Network key updating method, device, electronic device and server

Abstract

The present application discloses a network key update method, apparatus, electronic device, and server. When the first node device switches from an offline state to an online state and determines that the first network key is invalid, it sends a verification request to the server; after receiving the first network key update notification, it sends a first network key update request to the server; after receiving the first network key update response, it obtains the second data therein, decrypts the second data using its own device key, obtains the second network key (the network key that the server sent to the Mesh network for the last time before receiving the verification request from the first node device) and the generation time of the second network key, saves the decrypted data, immediately takes effect on the second network key, deletes the first network key, and completes the network key update. Based on the scheme disclosed in the present application, if the node device misses the network key update in an offline state, it can update the network key when it goes online again.

Description

Technical Field

[0001] The present application belongs to the field of Mesh communication technology, and in particular, relates to a network key updating method, device, electronic device and server. Background Art

[0002] Mesh network is a new type of wireless communication network architecture. In a Mesh network, any node device can act as a router, each node device can send and receive signals, and each node device can communicate directly with one or more node devices, thereby achieving communication in a wider range.

[0003] The secure communication of the Mesh network is based on the network key (NetKey). Specifically, the Mesh network management device allocates a network key to the Mesh network. When the node devices in the Mesh network communicate, the data needs to be encrypted and decrypted based on the network key.

[0004] In order to ensure the secure communication of the Mesh network, the network key needs to be updated. How to update the network key of the Mesh network to ensure the secure communication of the Mesh network is a very important issue for those skilled in the art. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a network key update method, device, electronic device and server to ensure secure communication in a Mesh network.

[0006] To achieve the above objectives, this application provides the following technical solutions:

[0007] In a first aspect, the present application provides a network key update method, which is applied to a first node device in a Mesh network, and the method includes:

[0008] The first node device switches from an offline state to an online state, and when it is determined that the first network key currently in use is invalid, sends a verification request to a server, wherein the verification request includes a device identifier of the first node device;

[0009] Receiving a first network key update notification including a first random number sent by the server;

[0010] Encrypting the first random number and the generation time of the first network key by using a device key to obtain first data, and sending a first network key update request including the device identifier and the first data to the server;

[0011] Receiving a first network key update response sent by the server;

[0012] Obtain second data included in the first network key update response, decrypt the second data using the device key to obtain a second network key and a generation time of the second network key, save the second network key and the generation time of the second network key, immediately take effect on the second network key, and delete the first network key, wherein the second network key is the network key that the server sent to the Mesh network for the last time before receiving the verification request.

[0013] Optionally, also include:

[0014] receiving a second network key update notification including a second random number sent by the server;

[0015] encrypting the second random number and the generation time of the third network key currently in use by using the device key to obtain third data, and sending a second network key update request including the device identification and the third data to the server;

[0016] receiving a second network key update response sent by the server;

[0017] Acquire fourth data included in the second network key update response, decrypt the fourth data using the device key to obtain a fourth network key, a generation time and an activation time of the fourth network key, and save the fourth network key and the generation time of the fourth network key;

[0018] Validating the fourth network key when the activation time is reached;

[0019] The third network key is deleted when a deletion time is reached, wherein the deletion time is after the activation time and differs from the activation time by a specified time interval.

[0020] Optionally, also include:

[0021] After the first node device takes effect with the fourth network key, the first node device uses the fourth network key to encrypt the data to be sent when sending data to other node devices in the Mesh network.

[0022] Optionally, also include:

[0023] Between the activation time and the deletion time, the first node device uses the third network key and the fourth network key to decrypt data sent by other node devices in the Mesh network.

[0024] Optionally, sending a verification request to the server includes:

[0025] Broadcast search agent request;

[0026] Determine a target proxy device from the node devices that respond to the search proxy request;

[0027] A verification request is sent to the target proxy device so that the target proxy device transmits the verification request to the server.

