:

[0127] An integrity calculation key, an encryption key, a key derivation key, and an identity authentication key. The integrity calculation key is used to perform integrity calculation on the identity authentication message, the encryption key is used to encrypt the identity authentication message, the key derivation key is used to derive other keys, and the identity authentication key is used to calculate the identity authentication information in the authentication message.

[0128] In one implementation, the method further includes: deriving a second Media Access Control Security (MACSec) key using the second PSK within an aging period of the second PSK.

[0129] In one implementation, the deriving the second MACSec key by using the second PSK includes: generating a master session key MSK according to the second PSK; deriving a secure connection association key CAK by using the MSK; and deriving the second MACSec key by using the CAK.

[0130] In one implementation, the deriving the second MACSec key by using the second PSK includes: using the second PSK as a CAK to derive the second MACSec key.

[0131] In one implementation, the deriving the second MACSec key by using the CAK includes: determining the CAK according to an identifier of the CAK; and deriving the second MACSec key by using the CAK.

[0132] In one implementation, the CAK identifier is generated according to any one or more of the following parameters: a first random number generated by the first communication device, a second random number generated by the second communication device, and a session identifier of the first protocol message.

[0133] In one implementation, the first protocol message includes: an Extensible Authentication Protocol (EAP) header, an EAP extension header, and a keyword field.

[0134] In one implementation, the first PSK key material is carried in the keyword field.

[0135] In one implementation, the keyword field includes any one or more of the following fields: a protocol version number field, a session identification field, a key identification field, an encrypted data field, a random number field, an identity identification field, and an integrity verification field.

[0136] In one implementation, the first PSK key material is carried in the encrypted data field.

[0137] In one implementation, the method further includes: receiving second indication information sent by the first communication device, where the second indication information is used to indicate that the first communication device has the capability of automatically updating the PSK.

[0138] In one implementation, the first protocol message is a message based on the Internet Key Exchange protocol IKE.

[0139] In one implementation, the first PSK key material is carried in a payload field of the first protocol message.

[0140] In one implementation, the first PSK key material is carried in a notification payload field of the first protocol message.

[0141] In one implementation, the first PSK key material is carried in an extended TLV field of the first protocol message.

[0142] In one implementation, the method further includes: receiving third indication information sent by the first communication device, where the third indication information is used to indicate that the first communication device has the capability of automatically updating the PSK.

[0143] In one implementation, the third indication information is carried in a notification payload field of a message based on the IKE protocol.

[0144] In one implementation, the third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

[0145] In one implementation, the method further includes: receiving a seventh protocol message sent by the first communication device, where the seventh protocol message is used to indicate that the first communication device has saved the second PSK.

[0146] In one implementation, the seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second PSK.

[0147] In one implementation, the seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

[0148] In one implementation, the first protocol message is an authentication exchange AUTH exchange message.

[0149] In one implementation, the first protocol message is a Create Child Security Association Exchange (CREATE_CHILD_SAexchange) message.

[0150] In one implementation, the first protocol message is an INFORMATIONAL exchange message.

[0151] In one implementation, the first protocol message is a message based on the Media Access Control Security Key Protocol (MKA).

[0152] In one implementation, the first PSK key material is carried in an extended parameter set parameter set field of the first protocol message.

[0153] In one implementation, the method further includes: receiving fifth indication information sent by the first communication device, where the fifth indication information is used to indicate that the first communication device has the capability of automatically updating the PSK.

[0154] In one implementation, the fifth indication information is carried in a parameter set field of an MKA-based message.

[0155] In an implementation manner, the fifth indication information is carried in a parameter set type field of the MKA-based message, and the parameter set field includes a parameter set type field.

[0156] In one implementation, the method further includes: receiving an eighth protocol message sent by the first communication device, where the eighth protocol message is used to indicate that the first communication device has saved the second PSK.

[0157] In one implementation, the eighth protocol message includes sixth indication information, and the sixth indication information is used to indicate that the first communication device has saved the second PSK.

[0158] In one implementation, the eighth protocol message is an MKA-based message, and the sixth indication information is carried in a parameter set type field of the MKA-based message.

[0159] In one implementation, the method further includes: deriving a first MACSec key using the first PSK within an aging period of the first PSK.

[0160] In one implementation, the first communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0161] In one implementation, the second communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0162] In one implementation, both the first communication device and the second communication device are T-BOXs.

[0163] In a third aspect, an embodiment of the present application provides a method for updating a data key, which can be performed by a first communication device. In one example, a first data key is stored in the first communication device, and the first data key is used to process data packets exchanged between the first communication device and the second communication device within the aging period of the first data key. The first communication device and the second communication device can both process data packets exchanged between the first communication device and the second communication device based on the first data key within the aging period of the first data key. In this application, the first communication device can receive a first protocol message sent by the second communication device within the aging period of the first data key, the first protocol message not being an MKA-based message, the first protocol message including first data key material, the first data key material being used to generate a second data key. The second data key is used to process data packets exchanged between the first communication device and the second communication device within the aging period of the second data key. The first communication device and the second communication device can both process data packets exchanged between the first communication device and the second communication device based on the second data key within the aging period of the second data key. Thus, using the solution of the embodiment of the present application, the first communication device can update the data key based on the first data key material. Therefore, the data key stored in the first communication device is no longer immutable, thereby reducing the possibility of the data key in the first communication device being cracked, and correspondingly, avoiding the security risks caused by the cracking of the data key. Moreover, because the first protocol message is not an MKA-based message, when using this solution, communication device 1 and communication device 2 interact using a non-MKA protocol, data key updates can also be achieved.

[0164] In one implementation, after obtaining the second data key from the first data key material, the first communication device may store the second data key in a non-volatile storage area of ​​the first communication device to prevent loss of the second data key in the event of a sudden failure or power outage of the first communication device. When the aging period of the second data key begins, the first communication device may read the second data key from the non-volatile storage area and use the second data key to process data messages exchanged between the first and second communication devices.

[0165] In one implementation, when the first communication device and the second communication device communicate via an Ethernet port, data keys can be updated using MKA or Extensible Authentication Protocol (EAP) based on a pre-shared key (PSK), i.e., EAP-PSK. In the present application, the first communication device and the second communication device communicate via a non-Ethernet port. Thus, using this solution, data keys can be updated even when the first communication device and the second communication device communicate via a non-Ethernet port.

[0166] In one implementation, if a first communication device and a second communication device communicate via an Ethernet port, and both the first communication device and the second communication device use an asymmetric key algorithm, the first communication device and the second communication device can use the Internet Key Exchange (IKE) protocol to update a data key. In one example of the present application, the first communication device and the second communication device communicate via an Ethernet port, and neither the first communication device nor the second communication device uses an asymmetric key algorithm. Thus, using this solution, even when the first communication device and the second communication device communicate via an Ethernet port, and at least one of the first communication device and the second communication device does not use an asymmetric key algorithm, the first communication device and the second communication device can still use the IKE protocol to update a data key.

[0167] In one implementation, the second data key may include: an integrity calculation key, and / or an encryption key, wherein the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

[0168] In one implementation, when the first communication device is capable of using an asymmetric key algorithm, the first communication device may derive the second data key based on the first data key material and the second data key material of the first communication device. For example, the first data key material may be a public value of the second communication device, and the second data key material may be a private value of the first communication device. The first communication device may utilize the asymmetric key algorithm to calculate the second data key based on the public value of the second communication device and the private value of the first communication device.

[0169] In one implementation, if the first communication device derives the second data key from the aforementioned first and second data key materials, the second communication device may also utilize an asymmetric key algorithm to obtain the second data key. In this case, the first communication device may transmit third data key material to the second communication device, allowing the second communication device to calculate the second data key based on the third data key material. For example, the third data key material may be the public value of the first communication device, and the second communication device may utilize the public value of the first communication device and the private value of the second communication device to calculate the second data key.

[0170] In one implementation, the second communication device can pre-acquire the second data key and send the second data key to the first communication device by including it in the aforementioned first protocol message. In this case, the first data key material included in the first protocol message received by the first communication device is the second data key. Therefore, in one example, after receiving the first protocol message, the first communication device can parse the first protocol message, obtain the first data key material included in the first protocol message, and determine the first data key material as the second data key.

[0171] In one implementation, the first communication device may derive the second data key from the first data key material. This may be accomplished, for example, by using the first data key material and a first key derivation algorithm. The first key derivation algorithm mentioned herein may be, for example, a KDF or a PRF. For details on KDF and PRF, please refer to the relevant descriptions in IEEE 802.1x-2010 and are not repeated here.

[0172] In one implementation, the first communication device obtains the second data key based on the first data key material and the first key derivation algorithm. In a specific implementation, for example, the first data key material can be first processed by the first algorithm to obtain an intermediate value, and then the intermediate value and the first key derivation algorithm can be used to obtain the second data key. The embodiment of the present application does not specifically limit the first algorithm. The first algorithm can be a key derivation algorithm or other algorithms. In this way, the second data key can only be cracked when the first algorithm, the first data key material and the first key derivation algorithm are all cracked, thereby reducing the risk of the second data key being cracked and further improving the security of the second data key.

[0173] In one implementation, the aforementioned first data key material can be a random number. The second communication device can generate a random number and send this random number as the first data key material in a first protocol message to the first communication device. Using a random number as the first data key material is less likely to be cracked than using a method where the second communication device generates the first data key material using a specific pattern. Therefore, using a random number as the first data key material can reduce the likelihood of the first data key material being cracked, and accordingly reduce the likelihood of the second data key being cracked.

[0174] In one implementation, the first data key material may include: a random number used to generate the integrity calculation key, and / or a random number used to generate the encryption key.

[0175] In one implementation, when the first protocol message is an EAP-PSK-based message, the first protocol message may include an extended TLV field, and the aforementioned first data key material may be carried in the extended TLV field.

[0176] In one implementation, the security of the first data key material is particularly important, as it is used to obtain the second data key. Once the first data key material is cracked, the risk of cracking the second data key increases. To avoid this problem, in one example, the first data key material can be encrypted using the first key, and the encrypted first data key material can be carried in the first protocol message.

[0177] In one implementation, in order to ensure the security of the first data key material, the first protocol message may further include first integrity verification information, which is used to perform integrity verification on the first protocol message. In this case, the first integrity verification information may be used to preliminarily determine the security of the first data key material. The first integrity verification information may be used to determine whether the first protocol message has been erroneously transmitted or tampered with during transmission. If the first protocol message has been erroneously transmitted or tampered with during transmission, the security of the first data key material in the first protocol message cannot be ensured.

[0178] In one implementation, when the first protocol message includes first integrity verification information, after the first communication device receives the first protocol message, it can first perform integrity verification on the first protocol message based on the first integrity verification information. If the first protocol message passes the integrity verification, it can then obtain the first data key material in the first protocol message and perform integrity verification on the first protocol message based on the first integrity verification information.

[0179] In one implementation, the first protocol message may include an identifier of a first key used to encrypt the first data key material. In this case, the first communication device may parse the first protocol message to obtain the identifier of the first key. The first communication device may then obtain the first key based on the identifier of the first key, decrypt the encrypted first data key material in the first protocol message using the first key, and obtain the second data key based on the decrypted first data key material. In one example, the first communication device may store a correspondence between the identifier of the first key and the first key. After obtaining the identifier of the first key, the first communication device may use this correspondence to obtain the first key.

[0180] In one implementation, when a first protocol message includes first integrity verification information, the first integrity verification information may be calculated by a second communication device using a second key. In one example, the first protocol message may include an identifier of the second key, where the identifier of the second key is used to identify the second key. In this case, when the first communication device uses the first integrity verification information to perform integrity verification on the first protocol message, it may obtain the second key based on the identifier of the second key, and then perform integrity verification on the first protocol message using the second key and the first integrity verification information. In one example, the first integrity verification information may be carried in the ICV field of the first protocol message. The first communication device may use the second key to calculate other fields of the first protocol message, excluding the ICV field, to obtain third integrity verification information, and then perform matching verification on the third integrity verification information and the first integrity verification information. In one example, when the third integrity verification information is equal to the first integrity verification information, it may be determined that the first protocol message has passed integrity verification; when the third integrity verification information is not equal to the first integrity verification information, it may be determined that the first protocol message has failed integrity verification.

[0181] In one implementation, before receiving the first protocol message, the first communication device may also send a second protocol message to the second communication device. The second protocol message may carry an identifier for a third key, which is used to identify a third key used to derive the first key. Through the second protocol message, the first and second communication devices can negotiate the third key, thereby determining the first key used to encrypt the first data key material in the first protocol message. The second protocol message mentioned here may also be an EAP-PSK-based message.

[0182] In one implementation, before receiving the first protocol message, the first communication device may further send a second protocol message to the second communication device. The second protocol message carries an identifier of a third key. The identifier of the third key is used to identify the third key, which is used to derive a second key. The second key is used to calculate the first integrity verification information. Through the second protocol message, the first and second communication devices can complete negotiation of the third key, thereby determining the second key used in calculating the first integrity verification information. The second protocol message mentioned here may also be an EAP-PSK-based message.

[0183] In one implementation, the third key may be a first PSK. The first communication device and the second communication device may each locally store the first PSK. The second communication device may use the first PSK to derive the first key and the second key, encrypt the first data key material using the first key, and calculate the first integrity verification information using the second key. The first communication device may use the first PSK to derive the first key and the second key, decrypt the encrypted first data key material in the first protocol message using the first key, and perform integrity verification on the first protocol message using the second key.

[0184] In one implementation, before sending the second protocol message to the second communication device, the first communication device may also receive a third protocol message from the second communication device, requesting identity authentication for the second communication device. In this case, the second protocol message may indicate to the first communication device that it agrees to identity authentication. This allows negotiation of the third key to be completed during the initial authentication interaction phase, eliminating the need for additional signaling interaction procedures and reducing signaling interactions between the first and second communication devices. The third protocol message mentioned herein may also be an EAP-PSK-based message.

[0185] In one implementation, the third protocol message may carry an identifier of the third key. Because the third protocol message includes the identifier of the third key, after receiving the third protocol message, the first communication device sends a second protocol message to the second communication device, where the second protocol message also includes the identifier of the third key. Through the third protocol message and the second protocol message, the first communication device and the second communication device complete the negotiation of the third key and the interaction in the initial stage of identity authentication.

[0186] In one implementation, after the first and second communication devices complete the exchange of third and second protocol messages, they can enter the identity authentication process. In this case, the first protocol message may include, in addition to the first data key material, first identity authentication information, which is used to authenticate the second communication device. In this manner, the first communication device can obtain the first data key material while authenticating the second communication device.

[0187] In one implementation, the security of the first identity authentication information is particularly important, given that the first identity authentication information can be used to determine the identity of the second communication device. Therefore, in one example, the first identity authentication information can be encrypted using a first key. In other words, the first protocol message can include the first identity authentication information encrypted using the first key.

[0188] In one implementation, the first identity authentication information may be obtained by the second communication device calculating a target field using a fourth key, wherein the target field may include part or all of the fields of the third protocol message and / or part or all of the fields of the second protocol message.

[0189] In one implementation, after receiving the first protocol message, the first communication device can use the first identity authentication information in the first protocol message to authenticate the second communication device. In one example, after determining that the second communication device has passed identity authentication, the first communication device can then perform the step of obtaining the second data key based on the first data key material. Because the security of the data key is particularly important, the first communication device cannot update the data key with an untrusted second communication device.

[0190] In one implementation, the first communication device uses the first identity authentication information to authenticate the second communication device. In a specific implementation, for example, the fourth key can be used to calculate the aforementioned target field to obtain third identity authentication information, and the third identity authentication information is then matched and verified with the first identity authentication information carried in the first protocol message. In one example, if the first and third identity authentication information are the same, it can be determined that the second communication device has passed identity authentication; if the first and third identity authentication information are different, it can be determined that the second communication device has failed identity authentication. It is understood that if the target field includes some or all fields in the third protocol message, the second communication device uses some or all fields in the third protocol message sent by the second communication device when calculating the first identity authentication information, while the first communication device uses some or all fields in the received third protocol message when calculating the third identity authentication information. This approach can also verify the third protocol message to a certain extent to verify whether the third protocol message has been tampered with during transmission. Similarly, if the target field includes some or all fields in the second protocol message, the second communication device uses some or all fields in the second protocol message received by the second communication device when calculating the first identity authentication information, and the first communication device uses some or all fields in the second protocol message sent by the first communication device when calculating the third identity authentication information. This approach can also verify the second protocol message to a certain extent, to verify whether the second protocol message has been tampered with during transmission.

[0191] In one implementation, if the first identity authentication information in the first protocol message is information encrypted using the first key, the first communication device uses the fourth key to calculate the target field to obtain the third identity authentication information. In a specific implementation, the target field can be first calculated using the fourth key to obtain a first calculation result, and then the first calculation result can be encrypted using the first key to obtain the third identity authentication information.

[0192] In one implementation, the aforementioned fourth key can be derived from the third key.

[0193] In one implementation, the fourth key can be derived from a third PSK stored in the first and second communication devices. In this case, the first and second keys are derived using a third key (e.g., the first PSK), and the fourth key is derived using the third PSK. With this approach, an untrusted third-party communication device can only forge first protocol messages if both the first and third PSKs are cracked, thereby enhancing the security of the first protocol messages.

[0194] In one implementation, when the fourth key is derived from the third PSK, the second protocol message may carry an identifier of the third PSK, which is used to identify the third PSK. In this case, the first communication device and the second communication device may complete negotiation of the third PSK via the second protocol message.

[0195] In one implementation, after the first communication device obtains the second data key based on the first data key material, it may notify the second communication device of the result of processing the first data key material. In one example, the first communication device may send a fourth protocol message to the second communication device, wherein the fourth protocol message carries first indication information, and the first indication information is used to indicate that the first communication device has stored the second data key. The fourth protocol message may be an EAP-PSK-based message.

[0196] In one implementation, the first communication device may extend the EAP-PSK-based message and carry the first indication information in an extended TLV field.

[0197] In one implementation, the fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message. Thus, after receiving the fourth protocol message, the second communication device can use the second integrity verification information to determine whether the fourth protocol message has been erroneously transmitted or tampered with.

[0198] In one implementation, the fourth protocol message may include, in addition to the aforementioned first indication information, second identity authentication information, used to authenticate the first communication device. In this way, using the third and fourth protocol messages, bidirectional identity authentication and data key update are accomplished between the first and second communication devices.

[0199] In one implementation, similar to the way in which the second communication device processes the first identity authentication information, the first communication device may also encrypt the second identity authentication information using the first key in the fourth protocol message.

[0200] In one implementation, the second identity authentication information is calculated based on a fourth key based on one or more of the following: some or all fields in the second protocol message, and some or all fields in the third protocol message. As described above with respect to the first identity authentication, when the second identity authentication information is calculated based on some or all fields in the second protocol message, it is possible to verify whether the second protocol message has been tampered with during transmission. When the second identity authentication information is calculated based on some or all fields in the third protocol message, it is possible to verify whether the third protocol message has been tampered with during transmission.

[0201] In one implementation, after the first communication device sends the fourth protocol message to the second communication device, the second communication device may use the second identity authentication information to authenticate the first communication device and confirm the first indication information in the fourth protocol message. The second communication device may then send a fifth protocol message to the first communication device, the fifth protocol message carrying the identity authentication result and the data key update result. The fifth protocol message may be an EAP-PSK-based message.

[0202] In one implementation, if the identity authentication result in the fifth protocol message indicates that the identity authentication failed, it means that the first communication device failed the identity authentication. In other words, the second communication device believes that the first communication device is untrustworthy. At this time, the first communication device and the second communication device cannot update the data key. Therefore, the first communication device can delete the second data key. If the data key update result in the fifth protocol message indicates that the data key update failed, the first communication device can delete the second data key. There are various reasons for the failure of the data key update, such as the second communication device failing to locally update the data key, or the second communication device determining that the first indication information failed to pass verification when verifying the first indication information.

[0203] In one implementation, after receiving the fifth protocol message, the first communication device may send a sixth protocol message to the second communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message. The sixth protocol message may be an EAP-PSK-based message.

[0204] In one implementation, the fifth protocol message may also include an ICV field. In this case, after receiving the fifth protocol message, the first communication device may perform integrity verification on the fifth protocol message to determine whether the fifth protocol message has been erroneously transmitted or tampered with.

[0205] In one implementation, the first communication device stores a first PSK, and the first protocol message also includes PSK key material. The PSK key material is used to generate an updated second PSK. During the aging period of the first PSK, the first communication device processes messages exchanged between the first and second communication devices based on the first PSK. During the aging period of the second PSK, the first communication device processes messages exchanged between the first and second communication devices based on the second PSK. In this case, the first communication device can also obtain the second PSK based on the PSK key material. In this case, the first communication device can use the first protocol message to update the PSK and the data key.

[0206] In one implementation, the first communication device stores a first authentication key, and the first protocol message includes authentication key material. The authentication key material is used to generate an updated second authentication key. The first communication device processes identity authentication messages exchanged between the first and second communication devices based on the first authentication key within the aging period of the first authentication key. The first communication device processes identity authentication messages exchanged between the first and second communication devices based on the second authentication key within the aging period of the second authentication key. In this case, the first communication device can obtain the second authentication key based on the authentication key material. In this case, the first communication device can use the first protocol message to update both the data key and the authentication key.

[0207] In one implementation, the second authentication key includes any one or more of the following: an integrity calculation key, an encryption key, a key derivation key, and an identity authentication key. The integrity calculation key is used to perform integrity calculation on the identity authentication message, the encryption key is used to encrypt the identity authentication message, the key derivation key is used to derive other keys, and the identity authentication key is used to calculate the identity authentication information in the authentication message.

[0208] In one implementation, the first protocol message includes: an Extensible Authentication Protocol (EAP) header, an EAP extension header, and a keyword field.

[0209] In one implementation, the first data key material is carried in the keyword field.

[0210] In one implementation, the keyword field includes any one or more of the following fields: a protocol version number field, a session identification field, a key identification field, an encrypted data field, a random number field, an identity identification field, and an integrity verification field.

[0211] In one implementation, the first data key material is carried in the encrypted data field.

[0212] In one implementation, before receiving the first protocol message, the first communication device may send second indication information to the second communication device, where the second indication information is used to indicate that the first communication device has the capability to automatically update the data key. After the second communication device determines, based on the second indication information, that the first communication device has the capability to automatically update the data key, it may send the first data key material to the first communication device by including it in the first protocol message.

[0213] In one implementation, the first protocol message is a message based on the Internet Key Exchange protocol IKE.

[0214] In one implementation, when the first protocol message is an IKE-based message, the first data key material is carried in a payload field of the first protocol message.

[0215] In one implementation, when the first protocol message is an IKE-based message, the first data key material is carried in a notification payload field of the first protocol message.

[0216] In one implementation, when the first protocol message is an IKE-based message, the first data key material is carried in an extended TLV field of the first protocol message.

[0217] In one implementation, when the first protocol message is an IKE-based message, the first communications device may further send third indication information to the second communications device, where the third indication information is used to indicate that the first communications device has the capability to automatically update the data key. After the second communications device determines, based on the third indication information, that the first communications device has the capability to automatically update the data key, it may carry the first data key material in the first protocol message and send it to the first communications device.

[0218] In one implementation, the third indication information is carried in a notification payload field of a message based on the IKE protocol.

[0219] In one implementation, the third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

[0220] In one implementation, after the first communication device obtains the second data key based on the first data key material, it can inform the second communication device of the processing result of the first data key material. In one example, the first communication device can send a seventh protocol message to the second communication device, and the seventh protocol message is used to indicate that the first communication device has saved the second data key.

[0221] In one implementation, the seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second data key.

[0222] In one implementation, the seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

[0223] In one implementation, the first protocol message is an authentication exchange AUTH exchange message.

[0224] In one implementation, the first protocol message is a Create Child Security Association Exchange (CREATE_CHILD_SAexchange) message.

[0225] In one implementation, the first protocol message is an INFORMATIONAL exchange message.