[0028] In a second aspect, the present application provides a network key update method, applied to a server, the method comprising:

[0029] Receiving a verification request sent by a first node device in the Mesh network, where the verification request includes a device identifier of the first node device;

[0030] Performing identity authentication based on the device identification included in the verification request;

[0031] When it is determined that the identity authentication is passed, sending a first network key update notification including a first random number to the first node device;

[0032] receiving a first network key update request sent by the first node device, where the first network key update request includes a device identifier of the first node device and fifth data;

[0033] Obtaining a device key of the first node device, and decrypting the fifth data using the device key of the first node device to obtain a generation time of a random number and a network key included in the fifth data;

[0034] Acquire a second network key and a generation time of the second network key, wherein the second network key is a network key that the server last sent to the Mesh network before receiving the verification request;

[0035] Performing legitimacy verification based at least on the random number included in the fifth data and the first random number;

[0036] If it is determined that the legitimacy verification has passed, a first network key update response is sent to the first node device, where the first network key update response includes a device identifier of the first node device and second data, where the second data is data obtained by encrypting the second network key and the generation time of the second network key using the device key of the first node device.

[0037] Optionally, also include:

[0038] When a preset update condition is met, generating a second network key update notification including a second random number;

[0039] Sending the second network key update notification to online node devices in the Mesh network;

[0040] Generate a fourth network key, record the generation time of the fourth network key, and configure the activation time of the fourth network key;

[0041] receiving a second network key update request sent by a node device, wherein the second network key update request includes a device identification of the node device and sixth data;

[0042] Acquire a device key corresponding to the device identifier included in the second network key update request, and decrypt the sixth data using the currently acquired device key to obtain a random number and a generation time of the network key included in the sixth data;

[0043] Perform verification based at least on the random number included in the sixth data and the second random number;

[0044] If it is determined that the verification is passed, a second network key update response is sent to the node device, where the second network key update response includes a device identification of the node device and fourth data, where the fourth data is data obtained by encrypting the fourth network key, the generation time of the fourth network key, and the activation time by using the device key.

[0045] In a third aspect, the present application provides a network key update device, applied to a first node device in a Mesh network, the device comprising:

[0046] a verification request sending unit, configured to send a verification request to a server when the first node device switches from an offline state to an online state and determines that the first network key currently in use is invalid, wherein the verification request includes a device identifier of the first node device;

[0047] A first update notification receiving unit, configured to receive a first network key update notification including a first random number sent by the server;

[0048] a first update request sending unit, configured to encrypt the first random number and the generation time of the first network key by using a device key to obtain first data, and send a first network key update request including the device identifier and the first data to the server;

[0049] A first update response receiving unit, configured to receive a first network key update response sent by the server;

[0050] The first network key updating unit is used to obtain the second data included in the first network key update response, decrypt the second data using the device key to obtain the second network key and the generation time of the second network key, save the second network key and the generation time of the second network key, immediately take effect on the second network key, and delete the first network key, wherein the second network key is the network key sent by the server to the Mesh network for the last time before receiving the verification request.

[0051] In a fourth aspect, the present application provides a network key updating device, applied to a server, the device comprising:

[0052] A verification request receiving unit, configured to receive a verification request sent by a first node device in the Mesh network, wherein the verification request includes a device identifier of the first node device;

[0053] An identity authentication unit, configured to perform identity authentication based on a device identifier included in the authentication request;

[0054] A first update notification sending unit, configured to send a first network key update notification including a first random number to the first node device when it is determined that the identity authentication is passed;

[0055] A first update request receiving unit, configured to receive a first network key update request sent by the first node device, wherein the first network key update request includes a device identification of the first node device and fifth data;

[0056] A first update request processing unit, configured to obtain a device key of the first node device, and decrypt the fifth data using the device key of the first node device to obtain a generation time of a random number and a network key included in the fifth data;

[0057] A network key acquisition unit, configured to acquire a second network key and a generation time of the second network key, wherein the second network key is a network key that the server last sent to the Mesh network before receiving the verification request;

[0058] A first legitimacy verification unit, configured to perform legitimacy verification based at least on a random number included in the fifth data and the first random number;

[0059] The first update response sending unit is used to send a first network key update response to the first node device when it is determined that the legitimacy verification has passed, wherein the first network key update response includes a device identification of the first node device and second data, wherein the second data is data obtained by encrypting the second network key and the generation time of the second network key using the device key of the first node device.