[0226] In one implementation, the first communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0227] In one implementation, the second communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0228] In one implementation, both the first communication device and the second communication device are T-BOXs.

[0229] In a fourth aspect, an embodiment of the present application provides a method for updating a data key, which can be performed by a second communication device. In one example, the second communication device can obtain a first data key material, which is used to generate a second data key. After the second communication device obtains the first data key material, it can generate a first protocol message based on the first data key material, and the first protocol message includes the first data key material. Wherein, the first protocol message is not an MKA-based message. After the second communication device generates the first protocol message, it can send the first protocol message to the first communication device so that the first communication device can generate an updated second data key based on the first data key material. It can be seen that using the solution of the embodiment of the present application, the first communication device can update the data key based on the first data key material. Therefore, the data key stored in the first communication device is no longer immutable, thereby reducing the possibility of the data key in the first communication device being cracked, and accordingly, avoiding the security risks caused by the cracking of the data key.

[0230] In one implementation, the second communication device may also store the first data key material. In this case, the second communication device can obtain the stored first data key material before the aging period of the second data key begins, and derive the second data key based on the first data key material. In this way, the second communication device can use the second data key to process data messages exchanged between the first and second communication devices during the aging period of the second data key.

[0231] In one implementation, the method further includes: receiving a third data key material sent by the first communication device; and obtaining the second data key based on the third data key material.

[0232] In one implementation, the method further includes: obtaining the second data key based on the first data key material.

[0233] In one implementation, obtaining the second data key based on the first data key material includes: determining the first data key material as the second data key.

[0234] In one implementation, obtaining the second data key according to the first data key material includes:

[0235] The second data key is obtained according to the first data key material and a first key derivation algorithm.

[0236] In one implementation, obtaining the second data key based on the first data key material and the first key derivation algorithm includes: calculating the first data key material using a first algorithm to obtain an intermediate value; and generating the second data key based on the intermediate value and the first key derivation algorithm.

[0237] In one implementation, the method further includes: saving the second data key.

[0238] In one implementation, the first communication device and the second communication device communicate with each other based on a non-Ethernet port.

[0239] In one implementation, the first communication device and the second communication device communicate with each other based on an Ethernet port, and the first communication device or the second communication device does not use an asymmetric algorithm.

[0240] In one implementation, the second data key includes: an integrity calculation key and / or an encryption key, the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

[0241] In one implementation, the first data key material includes a random number.

[0242] In one implementation, the first data key material includes: a random number used to generate the integrity calculation key, and / or a random number used to generate the encryption key.

[0243] In one implementation, the first protocol message is a PSK-based Extended Authentication Protocol EAP-PSK message.

[0244] In one implementation, the first protocol message includes an extended type-length-value TLV field, and the extended TLV field includes the first data key material.

[0245] In one implementation, in the first protocol message, the first data key material is encrypted using a first key.

[0246] In one implementation, the first protocol message further includes first integrity verification information, and the first integrity verification information is used to perform integrity verification on the first protocol message.

[0247] In one implementation, the first protocol message carries an identifier of the first key.

[0248] In one implementation, the first protocol message includes an identifier of a second key, where the identifier of the second key is used to identify the second key, and the second key is used to calculate the first integrity verification information.

[0249] In one implementation, before sending the first protocol message to the first communication device, the method also includes: receiving a second protocol message sent by the first communication device, the second protocol message carrying an identifier of a third key, the identifier of the third key being used to identify a third key, and the third key being used to derive the first key.

[0250] In one implementation, before sending the first protocol message to the first communication device, the method also includes: receiving a second protocol message sent by the first communication device, the second protocol message carrying an identifier of a third key, the identifier of the third key being used to identify the third key, the third key being used to derive a second key, and the second key being used to calculate the first integrity verification information.

[0251] In one implementation, the third key includes a first PSK stored in the first communication device and the second communication device.

[0252] In one implementation, after receiving the second protocol message sent by the first communication device, the method further includes: sending a third protocol message to the first communication device, where the third protocol message is used to request identity authentication of the second communication device.

[0253] In one implementation, the third protocol message carries an identifier of the third key.

[0254] In one implementation, the first protocol message includes first identity authentication information, and the first identity authentication information is used to authenticate the second communication device.

[0255] In one implementation, in the first protocol message, the first identity authentication information is encrypted using the first key.

[0256] In one implementation, the first identity authentication information is calculated based on a fourth key and one or more of the following: part or all of the fields of the third protocol message, and part or all of the fields of the second protocol message.

[0257] In one implementation, the fourth key is derived from the third key.

[0258] In one implementation, the fourth key is derived from the third PSK stored in the first communication device and the second communication device.

[0259] In one implementation, the second protocol message carries an identifier of the third PSK, and the identifier of the third PSK is used to identify the third PSK.

[0260] In one implementation, the method further includes: receiving a fourth protocol message sent by the first communication device, the fourth protocol message carrying first indication information, and the first indication information is used to indicate that the first communication device has saved the second data key.

[0261] In one implementation, the fourth protocol message includes an extended TLV field, and the extended TLV field includes the first indication information.

[0262] In one implementation, the fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message.

[0263] In one implementation, the fourth protocol message includes second identity authentication information, and the second identity authentication information is used to authenticate the first communication device.

[0264] In one implementation, in the fourth protocol message, the second identity authentication information is encrypted using the first key.

[0265] In one implementation, the second identity authentication information is calculated based on a fourth key using one or more of the following: some or all fields in the second protocol message, and some or all fields in the third protocol message.

[0266] In one implementation, the method further includes: performing identity authentication on the first communication device using the second identity authentication information.

[0267] In one implementation, the use of the second identity authentication information to authenticate the first communication device includes: using the fourth key to calculate the target field to obtain fourth identity authentication information; matching and verifying the fourth identity authentication information and the second identity authentication information carried in the fourth protocol message; wherein the target field includes one or more of the following: part or all of the fields of the third protocol message, part or all of the fields of the second protocol message.

[0268] In one implementation, the using the fourth key to calculate the target field to obtain the fourth identity authentication information includes: using the fourth key to calculate the target field to obtain a second calculation result; and using the first key to encrypt the second calculation result to obtain the fourth identity authentication information.

[0269] In one implementation, the method further includes: sending a fifth protocol message to the first communication device, wherein the fifth protocol message carries an identity authentication result and a data key update result.

[0270] In one implementation, the method further includes: receiving a sixth protocol message sent by the first communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message.

[0271] In one implementation, the second communication device stores a first PSK, and the first protocol message also includes PSK key material, the PSK key material is used to instruct the first communication device to generate an updated second PSK, the second communication device processes the messages exchanged between the first communication device and the second communication device based on the first PSK within the aging period of the first PSK, and the second communication device processes the messages exchanged between the first communication device and the second communication device based on the second PSK within the aging period of the second PSK.

[0272] In one implementation, the method further includes: obtaining the second PSK based on the PSK key material.

[0273] In one implementation, the second communication device stores a first authentication key, and the first protocol message also includes authentication key material, the authentication key material is used to instruct the first communication device to generate an updated second authentication key, the second communication device processes the identity authentication message exchanged between the first communication device and the second communication device based on the first authentication key within the aging period of the first authentication key, and the second communication device processes the identity authentication message exchanged between the first communication device and the second communication device based on the second authentication key within the aging period of the second authentication key.

[0274] In one implementation, the method further includes: obtaining the second authentication key based on the authentication key material.

[0275] In one implementation, the second authentication key includes any one or more of the following:

[0276] An integrity calculation key, an encryption key, a key derivation key, and an identity authentication key. The integrity calculation key is used to perform integrity calculation on the identity authentication message, the encryption key is used to encrypt the identity authentication message, the key derivation key is used to derive other keys, and the identity authentication key is used to calculate the identity authentication information in the authentication message.

[0277] In one implementation, the first protocol message includes: an Extensible Authentication Protocol (EAP) header, an EAP extension header, and a keyword field.

[0278] In one implementation, the first data key material is carried in the keyword field.

[0279] In one implementation, the keyword field includes any one or more of the following fields: a protocol version number field, a session identification field, a key identification field, an encrypted data field, a random number field, an identity identification field, and an integrity verification field.

[0280] In one implementation, the first data key material is carried in the encrypted data field.

[0281] In one implementation, the method further includes: receiving second indication information sent by the first communication device, where the second indication information is used to indicate that the first communication device has the ability to automatically update the data key.

[0282] In one implementation, the first protocol message is a message based on the Internet Key Exchange protocol IKE.

[0283] In one implementation, the first data key material is carried in a payload field of the first protocol message.

[0284] In one implementation, the first data key material is carried in a notification payload field of the first protocol message.

[0285] In one implementation, the first data key material is carried in an extended TLV field of the first protocol message.

[0286] In one implementation, the method further includes: receiving third indication information sent by the first communication device, where the third indication information is used to indicate that the first communication device has the ability to automatically update the data key.

[0287] In one implementation, the third indication information is carried in a notification payload field of a message based on the IKE protocol.

[0288] In one implementation, the third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

[0289] In one implementation, the method further includes: receiving a seventh protocol message sent by the first communication device, where the seventh protocol message is used to indicate that the first communication device has saved the second data key.

[0290] In one implementation, the seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second data key.

[0291] In one implementation, the seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

[0292] In one implementation, the first protocol message is an authentication exchange AUTH exchange message.

[0293] In one implementation, the first protocol message is a Create Child Security Association Exchange (CREATE_CHILD_SAexchange) message.

[0294] In one implementation, the first protocol message is an INFORMATIONAL exchange message.

[0295] In one implementation, the first communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0296] In one implementation, the second communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0297] In one implementation, both the first communication device and the second communication device are T-BOXs.

[0298] In a fifth aspect, an embodiment of the present application provides a method for updating an authentication key, which can be performed by a first communication device. In one example, a first authentication key is stored in the first communication device, and the first authentication key is used to process authentication messages exchanged between the first communication device and a second communication device within an aging period of the first authentication key. Both the first communication device and the second communication device can process authentication messages exchanged between the first communication device and the second communication device based on the first authentication key within the aging period of the first authentication key. In the present application, the first communication device and the second communication device communicate using a non-Ethernet port, and / or the first communication device or the second communication device does not use an asymmetric key algorithm. The first communication device can receive a first protocol message sent by the second communication device within the aging period of the first authentication key, the first protocol message including first authentication key material, the first authentication key material being used to generate a second authentication key. The second authentication key is used to process authentication messages exchanged between the first communication device and the second communication device within the aging period of the second authentication key. Both the first communication device and the second communication device can process authentication messages exchanged between the first communication device and the second communication device based on the second authentication key within the aging period of the second authentication key. Thus, using the solution of the embodiments of the present application, the first communication device can update the authentication key based on the first authentication key material. Therefore, the authentication key stored in the first communication device is no longer static, thereby reducing the possibility of the authentication key in the first communication device being cracked, and correspondingly, avoiding the security risks caused by the cracking of the authentication key. In addition, using this solution, the authentication key can be updated even when the first communication device and the second communication device communicate using a non-Ethernet port. In some embodiments, considering that the first communication device and the second communication device communicate based on an Ethernet port and both use an asymmetric key algorithm, the first communication device and the second communication device can use the IKE protocol to update the authentication key. In one example of the present application, the first communication device or the second communication device does not use an asymmetric key algorithm. In this way, using this solution, the authentication key can be updated between the first communication device and the second communication device using the IKE protocol even when at least one of the first communication device and the second communication device does not use an asymmetric key algorithm.

[0299] In one implementation, after obtaining a second authentication key based on the first authentication key material, the first communications device may store the second authentication key. When the aging period of the second authentication key begins, the first communications device may read the second authentication key and use the second authentication key to process messages exchanged between the first communications device and the second communications device.

[0300] In one implementation, the first protocol message includes first indication information, where the first indication information is used to instruct the first communication device to derive the second authentication key using a symmetric key algorithm. After receiving the first protocol message, the first communication device may obtain the first indication information and, based on the first indication information, determine to derive the second authentication key using the symmetric key algorithm.

[0301] In one implementation, the second authentication key includes any one or more of the following: an integrity calculation key, an encryption key, a key derivation key, and an identity authentication key. The integrity calculation key is used to perform integrity calculation on the identity authentication message, the encryption key is used to encrypt the identity authentication message, the key derivation key is used to derive other keys, and the identity authentication key is used to calculate the identity authentication information in the authentication message.

[0302] In one implementation, when the first communication device is capable of using an asymmetric key algorithm, the first communication device may derive the second authentication key based on the first authentication key material and the second authentication key material of the first communication device. For example, the first authentication key material may be a public value of the second communication device, and the second authentication key material may be a private value of the first communication device. The first communication device may utilize the asymmetric key algorithm to calculate the second authentication key based on the public value of the second communication device and the private value of the first communication device.

[0303] In one implementation, if the first communication device obtains the second authentication key based on the first and second authentication key materials, the second communication device may also obtain the second authentication key using an asymmetric key algorithm. In this case, the first communication device may send the third authentication key material to the second communication device, so that the second communication device can calculate the second authentication key based on the third authentication key material. For example, the third authentication key material may be the public value of the first communication device, and the second communication device may calculate the second authentication key using the public value of the first communication device and the private value of the second communication device.

[0304] In one implementation, the second communication device may pre-acquire a second authentication key and send the second authentication key to the first communication device by including it in the aforementioned first protocol message. In this case, the first authentication key material included in the first protocol message received by the first communication device is the second authentication key. Therefore, in one example, after receiving the first protocol message, the first communication device may parse the first protocol message, obtain the first authentication key material included in the first protocol message, and determine the first authentication key material as the second authentication key.

[0305] In one implementation, the first communications device may derive the second authentication key from the first authentication key material. This may be accomplished, for example, by using the first authentication key material and a first key derivation algorithm. The first key derivation algorithm mentioned herein may be, for example, a KDF or a PRF. For details on KDF and PRF, please refer to the relevant descriptions in IEEE 802.1x-2010 and are not repeated here.

[0306] In one implementation, the first communication device obtains the second authentication key based on the first authentication key material and the first key derivation algorithm. In a specific implementation, for example, the first authentication key material can be first processed using the first algorithm to obtain an intermediate value, and then the second authentication key can be obtained using the intermediate value and the first key derivation algorithm. The embodiment of the present application does not specifically limit the first algorithm. The first algorithm can be a key derivation algorithm or other algorithms. In this way, the second authentication key can only be cracked if the first algorithm, the first authentication key material, and the first key derivation algorithm are all cracked, thereby reducing the risk of the second authentication key being cracked and further improving the security of the second authentication key.

[0307] In one implementation, the aforementioned first authentication key material may be a random number. The second communication device may generate a random number and transmit this random number as the first authentication key material within a first protocol message to the first communication device. Using a random number as the first authentication key material reduces the likelihood of the random number being cracked compared to using a specific pattern to generate the first authentication key material by the second communication device. Therefore, using a random number as the first authentication key material can reduce the likelihood of the first authentication key material being cracked, and accordingly reduces the likelihood of the second authentication key being cracked.

[0308] In one implementation, the first authentication key material includes any one or more of the following: a random number used to generate the integrity calculation key, a random number used to generate the encryption key, a random number used to generate the key derivation key, and a random number used to generate the identity authentication key.

[0309] In one implementation, the identity authentication key and the integrity calculation key may be the same. In this case, if the second authentication key includes both the identity authentication key and the integrity calculation key, and the first authentication key material is a random number, then one less random number may be carried in the first protocol message.

[0310] In one implementation, the first protocol message is an EAP-PSK-based Extended Authentication Protocol (EAP-PSK) message. In this case, the second communication device may reconstruct the message structure of the EAP-PSK-based message and send the reconstructed EAP-PSK-based message carrying the first PSK key material to the first communication device.

[0311] In one implementation, when the first protocol message is an EAP-PSK-based message, the first protocol message may include an extended TLV field, and the aforementioned first PSK key material may be carried in the extended TLV field.

[0312] In one implementation, the security of the first authentication key material is particularly important, as it is used to obtain the second authentication key. Once the first authentication key material is compromised, the risk of the second authentication key being compromised increases. To avoid this issue, in one example, the first authentication key material can be encrypted using the first key, and the encrypted first authentication key material can be carried in the first protocol message.

[0313] In one implementation, to ensure the security of the first authentication key material, the first protocol message may further include first integrity verification information, which is used to perform integrity verification on the first protocol message. In this case, the first integrity verification information can be used to preliminarily determine the security of the first authentication key material. This first integrity verification information can be used to determine whether the first protocol message was sent with errors or tampered with during transmission. If the first protocol message was sent with errors or tampered with during transmission, the security of the first authentication key material in the first protocol message cannot be ensured.

[0314] In one implementation, when the first protocol message includes first integrity verification information, after the first communication device receives the first protocol message, it can first perform integrity verification on the first protocol message based on the first integrity verification information. If the first protocol message passes the integrity verification, it can obtain the first authentication key material in the first protocol message and perform integrity verification on the first protocol message based on the first integrity verification information.

[0315] In one implementation, the first protocol message may include an identifier of a first key used to encrypt the first authentication key material. In this case, the first communication device may parse the first protocol message to obtain the identifier of the first key. The first communication device may then obtain the first key based on the identifier of the first key, decrypt the encrypted first authentication key material in the first protocol message using the first key, and obtain the second authentication key based on the decrypted first authentication key material. In one example, the first communication device may store a correspondence between the identifier of the first key and the first key. After obtaining the identifier of the first key, the first communication device may use this correspondence to obtain the first key.

[0316] In one implementation, when a first protocol message includes first integrity verification information, the first integrity verification information may be calculated by a second communication device using a second key. In one example, the first protocol message may include an identifier of the second key, where the identifier of the second key is used to identify the second key. In this case, when the first communication device uses the first integrity verification information to perform integrity verification on the first protocol message, it may obtain the second key based on the identifier of the second key, and then perform integrity verification on the first protocol message using the second key and the first integrity verification information. In one example, the first integrity verification information may be carried in the ICV field of the first protocol message. The first communication device may use the second key to calculate other fields of the first protocol message, excluding the ICV field, to obtain third integrity verification information, and then perform matching verification on the third integrity verification information and the first integrity verification information. In one example, when the third integrity verification information is equal to the first integrity verification information, it may be determined that the first protocol message has passed integrity verification; when the third integrity verification information is not equal to the first integrity verification information, it may be determined that the first protocol message has failed integrity verification.

[0317] In one implementation, before receiving the first protocol message, the first communication device may also send a second protocol message to the second communication device. The second protocol message may carry an identifier of a third key, which is used to identify a third key used to derive the first key. Through the second protocol message, the first and second communication devices can negotiate the third key, thereby determining the first key used to encrypt the first authentication key material in the first protocol message. The second protocol message mentioned here may also be an EAP-PSK-based message.

[0318] In one implementation, before receiving the first protocol message, the first communication device may further send a second protocol message to the second communication device. The second protocol message carries an identifier of a third key. The identifier of the third key is used to identify the third key, which is used to derive a second key. The second key is used to calculate the first integrity verification information. Through the second protocol message, the first and second communication devices can complete negotiation of the third key, thereby determining the second key used in calculating the first integrity verification information. The second protocol message mentioned here may also be an EAP-PSK-based message.

[0319] In one implementation, the third key may be a first PSK. The first communication device and the second communication device may each locally store the first PSK. The second communication device may use the first PSK to derive the first key and the second key, encrypt the first authentication key material using the first key, and calculate the first integrity verification information using the second key. The first communication device may use the first PSK to derive the first key and the second key, decrypt the encrypted first authentication key material in the first protocol message using the first key, and perform integrity verification on the first protocol message using the second key.

[0320] In one implementation, before sending the second protocol message to the second communication device, the first communication device may also receive a third protocol message from the second communication device, requesting identity authentication for the second communication device. In this case, the second protocol message may indicate to the first communication device that it agrees to identity authentication. This allows negotiation of the third key to be completed during the initial authentication interaction phase, eliminating the need for additional signaling interaction procedures and reducing signaling interactions between the first and second communication devices. The third protocol message mentioned herein may also be an EAP-PSK-based message.

[0321] In one implementation, the third protocol message may carry an identifier of the third key. Because the third protocol message includes the identifier of the third key, after receiving the third protocol message, the first communication device sends a second protocol message to the second communication device, where the second protocol message also includes the identifier of the third key. Through the third protocol message and the second protocol message, the first communication device and the second communication device complete the negotiation of the third key and the interaction in the initial stage of identity authentication.

[0322] In one implementation, after the first and second communication devices complete the exchange of third and second protocol messages, they can enter the identity authentication process. In this case, the first protocol message may include, in addition to the first authentication key material, first identity authentication information, which is used to authenticate the second communication device. In this manner, the first communication device can obtain the first authentication key material while simultaneously authenticating the second communication device.

[0323] In one implementation, the security of the first identity authentication information is particularly important, given that the first identity authentication information can be used to determine the identity of the second communication device. Therefore, in one example, the first identity authentication information can be encrypted using a first key. In other words, the first protocol message can include the first identity authentication information encrypted using the first key.

[0324] In one implementation, the first identity authentication information may be obtained by the second communication device calculating a target field using a fourth key, wherein the target field may include part or all of the fields of the third protocol message and / or part or all of the fields of the second protocol message.

[0325] In one implementation, after receiving the first protocol message, the first communication device can use the first identity authentication information in the first protocol message to authenticate the second communication device. In one example, after determining that the second communication device has passed identity authentication, the first communication device can then perform the step of obtaining a second authentication key based on the first authentication key material. Because the security of the authentication key is particularly important, the first communication device cannot update the authentication key with an untrusted second communication device.

[0326] In one implementation, the first communication device uses the first identity authentication information to authenticate the second communication device. In a specific implementation, for example, the fourth key can be used to calculate the aforementioned target field to obtain third identity authentication information, and the third identity authentication information is then matched and verified with the first identity authentication information carried in the first protocol message. In one example, if the first and third identity authentication information are the same, it can be determined that the second communication device has passed identity authentication; if the first and third identity authentication information are different, it can be determined that the second communication device has failed identity authentication. It is understood that if the target field includes some or all fields in the third protocol message, the second communication device uses some or all fields in the third protocol message sent by the second communication device when calculating the first identity authentication information, while the first communication device uses some or all fields in the received third protocol message when calculating the third identity authentication information. This approach can also verify the third protocol message to a certain extent to verify whether the third protocol message has been tampered with during transmission. Similarly, if the target field includes some or all fields in the second protocol message, the second communication device uses some or all fields in the second protocol message received by the second communication device when calculating the first identity authentication information, and the first communication device uses some or all fields in the second protocol message sent by the first communication device when calculating the third identity authentication information. This approach can also verify the second protocol message to a certain extent, to verify whether the second protocol message has been tampered with during transmission.

[0327] In one implementation, if the first identity authentication information in the first protocol message is information encrypted using the first key, the first communication device uses the fourth key to calculate the target field to obtain the third identity authentication information. In a specific implementation, the target field can be first calculated using the fourth key to obtain a first calculation result, and then the first calculation result can be encrypted using the first key to obtain the third identity authentication information.

[0328] In one implementation, the aforementioned fourth key can be derived from the third key.

[0329] In one implementation, the fourth key can be derived from a third PSK stored in the first and second communication devices. In this case, the first and second keys are derived using a third key (e.g., the first PSK), and the fourth key is derived using the third PSK. With this approach, an untrusted third-party communication device can only forge first protocol messages if both the first and third PSKs are cracked, thereby enhancing the security of the first protocol messages.

[0330] In one implementation, when the fourth key is derived from the third PSK, the second protocol message may carry an identifier of the third PSK, which is used to identify the third PSK. In this case, the first communication device and the second communication device may complete negotiation of the third PSK via the second protocol message.

[0331] In one implementation, after obtaining the second authentication key based on the first authentication key material, the first communications device may notify the second communications device of the result of processing the first authentication key material. In one example, the first communications device may send a fourth protocol message to the second communications device, where the fourth protocol message carries second indication information, where the second indication information is used to indicate that the first communications device has stored the second authentication key. The fourth protocol message may be an EAP-PSK-based message.

[0332] In one implementation, the first communication device may extend the EAP-PSK-based message and carry the second indication information in an extended TLV field.

[0333] In one implementation, the fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message. Thus, after receiving the fourth protocol message, the second communication device can use the second integrity verification information to determine whether the fourth protocol message has been erroneously transmitted or tampered with.

[0334] In one implementation, the fourth protocol message may include, in addition to the first indication information, second identity authentication information, used to authenticate the first communication device. In this manner, using the third and fourth protocol messages, bidirectional identity authentication and authentication key update are accomplished between the first and second communication devices.

[0335] In one implementation, similar to the way in which the second communication device processes the first identity authentication information, the first communication device may also encrypt the second identity authentication information using the first key in the fourth protocol message.

[0336] In one implementation, the second identity authentication information is calculated based on a fourth key based on one or more of the following: some or all fields in the second protocol message, and some or all fields in the third protocol message. As described above with respect to the first identity authentication, when the second identity authentication information is calculated based on some or all fields in the second protocol message, it is possible to verify whether the second protocol message has been tampered with during transmission. When the second identity authentication information is calculated based on some or all fields in the third protocol message, it is possible to verify whether the third protocol message has been tampered with during transmission.

[0337] In one implementation, after the first communication device sends the fourth protocol message to the second communication device, the second communication device may use the second identity authentication information to authenticate the first communication device and confirm the first indication information in the fourth protocol message. The second communication device may then send a fifth protocol message to the first communication device, the fifth protocol message carrying the identity authentication result and the authentication key update result. The fifth protocol message may be an EAP-PSK-based message.

[0338] In one implementation, if the identity authentication result in the fifth protocol message indicates that the identity authentication failed, it means that the first communication device has not passed the identity authentication. In other words, the second communication device believes that the first communication device is untrustworthy. At this time, the first communication device and the second communication device cannot update the authentication key. Therefore, the first communication device can delete the second authentication key. If the authentication key update result in the fifth protocol message indicates that the authentication key update failed, the first communication device can delete the second authentication key. There are many reasons for the failure of the authentication key update, such as the failure of the second communication device to locally update the authentication key, or the second communication device determining that the first indication information has failed to pass the verification when verifying the first indication information.

[0339] In one implementation, after receiving the fifth protocol message, the first communication device may send a sixth protocol message to the second communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message. The sixth protocol message may be an EAP-PSK-based message.

[0340] In one implementation, the fifth protocol message may also include an ICV field. In this case, after receiving the fifth protocol message, the first communication device may perform integrity verification on the fifth protocol message to determine whether the fifth protocol message has been erroneously transmitted or tampered with.

[0341] In one implementation, the first communication device stores a first PSK, and the first protocol message includes PSK key material. The PSK key material is used to generate an updated second PSK. During the aging period of the first PSK, the first communication device processes messages exchanged between the first and second communication devices based on the first PSK. During the aging period of the second PSK, the first communication device processes messages exchanged between the first and second communication devices based on the second PSK. In this case, the first communication device can also obtain the second PSK based on the PSK key material. In this case, the first communication device can use the first protocol message to update the PSK and the data key.

[0342] In one implementation, the first communication device stores a first data key, and the first protocol message also includes data key material. The data key material is used to generate an updated second data key. During the aging period of the first data key, the first communication device processes data messages exchanged between the first and second communication devices based on the first data key. During the aging period of the second data key, the first communication device processes data messages exchanged between the first and second communication devices based on the second data key. In this case, the first communication device can obtain the second data key based on the data key material. In this case, the first communication device can use the first protocol message to update the authentication key and the data key.

[0343] In one implementation, the second data key includes: an integrity calculation key and / or an encryption key, the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

[0344] In one implementation, the first protocol message includes: an EAP header, an EAP extension header, and a keyword field.

[0345] In one implementation, the first authentication key material is carried in the keyword field.

[0346] In one implementation, the keyword field includes any one or more of the following fields: a protocol version number field, a session identification field, a key identification field, an encrypted data field, a random number field, an identity identification field, and an integrity verification field.

[0347] In one implementation, the first authentication key material is carried in the encrypted data field.

[0348] In one implementation, before receiving the first protocol message, the first communications device may send third indication information to the second communications device, where the third indication information is used to indicate that the first communications device has the capability to automatically update the authentication key. After the second communications device determines, based on the third indication information, that the first communications device has the capability to automatically update the authentication key, it may send the first authentication key material to the first communications device by including it in the first protocol message.

[0349] In one implementation, the first protocol message is a message based on the Internet Key Exchange protocol IKE.

[0350] In one implementation, when the first protocol message is an IKE-based message, the first authentication key material is carried in a payload field of the first protocol message.

[0351] In one implementation, when the first protocol message is an IKE-based message, the first authentication key material is carried in a notification payload field of the first protocol message.

[0352] In one implementation, when the first protocol message is an IKE-based message, the first authentication key material is carried in an extended TLV field of the first protocol message.

[0353] In one implementation, when the first protocol message is an IKE-based message, the first communications device may further send fourth indication information to the second communications device, where the fourth indication information is used to indicate that the first communications device has the capability to automatically update the authentication key. After the second communications device determines, based on the fourth indication information, that the first communications device has the capability to automatically update the authentication key, it may carry the first authentication key material in the first protocol message and send it to the first communications device.

[0354] In one implementation, the fourth indication information is carried in a notification payload field of a message based on the IKE protocol.

[0355] In one implementation, the fourth indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

[0356] In one implementation, after the first communication device obtains the second authentication key based on the first authentication key material, it can inform the second communication device of the processing result of the first authentication key material. In one example, the first communication device can send a seventh protocol message to the second communication device, and the seventh protocol message is used to indicate that the first communication device has saved the second authentication key.

[0357] In one implementation, the seventh protocol message includes fifth indication information, where the fifth indication information is used to indicate that the first communication device has saved the second authentication key.

[0358] In one implementation, the seventh protocol message is a message based on the IKE protocol, and the fifth indication information is carried in a notification message type field of the seventh protocol message.

[0359] In one implementation, the first protocol message is an authentication exchange AUTH exchange message.

[0360] In one implementation, the first protocol message is a Create Child Security Association Exchange (CREATE_CHILD_SAexchange) message.

[0361] In one implementation, the first protocol message is an INFORMATIONAL exchange message.

[0362] In one implementation, the first communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0363] In one implementation, the second communication device is a vehicle-mounted device, for example, a communication entity in a T-BOX.

[0364] In one implementation, both the first communication device and the second communication device are T-BOXs.

[0365] In a sixth aspect, embodiments of the present application provide a method for updating an authentication key, which can be performed by a second communication device. In one example, the second communication device can obtain first authentication key material, which is used to generate a second authentication key. After obtaining the first authentication key material, the second communication device can generate a first protocol message based on the first authentication key material, where the first protocol message includes the first authentication key material. The first communication device and the second communication device communicate using a non-Ethernet port, and / or the first communication device or the second communication device does not use an asymmetric key algorithm. After generating the first protocol message, the second communication device can send the first protocol message to the first communication device, so that the first communication device can generate an updated second authentication key based on the first authentication key material. Thus, using the solution of embodiments of the present application, the first communication device can update the authentication key based on the first authentication key material. Therefore, the authentication key stored in the first communication device is no longer immutable, thereby reducing the possibility of the authentication key in the first communication device being cracked, and correspondingly, avoiding the security risks caused by the cracking of the authentication key.

[0366] In one implementation, the second communication device may also store the first authentication key material. In this case, the second communication device may obtain the stored first authentication key material before the aging period of the second authentication key begins, and derive the second authentication key based on the first authentication key material. In this way, the second communication device can use the second authentication key to process messages exchanged between the first and second communication devices during the aging period of the second authentication key.

[0367] In one implementation, the method further includes: receiving a third authentication key material sent by the first communication device; and obtaining the second authentication key according to the third authentication key material.

[0368] In one implementation, the method further includes: obtaining the second authentication key based on the first authentication key material.

[0369] In one implementation, obtaining the second authentication key according to the first authentication key material includes: determining the first authentication key material as the second authentication key.

[0370] In one implementation, obtaining the second authentication key according to the first authentication key material includes obtaining the second authentication key according to the first authentication key material and a first key derivation algorithm.

[0371] In one implementation, obtaining the second authentication key based on the first authentication key material and the first key derivation algorithm includes: calculating the first authentication key material using a first algorithm to obtain an intermediate value; and generating the second authentication key based on the intermediate value and the first key derivation algorithm.

[0372] In one implementation, the method further includes: saving the second authentication key.

[0373] In one implementation, the second authentication key includes any one or more of the following: an integrity calculation key, an encryption key, a key derivation key, and an identity authentication key. The integrity calculation key is used to perform integrity calculation on the identity authentication message, the encryption key is used to encrypt the identity authentication message, the key derivation key is used to derive other keys, and the identity authentication key is used to calculate the identity authentication information in the authentication message.

[0374] In one implementation, the first authentication key material includes a random number.

[0375] In one implementation, the first authentication key material includes any one or more of the following: a random number used to generate the integrity calculation key, a random number used to generate the encryption key, a random number used to generate the key derivation key, and a random number used to generate the identity authentication key.

[0376] In one implementation, the identity authentication key and the integrity calculation key are the same.

[0377] In one implementation, the first protocol message is a PSK-based Extended Authentication Protocol EAP-PSK message.

[0378] In one implementation, the first protocol message includes an extended type-length-value TLV field, and the extended TLV field includes the first authentication key material.

[0379] In one implementation, in the first protocol message, the first authentication key material is encrypted using a first key.

[0380] In one implementation, the first protocol message further includes first integrity verification information, and the first integrity verification information is used to perform integrity verification on the first protocol message.

[0381] In one implementation, the first protocol message carries an identifier of the first key.

[0382] In one implementation, the first protocol message includes an identifier of a second key, where the identifier of the second key is used to identify the second key, and the second key is used to calculate the first integrity verification information.

[0383] In one implementation, before sending the first protocol message to the first communication device, the method also includes: receiving a second protocol message sent by the first communication device, the second protocol message carrying an identifier of a third key, the identifier of the third key being used to identify a third key, and the third key being used to derive the first key.

[0384] In one implementation, before sending the first protocol message to the first communication device, the method also includes: receiving a second protocol message sent by the first communication device, the second protocol message carrying an identifier of a third key, the identifier of the third key being used to identify the third key, the third key being used to derive a second key, and the second key being used to calculate the first integrity verification information.

[0385] In one implementation, the third key includes a first PSK stored in the first communication device and the second communication device.

[0386] In one implementation, after receiving the second protocol message sent by the first communication device, the method further includes: sending a third protocol message to the first communication device, where the third protocol message is used to request identity authentication of the second communication device.

[0387] In one implementation, the third protocol message carries an identifier of the third key.

[0388] In one implementation, the first protocol message includes first identity authentication information, and the first identity authentication information is used to authenticate the second communication device.

[0389] In one implementation, in the first protocol message, the first identity authentication information is encrypted using the first key.

[0390] In one implementation, the first identity authentication information is calculated based on a fourth key and one or more of the following: part or all of the fields of the third protocol message, and part or all of the fields of the second protocol message.

[0391] In one implementation, the fourth key is derived from the third key.

[0392] In one implementation, the fourth key is derived from the third PSK stored in the first communication device and the second communication device.

[0393] In one implementation, the second protocol message carries an identifier of the third PSK, and the identifier of the third PSK is used to identify the third PSK.

[0394] In one implementation, the method further includes: receiving a fourth protocol message sent by the first communication device, the fourth protocol message carrying first indication information, and the first indication information is used to indicate that the first communication device has saved the second authentication key.

[0395] In one implementation, the fourth protocol message includes an extended TLV field, and the extended TLV field includes the first indication information.

[0396] In one implementation, the fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message.

[0397] In one implementation, the fourth protocol message includes second identity authentication information, and the second identity authentication information is used to authenticate the first communication device.

[0398] In one implementation, in the fourth protocol message, the second identity authentication information is encrypted using the first key.

[0399] In one implementation, the second identity authentication information is calculated based on a fourth key using one or more of the following: some or all fields in the second protocol message, and some or all fields in the third protocol message.

[0400] In one implementation, the method further includes: performing identity authentication on the first communication device using the second identity authentication information.

[0401] In one implementation, the use of the second identity authentication information to authenticate the first communication device includes: using the fourth key to calculate the target field to obtain fourth identity authentication information; matching and verifying the fourth identity authentication information and the second identity authentication information carried in the fourth protocol message; wherein the target field includes one or more of the following: part or all of the fields of the third protocol message, part or all of the fields of the second protocol message.

[0402] In one implementation, the using the fourth key to calculate the target field to obtain the fourth identity authentication information includes: using the fourth key to calculate the target field to obtain a second calculation result; and using the first key to encrypt the second calculation result to obtain the fourth identity authentication information.

[0403] In one implementation, the method further includes: sending a fifth protocol message to the first communication device, wherein the fifth protocol message carries an identity authentication result and an authentication key update result.

[0404] In one implementation, the method further includes: receiving a sixth protocol message sent by the first communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message.

[0405] In one implementation, the second communication device stores a first PSK, and the first protocol message also includes PSK key material, the PSK key material is used to instruct the first communication device to generate an updated second PSK, the second communication device processes the messages exchanged between the first communication device and the second communication device based on the first PSK within the aging period of the first PSK, and the second communication device processes the messages exchanged between the first communication device and the second communication device based on the second PSK within the aging period of the second PSK.

[0406] In one implementation, the method further includes: obtaining the second PSK based on the PSK key material.

[0407] In one implementation, the second communication device stores a first data key, and the first protocol message also includes data key material, the data key material is used to instruct the first communication device to generate an updated second data key, the second communication device processes the identity data messages exchanged between the first communication device and the second communication device based on the first data key within the aging period of the first data key, and the second communication device processes the identity data messages exchanged between the first communication device and the second communication device based on the second data key within the aging period of the second data key.

[0408] In one implementation, the method further includes: obtaining the second data key based on the data key material.

[0409] In one implementation, the second data key includes any one or more of the following: an integrity calculation key and an encryption key, the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

[0410] In one implementation, the first protocol message includes: an Extensible Authentication Protocol (EAP) header, an EAP extension header, and a keyword field.

[0411] In one implementation, the first authentication key material is carried in the keyword field.

[0412] In one implementation, the keyword field includes any one or more of the following fields: a protocol version number field, a session identification field, a key identification field, an encrypted data field, a random number field, an identity identification field, and an integrity verification field.

[0413] In one implementation, the first authentication key material is carried in the encrypted data field.

[0414] In one implementation, the method further includes: receiving second indication information sent by the first communication device, where the second indication information is used to indicate that the first communication device has the capability of automatically updating the authentication key.

[0415] In one implementation, the first protocol message is a message based on the Internet Key Exchange protocol IKE.

[0416] In one implementation, the first authentication key material is carried in a payload field of the first protocol message.

[0417] In one implementation, the first authentication key material is carried in a notification payload field of the first protocol message.

[0418] In one implementation, the first authentication key material is carried in an extended TLV field of the first protocol message.

[0419] In one implementation, the method further includes: receiving third indication information sent by the first communication device, where the third indication information is used to indicate that the first communication device has the capability of automatically updating the authentication key.

[0420] In one implementation, the third indication information is carried in a notification payload field of a message based on the IKE protocol.

[0421] In one implementation, the third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

[0422] In one implementation, the method further includes: receiving a seventh protocol message sent by the first communication device, where the seventh protocol message is used to indicate that the first communication device has saved the second authentication key.

[0423] In one implementation, the seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second authentication key.

[0424] In one implementation, the seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

[0425] In one implementation, the first protocol message is an authentication exchange AUTH exchange message.

[0426] In one implementation, the first protocol message is a Create Child Security Association Exchange (CREATE_CHILD_SAexchange) message.

[0427] In one implementation, the first protocol message is an INFORMATIONAL exchange message.

[0428] In one implementation, the first communication device is a vehicle-mounted device.

[0429] In one implementation, the second communication device is a vehicle-mounted device.

[0430] In the seventh aspect, an embodiment of the present application provides a method for updating a PSK, which can be performed by a first communication device. In one example, a first PSK is stored in the first communication device, and the first PSK is used to process messages exchanged between the first communication device and the second communication device within the aging period of the first PSK. Both the first communication device and the second communication device can process messages exchanged between the first communication device and the second communication device based on the first PSK within the aging period of the first PSK. In the present application, the first communication device can receive a first protocol message sent by the second communication device within the aging period of the first PSK, where the first protocol message includes a first PSK key material, and the first PSK key material is used to generate a second PSK. The second PSK is used to process messages exchanged between the first communication device and the second communication device within the aging period of the second PSK. Both the first communication device and the second communication device can process messages exchanged between the first communication device and the second communication device based on the second PSK within the aging period of the second PSK. It can be seen that, by using the solution of the embodiment of the present application, the first communication device can update the PSK based on the first PSK key material. Therefore, the PSK stored in the first communication device is no longer static, thereby reducing the possibility of the PSK in the first communication device being cracked, and accordingly, avoiding the security risks caused by the cracking of the PSK.

[0431] In addition, the first communication device can also execute the method described in the first aspect and any one of the first aspects above. For related content, please refer to the relevant description of the first aspect above, and will not be repeated here.

[0432] In the eighth aspect, an embodiment of the present application provides a method for updating a PSK, which can be executed by a second communication device. In one example, the second communication device can obtain a first PSK key material, and the first PSK key material is used to generate a second PSK. After the second communication device obtains the first PSK key material, it can generate a first protocol message based on the first PSK key material, and the first protocol message includes the first PSK key material. After the second communication device generates the first protocol message, it can send the first protocol message to the first communication device so that the first communication device can generate an updated second PSK based on the first PSK key material. It can be seen that, using the solution of the embodiment of the present application, the first communication device can update the PSK based on the first PSK key material. Therefore, the PSK stored in the first communication device is no longer immutable, thereby reducing the possibility of the PSK in the first communication device being cracked, and accordingly, avoiding the security risks caused by the cracking of the PSK.

[0433] In addition, the second communication device can also execute the method described in the above second aspect and any one of the second aspects. For related content, please refer to the relevant description of the above second aspect and will not be repeated here.

[0434] Ninthly, an embodiment of the present application provides a method for processing a PSK, which can be executed by a first communication device. In one example, a first PSK is stored in the first communication device. Under normal circumstances, the first communication device can process the messages exchanged between the first communication device and the second communication device based on the first PSK within the aging period of the first PSK. In addition, the first communication device also locally stores a second PSK. In the present application, if the first communication device cannot process the messages exchanged between the first communication device and the second communication device based on the first PSK within the aging period of the first PSK. The first communication device can use the aforementioned second PSK to process the messages exchanged between the first communication device and the second communication device, so that the first communication device and the second communication device can communicate normally.

[0435] In one implementation, the second PSK may be stored in a non-volatile storage area of ​​the first communication device to ensure that the second PSK is not lost when a sudden failure or power failure occurs to the first communication device.

[0436] In one implementation, the first communications device may read the first PSK from a non-volatile storage area storing the first PSK within an aging period of the first PSK, so as to process messages exchanged between the first communications device and the second communications device using the first PSK. In one example, if the first communications device fails to read the first PSK from the non-volatile storage area corresponding to the first PSK, the first communications device may determine that the messages exchanged between the first communications device and the second communications device cannot currently be processed based on the first PSK.

[0437] In one implementation, the second PSK is generated by the first communication device based on the PSK key material within the aging period of the first PSK. As an example, the first communication device may receive a first protocol message sent by the second communication device within the aging period of the first PSK. The first protocol message includes PSK key material, which is used to generate an updated second PSK. The first communication device may process messages exchanged between the first communication device and the second communication device based on the second PSK within the aging period of the second PSK. After receiving the first protocol message, the first communication device may obtain and store the second PSK based on the PSK key material.

[0438] In one implementation, the second PSK is a PSK preset in the first communication device when it leaves the factory.

[0439] In one implementation, if the second PSK is a factory-set PSK for the first communication device, then if there are other available PSKs in the first communication device, the first communication device does not use the second PSK to process messages exchanged between the first communication device and the second communication device. In other words, the first communication device does not use the second PSK to process messages exchanged between the first communication device and the second communication device until the first communication device determines that the first PSK cannot be used to process the messages exchanged between the first communication device and the second communication device.

[0440] In one implementation, when the second PSK is a factory-set PSK for the first communication device, and the first communication device locally stores a third PSK in addition to the first and second PSKs, in this case, after the first communication device determines that it cannot use the first PSK to process messages exchanged between the second and first communication devices, it first determines whether it has any available PSKs locally stored in addition to the PSK. If so, it uses the available PSKs to process messages exchanged between the second and first communication devices. If not, it uses the second PSK to process messages exchanged between the second and first communication devices. In one example, the first communication device locally stores a third PSK in addition to the first and second PSKs. After the first communication device determines that it cannot use the first PSK to process messages exchanged between the second and first communication devices, it further determines whether it can use the third PSK to process messages exchanged between the second and first communication devices. After determining that the third PSK cannot be used to process the interactive message between the second communication device and the first communication device, it is determined to use the second PSK to process the interactive message between the second communication device and the first communication device.

[0441] In one implementation, the first communication apparatus may determine that the third PSK cannot be used to process the interactive message between the second communication apparatus and the first communication apparatus when reading the third PSK from the non-volatile storage area storing the third PSK fails.

[0442] In one implementation, the first communication device uses the second PSK to process the messages exchanged between the second communication device and the first communication device. In a specific implementation, for example, the first communication device uses the second PSK to derive a key, and uses the derived key to process the messages exchanged between the second communication device and the first communication device.

[0443] In one implementation, the first communication device can use the second PSK to derive an authentication key and use the authentication key to process message 1 exchanged between the second communication device and the first communication device, where message 1 is used to authenticate the first communication device. The authentication key may include one or more of an encryption key, an integrity calculation key, and an identity authentication key. The encryption key can be used to encrypt key information in the authentication message, the integrity calculation key can be used to perform integrity calculation on the authentication message, and the identity authentication key can be used to calculate the identity authentication information in the authentication message. In this embodiment of the present application, the second communication device can use the EAP-PSK protocol for identity authentication. The second communication device can also use the IKE protocol for identity authentication, which is not specifically limited in this embodiment of the present application.

[0444] In another example, the first communication device may use the second PSK to derive a key and use the derived key to process message 2 exchanged between the second communication device and the first communication device, wherein message 2 may be used to update the first PSK stored in the first communication device. In one example, after the first communication device successfully updates the PSK, the first communication device may use the updated PSK to process messages exchanged between the second communication device and the first communication device, and no longer use the second PSK to process messages exchanged between the second communication device and the first communication device.

[0445] In one implementation, when a first communication device determines that it cannot process messages exchanged between a second communication device and the first communication device based on the first PSK within the aging period of the first PSK, it may send an alarm to a control and management device. This alarm indicates that the first communication device cannot process messages exchanged between the second communication device and the first communication device based on the first PSK within the aging period of the first PSK. This allows operation and maintenance personnel to determine the status of the PSK in the second communication device based on the alarm and whether manual intervention is required.

[0446] In the tenth aspect, an embodiment of the present application provides a first communication device, comprising: a transceiver unit and a processing unit. The transceiver unit is used to perform the transceiver operation performed by the first communication device described in the first aspect and any one of the first aspects, and the processing unit is used to perform other operations except the transceiver operation performed by the first communication device described in the first aspect and any one of the first aspects; or, the transceiver unit is used to perform the transceiver operation performed by the first communication device described in the third aspect and any one of the third aspects, and the processing unit is used to perform other operations except the transceiver operation performed by the first communication device described in the third aspect and any one of the third aspects; or, the transceiver unit is used to perform the transceiver operation performed by the first communication device described in the fifth aspect and any one of the fifth aspects, and the processing unit is used to perform other operations except the transceiver operation performed by the first communication device described in the third aspect and any one of the third aspects. The unit is used to perform other operations except the receiving and sending operations performed by the first communication device described in the fifth aspect and any one of the fifth aspects; or, the receiving and sending unit is used to perform the receiving and sending operations performed by the first communication device described in the seventh aspect and any one of the seventh aspects, and the processing unit is used to perform other operations except the receiving and sending operations performed by the first communication device described in the seventh aspect and any one of the seventh aspects; or, the receiving and sending unit is used to perform the receiving and sending operations performed by the first communication device described in the ninth aspect and any one of the ninth aspects, and the processing unit is used to perform other operations except the receiving and sending operations performed by the first communication device described in the ninth aspect and any one of the ninth aspects.