[0060] In a fifth aspect, the present application provides an electronic device, including a communication module, a processor and a memory;

[0061] The memory is used to store programs;

[0062] The processor is used to execute the program to implement each step of any one of the above-mentioned network key updating methods applied to the first node device.

[0063] In a sixth aspect, the present application provides a server, including a communication module, a processor, and a memory;

[0064] The memory is used to store programs;

[0065] The processor is used to execute the program to implement each step of any one of the above-mentioned network key updating methods applied to the server.

[0066] It can be seen that the beneficial effects of this application are:

[0067] The network key update method disclosed in the present application, after the first node device in the Mesh network switches from an offline state to an online state, if it is determined that the first network key (i.e., the currently used network key) is invalid, then a verification request is sent to the server; after receiving the first network key update notification containing the first random number sent by the server, a first network key update request is sent to the server, the first network key update request contains the device identification and the first data of the first node device, wherein the first data is the data obtained by encrypting the first random number and the generation time of the first network key using its own device key; after receiving the first network key update response sent by the server, the second data contained in the first network key update response is obtained, the second data is decrypted using its own device key, the second network key and the generation time of the second network key are obtained, the decrypted data is saved, the second network key is immediately effective, the first network key is deleted, and the network key update of the first node device is completed, wherein the second network key is the network key sent by the server to the Mesh network for the last time before receiving the verification request of the first node device. Based on the network key update method disclosed in the present application, if the node device misses the network key update in the offline state, it can update the network key when it goes online again, and communicate with other node devices based on the updated network key. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0069] Figure 1 A flowchart of a network key updating method disclosed in this application;

[0070] Figure 2 A flowchart of another network key updating method disclosed in this application;

[0071] Figure 3 A flowchart of another network key updating method disclosed in this application;

[0072] Figure 4 A flowchart of another network key updating method disclosed in this application;

[0073] Figure 5 A schematic diagram of the structure of a network key updating device applied to a node device disclosed in the present application;

[0074] Figure 6 A schematic diagram of the structure of a network key updating device applied to a server disclosed in the present application;

[0075] Figure 7 A hardware structure diagram of the electronic device disclosed in this application;

[0076] Figure 8 This is a hardware structure diagram of the server disclosed in this application. DETAILED DESCRIPTION

[0077] The present application provides a network key update method, device, electronic device and server to ensure secure communication in a Mesh network.

[0078] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0079] See also Figure 1 , Figure 1This is a flow chart of a network key update method disclosed in the present application. The method is applied to a first node device in a Mesh network, wherein each node device in the Mesh network has a unique device identifier (DevID) and a device key (DevKey). The method includes:

[0080] S11: The first node device switches from an offline state to an online state, and when it is determined that the first network key is invalid, sends a verification request to the server, wherein the verification request includes the device identification of the first node device, and the first network key is the network key currently used by the first node device.

[0081] If the server updates the network key of the Mesh network during the period when the first node device is offline (such as shut down or power off), then when the first node device switches to the online state, it stores and uses an expired network key (that is, an invalid network key), and cannot communicate with other node devices in the Mesh network and cannot access the Mesh network. Therefore, it is necessary to provide a network key update mechanism to ensure that after the node device switches from the offline state to the online state, the network key can be updated and communicate with other node devices based on the updated network key.

[0082] During implementation, after the first node device switches from an offline state to an online state, the following method can be used to determine whether the currently used network key is invalid: after receiving data sent by other node devices, the data is decrypted using the currently used network key. If the decryption is successful, it is determined that the currently used network key has not expired. If the decryption fails, it is determined that the currently used network key is invalid.

[0083] It should be noted that under normal circumstances, when node devices in a Mesh network communicate, they need to encrypt and decrypt data based on the network key. That is, the sender encrypts the data based on the network key, and the receiver decrypts the data based on the network key. If the receiver fails to decrypt, the received data is discarded.

[0084] The premise for the first node device to send a verification request to the server is that the first node device currently stores and uses an invalid network key. In order to ensure that the recipient of the verification request does not discard the verification request, the first node device no longer encrypts the verification request based on the network key, and the verification request should have a type identifier so that the recipient can know that the received data is a verification request. For example, a specific position (such as the head or tail) of the verification request is an identification bit, which is used to indicate that the data is a verification request.

[0085] In addition, there are multiple situations in which the first node device sends a verification request to the server: in the first situation, the first node device directly sends a verification request to the server; in the second situation, the verification request of the first node device is forwarded to the server via one or more node devices.

[0086] S12: The first node device receives a first network key update notification sent by the server, where the first network key update notification includes a first random number.

[0087] The server authenticates the first node device based on the verification request sent by the first node device, and sends a network key update notification to the first node server if the authentication is passed, and the network key update notification includes a random number. For ease of description, the network key update notification here is referred to as the first network key update notification, and the random number here is referred to as the first random number.

[0088] It should be noted that when the server sends the first network key update notification and other node devices forward the first network key update notification to the first node device, it is not necessary to encrypt the first network key update notification based on the network key, and the first network key update notification should have a type identifier so that the receiving party can know that the received data is a network key update notification. For example, a specific position (such as the head or the tail) of the first network key update notification is an identification bit, and the identification bit is used to indicate that the data is a network key update notification.

[0089] S13: The first node device encrypts the first random number and the generation time of the first network key by using the device key to obtain first data, and sends a first network key update request including the device identification and the first data to the server.

[0090] The first node device stores a network key and the generation time of the network key. After receiving the first network key update notification, the first node device obtains the first random number contained in the first network key update notification, encrypts the first random number and the generation time of the first network key using its own device key to obtain the first data, encapsulates its own device key and the first data into a network key update request, and sends the network key update request to the server. For ease of description, the network key update request here is referred to as the first network key update request.

[0091] It should be noted that there are multiple situations when the first node device sends a network key update request to the server: in the first situation, the first node device directly sends a network key update request to the server; in the second situation, the network key update request of the first node device is forwarded to the server via one or more node devices.

[0092] When the first node device sends a network key update request, and when other node devices forward the network key update request, it is not necessary to encrypt the network key update request based on the network key, and the network key update request should have a type identifier so that the receiving party can know that the received data is a network key update request. For example, a specific position (such as the head or the tail) of the network key update request is an identification bit, and the identification bit is used to indicate that the data is a network key update request.

[0093] S14: The first node device receives a first network key update response sent by the server.

[0094] The first network key update response includes the device identification of the first node device and the second data, the second data is the data obtained by the server using the device key of the first node device to encrypt the second network key and the generation time of the second network key. The second network key is the network key that the server sent to the Mesh network for the last time before receiving the verification request.

[0095] As to which network key the second network key is specifically, it is described here with reference to an example.

[0096] For example: the first node device is turned off at time T1 and turned on at time T2. Between time T1 and time T2, if the server only sends the network key to the Mesh network at time T3 (i.e., updates the network key of the Mesh network), then the network key sent at time T3 is carried as the second network key in the first network key update response. Between time T1 and time T2, if the server sends the network key to the Mesh network at time T3, time T4, and time T5, then the network key sent at time T5 is carried as the second network key in the first network key update response.

[0097] It should be noted that when the server sends a network key update response and other node devices forward the network key update response to the first node device, it is not necessary to encrypt the network key update response based on the network key, and the network key update response should have a type identifier so that the receiving party can know that the received data is a network key update response. For example, a specific position (such as the head or the tail) of the network key update response is an identification bit, and the identification bit is used to indicate that the data is a network key update response. For the convenience of description, the network key update response here is referred to as the first network key update response.