[0447] In the eleventh aspect, an embodiment of the present application provides a second communication device, comprising: a transceiver unit and a processing unit. The transceiver unit is used to perform the transceiver operation performed by the second communication device described in the second aspect and any one of the second aspects, and the processing unit is used to perform other operations other than the transceiver operation performed by the second communication device described in the second aspect and any one of the second aspects; or, the transceiver unit is used to perform the transceiver operation performed by the second communication device described in the fourth aspect and any one of the fourth aspects, and the processing unit is used to perform other operations other than the transceiver operation performed by the second communication device described in the fourth aspect and any one of the fourth aspects; or, the transceiver unit is used to perform the transceiver operation performed by the second communication device described in the sixth aspect and any one of the sixth aspects, and the processing unit is used to perform other operations other than the transceiver operation performed by the second communication device described in the sixth aspect and any one of the sixth aspects; or, the transceiver unit is used to perform the transceiver operation performed by the second communication device described in the eighth aspect and any one of the eighth aspects, and the processing unit is used to perform other operations other than the transceiver operation performed by the second communication device described in the eighth aspect and any one of the eighth aspects.

[0448] In the twelfth aspect, an embodiment of the present application provides a first communication device, comprising: a communication interface; and a processor connected to the communication interface; according to the communication interface and the processor, the first communication device is used to execute the method described in the first aspect and any one of the first aspects; or, the first communication device is used to execute the method described in the third aspect and any one of the third aspects; or, the first communication device is used to execute the method described in the fifth aspect and any one of the fifth aspects; or, the first communication device is used to execute the method described in the seventh aspect and any one of the seventh aspects; or, the first communication device is used to execute the method described in the ninth aspect and any one of the ninth aspects. In one example, the method executed by the first communication device can be executed by a central processing unit (CPU) and a software program; in another example, the method executed by the first communication device can be executed by a chip.

[0449] In a thirteenth aspect, an embodiment of the present application provides a second communication device, comprising: a communication interface; and a processor connected to the communication interface; according to the communication interface and the processor, the second communication device is used to execute the method described in the second aspect and any one of the second aspects; or, the second communication device is used to execute the method described in the fourth aspect and any one of the fourth aspects; or, the second communication device is used to execute the method described in the sixth aspect and any one of the sixth aspects; or, the second communication device is used to execute the method described in the eighth aspect and any one of the eighth aspects. In one example, the method executed by the second communication device can be executed by a CPU and a software program; in another example, the method executed by the second communication device can be executed by a chip.

[0450] In the fourteenth aspect, an embodiment of the present application provides a first communication device, which includes a memory and a processor; the memory is used to store program code; the processor is used to run instructions in the program code, so that the first communication device executes the method described in the first aspect and any one of the first aspects; or, the first communication device executes the method described in the third aspect and any one of the third aspects; or, the first communication device executes the method described in the fifth aspect and any one of the fifth aspects; or, the first communication device executes the method described in the seventh aspect and any one of the seventh aspects; or, the first communication device executes the method described in the ninth aspect and any one of the ninth aspects.

[0451] In aspect fifteen, an embodiment of the present application provides a second communication device, which includes a memory and a processor; the memory is used to store program code; the processor is used to run instructions in the program code, so that the second communication device executes the method described in the second aspect and any one of the second aspects; or, the second communication device executes the method described in the fourth aspect and any one of the fourth aspects; or, the second communication device executes the method described in the sixth aspect and any one of the sixth aspects; or, the second communication device executes the method described in the eighth aspect and any one of the eighth aspects.

[0452] In the sixteenth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the method described in the first aspect and any one of the first aspects, or the computer executes the method described in the second aspect and any one of the second aspects, or the computer executes the method described in the third aspect and any one of the third aspects, or the computer executes the method described in the fourth aspect and any one of the fourth aspects, or the computer executes the method described in the fifth aspect and any one of the fifth aspects, or the computer executes the method described in the sixth aspect and any one of the sixth aspects; or the computer executes the method described in the seventh aspect and any one of the seventh aspects, or the computer executes the method described in the eighth aspect and any one of the eighth aspects, or the computer executes the method described in the ninth aspect and any one of the ninth aspects.

[0453] In the seventeenth aspect, an embodiment of the present application provides a communication system, characterized in that it includes the first communication device described in the tenth aspect or the twelfth aspect or the fourteenth aspect and the second communication device described in the eleventh aspect or the thirteenth aspect or the fifteenth aspect.

[0454] In the eighteenth aspect, an embodiment of the present application provides a communication device, characterized in that it includes the first communication device described in the tenth aspect or the twelfth aspect or the fourteenth aspect and the second communication device described in the eleventh aspect or the thirteenth aspect or the fifteenth aspect.

[0455] In one implementation, the communication device may be an Internet of Things (IoT) device. For example, the communication device may be a vehicle; for another example, the communication device may be a smart wearable device such as a wristband; and for another example, the communication device may be a smart home device such as a robot vacuum.

[0456] In one implementation, the communication device is a T-BOX. Exemplarily, the first communication device may be a network access device, and the second communication device may be a microcontroller.

[0457] In the nineteenth aspect, an embodiment of the present application provides a communication method, which is executed by the communication device described in the eighteenth aspect, and the method includes: the first communication device executes the operation performed by the first communication device in any of the aforementioned aspects or any implementation methods; the second communication device executes the operation performed by the second communication device in any of the aforementioned aspects or any implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0458] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0459] Figure 1 is a schematic diagram of an exemplary application scenario;

[0460] Figure 2a A flowchart of a method for performing MACSec communication based on PSK provided in an embodiment of the present application;

[0461] Figure 2b A signaling interaction diagram of a PSK update method provided in an embodiment of the present application;

[0462] Figure 3a A schematic diagram of the structure of an EAP-PSK message provided in an embodiment of the present application;

[0463] Figure 3b A schematic diagram of the structure of a TLV field provided in an embodiment of the present application;

[0464] Figure 3c A schematic diagram of the structure of an EAP-PSK message provided in an embodiment of the present application;

[0465] Figure 3d A schematic diagram of the structure of an encrypted payload field provided in an embodiment of the present application;

[0466] Figure 3e A schematic diagram of the structure of a field to be encrypted provided in an embodiment of the present application;

[0467] Figure 3fA schematic diagram of a key material payload field provided in an embodiment of the present application;

[0468] Figure 3g A schematic diagram of a key material field provided in an embodiment of the present application;

[0469] Figure 3h A schematic diagram of the structure of a field to be encrypted provided in an embodiment of the present application;

[0470] Figure 3i A schematic diagram of a key confirmed payload field provided in an embodiment of the present application;

[0471] Figure 3j A schematic diagram of a key confirmed field provided in an embodiment of the present application;

[0472] Figure 3k The figure shows a schematic diagram of a structure of a field to be encrypted provided in an embodiment of the present application;

[0473] Figure 3l A schematic diagram of a result payload field provided in an embodiment of the present application;

[0474] Figure 3m A schematic diagram of the structure of an EAP-PSK message provided in an embodiment of the present application;

[0475] Figure 3n This is a schematic diagram of the structure of a traditional EAP-PSK message;

[0476] Figure 3o A schematic diagram of a protocol stack provided in an embodiment of the present application;

[0477] Figure 4 A signaling interaction diagram of a PSK update method provided in an embodiment of the present application;

[0478] Figure 5a A schematic diagram of an MKA capability notification parameter set provided in an embodiment of the present application;

[0479] Figure 5b A schematic diagram of an MKA distributing and updating a PSK parameter set provided in an embodiment of the present application;

[0480] Figure 5c A schematic diagram of an MKA PSK storage result notification parameter set provided in an embodiment of the present application;

[0481] Figure 6 A signaling interaction diagram of a key update method provided in an embodiment of the present application;

[0482] Figure 7a A schematic diagram of the structure of a notification payload field provided in an embodiment of the present application;

[0483] Figure 7b A schematic diagram of the structure of a notification data field provided in an embodiment of the present application;

[0484] Figure 7c A schematic diagram of the structure of a notification data field provided in an embodiment of the present application;

[0485] Figure 7d A schematic diagram of the structure of a key distribute payload provided in an embodiment of the present application;

[0486] Figure 7e A schematic diagram of the structure of a notification data field provided in an embodiment of the present application;

[0487] Figure 8a A flowchart of a method for performing MACSec communication based on PSK provided in an embodiment of the present application;

[0488] Figure 8b A flowchart of a method for performing MACSec communication based on PSK provided in an embodiment of the present application;

[0489] Figure 9a A flowchart of a method for updating a data key provided in an embodiment of the present application;

[0490] Figure 9b A flowchart of a method for updating a data key provided in an embodiment of the present application;

[0491] Figure 10a A flowchart of a method for updating an authentication key provided in an embodiment of the present application;

[0492] Figure 10b A flowchart of a method for updating an authentication key provided in an embodiment of the present application;

[0493] Figure 11a A flowchart of a PSK update method provided in an embodiment of the present application;

[0494] Figure 11b A flowchart of a PSK update method provided in an embodiment of the present application;

[0495] Figure 12 A flowchart of a PSK processing method provided in an embodiment of the present application;

[0496] Figure 13 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0497] Figure 14 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0498] Figure 15 A schematic structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0499] The embodiments of the present application provide a method for MACSec communication based on PSK, which can reduce the risk of PSK being cracked and correspondingly reduce the risk of MACSec keys derived from PSK being cracked, thereby reducing security risks.

[0500] For ease of understanding, the possible application scenarios of the embodiments of the present application are first introduced.

[0501] See also Figure 1 , which is a schematic diagram of an exemplary application scenario.

[0502] like Figure 1 As shown, the vehicle-mounted information box (T-Box) includes a network access device (NAD) 101 and a microcontroller unit (MCU) 102. The NAD 101 can communicate with external devices, and the MCU 102 can communicate with other devices in the vehicle, such as other MCUs in the vehicle.

[0503] The computing resources of NAD 101 are sufficient, and the computing power of the central processing unit (CPU) of NAD 101 is relatively strong.

[0504] The computing resources of MCU 102 are relatively limited. For example, the size of the random access memory (RAM) of MCU 102 is approximately 300 kilobytes (KB). One or more software programs can run on MCU 102, and MCU 102 is very sensitive to the size of the software package and the occupancy of the random access memory (RAM). In one example, MCU 102 needs to support communication security functions. In this case, it can be required that the software package does not exceed 150 kilobytes (KB), and that the RAM occupied by the aforementioned communication security functions does not exceed 10KB. The CPU computing power of MCU 102 is relatively weak, and it does not support asymmetric algorithms. It cannot use certificate authentication or key exchange algorithms.

[0505] In one example, when a software program needs to be updated, an external device such as a server may send the updated software program package to the NAD 101 , and the NAD 101 may then send the updated software program package to the MCU 102 .

[0506] In another example, MCU 102 can collect operating data within the vehicle and send it to NAD 101. NAD 101 then transmits the data to an external device, such as a server, thereby enabling remote collection of operating data within the vehicle. To protect data privacy, MCU 102 can encrypt the data when sending it to NAD 101.

[0507] In another example, if a vehicle supports remote control functions, such as remote door opening, a device outside the vehicle can send a control message corresponding to the remote control function to NAD 101. NAD 101 then sends this control message to MCU 102, which then interacts with other devices inside the vehicle to control the vehicle to perform the corresponding action, such as opening a door. To ensure vehicle operation safety, MCU 102 needs to verify the control message received from NAD 101.

[0508] In the above scenario, MACSec communication can be performed between NAD 101 and MCU 102. During MACSec communication, messages exchanged between the two devices can be processed using a MACSec key. In some embodiments, the MACSec key can be derived from a Public Token Storage Key (PSK). A PSK can be pre-stored on both NAD 101 and MCU 102, and the PSK pre-stored on NAD 101 and MCU 102 can be the same.

[0509] In some embodiments, the PSK pre-stored in the NAD 101 and MCU 102 is immutable. For example, the PSK remains unchanged from the time a vehicle leaves the factory until it is scrapped. Because the PSK is susceptible to being cracked, a cracked PSK may pose a security risk. For example, an untrusted third-party communication device could crack the PSK and further crack the MACSec key derived from it, potentially allowing the user to eavesdrop on messages exchanged between the NAD 101 and MCU 102.

[0510] The inventors of this application discovered that if the NAD 101 and MCU 102 can update their stored PSKs, for example, automatically and periodically, and accordingly use different PSKs to derive MACSec keys during different communication cycles, the risk of the PSK being cracked can be reduced, and accordingly, the risk of the MACSec keys derived from the PSK being cracked can be reduced, thereby reducing security risks.

[0511] It should be noted that Figure 1 This is only for the convenience of understanding and does not constitute a limitation on the application scenarios of the embodiments of the present application. Figure 1 The NAD 101 and MCU 102 shown may also be the NAD 101 and other devices in the vehicle, or the MCU 102 and other devices in the vehicle, or any two communication devices.

[0512] The communication device mentioned in the embodiments of the present application may be a device capable of exchanging data with other devices. For example: Figure 1 The NAD 101 and MCU 102 shown may also be network devices, user equipment, or servers, etc., and are not specifically limited in the embodiments of the present application. Furthermore, the communication device may also be a component on a device capable of exchanging data with other devices, such as a single board or line card on a network device, or a functional module on a network device, and are not limited in the embodiments of the present application.

[0513] In view of this, an embodiment of the present application provides a method for MACSec communication based on PSK, which is described below with reference to the accompanying drawings.

[0514] See also Figure 2a , this figure is a flow chart of a method for MACSec communication based on PSK provided in an embodiment of the present application. Figure 2a The illustrated method 100 for performing MACSec communication based on PSK can be performed by communication device 2, wherein PSK1 is stored in communication device 2. Communication device 2 can process messages exchanged between communication device 1 and communication device 2 based on PSK1 during the aging period of PSK1. In addition, communication device 1 can also derive MACSec keys using PSK1 during the aging period of PSK1. Messages exchanged between communication device 1 and communication device 2 are processed based on PSK1. For example, an encryption key and an integrity calculation key can be derived based on PSK1. When a message for identity authentication is transmitted between communication device 1 and communication device 2, communication device 2 encrypts the message for identity authentication using the encryption key derived from PSK1, and performs integrity calculation on the message for identity authentication using the integrity calculation key derived from PSK1.

[0515] The communication device 1 mentioned in the method 100 may be, for example, Figure 1 The NAD 101 shown, the communication device 2 mentioned in the method 100, can be, for example, Figure 1 The MCU 102 is shown. Of course, the communication device 1 and the communication device 2 can also be other devices, which is not limited here.

[0516] The method 100 may include, for example, the following S101 , S102 a , and S102 b .

[0517] S101a: The communication device 2 derives the MACSec key 1 based on PSK1 within the aging period of PSK1.

[0518] In the embodiment of the present application, PSK1 may be stored in communication device 2 and communication device 1. PSK1 is used to process messages exchanged between communication device 1 and communication device 2 during the aging period of PSK1. Both communication device 1 and communication device 2 may process messages exchanged between communication device 1 and communication device 2 based on PSK1 during the aging period of PSK1.

[0519] It should be noted that S101a can be implemented in multiple ways. In one implementation, PSK1 can be used to derive the master session key (MSK), which can then be used to derive the secure connectivity association key (CAK), and finally, the CAK can be used to derive MACSec key 1. In another implementation, PSK1 can be directly used as the CAK to derive MACSec key 1. The specific implementations of deriving the MSK from PSK1, deriving the CAK from the MSK, and deriving the MACSec key 1 from the CAK are not described in detail here.

[0520] S102a: The communication device 2 updates PSK1 to PSK2.

[0521] In an embodiment of the present application, to prevent PSK1 from being cracked due to its immutability, thereby preventing the MACSec key 1 derived from PSK1 from being cracked, communication device 2 can update PSK1 to obtain PSK2. PSK2 is used to process messages exchanged between communication devices 1 and 2 during the aging period of PSK2. Both communication devices 1 and 2 can process messages exchanged between them based on PSK2 during the aging period of PSK2.

[0522] In one example, communication device 2 may obtain PSK2 based on PSK key material 1. As an example, communication device 2 may receive message 3 sent by communication device 1 within the aging period of PSK 1, where message 3 includes key material 1, where key material 1 includes PSK key material 1, and where PSK key material 1 is used to generate PSK2.

[0523] In an embodiment of the present application, message 1 may be a protocol message. In one example, message 1 may be an Extensible Authentication Protocol (EAP) message based on PSK, i.e., an EAP-PSK message. In another example, message 1 may be a message based on the Internet Key Exchange (IKE) protocol. In another example, message 1 may be a message based on the Media Access Control Security Key Agreement (MKA) protocol. If message 1 is an EAP-PSK message, then for message 1, please refer to the following description of the message. Figure 2bThe relevant description parts in the method 100' are not described in detail here. If the message 1 is an MKA-based message, then regarding the message 1, you can refer to the relevant description parts of the method 200 below, which are not described in detail here. If the message 1 is a message based on the IKE protocol, then regarding the message 1, you can refer to the relevant description parts of the method 300 below, which are not described in detail here. In the embodiment of the present application, the PSK key material 1 can be used to obtain PSK2. After the communication device 2 obtains PSK2, it can process the messages exchanged between the communication device 1 and the communication device 2 based on PSK2 within the aging period of PSK2.

[0524] After obtaining the key material 1, the communication device 2 can obtain an updated key according to the key material 1, where the updated key includes PSK2.

[0525] Regarding the implementation method of the communication device 2 obtaining PSK2 based on the PSK key material 1, please refer to the following Figure 2b The related description parts of the method 100 ′ shown, the method 200 mentioned below, and the method 300 mentioned below are not described in detail here.

[0526] In one example, after obtaining PSK2, communication device 2 may store PSK2 in a non-volatile storage area of ​​communication device 2. Correspondingly, the aforementioned PSK1 may also be stored in the non-volatile storage area of ​​communication device 2. For example, communication device 2 includes at least two non-volatile storage areas, such as non-volatile storage area 1 and non-volatile storage area 2. Non-volatile storage area 1 is used to store PSK1. During the aging period of PSK1, communication device 2 may read PSK1 from non-volatile storage area 1 and process messages exchanged between communication device 1 and communication device 2 based on PSK1. During the aging period of PSK1, communication device 2 obtains PSK2 and stores PSK2 in non-volatile storage area 2. During the aging period of PSK2, communication device 2 may read PSK2 from non-volatile storage area 2 and process messages exchanged between communication device 1 and communication device 2 based on PSK2.

[0527] S103a: Communication device 2 derives MACSec key 2 based on PSK2 within the aging period of PSK2.

[0528] It should be noted that S103a can be implemented in multiple ways. In one implementation, PSK2 can be used to derive the MSK, which can then be used to derive the CAK, and finally, the CAK can be used to derive the MACSec key 2. In another implementation, PSK2 can be directly used as the CAK to derive the MACSec key 2. The specific implementations of deriving the MSK from PSK2, deriving the CAK from the MSK, and deriving the MACSec key 2 from the CAK are not described in detail here.

[0529] As can be seen, through the above method 100, the PSK stored in communication device 2 is no longer static. Instead, messages exchanged between communication devices 1 and 2 are processed based on different PSKs during different communication cycles. For example, as described above, during the communication cycle corresponding to the aging cycle of PSK1, messages exchanged between communication devices 1 and 2 are processed based on PSK1, and during the communication cycle corresponding to the aging cycle of PSK2, messages exchanged between communication devices 1 and 2 are processed based on PSK2. Accordingly, MACSec keys can be derived based on different PSKs during different communication cycles. For example, during the communication cycle corresponding to the aging cycle of PSK1, MACSec key 1 is derived based on PSK1, and during the communication cycle corresponding to the aging cycle of PSK2, MACSec key 2 is derived based on PSK2. As can be seen, utilizing this method 100 can reduce the risk of MACSec keys derived from PSKs being cracked, thereby mitigating security risks.

[0530] Similar to communication device 2 , communication device 1 may also derive MACSec key 1 based on PSK1 during a communication period corresponding to the aging period of PSK1 , and derive MACSec key 2 based on PSK2 during a communication period corresponding to the aging period of PSK2 .

[0531] In one example, communication device 1 and communication device 2 may perform the following Figure 2b The method shown in the following example realizes the update of PSK. Figure 2b The PSK update method shown is introduced. Figure 2b The method shown may include the following S101-S114.

[0532] S101: Communication device 1 sends message 1 to communication device 2. Message 1 is used to request identity authentication of communication device 1.

[0533] In the embodiment of the present application, the message 1 may be an EAP-PSK message. Figure 3a To understand, Figure 3aThis is a schematic diagram of the structure of a message 1 provided in an embodiment of the present application. Figure 3a As shown, message 1 includes an EAP header field, an EAP type field, a flags field, an extension flags (ext flags) field, a session ID field, a key ID field, a nonce field, and an identifier (ID) field. Among them:

[0534] The EAP header consists of 4 bytes: the code field, the identifier field, and the length field. The code field occupies 1 byte, the identifier field occupies 1 byte, and the length field occupies 2 bytes. For the meaning of each field in the EAP header, refer to the relevant description in Request for Comments (RFC) 3748; detailed description is not provided here.

[0535] The EAP type field includes 1 byte, and the EAP type field is used to indicate the EAP method type. In this application, message 1 is an EAP-PSK message. Therefore, the value of the EAP type field may be 47, a value assigned by the Internet Engineering Task Force (IETF) to EAP-PSK.

[0536] The flags field consists of 1 byte, which includes a P indicator bit, an R indicator bit, a version indicator bit, a CS indicator bit, and a K indicator bit.

[0537] The P (protected) indicator bit occupies the 7th bit of the flags field, and is used to indicate whether the current message is an encrypted message or whether it includes an integrity check value (ICV) field. In a specific implementation, when the value of the P indicator bit is 1, it indicates that the current message includes the ICV field, but the current message can be an encrypted message or an unencrypted message. In the present application, message 1 is plain text and does not include the ICV field. In one example, when the EAP-PSK message is plain text and does not include the ICV field, the value of the P indicator bit can be 0. Correspondingly, if the EAP-PSK message includes encrypted content or includes the ICV field, the value of the P indicator bit is 1. In the following description of the embodiments of the present application, unless otherwise specified, the meanings corresponding to the various values ​​of the P indicator bit are explained with this example. The R indicator bit occupies the 6th bit of the flags field, and is used to indicate whether the current message is a response message. In one example, if the EAP-PSK message is a request message, the R indicator bit has a value of 0. If the EAP-PSK message is a response message, the R indicator bit has a value of 1. Message 1 is a request message. In the following description of the embodiments of the present application, unless otherwise specified, the meanings of the various values ​​of the R indicator bit are explained using this example.

[0538] The version indicator occupies bits 5, 4, and 3 of the flags field and is used to indicate the EAP-PSK protocol version number. The structure of message 1 differs from that of a traditional EAP-PSK message, expanding upon the traditional EAP-PSK message structure. In one example of the present invention, the value of the version indicator can be 1. In the following description of the present invention, unless otherwise specified, the value of the P indicator is described using this example.