[0098] S15: The first node device obtains the second data included in the first network key update response, decrypts the second data using the device key to obtain the second network key and the generation time of the second network key, saves the second network key and the generation time of the second network key, immediately takes effect on the second network key, and deletes the first network key.

[0099] The first node device receives the first network key update response, obtains the second data contained in the first network key update response, decrypts the second data using its own device key to obtain the second network key contained in the second data and the generation time of the second network key, and saves the second network key and the generation time of the second network key. Moreover, after obtaining the second network key, the second network key is immediately effective and the first network key is deleted. Here is an explanation of the meaning of "immediately": after performing the decryption operation to obtain the second network key, the operation of taking the second network key into effect is performed without any waiting or delay.

[0100] It is understandable that after the first node device validates the second network key, it can communicate with other node devices based on the second network key. At this time, the online node devices in the Mesh network use the same network key (that is, the second network key). In implementation, the first node device can execute the operation of validating the second network key and the operation of deleting the first network key at the same time, or it can execute the operation of validating the second network key first and then execute the operation of deleting the first network key.

[0101] The network key update method disclosed in the present application, after the first node device in the Mesh network switches from an offline state to an online state, if it is determined that the first network key (i.e., the currently used network key) is invalid, then a verification request is sent to the server; after receiving the first network key update notification containing the first random number sent by the server, a first network key update request is sent to the server, the first network key update request contains the device identification and the first data of the first node device, wherein the first data is the data obtained by encrypting the first random number and the generation time of the first network key using its own device key; after receiving the first network key update response sent by the server, the second data contained in the first network key update response is obtained, the second data is decrypted using its own device key, the second network key and the generation time of the second network key are obtained, the decrypted data is saved, the second network key is immediately effective, the first network key is deleted, and the network key update of the first node device is completed, wherein the second network key is the network key sent by the server to the Mesh network for the last time before receiving the verification request of the first node device. Based on the network key update method disclosed in the present application, if the node device misses the network key update in the offline state, it can update the network key when it goes online again, and communicate with other node devices based on the updated network key.

[0102] The present application discloses how to update the network key of a node device after the node device switches from an offline state to an online state. On this basis, the present application also discloses a solution for updating the network key of an online node device in a Mesh network under normal conditions. The following is still explained by taking the first node device as an example.

[0103] See also Figure 2 , Figure 2 This is a flow chart of another network key update method disclosed in this application. The method is applied to a first node device in a Mesh network, and the method includes:

[0104] S21: The first node device receives a second network key update notification sent by the server.

[0105] The second network key update notification includes a second random number.

[0106] S22: The first node device encrypts the second random number and the generation time of the third network key by using the device key to obtain third data, and sends a second network key update request including the device identification and the third data to the server.

[0107] The third network key is the network key currently used by the first node device.

[0108] The first node device stores the network key and the generation time of the network key. After receiving the second network key update notification, the first node device obtains the second random number contained in the second network key update notification, encrypts the second random number and the generation time of the third network key using its own device key to obtain the third data, encapsulates its own device key and the third data into a network key update request, and sends the network key update request to the server. For ease of description, the network key update request here is referred to as the second network key update request.

[0109] S23: The first node device receives a second network key update response sent by the server.

[0110] The second network key update response includes the device identification of the first node device and fourth data, and the fourth data is data obtained by the server using the device key of the first node device to encrypt the fourth network key, the generation time of the fourth network key and the activation time. The fourth network key is a new network key generated after the server sends the second network key update notification.

[0111] Compared with the first network key update response mentioned above, the second network key update response also includes the activation time of the fourth network key. Among them, the activation time of the fourth network key should satisfy: the online node device in the Mesh network has decrypted and obtained the fourth network key before the activation time. After many experiments, the applicant found that after the server sends the second network key update notification to the online node device, the online node device takes up to 3 minutes to complete the reception of the second network key update response and subsequent decryption operations. In implementation, the activation time of the fourth network key can be determined based on the test data and the generation time of the fourth network key.

[0112] S24: The first node device obtains the fourth data included in the second network key update response, decrypts the fourth data using the device key to obtain the fourth network key, the generation time and the activation time of the fourth network key, and saves the fourth network key and the generation time of the fourth network key.