[0539] The CS indicator bit occupies the second bit of the flags field, and is used to indicate whether this identity authentication includes a CSID field. When the communication device 2 can perform identity authentication with multiple communication devices, in order to prevent the multiple communication devices from assigning the same connection identifier (i.e., SSID) for the identity authentication, resulting in the communication device 2 being unable to uniquely determine the authentication session based on the SSID, the communication device 2 can assign a CSID to ensure the uniqueness of the authentication session. Since message 1 is generated by the communication device 1, the communication device 1 cannot determine whether the communication device 2 can perform identity authentication with multiple communication devices. Therefore, there may be no CSID field in message 1. In an example, when the value of the CS indicator bit is 0, it indicates that there is no CSID field in the EAP-PSK message. Correspondingly, when the value of the CS indicator bit is 1, it indicates that the EAP-PSK message includes a CSID field. In the following description of the embodiments of the present application, unless otherwise specified, the meaning of each value of the CS indicator bit is explained by this example.

[0540] The K indicator bit occupies the first bit of the flags field and is used to indicate whether the keyID field is included. In message 1, the keyID field is used to indicate the PSK identifier and can include 4 bytes. In one example, if the EAP-PSK message includes the keyID field, the value of the K indicator bit is 1; if the EAP-PSK message does not include the keyID field, the value of the K indicator bit is 0. In the following description of the embodiments of the present application, unless otherwise specified, the meanings of the various values ​​of the K indicator bit are explained using this example.

[0541] Regarding the keyID field, it should be noted that the keyID field in message 1 is used to carry the identifier of the PSK. In an embodiment of the present application, the key used in the identity authentication process may be derived from the PSK or may not be derived from the PSK. For example, it may be pre-negotiated by the communication device 1 and the communication device 2. For the convenience of description, the "key used in the identity authentication process" is referred to as the "authentication key". If the authentication key is derived from the PSK, the PSK used to derive the authentication key can be determined based on the keyID field. The authentication key includes an authentication cipher key (ACK), an authentication integrity key (AIK), an identity authentication key (IAK), and a key derive key (KDK). Among them, the authentication cipher key is used to encrypt the content to be encrypted, the authentication integrity key is used to calculate the ICV of the authentication message, the identity authentication key is used to calculate the identity authentication information, and the key derivation key is used as the key used when deriving the key. In one example, the authentication cipher key can be a transient EAP key (TEK). In another example, the identity authentication key and the authentication integrity key use the same key.

[0542] It should be noted that in the following description of the embodiments of the present application, integrity keys and integrity calculation keys can be used interchangeably.

[0543] When the K indicator bit indicates that the message 1 includes a keyID field, the communication device 1 may determine the value of the keyID field, for example, in the following manner:

[0544] (1) If a valid and usable PSK exists locally on the communication device 1, the PSK is determined as the PSK used to derive the key during the authentication process. In this case, the value of the keyID field is the ID of the PSK. Whether the PSK is usable can be determined based on whether the PSK has an usable flag.

[0545] (2) If a successfully installed and valid PSK exists locally on the communication device 1, the PSK is determined as the PSK used to derive the key during the identity authentication process. In this case, the value of the keyID field is the ID of the PSK. Whether the PSK is successfully installed can be determined based on whether the PSK has an installation success flag.

[0546] (3) If neither of the above conditions is met, to ensure normal authentication, if a default PSK is locally stored in communication device 1, the default PSK is determined as the PSK for deriving the key during the authentication process. In this case, the value of the keyID field is the ID of the PSK. In one example, if the default PSK is selected as the PSK for deriving the authentication key during the authentication process, the keyID field may not be included in message 1, that is, the value of the K indicator bit may be 0.

[0547] The 0th bit of the flags field is a reserved bit.

[0548] The ext flags field includes 1 byte, and the ext flags field includes a reserved field and an exchange type (exchangetype, exch type) field. The reserved field occupies the 7th to 5th bits of the ext flags field, and the exch type field occupies the 4th to 0th bits of the ext flags field. The exch type field is used to identify the type of message interaction. In an example, the type of message interaction may include an initial phase, an identity authentication phase, and a result notification phase. In an example, when the type of message interaction is the initial phase, the value of the ext flags field may be 1, when the type of message interaction is the identity authentication phase, the value of the ext flags field may be 2, and when the type of message interaction is the result notification phase, the value of the ext flags field may be 4. In the following description of the embodiments of the present application, unless otherwise specified, the meaning corresponding to each value of the exchtype field is explained by taking this example. Among them, the result notification phase can be used to notify the identity authentication result and the key update result.

[0549] The session ID field is used to identify the session between communication device 1 and communication device 2. The session ID field may include an SSID field and a CSID field. The SSID field is used to carry the session identifier SSID assigned by communication device 1, and the CSID field is used to carry the session identifier CSID assigned by communication device 2. The SSID field is a mandatory field, and the CSID field is an optional field. For details, please refer to the above description of the CS field. When the session ID field includes the SSID field and the CSID field, the session ID field may include 8 bytes, with the SSID field and the CSID field each occupying 4 bytes. When the session ID field does not include the CSID field, the session ID field may include 4 bytes.

[0550] Regarding SSID, it should be noted that, in one example, the communication device 1 can generate a random SSID using a random number function, thereby avoiding the generation of the SSID according to a certain rule so that the attacker can predict the SSID, thereby bringing security risks. In another example, the communication device 1 can, for example, use a local timestamp as the SSID. If this identity authentication is completed, when the communication device 1 re-initiates the initial identity authentication (for example, regenerates a message 1 and sends it to the communication device 2), the communication device 1 needs to regenerate an SSID to prevent replay attacks. If the communication device 1 and the communication device 2 are authenticated successfully and then perform a quick re-authentication, and the quick re-authentication directly uses the key obtained after the last successful identity authentication for quick re-authentication, then the communication device 1 does not need to regenerate an SSID, and can use the SSID used for the last identity authentication. If the last initial identity authentication fails, the communication device 1 re-initiates the initial identity authentication, and the communication device 1 needs to regenerate an SSID.

[0551] The nonce field is used to carry the random number 1 generated by the communication device 1. When the communication device 1 and the communication device 2 use PSK to derive the authentication key, the random number 1 can be used as a parameter of the key derivation algorithm to increase the randomness of the key derivation and improve the key security. The length of the random number 1 can be between 16 and 256 bytes. The specific length can be determined according to the actual situation. The embodiment of the present application does not make specific restrictions. In one example, the length of the random number 1 can be 16 bytes. In one example, the random number 1 can be carried in a type length value (TLV) field. In one example, the structure of the TLV field can refer to Figure 3b , Figure 3b A schematic diagram of the structure of a TLV field provided in an embodiment of the present application. Figure 3b As shown, the TLV field includes a TLV header and TLV data, wherein the TLV data is used to carry a random number 1, and the TLV header may include a TLV type field, a reserved field, and a TLV length field. In one example, the TLV header may include 4 bytes, wherein the TLV type field occupies 1 byte, the reserved field occupies 1 byte, and the TLV length field occupies 2 bytes.

[0552] Regarding the nonce field, it should be noted that when communication device 1 and communication device 2 re-authenticate, the random number carried in the TLV data in the nonce field must be regenerated. During the same authentication, if message 1 is retransmitted, the random number carried in the TLV data in the nonce field can remain unchanged.

[0553] The ID field, which includes several bytes, such as n, carries the identity of communication device 1. The value of the ID field can be used by communication device 2 to perform a whitelist check based on the value of the ID field after receiving message 1, to determine whether to approve identity authentication. The value of the ID field can also be used to instruct communication device 2 to determine the PSK to be used during the identity authentication process.

[0554] The embodiments of the present application do not specifically limit the identity of the communication device 1. In one example, the identity of the communication device 1 may be a string of random numbers; in another example, the identity of the communication device 1 may be the Internet Protocol (IP) address or the Media Access Control (MAC) address of the communication device 1; in another example, the identity of the communication device 1 may be the Network Access Identifier (NAI) of the communication device 1.

[0555] S102: Communication device 2 sends message 2 to communication device 1, where message 2 is used to indicate that communication device 2 agrees to perform identity authentication.

[0556] After receiving the message 1, the communication device 2 may verify the message 1 and determine whether to agree to perform identity authentication based on the verification result.

[0557] When the communication device 2 verifies the message 1, it can verify the value of each field in the message 1.

[0558] For the verification of EAP header fields, please refer to the relevant description in RFC3748, which will not be detailed here.

[0559] For the Flags field:

[0560] As described for the Flags field in S101 , when the communication device 2 verifies the message 1 , the values ​​of the P indicator bit, the R indicator bit, and the CS indicator bit must be 0, and the value of the version field must be 1.

[0561] The value of the K indicator bit can be either 0 or 1. When the K indicator bit is 0, it indicates that message 1 does not include the keyID field. When the K indicator bit is 1, it indicates that message 1 includes the keyID field. When message 1 does not include the keyID field, two situations may occur. The first situation is that the authentication key is derived based on the default PSK. The second situation is that the authentication key is not derived from the PSK. When message 1 does not include the keyID field, communication device 2 can determine whether it supports the use of the default PSK-derived authentication key. For example, communication device 2 determines whether it supports the use of the default PSK-derived authentication key based on the locally configured PSK usage policy. If communication device 2 does not support the use of the default PSK-derived authentication key, identity authentication is rejected. When message 1 includes the keyID field, communication device 2 can, for example, determine whether it supports the use of the PSK-derived authentication key corresponding to the keyID carried in the keyID field. If communication device 2 does not support the use of the PSK-derived authentication key corresponding to the keyID carried in the keyID field, identity authentication can be rejected. Of course, if the communication device 2 does not support the use of the PSK derived authentication key corresponding to the keyID carried by the keyID field, the communication device 2 may not reject the identity authentication and continue to negotiate the PSK derived authentication key in subsequent interactions. No specific limitation is made here.

[0562] For the ext flags field: Since message 1 is the first message sent by communication device 1 to communication device 2 when initiating identity authentication, the value of the exch type field must be 1.

[0563] Regarding the session ID field, for message 1, it includes the SSID but not the CSID. Communication device 2 can record the SSID value carried in the SSID field and, when sending a response message to communication device 1 for message 1, encapsulate the SSID value in the response message. Regarding the nonce field, communication device 2 can record the random number 1 carried in the nonce field.

[0564] Regarding the ID field, the communication device 2 can determine whether it supports identity authentication with the communication device corresponding to the ID carried in the ID field. In one example, the communication device 2 can determine whether it supports identity authentication with the communication device corresponding to the ID carried in the ID field based on the locally configured identity authentication policy. In addition, when the communication device 2 determines the locally supported PSK for deriving the authentication key, it can also be determined in combination with the ID value carried in the ID field in the message 1. For example, the local identity authentication configuration policy of the communication device 2 indicates that the communication device 2 can perform identity authentication with the communication device 1, and when performing identity authentication with the communication device 1, it supports the use of PSK 1 to derive the authentication key.

[0565] When message 1 passes the verification, communication device 2 may send message 2 to communication device 1 , where message 2 is used to indicate that communication device 2 agrees to perform identity authentication.

[0566] In the embodiment of the present application, message 2 is also an EAP-PSK message. Moreover, the message structure of message 2 is the same as that of message 1, and can be referred to Figure 3a As shown. For the meaning of each field in message 2, please refer to the above Figure 3a The description of the message 2 is omitted here. For the values ​​of the various fields in the message 2, please refer to Table 1 below for understanding.

[0567] Table 1

[0568]

[0569]

[0570] Regarding the K indicator bit in message 2, it should be noted that if the value of the K indicator bit included in message 1 is 0, the value of the K indicator bit in message 2 may also be 0, indicating that communication device 1 and communication device 2 each use the locally stored default PSK to derive the authentication key. Alternatively, the authentication key is not derived using PSK. If the value of the K indicator bit in message 1 is 1, the value of the K indicator bit in message 2 may also be 1. When the value of the K indicator bit in message 2 is 1, the method for determining the value of the keyID field in message 2 can refer to the description of the value of the keyID field in message 1 above, and will not be repeated here. It should be noted here that the value of the keyID field in message 2 may be the same as or different from the value of the keyID field in message 1, and this is not specifically limited in the embodiments of the present application.

[0571] Regarding the CS indicator bit, it should be noted that if the communication device 2 needs to authenticate with multiple different communication devices, for example, the communication device 2 needs to authenticate with the communication device 1, and the communication device 2 also needs to authenticate with the communication device 3. In order to prevent the communication device 3 and the communication device 1 from being assigned the same SSID, so that the communication device 2 cannot uniquely determine the corresponding authentication session based on the SSID, the communication device 2 can assign a CSID by itself to ensure the uniqueness of the session. If the communication device 2 does not authenticate with other communication devices except for the communication device 1, the communication device 2 does not need to assign a CSID value. Alternatively, if the communication device 2 can use other information to distinguish between authentication sessions with different communication devices, the communication device 2 does not need to assign a CSID value. The other information mentioned here can be, for example, an interface index (ifIndex), or an underlying bearer protocol, etc.

[0572] It should be noted that if message 2 includes CSID, the following messages 3 to 6 also include CSID, and the CSID in messages 3 to 6 is equal to the CSID in message 2.

[0573] S103: Communication device 1 sends message 3 to communication device 2, where message 3 includes key material 1 and identity authentication information 1.

[0574] After receiving the message 2, the communication device 1 may verify the message 2 and determine whether to continue the identity authentication according to the verification result.

[0575] When the communication device 1 verifies the message 2, it can verify the value of each field in the message 2.

[0576] For the verification of EAP header fields, please refer to the relevant description in RFC3748, which will not be detailed here.

[0577] For the Flags field: the P indicator bit must be 0, the R indicator bit must be 1, indicating a response message; the CS indicator bit can be 0 or 1; the value of the version field must be 1.

[0578] The value of the K indicator bit can be either 0 or 1. When the K indicator bit is 0, it indicates that message 2 does not include the keyID field. When the K indicator bit is 1, it indicates that message 2 includes the keyID field. When message 2 does not include the keyID field, two situations may occur. The first situation is that the authentication key is derived based on the default PSK. The second situation is that the authentication key is not derived from the PSK. When message 2 does not include the keyID field, communication device 1 can determine whether it supports the use of the default PSK-derived authentication key. For example, communication device 1 determines whether it supports the use of the default PSK-derived authentication key based on the locally configured PSK usage policy. If communication device 1 does not support the use of the default PSK-derived authentication key, identity authentication will not proceed. When message 2 includes the keyID field, communication device 1 can, for example, determine whether it supports the use of the PSK-derived authentication key corresponding to the keyID carried in the keyID field. If communication device 1 does not support the use of the PSK-derived authentication key corresponding to the keyID carried in the keyID field, identity authentication may not proceed.

[0579] Regarding the ext flags field: since message 2 is the response message of communication device 2 to message 1, when the value 1 indicates the initial stage of identity authentication, the value of the exch type field must be 1.

[0580] Regarding the session ID field: The value of the SSID field in the session ID field is the same as the value of the SSID field in message 1. If the value of the CS indicator bit is 1, the value carried by the CSID field is recorded.

[0581] Regarding the nonce field, the communication device 1 may record the random number 2 carried by the nonce field.

[0582] Regarding the ID field, the communication device 1 can determine whether it supports identity authentication of the communication device corresponding to the ID carried by the ID field. In one example, the communication device 1 can determine whether it supports identity authentication of the communication device corresponding to the ID carried by the ID field based on the locally configured identity authentication policy. In addition, when the communication device 1 determines the locally supported PSK for deriving the authentication key, it can also be determined in combination with the ID value carried by the ID field in the message 2. For example, the local identity authentication configuration policy of the communication device 1 indicates that the communication device 1 can perform identity authentication with the communication device 2, and when performing identity authentication with the communication device 2, it supports the use of PSK 1 to derive the key used in the identity authentication process.

[0583] In the embodiment of the present application, if any field in message 2 fails verification, communication device 1 may not continue to perform identity authentication with communication device 2. In other words, when message 2 fails verification, communication device 1 may not perform the steps performed by communication device 1 in the following steps.

[0584] When message 2 passes verification, communication device 1 sends message 3 to communication device 2 , where message 3 includes key material 1 and identity authentication information 1 .

[0585] When message 2 passes verification, communication device 1 can continue to authenticate itself with communication device 2. In the present application, communication device 1 can send message 3 to communication device 2, and message 3 includes key material 1 and identity authentication information 1. Among them, identity authentication information 1 can be used by communication device 2 to authenticate communication device 1. Key material 1 can be used to update the key. The key material 1 mentioned here can include any one or more of: PSK key material 1, data key material 1 and authentication key (AK) material 1. Among them:

[0586] The PSK key material 1 is used to generate the updated PSK2.

[0587] The data key material 1 is used to generate an updated data key. The data key may include a data encryption key (DCK), which is used to encrypt data messages transmitted between the communication device 1 and the communication device 2. The data key may also include a data integrity key (DIK), which is used to perform integrity calculation on the data messages transmitted between the communication device 1 and the communication device 2.

[0588] The authentication key material 1 is used to generate an updated authentication key, which is a key used in the identity authentication process between the communication device 1 and the communication device 2. Regarding the authentication key, please refer to the description of the authentication key in S101, which will not be repeated here. In one example, the communication device 1 can, for example, generate the key material 1 by itself. For example, the communication device 1 can generate one or more random numbers and use the one or more random numbers as the key material 1. For another example, the communication device 1 can generate one or more random numbers, and then calculate the one or more random numbers using a predetermined calculation method, and determine the calculation result as the key material 1. In another example, the communication device 1 can, for example, be pre-configured with the key material 1, and the communication device 1 can obtain the key material 1 pre-configured on the communication device 1.

[0589] In the embodiment of the present application, message 3 may also be an EAP-PSK message. For information about message 3, please refer to Figure 3c To understand, Figure 3c This is a schematic diagram of the structure of a message 3 provided in an embodiment of the present application. Figure 3c As shown, compared with message 2, message 3 does not include the nonce field and the ID field, but message 3 also includes an encrypted payload field and an ICV field. The fields in message 3 are described as follows.

[0590] For the meaning of each field in the EAP header, please refer to the relevant description section of Request for Comments (RFC) 3748, which is not described in detail here.

[0591] The value of the EAP Type field is 47.

[0592] Regarding the flags field: The value of the P indicator bit is 1, and message 3 is the third message in the identity authentication process. Message 3 includes key material 1 and identity authentication information 1 that can verify the identity of communication device 1. To prevent the above information in message 3 from being leaked, message 3 is sent in ciphertext. The value of the R indicator bit is 0, indicating that message 3 is a request message. The value of the version indicator bit can be 1; the value of the CS indicator bit is the same as the value of the CS indicator bit in message 2. The K indicator bit is used to indicate whether the keyID field is included. It should be noted here that the meaning of the keyID field in message 3 is different from the meaning of the keyID field in message 1. The keyID in message 3 can be used to indicate the authentication key. It is understandable that if the KeyID field is included in message 3, the keyID field may not be included in messages 1 and 2. Among them, the authentication key indicated by the keyID field in message 3 can be the authentication key updated by communication device 1 and communication device 2 during the last identity authentication process. In one example, if message 2 includes a keyID field, message 3 does not include a keyID field, because if message 2 includes a keyID field, the keyID field in message 2 already indicates that the authentication key is derived using PSK, and there is no need to use the keyID field in message 3 to indicate the authentication key.

[0593] Regarding the exch type field, in message 3, the value of the exch type field can be 2, which is used to indicate the identity authentication stage.

[0594] Regarding the session ID field, the value of the SSID field in the session ID field is the same as the value of the SSID field in message 1. If the session ID field includes the CSID field, the value of the CSID field is the same as the value of the CSID in message 2.

[0595] Regarding the encrypted payload field, this field is used to carry encrypted data. In one example, the encrypted payload field can be a TLV field. For the structure of the TLV field, please refer to Figure 3b, which will not be repeated here. In one example, the encrypted payload field may include a TLV header field and an encrypted data field. Among them, the encrypted data field is used to carry the encrypted data. In one implementation of the embodiment of the present application, the value of the encrypted data field in message 3 can be obtained by encrypting using the AES_CBC_128 encryption algorithm. In this case, in addition to the TLV header field and the encrypted data field, the encrypted payload field may also include an initialization vector (IV) field. The IV field is used to carry the initial vector value required for encryption using the AES_CBC_128 encryption algorithm. At this time, the encrypted payload field can refer to Figure 3d , Figure 3d A schematic diagram of the structure of an encrypted payload field provided in the embodiment of the present application. In the embodiment of the present application, the value of the encrypted data field can be an encrypted data field using an encryption algorithm. Figure 3e The fields shown are encrypted. Figure 3e The fields shown include the auth payload field, the key material payload field, the padding field, and the padding length field.

[0596] The auth payload field is used to carry the identity authentication information 1 mentioned in S103. The auth payload field includes "TLV header|auth data", where "|" represents the byte streams of the two fields concatenated in sequence. For example, the value of the TLV header is 0X55, and the value of the auth data is OXAA, then the value of the auth payload field is OX55AA. Regarding the TLV header, please refer to the relevant description part above, which will not be described in detail here. The auth data field in message 3 is used to instruct the communication device 2 to perform identity authentication on the communication device 1. In an embodiment of the present application, the auth data value carried by the auth data field can be calculated based on the message 1, the random number 2 mentioned above, and the identifier of the communication device 2. For example: the auth data value can be calculated using the following formula (1):

[0597] auth data = Prf (key 1, {message 1 | random number 2 | ID_2}) formula (1)

[0598] Among them, Prf can be AES_CMAC_128 algorithm, key 1 can be derived from PSK indicated by keyID in message 1, and ID_2 is the identifier of communication device 2.

[0599] In one example, during initial identity authentication, communication device 1 and communication device 2 can each derive authentication keys as follows:

[0600] {AIK|KDK|ACK|IAK}=KDF(PSK, “Initial authentication keys”, SSID|random number 1|random number 2),

[0601] This method uses the KDF for continuous iteration until the output bit length meets all key requirements. "{AIK|KDK|ACK|IAK}" indicates that each key in the authentication key is derived sequentially from the KDF output. For example, if the AIK, KDK, ACK, and IAK are all 128 bits, the first 128 bits of the KDF output serve as the AIK, the next 128 bits as the KDK, and so on. Where: PSK is the PSK currently used by communication device 1 and communication device 2; "Initial authentication keys" represents the string "Initial authentication keys."

[0602] In another example, during the initial identity authentication, the communication device 1 and the communication device 2 can each derive the authentication key as follows: IntermediateValue1 = AES-128(PSK, {0} 128bit )

[0603] AIK=AES-128(PSK,{1} 128bit IntermediateValue1)

[0604] KDK=AES-128(PSK,{2} 128bit IntermediateValue1)IntermediateValue2=AES-128(KDK,random number 2)

[0605] ACK=AES-128(KDK,{1} 128bit IntermediateValue2) where:

[0606] {x}128bit indicates an integer with a value of x and a length of 128 bits.

[0607] Represents the bitwise exclusive OR operation of two values.

[0608] AES-128 is an encryption algorithm, and the value of the IV field is fixed to 0.

[0609] The initial identity authentication mentioned above may refer to identity authentication performed just after the communication device 1 or the communication device 2 is powered on, or identity authentication performed after the EAP-PSK connection between the communication device 1 and the communication device 2 is disconnected and then re-established.

[0610] The key material payload field is used to carry key material 1. In one example, the key material payload field can be a TLV field. For the structure of the TLV field, please refer to Figure 3b , which will not be described again here. In one example, see Figure 3f , Figure 3f A schematic diagram of a key material payload field provided in an embodiment of the present application. The key material payload field may include a TLV header field, a key number (keynumbers, keynums) field, and a key material (key material) field. Among them:

[0611] For details about the TLV header field, please refer to the description of the TLV header field above and will not be described in detail here.

[0612] The keynums field is used to indicate the number of key materials 1 carried in the encrypted payload field. As mentioned above, key material 1 may include one or more of PSK key material 1, data key material 1, and authentication key material 1. The keynums field may occupy, for example, 1 byte.

[0613] The key material field is used to carry key material 1. The structure of the key material field can be referred to Figure 3g As shown. Figure 3g The key material field includes a key type field, a keyID field, and several material data fields.

[0614] The key type field is used to indicate the key type. The key type mentioned here can be a PSK key, a data key, or an authentication key. Among them, regarding the PSK key, it should be noted that the PSK key can include two types, a type 1 PSK key (hereinafter referred to as PSK_normal), which can be used to derive all keys in the identity authentication process, including the key for integrity calculation of message 3, the key for encrypting the encrypted payload, and the key for calculating authdata (i.e., the key 1 mentioned above). The type 2 PSK key (hereinafter referred to as PSK_auth) is only used to derive the key 1 for calculating auth data. In other words, in an embodiment of the present application, the PSK derived for calculating authdata may not be the same PSK as the PSK derived for the key for integrity calculation of message 3 and the key for encrypting the encrypted payload. For example, the key used to calculate the integrity of message 3 and encrypt the encrypted payload is derived from PSK1, and the key used to calculate the auth data is derived from PSK2, where PSK1 and PSK3 are both PSKs stored in communication device 1 and communication device 2. In this case, only if both PSKs are cracked can a network attack be launched against communication device 1 or communication device 2, further improving network security. Of course, the key used to calculate the integrity of message 3 and encrypt the encrypted payload, as well as the key used to calculate the auth data, can be derived from the same PSK, for example, from PSK1, and this is not specifically limited in the embodiments of the present application.

[0615] The material data field is used to carry key material 1. Generally, key material 1 can be a random number. For the key material field, a material data field is used to derive a key. For example, for the key material field of PSK, it can carry one random number or two random numbers. If it carries one random number, the random number is used to derive PSK_normal. If it carries two random numbers, the first random number is used to derive PSK_normal, and the second random number is used to derive PSK_auth. For another example: for the key material field of the authentication key, it can carry four random numbers. The first random number is used to derive the authentication integrity key, the second random number is used to derive the key derive key (KDK), the third random number is used to derive the authentication encryption key, and the fourth random number is used to derive the identity authentication key. In another example, the key material field of the authentication key can carry three random numbers. The first random number is used to derive the authentication integrity key AIK, the second random number is used to derive the key derive key (KDK), and the third random number is used to derive the authentication encryption key ACK. In this case, the authentication information calculation uses the authentication integrity key AIK. Among them, KDK participates in the derivation of the authentication encryption key. For another example: For the key material field of the data key, it can carry two random numbers. The first random number is used to derive the data integrity key, and the second random number is used to derive the data encryption key.

[0616] The keyID field is used to identify key material 1 carried in the material data field. In one example, after a key is derived using key material 1 carried in the material data field, the keyID field can also serve as the identifier of the derived key. It should be noted that for a set of authentication keys, such as the key used to calculate the integrity of message 3 and the key used to encrypt the encrypted payload in message 3, the corresponding keyID is the same.

[0617] about Figure 3f and Figure 3g It should be noted that when the message 3 carries at least two key materials 1, Figure 3f and Figure 3gAs shown, the aforementioned at least two key materials 1 are carried in a TLV field (i.e., key material payload), and the key type is distinguished by the key type field, but this is only one possible implementation. In another implementation, each key material 1 can be carried by an independent TLV field, for example, the PSK key material 1 is carried by the PSK material payload, and the data key material 1 is carried by the data key material payload, which is not specifically limited in the embodiments of the present application.

[0618] Regarding the padding field, it is a padding field used to ensure that the length of the encrypted message meets the message length requirement of the AES_CBC_128 algorithm. The value of the padding field can be determined by the communication device 1. In one example, the value of the padding field can be all 0s.

[0619] Regarding the padding length field, it is used to carry the byte length of the padding field. The padding length field occupies 1 byte. The value of the padding length field can be determined based on the encryption algorithm of the encrypted payload field. For example, if the encryption algorithm is the AES_CBC_128 encryption algorithm, the value carried by the padding length field is between 0 and 15. For another example, if the encryption algorithm is the AES_CBC_256 encryption algorithm, the value carried by the padding length field is between 0 and 31. The byte length of the padding field can be calculated using the following formula (2).

[0620] n1=(n==BlockSize)? 0:n formula (2)

[0621] Formula (2) is a formula expression used in the C language programming environment. The meaning of Formula 2 is: (n == BlockSize) determines whether they are equal. If they are equal, then n1 = 0. If they are not equal, then n1 = n.

[0622] Among them: n=BlockSize-(sizeof(auth payload)+sizeof(key material payload)+sizeof(padding length)%BlockSize;

[0623] sizeof is a function whose return value is the number of bytes of the input parameter. For example, the return value of sizeof(auth payload) is the number of bytes of the auth payload field.

[0624] BlockSize is the block length of the encryption algorithm used to calculate the encrypted payload field. For example, the block length of the AES_CBC_128 encryption algorithm is 16 bytes, so the BlockSize value is 16. Another example: the block length of the AES_CBC_256 encryption algorithm is 32 bytes, so the BlockSize value is 32.

[0625] Regarding the ICV field, this field is used to carry the integrity check value of message 3. The ICV field can be calculated using the following formula (3):

[0626] ICV=Prf(AIK,message 3) Formula (3)

[0627] In formula (3):

[0628] Prf: can be AES_CMAC_128 algorithm;

[0629] AIK is the authentication integrity key;

[0630] Message 3 is part of the fields in message 3. In one example, message 3 includes the EAP header of message 3 to the first byte of the ICV field, or in other words, message 3 includes the EAP header of message 3 to the last byte of the encrypted payload field, excluding the ICV itself. That is:

[0631] message 3={EAP header|EAP type|flags|ext flags|session ID|keyID|encrypted payload}.

[0632] In one example, if message 3 includes data key material 1, after sending message 3 to communication device 2, communication device 1 can use data key material 1 to derive a data integrity key and a data encryption key, and use these data integrity key and data encryption key to process the received data message. It should be noted that since communication device 1 has not yet verified the identity of communication device 2, communication device 1 cannot use the integrity calculation key and data encryption key derived above to process the data message sent to communication device 2.

[0633] S104: Communication device 2 performs identity authentication on communication device 1 according to message 3.

[0634] S105: When the communication device 1 passes the identity authentication, the communication device 2 obtains an updated key according to the key material 1 in the message 3, where the updated key includes PSK2.

[0635] S106: The communication device 2 saves the updated key.

[0636] After receiving the message 3, the communication device 2 may verify the message 3 to determine whether the communication device 1 has passed the identity authentication.

[0637] When the communication device 2 verifies the message 3, it can verify the value of each field in the message 3.

[0638] For the verification of EAP header fields, please refer to the relevant description in RFC3748, which will not be detailed here.

[0639] For the flags field: the P indicator bit must be 1, because message 3 is a message in the authentication phase and contains an encryption field, that is, an encrypted payload field. The R indicator bit must be 0, because message 3 is a request message. The value of the CS indicator bit should be the same as the value of the CS indicator bit in message 2. When the current version of the EAP-PSK protocol is 1, the value of the version field must be 1. In one example, if the value of the version field is not 1, the communication device 2 can directly determine that the authentication has failed and terminate the authentication process without verifying other fields. In this case, the communication device 2 can send a response message to the communication device 1 indicating the termination of the authentication. The response message may, for example, include an indication information, which is used to indicate that the reason for the termination of the authentication is that the version number of the EAP-PSK protocol does not match.

[0640] The value of the K indicator bit can be 1 or 0. If the value of the K indicator bit is 0, it means that the keyID field is not included in message 3, so there is no need to verify the KeyID field later. If the value of the K indicator bit is 1, it means that the keyID field is included in message 3, so communication device 2 also needs to verify the keyID field. When the keyID field is included in message 3, it means that communication device 1 and communication device 2 updated the authentication key during the last identity authentication. When communication device 2 verifies the keyID field, it verifies whether the keyID field matches the keyID of the locally stored available authentication key.

[0641] For the ext flags field: Since message 3 is an authentication message sent by communication device 1 to communication device 2, when the value 2 indicates the identity authentication stage, the value of the exch type field must be 2.

[0642] Regarding the session ID field: The value of the SSID field in the session ID field is the same as the value of the SSID field in message 1. If message 3 includes a CSID field, the value of the CSID field is the same as the value of the CSID field in message 2.

[0643] In this embodiment of the present application, communication device 2 can first verify the ICV field in message 3 to verify the integrity of message 3. If message 3 passes the integrity verification, the encrypted payload field in message 3 is then checked. This is because only if message 3 passes the integrity verification can it be confirmed that message 3 has not been tampered with during transmission and that the content in the encrypted payload field is likely to be authentic.

[0644] When verifying the ICV field in message 3, communication device 2 may calculate the ICV for all fields in message 3 except the ICV field, and compare the calculated value with the value of the ICV field carried in message 3. If the two values ​​are the same, message 3 is determined to have passed integrity verification; otherwise, message 3 is determined to have failed integrity verification. The algorithm and key used by communication device 2 to calculate the ICV field are the same as the algorithm and key used by communication device 1 to calculate the ICV field in message 3.

[0645] In one example, if the communication device 2 determines that the message 3 fails the integrity verification, the communication device 2 may ignore the message and continue to wait for a legitimate authentication message from the communication device 1 .

[0646] After communication device 2 determines that message 3 passes integrity verification, it can proceed to verify the encrypted payload field. When verifying the encrypted payload field, communication device 2 can first decrypt the encrypted payload field to obtain the auth payload field and the key material payload field. It should be noted that the algorithm and key used by communication device 2 to decrypt the encrypted payload field match the encryption algorithm and key used by communication device 1 to calculate the encrypted payload field.

[0647] After decrypting and obtaining the auth payload field and the key material payload field, communication device 2 can process the auth payload field and the key material payload field, respectively. The auth payload field is processed by verifying the auth payload to thereby verify the identity of communication device 1. The method for processing the key material payload can be determined based on the verification result of the auth payload. In one example, if the auth payload passes verification, communication device 2 can obtain an updated key based on key material 1 in message 3. For example, communication device 2 can obtain an updated key based on key material 1 and key derivation algorithm 1 in message 3. In another example, communication device 2 can directly determine key material 1 as the updated key. If the auth payload fails verification, it indicates that message 3 has been tampered with or the sender of message 3 is untrustworthy. In this case, communication device 2 can ignore the key material payload and not perform the steps of obtaining an updated key based on key material 1 and subsequently storing the updated key.

[0648] Regarding the auth payload field: the communication device 2 can first verify the TLV header of the auth payload. After the TLV header of the auth payload passes the verification, the authdata field of the auth payload can be further verified. When verifying the auth data field of the auth payload, the above formula (1) can be used to calculate the auth data, and the calculated auth data can be compared with the auth data in the auth payload field. If the two are the same, it is determined that the auth payload field has passed the verification. Otherwise, it is determined that the auth payload field has not passed the verification. It should be noted here that when the communication device 1 uses formula (1) to calculate the auth data, the message 1 in formula (1) is the message sent by the communication device 1 to the communication device 2, and the random number 2 and ID_2 are carried in the message 2 received by the communication device 1. When the communication device 2 uses formula (1) to calculate the auth data, the message 1 in formula (1) is the message received by the communication device 2, and the random number 2 and ID_2 are generated by the communication device 2. The TLV header is verified, for example, whether the TLV type of the TLV header is Auth payload, whether the value of the TLV length field is correct, etc.

[0649] It is understandable that since Message 1 participates in the calculation of auth data, the verification of auth data further verifies the legitimacy of Message 1, thereby avoiding the potential security risks caused by the plaintext transmission of Message 1.

[0650] In one example, if the auth payload field fails verification, communication device 2 may determine that the authentication has failed and terminate the authentication process. In this case, communication device 2 may send a response message to communication device 1 indicating the termination of authentication. The response message may include, for example, an indication indicating that the reason for the termination of authentication is authentication failure.

[0651] Regarding the key material payload field, if the auth payload field passes verification, it means that the communication device 1 passes identity authentication. In this case, the communication device 2 can extract the key material 1 carried in the key material payload field and use the key material 1 and the key derivation algorithm to derive the key.

[0652] In one example, message 3 carries PSK key material 1, and communication device 2 can derive updated PSK2 based on PSK key material 1 and key derivation algorithm 1. In one example, the updated PSK2 can be derived using the following formula (4) or formula (5).

[0653] PSK2=KDF(AES(PSK1,MSK[0-63]),“PSK”,PSK key material 1)Formula (4)

[0654] PSK2=KDF(PSK1, "PSK", PSK key material 1|MSK[0-63]) Formula (5)

[0655] In formula (4) and formula (5):

[0656] KDF is the key derivation algorithm 1. For details about KDF, refer to "6.2.1 Keyderivation function (KDF)" in IEEE 802.1x-2010. A detailed description is not given here.

[0657] AES stands for Advanced Encryption Standard (AES);

[0658] PSK1 is the PSK currently used by communication device 1 and communication device 2 for identity authentication, for example, it can be the PSK indicated by the keyID field in message 1;

[0659] MSK[0-63] is the 0th to 63rd bits of MSK;

[0660] "PSK" is a character string.

[0661] In another example, the updated PSK2 can also be calculated using the following formula (6):

[0662] PSK2=KDF(PSK1,“PSK”,MSK[0-63]) formula (6)

[0663] In this case, MSK[0-63] can be used as PSK key material 1.

[0664] In another example, when both communication device 1 and communication device 2 support an asymmetric key algorithm, communication device 2 can generate an updated PSK2 based on the PSK key material 1 sent by communication device 1 and the locally stored PSK key material 2. Accordingly, in this case, communication device 2 can also send PSK key material 3 to communication device 1, so that communication device 1 can generate an updated PSK2 based on the PSK key material 3 and the locally stored PSK key material 4 of communication device 1.

[0665] After the communication device 2 derives the updated PSK2, it can store the updated PSK2 in the non-volatile storage area of ​​the communication device 2, for example, in the hardware security module (HSM) or trusted execution environment (TEE) of the communication device 2. In some embodiments, the updated PSK2 can be derived in the memory, and after the updated PSK2 is stored in the non-volatile storage area, the updated PSK2 cached in the memory can be deleted. In some embodiments, the aforementioned updated PSK2 can be derived in the trusted application (TA) of the TEE. In an embodiment of the present application, if the updated PSK2 is obtained using the PSK key material 1 and the updated PSK2 is successfully stored in the non-volatile storage area of ​​the communication device 2, it can be considered that the communication device 2 has successfully completed the processing of the PSK derived material. If any of the steps of obtaining the updated PSK2 using the PSK key material 1 and storing the updated PSK2 in the non-volatile storage area fails, it means that the communication device 2 has not successfully completed the processing of the PSK key material 1. In addition, when the communication device 2 stores the updated PSK2, it also needs to store the keyID of the updated PSK2. The keyID can be stored in a non-volatile storage area or in other storages. For example: the communication device 2 corresponds to Figure 1As shown in the MCU 102, the MCU 102 can derive an updated PSK2 in the memory, and then save the updated PSK2 to the unreadable storage area of ​​the HSM, and store the keyID of the updated PSK2 in the flash.

[0666] In an example, message 3 carries authentication key material 1 , and communication device 2 can derive an updated authentication key according to authentication key material 1 and key derivation algorithm 2 .

[0667] In an example, authentication key material 1 may include four random numbers, namely random number 1', random number 2', random number 3', and random number 4', which are used to derive four keys in the authentication key. One derivation method can refer to the following formula 7-1:

[0668] {AIK|KDK|ACK|IAK}=KDF(KDK old , "New authentication keys", MSK[0-63]|Random number 1'|Random number 2'|Random number 3'|Random number 4') Formula (7-1)

[0669] Formula (7-1) indicates that KDF is used to iterate continuously until the output bit length meets the requirements of all keys.

[0670] In formula (7-1), KDK old Indicates the KDK before the update;

[0671] MSK[0-63] is the 0th to 63rd bits of MSK;

[0672] {AIK|KDK|ACK|IAK} indicates that AIK, KDK, ACK, and IAK are taken from the KDF output in that order. For example, if AIK, KDK, ACK, and IAK are all 128 bits, the first 128 bits of the KDF output are considered the AIK, the 128 bits after the AIK are considered the KDK, the 128 bits after the KDK are considered the ACK, and the 128 bits after the ACK are considered the IAK.

[0673] In yet another example, AIK may be derived using the following formula (7-2), KDK may be derived using the following formula (7-3), ACK may be derived using the following formula (7-4), and IAK may be derived using the following formula (7-5).

[0674] AIK=KDF(KDK old , "AIK", MSK[0-15]|random number 1') Formula (7-2)

[0675] KDK=KDF(KDK old , "KDK", MSK[16-31]|random number 2') Formula (7-3)

[0676] ACK=KDF(KDK old , "ACK", MSK[32-47]|random number 3') Formula (7-4)

[0677] IAK=KDF(KDK old , "IAK", MSK[48-63]|random number 4') Formula (7-5)

[0678] In formulas (7-2), (7-3), (7-4), and (7-5):

[0679] KDKold indicates the KDK before the update, or the KDK in the authentication key currently in use;

[0680] "AIK" means the string AIK;

[0681] MSK[0-15] is the 0th to 15th bits of MSK;

[0682] "KDK" means the string KDK;

[0683] MSK[16-31] is the 16th to 31st bits of MSK;

[0684] "ACK" means the string ACK;

[0685] MSK[32-47] is the 32nd to 47th bits of MSK;

[0686] MSK[48-63] is the 48th to 63rd bits of MSK; where:

[0687] MSK[0-15]=AES-128(KDK,{2}128bit IntermediateValue2)

[0688] MSK[16-31]=AES-128(KDK,{3}128bit IntermediateValue2)

[0689] MSK[32-47]=AES-128(KDK,{4}128bit IntermediateValue2)

[0690] MSK[48-63]=AES-128(KDK,{5}128bit IntermediateValue2)

[0691] EMSK[0-15]=AES-128(KDK,{6}128bit IntermediateValue2)

[0692] EMSK[16-31]=AES-128(KDK,{7}128bit IntermediateValue2)

[0693] EMSK[32-47]=AES-128(KDK,{8}128bit IntermediateValue2)

[0694] EMSK[48-63]=AES-128(KDK,{9}128bit IntermediateValue2);

[0695] For details about IntermediateValue2, please refer to the description of IntermediateValue2 above, which will not be repeated here.

[0696] In another example, the authentication key material 1 may include three random numbers, namely, random number 1', random number 2', and random number 3', which are used to derive three keys in the authentication key. One derivation method can refer to the following formulas (8-1), (8-2), and (8-3):

[0697] AIK=KDF(KDK old , "AIK", MSK[0-15]|random number 1') Formula (8-3)

[0698] KDK=KDF(KDK old , "KDK", MSK[16-31]|random number 2') Formula (8-4)

[0699] ACK=KDF(KDK old , "ACK", MSK[32-47]|random number 3') Formula (8-5)

[0700] In formulas (8-1), (8-2), and (8-3):

[0701] KDKold indicates the KDK before the update, or the KDK in the authentication key currently in use;

[0702] "AIK" means the string AIK;

[0703] MSK[0-15] is the 0th to 15th bits of MSK;

[0704] "KDK" means the string KDK;

[0705] MSK[16-31] is the 16th to 31st bits of MSK;

[0706] "ACK" means the string ACK;

[0707] MSK[32-47] is the 32nd to 47th bits of the MSK. In this mode, the identity authentication key IAK is the same as the authentication integrity key AIK.

[0708] In another example, the authentication key material 1 may include three random numbers, namely random number 1', random number 2', and random number 3', which are used to derive three keys in the authentication key respectively. The authentication key can be derived using the following formula (9).

[0709] {AIK|KDK|ACK}=KDF(KDK old , “New authentication keys”, MSK[0-63]|random number 1'|random number 2'|random number 3') Formula (9)

[0710] In formula (9):

[0711] KDKold indicates the KDK before the update, or the KDK in the authentication key currently in use;

[0712] "New authentication keys" means the string New authentication keys;

[0713] MSK[0-15] is the 0th to 63rd bits of MSK;

[0714] The identity authentication key IAK is the same as the authentication integrity key AIK.

[0715] In one example, when communication device 1 and communication device 2 communicate using a non-Ethernet port and both use an asymmetric key algorithm, communication device 2 can generate an updated authentication key based on authentication key material 1 sent by communication device 1 and locally stored authentication key material 2. Accordingly, in this case, communication device 2 can also send authentication key material 3 to communication device 1, so that communication device 1 can generate the updated authentication key based on authentication key material 3 and locally stored authentication key material 4.

[0716] After the communication device 2 derives the updated authentication key, it can store the updated authentication key, wherein the authentication key can be stored in a non-volatile storage area or in other memories, which is not specifically limited in the embodiment of the present application.

[0717] In one example, message 3 carries data key material, and communication device 2 can derive an updated data key based on the data key material and key derivation algorithm 3. In one example, communication device 2 can derive an updated data key based on data key material 1 and key derivation algorithm 3. In one example, the updated data key can be derived using the following formula (10) or formula (11).

[0718] DIK=KDF(MSK[0-16], “DIK”, DIK key material 1) Formula (10)

[0719] DCK=KDF(MSK[16-31], “DCK”, DCK key material 1) Formula (11)

[0720] In formula (10) and formula (11):

[0721] The data key material 1 includes the DIK key material 1 and the DCK key material 1;

[0722] DIK is the updated data integrity key;

[0723] KDF is the key derivation algorithm 3;

[0724] DCK is the updated data encryption key.

[0725] In another example, when communication device 1 and communication device 2 communicate using a non-Ethernet port and both use an asymmetric key algorithm, communication device 2 can generate an updated digital key based on the digital key material 1 sent by communication device 1 and the locally stored digital key material 2. Accordingly, in this case, communication device 2 can also send digital key material 3 to communication device 1, so that communication device 1 can generate the updated digital key based on the digital key material 3 and the locally stored digital key material 4 of communication device 1.

[0726] After the communication device 2 derives the updated data key, it can store the updated data key, wherein the data key can be stored in a non-volatile storage area or in other storage, which is not specifically limited in the embodiment of the present application.

[0727] S107: Communication device 2 sends message 4 to communication device 1, where message 4 includes identity authentication information 2.

[0728] After the communication device 2 determines that the communication device 1 has passed the identity authentication based on the identity authentication information 1 in the message 3, it can generate a message 4 and send the message 4 to the communication device 1. The message 4 includes the identity authentication information 2. The identity authentication information 2 is used to authenticate the communication device 2. In one example, the message 4 may also include key material confirmation information. The key material confirmation information is used to indicate the processing result of the key material 1 in the message 3 by the communication device 2. Of course, in one example, if the communication device 2 successfully completes the processing of all the key materials 1 carried in the message 3, the key material 1 confirmation information may not be carried in the message 4. After the communication device 1 receives the message 4, if there is no key material 1 confirmation information in the message 4, it is assumed that the communication device 2 has successfully completed the processing of all the key materials 1 carried in the message 3, that is, the communication device 2 has completed the key update based on the key material 1.

[0729] In the embodiment of the present application, message 4 may also be an EAP-PSK message. The structure of message 4 is the same as that of message 3. Figure 3c The fields in message 4 are explained as follows:

[0730] For the meaning of each field in the EAP header, please refer to the relevant description section of Request for Comments (RFC) 3748, which is not described in detail here.

[0731] The value of the EAP Type field is 47.

[0732] Regarding the flags field: the value of the P indicator bit is 1, and message 4 is the fourth message in the identity authentication process. Message 4 includes identity authentication information 4 that can verify the identity of the communication device 4, as well as key material confirmation information. To prevent the above information in message 4 from being leaked, message 4 is sent in ciphertext. The value of the R indicator bit is 1, indicating that message 4 is a response message. The value of the version indicator bit can be 1; the value of the CS indicator bit is the same as the value of the CS indicator bit in message 2. The K indicator bit is used to indicate whether the keyID field is included. It should be noted here that the meaning of the keyID field in message 4 is the same as that of the keyID field in message 3. For details, please refer to the description of the keyID field in S103, which will not be described in detail here.

[0733] Regarding the exch type field, in message 4, the value of the exch type field can be 2, which is used to indicate the identity authentication stage.

[0734] Regarding the session ID field, the value of the SSID field in the session ID field is the same as the value of the SSID field in message 1. If the session ID field includes the CSID field, the value of the CSID field is the same as the value of the CSID in message 2.