[0113] S25: The first node device validates the fourth network key when the activation time arrives.

[0114] S26: The first node device deletes the third network key when the deletion time is reached.

[0115] The deletion time is after the activation time of the fourth network key, and differs from the activation time of the fourth network key by a specified time interval. The time interval can be an empirical value, such as 30 seconds, or other data, which is not specifically limited in this application. It should be noted that each node device in the Mesh network pre-stores the value of the time interval, and the time interval pre-stored by each node device is the same value.

[0116] The first node device receives the second network key update response, obtains the fourth data contained in the second network key update response, and decrypts the fourth data using its own device key to obtain the fourth network key, the generation time of the fourth network key, and the activation time of the fourth network key contained in the fourth data. The first node device saves the fourth network key and the generation time of the fourth network key. When the activation time of the fourth network key is reached, the first node device takes effect on the fourth network key. When the deletion time is reached, the first node device deletes the third network key.

[0117] It should be noted that the above is an example of how to update the network key of the online node device in the Mesh network under normal conditions. It can be understood that the online node devices in the Mesh network all execute the above scheme to update the network key. In addition, the node devices in the Mesh network have the ability to maintain time synchronization, that is, the system time of each node device is the same, or there is a very small error. Therefore, when the activation time of the fourth network key is reached, each online node device in the Mesh network can complete the effectiveness of the fourth network key in a very short time, and when the deletion time is reached, each online node device in the Mesh network can complete the deletion of the third network key in a very short time. The time difference between each online node device performing the first two operations is determined by the difference in the system time of each node device. The time difference is very small. It can be considered that the online node devices in the Mesh network synchronously complete the effectiveness of the fourth network key and the deletion of the third network key.

[0118] It can be seen that there is a certain time interval between the first node device taking effect on the fourth network key and deleting the third network key. Similarly, there is a certain time interval between the other online node devices in the Mesh network taking effect on the fourth network key and deleting the third network key. During this time interval, each online node device stores two network keys, namely the third network key and the fourth network key.

[0119] As an optional implementation, the first node device uses the third network key or the fourth network key to encrypt the data to be sent when sending data to other node devices in the Mesh network from the time the fourth network key takes effect to the time the third network key is deleted.

[0120] As a more preferred implementation manner, after the first node device takes effect on the fourth network key, the fourth network key is used to encrypt the data to be sent when sending data to other node devices in the Mesh network.

[0121] In addition, considering that there may be certain differences in the system time of online node devices in the Mesh network, this may result in certain differences in the time when each node device takes effect on the fourth network node. As an optional implementation, between the activation time of the fourth network key and the deletion time of the third network key, the first node device uses the third network key and the fourth network key to decrypt the data sent by other node devices in the Mesh network. Similarly, between the activation time of the fourth network key and the deletion time of the third network key, when each node device receives data sent by other node devices, it uses the third network key and the fourth network key to decrypt the received data.

[0122] This application Figure 2 The network key update method shown in Figure 1 The network key update method shown in the figure adds a scheme for updating the network key of the online node device in the Mesh network under normal conditions. In addition, the second network key update response sent by the server to the node device not only includes the fourth network key (i.e., the new network key) and the generation time of the fourth network key, but also includes the activation time of the fourth network key, which enables each online node device in the Mesh network to synchronously activate the fourth network key and synchronously delete the third network key (i.e., the old network key), providing a simple and effective network key synchronization switching mechanism.

[0123] Optional, in this application Figure 1 In the network key update method shown, the first node device sends a verification request to the server, using the following scheme:

[0124] 1) Broadcast search agent request;

[0125] 2) Determine the target proxy device from the node devices that respond to the search proxy request;

[0126] 3) Sending a verification request to the target proxy device so that the target proxy device transmits the verification request to the server.

[0127] The first node device determines the target proxy device from the node devices that respond to the search proxy request, and multiple solutions may be adopted.