[0735] Regarding the encrypted payload field, this field is used to carry encrypted data. In one example, the encrypted payload field can be a TLV field. For the structure of the TLV field, please refer to Figure 3b , which will not be repeated here. In one example, the encrypted payload field may include a TLV header field and an encrypted data field. Among them, the encrypted data field is used to carry the encrypted data. In one implementation of the embodiment of the present application, the value of the encrypted data field in message 3 can be obtained by encrypting using the AES_CBC_128 encryption algorithm. In this case, in addition to the TLV header field and the encrypted data field, the encrypted payload field may also include an initialization vector (IV) field. The IV field is used to carry the initial vector value required for encryption using the AES_CBC_128 encryption algorithm. At this time, the encrypted payload field can refer to Figure 3d In the embodiment of the present application, the value of the encrypted data field can be the value of the encrypted data field. Figure 3h The fields shown are encrypted. Figure 3h The fields shown include the auth payload field, the key confirmed payload field, the padding field, and the padding length field.

[0736] The auth payload field is used to carry the identity authentication information 2 mentioned in S107. The auth payload field includes "TLV header|auth data". Regarding the TLV header, please refer to the relevant description part above and will not be described in detail here. The auth data field is used to instruct the communication device 1 to authenticate the communication device 2. In the embodiment of the present application, the auth data value carried by the auth data field in the message 4 can be calculated based on the message 2, the random number 1 mentioned above, and the identifier of the communication device 1. For example: the auth data value can be calculated using the following formula (12):

[0737] auth data = Prf (key 2, {message 2 | random number 1 | ID_1}) formula (12)

[0738] Among them, Prf can be an AES_CMAC_128 algorithm, and key 2 can be derived from the PSK indicated by keyID in message 1. The key 2 mentioned here and the key 1 in formula (1) can be the same or different, and the embodiment of the present application does not make specific limitations. ID_1 is the identifier of communication device 2.

[0739] In an embodiment of the present application, the calculation method of the auth data field in message 3 is different from the calculation method of the auth data field in message 4. This method can prevent replay attacks and brute force attacks to a certain extent.

[0740] The key confirmed payload field is used to carry key material confirmation information. In one example, the key confirmed payload field can be a TLV field. For the structure of the TLV field, please refer to Figure 3b , which will not be described again here. In one example, see Figure 3i , Figure 3i A schematic diagram of a key confirmed payload field provided in an embodiment of the present application. The key confirmed payload field may include a TLV header field, a key number (keynumbers, keynums) field, and a key confirmed (key confirmed) field.

[0741] For details about the TLV header field, please refer to the description of the TLV header field above and will not be described in detail here.

[0742] The keynums field indicates the number of key confirmation messages carried in the key confirmed payload field. The keynums field can, for example, occupy 1 byte. The key confirmed field carries key confirmation information. In one example, the value of the keynums field in message 4 can be the same as the value of the keynums field in message 3. That is, if message 3 carries m groups of key material 1, message 4 can also carry m corresponding groups of key confirmation messages, with one group of key material 1 corresponding to one key confirmation message. For example, if message 3 carries PSK key material 1, message 4 carries the confirmation information corresponding to PSK key material 1. For another example, if message 3 carries PSK key material 1 and authentication key material 1, message 4 carries the confirmation information corresponding to PSK key material 1 and the confirmation information corresponding to authentication key material 1. For another example, if message 3 carries PSK key material 1, authentication key material 1, and data key material 1, message 4 carries the confirmation information corresponding to PSK key material 1, the confirmation information corresponding to authentication key material 1, and the confirmation information corresponding to data key material 1.

[0743] In another example, for the key material 1 that the communication device 2 did not successfully process, the message 4 may not carry the confirmation information corresponding to the key material 1. For example, the message 3 carries the PSK key material 1, the authentication key material 1, and the data key material 1, and the communication device 2 successfully processes the authentication key material 1 and the data key material 1, but fails to process the PSK key material 1. Then, the message 4 may carry the confirmation information corresponding to the authentication key material 1 and the confirmation information corresponding to the data key material 1, but not the confirmation information of the PSK key material 1. In this case, the value of the keynums field in the message 4 may be less than the value of the keynums field in the message 3. In this case, the structure of the key confirmed field can refer to Figure 3j As shown. Figure 3j The key confirmed field includes the key type field, keyID field, and check value field (i.e., the MAC_K field in Figure j).

[0744] For details about the key type field and keyID field, please refer to the above Figure 3g The description part will not be repeated here.

[0745] The MAC_K field is used to perform integrity verification on the key material 1. Taking the MAC_K corresponding to the PSK key material 1 as an example, the value of the MAC_K field corresponding to the PSK key material 1 can be achieved by the following formula (13) or (14).

[0746] MAC_K(PSK)=Prf(key3, key type|keyID|PSK key material 1) Formula (13)

[0747] MAC_K(PSK)=Prf(key3, key type|keyID|updatedPSK2) Formula (14)

[0748] In formula (13) and formula (14):

[0749] Key 3 may be derived from the PSK indicated by keyID in message 1. Key 3 and key 1 in formula (1) and key 2 in formula (12) may be the same or different, and this embodiment of the present application does not specifically limit this.

[0750] The key type is PSK;

[0751] keyID is the updated keyID of PSK2;

[0752] The PSK key material 1 is the PSK key material 1 carried in the message 3 received by the communication device 2 .

[0753] Regarding the padding field and the padding length field, please refer to the relevant description in S103 and will not be described in detail here.

[0754] Regarding the ICV field, this field is used to carry the integrity check code of message 4. The ICV field can be calculated using the following formula (15):

[0755] ICV=Prf(AIK,message 4) Formula (15)

[0756] In formula (15):

[0757] Prf: can be AES_CMAC_128 algorithm;

[0758] Message 4 is part of the fields in message 4. In one example, message 4 includes the EAP header of message 4 to the first byte of the ICV field, or in other words, message 4 includes the EAP header of message 4 to the last byte of the encrypted payload field, excluding the ICV itself. That is:

[0759] message 4={EAP header|EAP type|flags|ext flags|session ID|keyID|encrypted payload}.

[0760] S108: The communication device 1 verifies the received message 4.

[0761] After receiving message 4, communication device 1 can verify message 4. On the one hand, message 4 can be used to determine whether communication device 2 has passed identity authentication, and on the other hand, message 4 can be used to determine the result of communication device 2 processing key material 1 carried in message 3.

[0762] When the communication device 1 verifies the message 4, it can verify the value of each field in the message 4.

[0763] For the verification of EAP header fields, please refer to the relevant description in RFC3748, which will not be detailed here.

[0764] For the flags field: the P indicator bit must be 1, because message 4 is a message in the authentication phase and contains an encryption field, that is, an encrypted payload field. The R indicator bit must be 1, because message 4 is a response message. The value of the CS indicator bit should be the same as the value of the CS indicator bit in message 2. When the current version of the EAP-PSK protocol is 1, the value of the version field must be 1. In one example, if the value of the version field is not 1, the communication device 1 can directly determine that the identity authentication has failed and terminate the identity authentication process without verifying other fields. In this case, the communication device 1 can send a response message indicating the identity authentication failure to the communication device 2. The response message may, for example, include an indication information, which is used to indicate that the reason for the termination of the identity authentication is that the version number of the EAP-PSK protocol does not match.

[0765] The value of the K indicator bit can be 1 or 0. If the value of the K indicator bit is 0, it means that the keyID field is not included in message 4, so there is no need to verify the keyID field later. If the value of the K indicator bit is 1, it means that the keyID field is included in message 4, so communication device 1 also needs to verify the keyID field. When the keyID field is included in message 4, it means that communication device 1 and communication device 2 updated the authentication key during the last identity authentication. When communication device 1 verifies the keyID field, it verifies whether the keyID field matches the keyID of the locally stored available authentication key.

[0766] For the ext flags field: Since message 4 is an authentication message sent by communication device 2 to communication device 1, when the value 2 indicates the identity authentication stage, the value of the exch type field must be 2.

[0767] Regarding the session ID field: The value of the SSID field in the session ID field is the same as the value of the SSID field in message 1. If message 3 includes a CSID field, the value of the CSID field is the same as the value of the CSID field in message 2.

[0768] In the embodiment of the present application, the communication device 1 can first verify the ICV field in message 4 to verify the integrity of message 4. If message 4 passes the integrity verification, the encrypted payload field in message 4 is then checked. This is because only if message 4 passes the integrity verification can it be confirmed that message 4 has not been tampered with during transmission and that the content in the encrypted payload field is likely to be authentic.

[0769] When communication device 1 verifies the ICV field in message 4, it can perform ICV calculation on the other fields in message 4 except the ICV field, and compare the calculated value with the value of the ICV field carried in message 4. If the two are the same, it is determined that message 4 has passed integrity verification; otherwise, it is determined that message 4 has failed integrity verification. The algorithm and key used by communication device 1 to calculate the ICV field in message 4 are the same as the algorithm and key used by communication device 2 to calculate the ICV field in message 4. If communication device 1 includes multiple keys, communication device 1 can, for example, determine the corresponding key based on the SSID in message 4, and use the key to perform ICV calculation on the other fields in message 4 except the ICV field.

[0770] In one example, if the communication device 1 determines that the message 4 fails the integrity verification, the communication device 1 may ignore the message and continue to wait for a legitimate authentication message from the communication device 2 .

[0771] After communication device 1 determines that message 4 passes integrity verification, it can proceed to verify the encrypted payload field. When verifying the encrypted payload field, communication device 1 can first decrypt the encrypted payload field to obtain the auth payload field and the key confirmed payload field. It should be noted that the algorithm and key used by communication device 1 to decrypt the encrypted payload field match the encryption algorithm and key used by communication device 2 to calculate the encrypted payload field.

[0772] After decrypting the auth payload and key confirmed payload fields, communication device 1 can process them separately. The auth payload field is processed by verifying the auth payload, thereby verifying the identity of communication device 2. The processing of the key confirmed payload can be determined based on the verification results of the auth payload. In one example, if the auth payload passes verification, communication device 1 can further verify the integrity of the key confirmed payload.

[0773] Regarding the auth payload field: the communication device 1 can first verify the TLV header of the auth payload, and after the TLV header of the auth payload passes the verification, it can then verify the auth data field of the auth payload. When verifying the auth data field of the auth payload, the above formula (12) can be used to calculate the auth data, and the calculated auth data can be compared with the auth data in the auth payload field of message 4. If the two are the same, it is determined that the auth payload field has passed the verification; otherwise, it is determined that the auth payload field has failed the verification. It should be noted here that when the communication device 2 uses formula (12) to calculate the auth data, the message 2 in formula (12) is the message sent by the communication device 2 to the communication device 1, and the random number 1 and ID_1 are carried in the message 1 received by the communication device 2. When the communication device 1 uses formula (12) to calculate the auth data, the message 2 in formula (12) is the message received by the communication device 1, and the random number 1 and ID_1 are generated by the communication device 1. The TLV header is verified, for example, to check whether the TLV type of the TLV header is Auth payload and whether the value of the TLV length field is correct. It can be understood that since Message 2 participates in the calculation of Auth Data, the verification of Auth Data further verifies the legitimacy of Message 2, thereby avoiding the potential security risks caused by the plaintext transmission of Message 2.

[0774] In one example, if the auth payload field fails verification, communication device 1 may determine that the authentication has failed and terminate the authentication process. In this case, communication device 1 may send a response message indicating the authentication failure to communication device 2. The response message may include, for example, indication information indicating the authentication failure.

[0775] In one example, if the auth payload field passes verification, the communication device 1 can continue to verify the key confirmed payload field. When verifying the key confirmed payload field, each key confirmed field in the key confirmed payload field can be checked. Taking the key confirmed field corresponding to PSK (hereinafter referred to as the PSK key confirmed field) as an example, the communication device 1 can adopt the method of calculating the MAC_K field by the communication device 2 to calculate the value of the MAC_K field in the PSK key confirmed field. For example, the communication device 1 can use the above formula (13) and formula (14) to calculate the PSK key confirmed field. After the communication device 1 calculates the corresponding value, it can compare the calculated value with the value of the MAC_K field in the PSK key confirmed field in the message 4. If the two are the same, the PSK key confirmed field passes verification. Otherwise, the PSK key confirmed field fails verification.

[0776] It should be noted here that if the communication device 1 uses the above formula (14) for calculation, the communication device 1 needs to use the PSK key material 1 carried in the message 3 to obtain the updated PSK2; similarly, when verifying the keyconfirmed field corresponding to the authentication key, if the communication device 1 uses the above formula (14) for calculation, the communication device 1 needs to use the authentication key material 1 carried in the message 3 to obtain the updated authentication key; when verifying the keyconfirmed field corresponding to the data key, if the communication device 1 uses the above formula (14) for calculation, the communication device 1 needs to use the data key material 1 carried in the message 3 to obtain the updated data key.

[0777] S109: The communication device 1 obtains an updated key based on the key material 1, and stores the obtained updated key.

[0778] In the embodiment of the present application, S109 may be executed after S103 and before S108, or may be executed after S108, and the embodiment of the present application does not make any specific limitation.

[0779] If S109 is executed between S103 and S108, the communication device 1 can perform corresponding processing based on the result of verifying the key confirmed payload field in S108. The following describes several possible situations.

[0780] In one example, all key materials 1 included in message 3 have corresponding key material 1 confirmation information in message 4, and communication device 1 determines that the key material 1 confirmation information in message 4 has all been verified. In this case, communication device 1 can immediately execute the following steps S110 and S111 to notify communication device 2 of the successful identity authentication and key update. If message 3 includes digital key material 1, communication device 2 can communicate with communication device 1 using the digital key derived from the digital key material 1.

[0781] In another example, the amount of key material 1 confirmation information in message 4 is less than the amount of key material 1 in message 3. That is, the value of the keynumbers field in message 4 is less than the value of the keynumbers field in message 3. This indicates that communication device 2 has completed a partial key update. Accordingly, when communication device 1 verifies the key confirmed payload field, it determines that some or all key confirmed fields have passed verification. In this case, communication device 1 can retain the updated key corresponding to the verified key confirmed field and delete all other keys stored in S109 except for the updated key corresponding to the verified key confirmed field.

[0782] For example, message 3 includes PSK key material 1, authentication key material 1, and data key material 1. Communication device 1 executes S109 and saves the updated PSK2, updated authentication key, and updated data key. Message 4 includes PSK key material 1 confirmation information and authentication key material 1 confirmation information. Communication device 1 determines that both the PSK key material 1 confirmation information and the authentication key material 1 confirmation information have passed authentication. Communication device 1 can then delete the saved updated data key because communication device 2 failed to successfully update the data key.

[0783] For example, message 3 includes PSK key material 1, authentication key material 1, and data key material 1. Communication device 1 executes S109 and saves the updated PSK2, updated authentication key, and updated data key. Message 4 includes PSK key material 1 confirmation information and authentication key material 1 confirmation information. Communication device 1 determines that the PSK key material 1 confirmation information has been authenticated. Communication device 1 can then delete the saved updated data key and updated authentication key. Because communication device 2 failed to successfully update the data key, communication device 1 determines that the authentication key confirmation information in message 4 has failed verification.

[0784] If S109 is executed after S108, then in the specific implementation of S109, the communication device 1 can combine the result of verifying the keyconfirmed payload field in S108 to obtain and save the relevant updated key. The following introduces several possible situations.

[0785] In one example, all key materials 1 included in message 3 have corresponding key material 1 confirmation information in message 4, and the communication device 1 determines that the key material 1 confirmation information in message 4 has all passed verification. In this case, the communication device 1 can obtain the corresponding updated key based on all key materials 1 in message 3 and save the updated key. It should be noted here that after the communication device 1 obtains the updated PSK2 based on the PSK key material 1, it is necessary to store the updated PSK2 in the non-volatile storage area of ​​the communication device 1. If any one of the two steps of the communication device 1 obtaining the updated PSK2 based on the PSK key material 1 and the communication device 1 storing the updated PSK2 in the non-volatile storage area of ​​the communication device 1 fails, the communication device 1 fails to update the PSK.

[0786] In one example, the communication device 1 may first save the key material 1. As an example, when the key material 1 includes PSK key material 1, the communication device 1 may read the PSK key material 1 before the aging period of PSK2 begins, and obtain PSK2 based on the PSK key material 1. As another example, when the key material 1 includes data key material 1, the communication device 1 may read the data key material 1 before the aging period of the updated data key begins, and obtain an updated data key based on the PSK key material 1. As another example, when the key material 1 includes authentication key material 1, the communication device 1 may read the authentication key material 1 before the aging period of the updated authentication key begins, and obtain an updated authentication key based on the authentication key material 1.

[0787] In another example, the amount of key material confirmation information in message 4 is less than the amount of key material 1 in message 3. That is, the value of the keynumbers field in message 4 is less than the value of the keynumbers field in message 3. In other words, communication device 2 has completed the update of part of the key. Accordingly, when communication device 1 verifies the key confirmed payload field, it determines that some or all of the key confirmed fields have passed verification. In this case, communication device 1 can obtain an updated key based on the key material 1 corresponding to the verified key confirmed fields and save the updated key. For the key material 1 corresponding to the key confirmed fields that have not passed verification, communication device 1 may not process it, that is, it no longer performs the steps of obtaining an updated key based on the key material 1 and saving the updated key.

[0788] For example, message 3 includes PSK key material 1, authentication key material 1, and data key material 1. Message 4 includes PSK key material 1 confirmation information and authentication key material 1 confirmation information. If communication device 1 determines that both the PSK key material 1 confirmation information and the authentication key material 1 confirmation information are authenticated, communication device 1 can obtain and store an updated PSK2 based on PSK key material 1. Communication device 1 can also obtain and store an updated authentication key based on authentication key material 1. Communication device 1 does not need to perform the step of obtaining an updated data key based on data key material 1.

[0789] For example, message 3 includes PSK key material 1, authentication key material 1, and data key material 1. Message 4 includes PSK key material 1 confirmation information and authentication key...

Claims

1. A method for media access control security MACSec communication based on a pre-shared key PSK, characterized in that: Executed by a first communication device, the method includes: within an aging period of a first PSK, deriving a first media access control security MACSec key based on the first PSK, wherein the first PSK is used to process a message for identity authentication exchanged between the first communication device and the second communication device within the aging period of the first PSK; The first PSK is updated to a second PSK, where the second PSK is used to process messages for identity authentication exchanged between the first communication device and the second communication device within an aging period of the second PSK; the first PSK and the second PSK are also used by the first communication device to derive: an encryption key for encrypting information in the message for identity authentication, and / or an integrity calculation key for calculating integrity verification information of the message for identity authentication; Within an aging period of the second PSK, a second MACSec key is derived based on the second PSK.

2. The method according to claim 1, characterized in that The updating of the first PSK to a second PSK comprises: receiving a first protocol message sent by a second communication device within an aging period of the first PSK, wherein the first protocol message includes a first PSK key material, and the first PSK key material is used to generate the second PSK; The second PSK is obtained according to the first PSK key material.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: The second PSK is stored in a non-volatile storage area of ​​the first communication device.

4. The method according to claim 1 or 2, characterized in that: The deriving a second MACSec key by using the second PSK includes: The second PSK is used as a security connection associated key CAK to derive the second MACSec key.

5. The method according to claim 1 or 2, characterized in that: The deriving a second MACSec key by using the second PSK includes: Generate a master session key MSK according to the second PSK; deriving a secure connection associated key CAK using the MSK; The second MACSec key is derived using the CAK.

6. The method according to claim 2, characterized in that The obtaining the second PSK according to the first PSK key material includes: The second PSK is obtained according to the first PSK key material and the second PSK key material of the first communication device.

7. The method according to claim 1, 2 or 6, characterized in that: The method further comprises: The third PSK key material is sent to the second communication device, so that the second communication device generates the second PSK according to the third PSK key material.

8. The method according to claim 2, characterized in that: The obtaining the second PSK according to the first PSK key material includes: The first PSK key material is determined as the second PSK.

9. The method according to claim 2, characterized in that: The obtaining the second PSK according to the first PSK key material includes: The second PSK is obtained according to the first PSK key material and a first key derivation algorithm.

10. The method according to claim 9, characterized in that The generating the second PSK according to the first PSK key material and the first key derivation algorithm comprises: Calculating the first PSK key material using a first algorithm to obtain an intermediate value; The second PSK is generated according to the intermediate value and the first key derivation algorithm.

11. The method according to any one of claims 2 or 6 or 8-10, characterized in that: The first PSK key material includes a random number.

12. The method according to any one of claims 2 or 6 or 8-10, characterized in that: The first protocol message is a message of the PSK-based extended authentication protocol EAP-PSK.

13. The method according to claim 12, characterized in that The first protocol message includes an extended type-length-value TLV field, and the extended TLV field includes the first PSK key material.

14. The method according to claim 12, characterized in that In the first protocol message, the first PSK key material is encrypted using a first key.

15. The method according to claim 13 or 14, characterized in that The first protocol message also includes first integrity verification information, and the first integrity verification information is used to perform integrity verification on the first protocol message.

16. The method according to claim 15, characterized in that Before obtaining the second PSK according to the first PSK key material, the method further includes: Perform integrity verification on the first protocol message according to the first integrity verification information.

17. The method according to claim 14 or 16, characterized in that The first protocol message carries an identifier of the first key, and obtaining the second PSK according to the first PSK key material includes: determining the first key according to the identifier of the first key; decrypting the first PSK keying material using the first key; The second PSK is obtained according to the first PSK key material obtained by decryption.

18. The method according to claim 16, characterized in that The first protocol message includes an identifier of a second key, where the identifier of the second key is used to identify the second key, and the performing integrity verification on the first protocol message according to the first integrity verification information includes: determining the second key according to the identifier of the second key; Perform integrity verification on the first protocol message according to the second key and the first integrity verification information.

19. The method according to claim 14 or 16, characterized in that: Before receiving the first protocol message, the method further includes: A second protocol message is sent to the second communication device, where the second protocol message carries an identifier of a third key, where the identifier of the third key is used to identify a third key, and the third key is used to derive the first key.

20. The method according to claim 15, characterized in that Before receiving the first protocol message, the method further includes: A second protocol message is sent to the second communication device, wherein the second protocol message carries an identifier of a third key, the identifier of the third key is used to identify the third key, the third key is used to derive a second key, and the second key is used to calculate the first integrity verification information.

21. The method according to claim 20, characterized in that The third key includes the first PSK.

22. The method according to claim 20 or 21, characterized in that Before sending the second protocol message to the second communication device, the method further includes: A third protocol message is received from the second communication device, where the third protocol message is used to request identity authentication for the second communication device.

23. The method according to claim 22, characterized in that The third protocol message carries the identifier of the third key.

24. The method according to claim 22, characterized in that The first protocol message includes first identity authentication information, and the first identity authentication information is used to authenticate the second communication device.

25. The method according to claim 24, characterized in that In the first protocol message, the first identity authentication information is encrypted by using the first key.

26. The method according to claim 24 or 25, characterized in that The first identity authentication information is calculated based on the fourth key using one or more of the following: Some or all fields of the third protocol message, and some or all fields of the second protocol message.

27. The method according to claim 24 or 25, characterized in that The method further comprises: The second communication device is authenticated using the first identity authentication information.

28. The method according to claim 26, characterized in that The using the first identity authentication information to authenticate the second communication device includes: Calculating the target field using the fourth key to obtain third identity authentication information; Match and verify the third identity authentication information with the first identity authentication information carried in the first protocol message; wherein the target field includes one or more of the following: Some or all fields of the third protocol message, and some or all fields of the second protocol message.

29. The method according to claim 28, characterized in that The using the fourth key to calculate the target field to obtain the third identity authentication information includes: Calculating the target field using the fourth key to obtain a first calculation result; The first calculation result is encrypted using the first key to obtain the third identity authentication information.

30. The method according to claim 28 or 29, characterized in that The fourth key is derived from the third key.

31. The method according to claim 28 or 29, characterized in that The fourth key is derived from the third PSK stored in the first communication device and the second communication device.

32. The method according to claim 31, characterized in that The second protocol message carries the identifier of the third PSK, and the identifier of the third PSK is used to identify the third PSK.

33. The method according to claim 3, characterized in that The method further comprises: A fourth protocol message is sent to the second communication device, where the fourth protocol message carries first indication information, and the first indication information is used to indicate that the first communication device has saved the second PSK.

34. The method according to claim 33, characterized in that The fourth protocol message includes an extended TLV field, and the extended TLV field includes the first indication information.

35. The method according to claim 33 or 34, characterized in that The fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message.

36. The method according to claim 33 or 34, characterized in that The fourth protocol message includes second identity authentication information, and the second identity authentication information is used to authenticate the first communication device.

37. The method according to claim 36, characterized in that In the fourth protocol message, the second identity authentication information is encrypted by using the first key.

38. The method according to claim 36, characterized in that The second identity authentication information is calculated based on the fourth key using one or more of the following: Some or all of the fields in the second protocol message, and some or all of the fields in the third protocol message.

39. The method according to claim 33 or 34 or 37 or 38, characterized in that The method further comprises: A fifth protocol message is received from the second communication device, wherein the fifth protocol message carries an identity authentication result and a PSK update result.

40. The method according to claim 39, characterized in that The method further comprises: If the identity authentication result in the fifth protocol message indicates that the identity authentication fails, or if the PSK update result in the fifth protocol message indicates that the PSK update fails, then the second PSK is deleted.

41. The method according to claim 39, characterized in that The method further comprises: A sixth protocol message is sent to the second communication device, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message.

42. The method according to claim 39, characterized in that The method further comprises: Perform integrity verification on the fifth protocol message.

43. The method according to any one of claims 2 or 6 or 8-10 or 13 or 14 or 16 or 18 or 20 or 21 or 23-25 ​​or 28 or 29 or 32-34 or 37 or 38 or 40-42, characterized in that: The first communication device stores a first data key, the first protocol message includes a data key material, the data key material is used to generate a second data key, the first data key is used to process data messages exchanged between the first communication device and the second communication device within an aging period of the first data key, and the second data key is used to process data messages exchanged between the first communication device and the second communication device within an aging period of the second data key; The method further comprises: The second data key is obtained according to the data key material.

44. The method according to claim 43, characterized in that The second data key includes: An integrity calculation key and / or an encryption key, wherein the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

45. The method according to claim 2 or 6 or any one of 8-10 or 13 or 14 or 16 or 18 or 20 or 21 or any one of 23-25 ​​or 28 or 29 or any one of 32-34 or 37 or 38 or any one of 40-42 or 44, characterized in that: The first communication device stores a first authentication key, the first protocol message includes an authentication key material, the authentication key material is used to generate a second authentication key, the first authentication key is used to process the identity authentication message exchanged between the first communication device and the second communication device within an aging period of the first authentication key, and the second authentication key is used to process the identity authentication message exchanged between the first communication device and the second communication device within an aging period of the second authentication key; The method further comprises: The second authentication key is obtained according to the authentication key material.

46. ​​The method according to claim 45, characterized in that The second authentication key includes any one or more of the following: An integrity calculation key, an encryption key, a key derivation key and an authentication key, wherein the integrity calculation key is used to perform integrity calculation on the authentication message, the encryption key is used to encrypt the authentication message, the key derivation key is used to derive other keys, and the authentication key is used to calculate the authentication information in the authentication message.

47. The method according to claim 12 or 13 or 14 or 16 or 18 or 20 or 21 or any one of 23-25 ​​or any one of 28 or 29 or 32-34 or any one of 37 or 38 or 40-42 or 44 or 46, characterized in that: An identifier for deriving the CAK of the second MACSec key, generated according to any one or more of the following parameters: A first random number generated by the first communication device, a second random number generated by the second communication device, and a session identifier of the first protocol message.

48. The method according to claim 12 or 13 or 14 or 16 or 18 or 20 or 21 or any one of 23-25 ​​or any one of 28 or 29 or 32-34 or any one of 37 or 38 or 40-42 or 44 or 46, characterized in that: The first protocol message includes: EAP header, EAP extension header and keyword field.

49. The method according to claim 48, characterized in that The PSK keying material is carried in the Key field.

50. The method according to claim 48, characterized in that The keyword field includes any one or more of the following fields: Protocol version number field, session identification field, key identification field, encrypted data field, random number field, identity identification field and integrity verification field.

51. The method according to claim 50, characterized in that The keyword field includes the encrypted data field, and the first PSK key material is carried in the encrypted data field.

52. The method according to any one of claims 12 or 13 or 14 or 16 or 18 or 20 or 21 or 23-25 ​​or any one of 28 or 29 or 32-34 or any one of 37 or 38 or 40-42 or any one of 44 or 46 or 49-51, characterized in that: The method further comprises: Sending second indication information to the second communication device, where the second indication information is used to indicate that the first communication device has the capability of automatically updating the PSK.

53. The method according to any one of claims 2 or 6 or 8-10, characterized in that: The first protocol message is a message based on the Internet Key Exchange Protocol IKE.

54. The method according to claim 53, characterized in that The first PSK key material is carried in a payload field of the first protocol message.

55. The method according to claim 53, characterized in that The first PSK key material is carried in a notification payload field of the first protocol message.

56. The method according to claim 53, characterized in that The first PSK key material is carried in an extended TLV field of the first protocol message.

57. The method according to claim 53, characterized in that The method further comprises: Sending third indication information to the second communication device, where the third indication information is used to indicate that the first communication device has a capability of automatically updating the PSK.

58. The method according to claim 57, characterized in that The third indication information is carried in the notification payload field of the message based on the IKE protocol.

59. The method according to claim 57 or 58, characterized in that The third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notification payload field of the message based on the IKE protocol includes the notification message type field.

60. The method of claim 53, wherein: The method further includes: sending a seventh protocol message to the second communication device, where the seventh protocol message is used to indicate that the first communication device has saved the second PSK.

61. The method according to claim 60, characterized in that The seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second PSK.

62. The method according to claim 61, characterized in that The seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

63. The method according to claim 53, characterized in that The first protocol message is an authentication exchange AUTHexchange message.

64. The method according to claim 53, characterized in that The first protocol message is a create child security association exchange CREATE_CHILD_SA exchange message.

65. The method of claim 53, wherein: The first protocol message is a notification exchange INFORMATIONAL exchange message.

66. The method according to any one of claims 2 or 6 or 8-10, characterized in that: The first protocol message is a message based on the media access control security key protocol MKA.

67. The method according to claim 66, characterized in that The first PSK key material is carried in an extended parameter set parameter set field of the first protocol message.

68. The method according to any one of claims 66, characterized in that The method further comprises: Sending fifth indication information to the second communication device, where the fifth indication information is used to indicate that the first communication device has a capability of automatically updating the PSK.

69. The method according to claim 68, characterized in that The fifth indication information is carried in the parameter set field of the MKA-based message.

70. The method according to claim 69, characterized in that The fifth indication information is carried in a parameter set type field of the MKA-based message, where the parameter set field includes a parameter set type field.

71. The method of claim 66, wherein: The method further comprises: An eighth protocol message is sent to the second communication device, where the eighth protocol message is used to indicate that the first communication device has saved the second PSK.

72. The method according to claim 71, characterized in that The eighth protocol message includes sixth indication information, and the sixth indication information is used to indicate that the first communication device has saved the second PSK.

73. The method according to claim 72, characterized in that The eighth protocol message is an MKA-based message, and the sixth indication information is carried in a parameter set type field of the MKA-based message.

74. The method according to claim 1 or 2, characterized in that The first communication device is a vehicle-mounted device.

75. The method according to claim 1 or 2, characterized in that The second communication device is a vehicle-mounted device.

76. A method for media access control secure MACSec communication based on a pre-shared key PSK, characterized in that: Executed by a second communication device, the method includes: Acquire a first PSK key material, where the first PSK key material is used to instruct a first communication device to generate a second PSK, where the first PSK is used to process messages for identity authentication exchanged between the first communication device and the second communication device within an aging period of the first PSK, and the second PSK is used to process messages for identity authentication exchanged between the first communication device and the second communication device within an aging period of the second PSK; both the first PSK and the second PSK are also used by the first communication device to derive: an encryption key for encrypting information in messages for identity authentication between the first communication device and the second communication device, and / or an integrity calculation key for calculating integrity verification information of the messages for identity authentication, the first PSK is also used to derive a first media access control security MACSec key within the aging period of the first PSK; the second PSK is also used to derive a second MACSec key within the aging period of the second PSK; A first protocol message is sent to the first communication device within an aging period of the first PSK, wherein the first protocol message includes the first PSK key material.

77. The method according to claim 76, characterized in that The method further comprises: The first PSK key material is saved.

78. The method according to claim 76, characterized in that The method further comprises: receiving a third PSK key material sent by the first communication device; The second PSK is obtained according to the third PSK key material.

79. The method according to claim 76 or 77, characterized in that The method further comprises: The second PSK is obtained according to the first PSK key material.

80. The method according to claim 79, characterized in that The obtaining the second PSK according to the first PSK key material includes: Before the aging period of the second PSK begins, the second PSK is obtained according to the first PSK key material.

81. The method according to claim 79, characterized in that The obtaining the second PSK according to the first PSK key material includes: The first PSK key material is determined as the second PSK.

82. The method of claim 79, wherein: The obtaining the second PSK according to the first PSK key material includes: The second PSK is obtained according to the first PSK key material and a first key derivation algorithm.

83. The method according to claim 82, characterized in that The obtaining the second PSK according to the first PSK key material and the first key derivation algorithm includes: Calculating the first PSK key material using a first algorithm to obtain an intermediate value; The second PSK is generated according to the intermediate value and the first key derivation algorithm.

84. The method according to any one of claims 78 or 80-83, characterized in that: The method further comprises: The second PSK is stored in a non-volatile storage area of ​​the second communication device.

85. The method according to any one of claims 76-78 or any one of claims 80-83, characterized in that: The first PSK key material includes a random number.

86. The method according to any one of claims 76-78 or any one of claims 80-83, characterized in that: The first protocol message is a message of the PSK-based extended authentication protocol EAP-PSK.

87. The method according to claim 86, characterized in that The first protocol message includes an extended type-length-value TLV field, and the extended TLV field includes the first PSK key material.

88. The method according to claim 86, characterized in that In the first protocol message, the first PSK key material is encrypted using a first key.

89. The method according to claim 86, characterized in that The first protocol message also includes first integrity verification information, and the first integrity verification information is used to perform integrity verification on the first protocol message.

90. The method according to claim 88, characterized in that The first protocol message carries an identifier of the first key.

91. The method according to claim 89, characterized in that The first protocol message includes an identifier of a second key, where the identifier of the second key is used to identify the second key, and the second key is used to calculate the first integrity verification information.

92. The method according to claim 88 or 90, characterized in that Before sending the first protocol message to the first communication device, the method further includes: A second protocol message sent by the first communication device is received, wherein the second protocol message carries an identifier of a third key, the identifier of the third key is used to identify a third key, and the third key is used to derive the first key.

93. The method according to claim 89 or 91, characterized in that Before sending the first protocol message to the first communication device, the method further includes: Receive a second protocol message sent by the first communication device, where the second protocol message carries an identifier of a third key, where the identifier of the third key is used to identify the third key, where the third key is used to derive a second key, and where the second key is used to calculate the first integrity verification information.

94. The method according to claim 92, characterized in that The third key includes the first PSK.

95. The method according to claim 92, characterized in that After receiving the second protocol message sent by the first communication device, the method further includes: A third protocol message is sent to the first communication device, where the third protocol message is used to request identity authentication for the second communication device.

96. The method according to claim 95, characterized in that The third protocol message carries the identifier of the third key.

97. The method according to claim 95 or 96, characterized in that The first protocol message includes first identity authentication information, and the first identity authentication information is used to authenticate the second communication device.

98. The method according to claim 97, characterized in that In the first protocol message, the first identity authentication information is encrypted by using the first key.

99. The method according to claim 97, characterized in that The first identity authentication information is calculated based on the fourth key using one or more of the following: Some or all fields of the third protocol message, and some or all fields of the second protocol message.

100. The method according to claim 99, characterized in that The fourth key is derived from the third key.

101. The method according to claim 99, characterized in that The fourth key is derived from the third PSK stored in the first communication device and the second communication device.

102. The method according to claim 101, characterized in that The second protocol message carries the identifier of the third PSK, and the identifier of the third PSK is used to identify the third PSK.

103. The method according to any one of claims 76-78, any one of claims 80-83, any one of claims 87-91, any one of claims 94-96, or any one of claims 98-102, characterized in that: The method further comprises: A fourth protocol message sent by the first communication device is received, where the fourth protocol message carries first indication information, and the first indication information is used to indicate that the first communication device has saved the second PSK.

104. The method according to claim 103, characterized in that The fourth protocol message includes an extended TLV field, and the extended TLV field includes the first indication information.

105. The method according to claim 103, characterized in that The fourth protocol message carries second integrity verification information, and the second integrity verification information is used to perform integrity verification on the fourth protocol message.

106. The method according to claim 103, characterized in that The fourth protocol message includes second identity authentication information, and the second identity authentication information is used to authenticate the first communication device.

107. The method according to claim 106, characterized in that In the fourth protocol message, the second identity authentication information is encrypted by using the first key.

108. The method according to claim 107, characterized in that The second identity authentication information is calculated based on the fourth key using one or more of the following: Some or all of the fields in the second protocol message, and some or all of the fields in the third protocol message.

109. The method according to claim 108, characterized in that The method further comprises: The first communication device is authenticated using the second identity authentication information.

110. The method according to claim 109, characterized in that The using the second identity authentication information to authenticate the first communication device includes: Calculating the target field using the fourth key to obtain fourth identity authentication information; The fourth identity authentication information and the second identity authentication information carried in the fourth protocol message are matched and verified; wherein the target field includes one or more of the following: Part or all of the fields of the third protocol message, part or all of the fields of the second protocol message.

111. The method according to claim 110, characterized in that The using the fourth key to calculate the target field to obtain fourth identity authentication information includes: Calculating the target field using the fourth key to obtain a second calculation result; The second calculation result is encrypted using the first key to obtain the fourth identity authentication information.

112. The method according to any one of claims 105-111, characterized in that: The method further comprises: A fifth protocol message is sent to the first communication device, wherein the fifth protocol message carries an identity authentication result and a PSK update result.

113. The method according to claim 112, characterized in that The method further comprises: A sixth protocol message sent by the first communication device is received, where the sixth protocol message is used to indicate that the first communication device has received the fifth protocol message.

114. The method according to any one of claims 76-78, any one of claims 80-83, any one of claims 87-91, any one of claims 94-96, any one of claims 98-102, any one of claims 104-111, or 113, characterized in that: The second communication device stores a first data key, and the first protocol message also includes data key material, the data key material is used to instruct the first communication device to generate a second data key, the first data key is used to process data messages exchanged between the first communication device and the second communication device within the aging period of the first data key, and the second data key is used to process data messages exchanged between the first communication device and the second communication device within the aging period of the second data key.

115. The method according to claim 114, characterized in that The method further comprises: The second data key is obtained according to the data key material.

116. The method according to claim 114, characterized in that The second data key includes: An integrity calculation key and / or an encryption key, wherein the integrity calculation key is used to perform integrity calculation on the data message, and the encryption key is used to encrypt the data message.

117. The method according to any one of claims 76-78, 80-83, 87-91, 94-96, 98-102, 104-111, 113, 115 or 116, characterized in that: The second communication device stores a first authentication key, and the first protocol message also includes authentication key material, the authentication key material is used to instruct the first communication device to generate a second authentication key, the first authentication key is used to process the identity authentication message exchanged between the first communication device and the second communication device within the aging period of the first authentication key, and the second authentication key is used to process the identity authentication message exchanged between the first communication device and the second communication device within the aging period of the second authentication key.

118. The method according to claim 117, characterized in that The method further comprises: The second authentication key is obtained according to the authentication key material.

119. The method according to claim 117, characterized in that The second authentication key includes any one or more of the following: An integrity calculation key, an encryption key, a key derivation key and an authentication key, wherein the integrity calculation key is used to perform integrity calculation on the authentication message, the encryption key is used to encrypt the authentication message, the key derivation key is used to derive other keys, and the authentication key is used to calculate the authentication information in the authentication message.

120. The method according to any one of claims 76-78, 80-83, 87-91, 94-96, 98-102, 104-111, 113, 115, 116, 118 or 119, characterized in that: The method further comprises: During an aging period of the second PSK, a second media access control security MACSec key is derived using the second PSK.

121. The method according to claim 120, characterized in that The deriving a second MACSec key by using the second PSK includes: Generate a master session key MSK according to the second PSK; deriving a secure connection associated key CAK using the MSK; The second MACSec key is derived using the CAK.

122. The method according to claim 120, characterized in that The deriving a second MACSec key by using the second PSK includes: The second PSK is used as the CAK to derive the second MACSec key.

123. The method according to claim 121 or 122, characterized in that The deriving a second MACSec key by using the CAK includes: Determining the CAK according to the identifier of the CAK; The second MACSec key is derived using the CAK.

124. The method according to claim 123, characterized in that The CAK identifier is generated according to any one or more of the following parameters: A first random number generated by the first communication device, a second random number generated by the second communication device, and a session identifier of the first protocol message.

125. The method according to claim 86, characterized in that The first protocol message includes: Extensible Authentication Protocol (EAP) header, EAP extension header, and keyword fields.

126. The method according to claim 125, characterized in that The key field includes the encrypted data field, and the first PSK key material is carried in the key field.

127. The method according to claim 125 or 126, characterized in that The keyword field includes any one or more of the following fields: Protocol version number field, session identification field, key identification field, encrypted data field, random number field, identity identification field and integrity verification field.

128. The method according to claim 127, characterized in that The first PSK key material is carried in the encrypted data field.

129. The method according to claim 86, characterized in that The method further comprises: Second indication information sent by the first communication device is received, where the second indication information is used to indicate that the first communication device has a capability of automatically updating the PSK.

130. The method according to any one of claims 76-78 or any one of claims 80-83, characterized in that: The first protocol message is a message based on the Internet Key Exchange Protocol IKE.

131. The method according to claim 130, characterized in that The first PSK key material is carried in a payload field of the first protocol message.

132. The method according to claim 130, characterized in that The first PSK key material is carried in a notification payload field of the first protocol message.

133. The method according to claim 130, characterized in that The first PSK key material is carried in an extended TLV field of the first protocol message.

134. The method according to claim 130, characterized in that The method further comprises: Receive third indication information sent by the first communication device, where the third indication information is used to indicate that the first communication device has a capability of automatically updating the PSK.

135. The method according to claim 134, characterized in that The third indication information is carried in the notification payload field of the message based on the IKE protocol.

136. The method according to claim 134 or 135, characterized in that The third indication information is carried in the notification message type field of the message based on the IKE protocol, and the notificationpayload field of the message based on the IKE protocol includes the notification message type field.

137. The method according to claim 130, characterized in that The method further comprises: A seventh protocol message sent by the first communication device is received, where the seventh protocol message is used to indicate that the first communication device has saved the second PSK.

138. The method according to claim 137, characterized in that The seventh protocol message includes fourth indication information, and the fourth indication information is used to indicate that the first communication device has saved the second PSK.

139. The method according to claim 138, characterized in that The seventh protocol message is a message based on the IKE protocol, and the fourth indication information is carried in a notification message type field of the seventh protocol message.

140. The method according to claim 130, characterized in that The first protocol message is an authentication exchange AUTHexchange message.

141. The method according to claim 130, characterized in that The first protocol message is a create child security association exchange CREATE_CHILD_SA exchange message.

142. The method according to claim 130, characterized in that The first protocol message is a notification exchange INFORMATIONAL exchange message.

143. The method according to any one of claims 76-78 or any one of claims 80-83, characterized in that: The first protocol message is a message based on the media access control security key protocol MKA.

144. The method according to claim 143, characterized in that The first PSK key material is carried in an extended parameter set parameter set field of the first protocol message.

145. The method according to claim 143, characterized in that The method further comprises: Fifth indication information sent by the first communication device is received, where the fifth indication information is used to indicate that the first communication device has a capability of automatically updating the PSK.

146. The method according to claim 145, characterized in that The fifth indication information is carried in the parameter set field of the MKA-based message.

147. The method according to claim 146, characterized in that The fifth indication information is carried in a parameter set type field of the MKA-based message, where the parameter set field includes a parameter set type field.

148. The method according to claim 143, characterized in that The method further comprises: An eighth protocol message sent by the first communication device is received, where the eighth protocol message is used to indicate that the first communication device has saved the second PSK.

149. The method according to claim 148, characterized in that The eighth protocol message includes sixth indication information, and the sixth indication information is used to indicate that the first communication device has saved the second PSK.

150. The method according to claim 148, characterized in that The eighth protocol message is an MKA-based message, and the sixth indication information is carried in a parameter set type field of the MKA-based message.

151. The method according to any one of claims 76-78, or any one of claims 80-83, or any one of claims 87-91, or any one of claims 94-96, or any one of claims 98-102, or any one of claims 104-111, or any one of claims 113, or 115, or 116, or 118, or 119, or 121, or 122, or any one of claims 124-126, or 128, or 129, or any one of claims 131-135, or any one of claims 137-142, or any one of claims 144-150, characterized in that: The method further comprises: During an aging period of the first PSK, a first MACSec key is derived using the first PSK.

152. The method according to any one of claims 76-78, or any one of claims 80-83, or any one of claims 87-91, or any one of claims 94-96, or any one of claims 98-102, or any one of claims 104-111, or any one of claims 113, or 115, or 116, or 118, or 119, or 121, or 122, or any one of claims 124-126, or 128, or 129, or any one of claims 131-135, or any one of claims 137-142, or any one of claims 144-150, characterized in that: The first communication device is a vehicle-mounted device.

153. The method according to any one of claims 76-78, or any one of claims 80-83, or any one of claims 87-91, or any one of claims 94-96, or any one of claims 98-102, or any one of claims 104-111, or any one of claims 113, or 115, or 116, or 118, or 119, or 121, or 122, or any one of claims 124-126, or 128, or 129, or any one of claims 131-135, or any one of claims 137-142, or any one of claims 144-150, characterized in that: The second communication device is a vehicle-mounted device.

154. A first communication device, characterized in that: The first communication device includes a memory and a processor; The memory is used to store program code; The processor is used to run the instructions in the program code so that the first communication device executes the method described in any one of claims 1-75 above.

155. A second communication device, characterized in that: The first communication device includes a memory and a processor; The memory is used to store program code; The processor is used to run the instructions in the program code so that the second communication device executes the method described in any one of claims 76-153 above.

156. A first communication device, characterized in that: The first communication device includes a communication interface and a processor, and the processor is used to execute the method described in any one of claims 1-75 above.

157. A second communication device, characterized in that: The second communication device includes a communication interface and a processor, and the processor is used to execute the method described in any one of claims 76-153 above.

158. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the method described in any one of claims 1 to 75, or enable the computer to execute the method described in any one of claims 76 to 153.

159. A communication device, characterized in that: The communication device includes the first communication device described in claim 154 or 156 and the second communication device described in claim 155 or 157.

160. The communication device according to claim 159, characterized in that The communication device is an Internet of Things (IoT) device.

161. The communication device according to claim 159, characterized in that The communication device is a vehicle-mounted information box T-BOX.

162. A communication system, characterized in that: Includes the first communication device described in claim 154 or 156 and the second communication device described in claim 155 or 157.

163. A communication method, characterized in that: The method is performed by a communication device, wherein the communication device includes a first communication device and a second communication device, and includes: The method according to any one of claims 1 to 75 is performed by the first communication device; and The method described in any one of claims 76-153 is performed by the second communication device.

164. The method according to claim 163, characterized in that The communication device is an IoT device.

165. The method according to claim 163, characterized in that The communication device is a vehicle-mounted information box T-BOX.

Images