[0128] The first option:

[0129] The first node device obtains the communication quality parameters between each node device that responds to the search proxy request and the server, and uses the node device with the best communication quality parameter as the target proxy device.

[0130] Second option:

[0131] The first node device obtains the communication quality parameters between itself and each node device that responds to the search proxy request, and uses the node device with the best quality parameter as the target proxy device.

[0132] Optionally, the communication quality parameter between the node device and the server is determined according to the number of hops between the node device and the server, and the communication quality parameter between the node devices is determined according to the number of hops between the node devices.

[0133] The network key updating method disclosed in this application is introduced from the perspective of the server below.

[0134] See also Figure 3 , Figure 3 This is a flowchart of another network key update method disclosed in this application. The method is applied to a server, wherein each node device in the Mesh network has a unique device identifier and a device key, and the server stores configuration information of the node devices connected to the Mesh network, and the configuration information of the node devices at least includes the device identifier and the device key of the node device. The method includes:

[0135] S31: The server receives a verification request sent by a first node device in the Mesh network. The verification request includes a device identifier of the first node device.

[0136] S32: The server performs identity authentication based on the device identifier included in the verification request.

[0137] The server determines whether the first node device is a node device that has accessed the Mesh network based on the device identifier of the first node device.

[0138] Optionally, the server maintains a device list that contains the identifiers of all node devices that have been connected to the Mesh network. After receiving the verification request, the server determines whether the device identifier contained in the verification request exists in the device list. If it exists in the device list, it is determined that the identity verification has been passed and the subsequent process is executed. Otherwise, it is determined that the identity verification has not been passed and the process ends.

[0139] It should be noted that, for a deleted node device, since the server has deleted the configuration information of the node device, even if the deleted node device sends a verification request to the server, it cannot pass the identity authentication, let alone update the network key.

[0140] S33: When determining that the identity authentication is passed, the server sends a first network key update notification to the first node device, where the first network key update notification includes a first random number.

[0141] Optionally, the server generates a random number based on a random algorithm, and the random number is referred to as a first random number. The server sends a first network key update notification carrying the first random number to the first node device. In addition, the server also needs to store the first random number for subsequent use.

[0142] There are multiple situations in which the server sends the first network key update notification to the first node device: in the first situation, the server directly sends the first network key update notification to the first node device; in the second situation, the server forwards the first network key update notification to the first node device via one or more node devices.

[0143] S34: The server receives a first network key update request sent by the first node device, where the first network key update request includes a device identifier of the first node device and fifth data.

[0144] S35: The server obtains the device key of the first node device, and uses the device key of the first node device to decrypt the fifth data to obtain the generation time of the random number and the network key included in the fifth data.

[0145] The server stores the device identification and device key of each node device connected to the Mesh network. After receiving the first network key update request, the server obtains the device identification contained in the first network key update request (that is, the device identification of the first node device), further obtains the device key corresponding to the device identification of the first node device (that is, the device key of the first node device), and uses the device key of the first node device to decrypt the fifth data to obtain the random number contained in the fifth data and the generation time of the network key.

[0146] S36: The server obtains the second network key and the generation time of the second network key.

[0147] The second network key is the network key that the server sends to the Mesh network for the last time before receiving the verification request.

[0148] S37: The server performs legitimacy verification based at least on the random number included in the fifth data and the first random number.

[0149] As an optional implementation, the server compares the random number decrypted from the fifth data with the first random number. If the two are the same, it is determined that the legitimacy verification has passed and the subsequent process continues. Otherwise, it is determined that the legitimacy verification has not passed and the process ends.

[0150] As another optional implementation, the server compares the random number decrypted from the fifth data with the first random number, and compares the generation time of the network key decrypted from the fifth data with the generation time of the second network key. If the random number decrypted from the fifth data is the same as the first random number, and the generation time of the network key decrypted from the fifth data is earlier than the generation time of the second network key, it is determined that the legitimacy verification has passed and the subsequent process continues to execute; otherwise, it is determined that the legitimacy verification has not passed and the process ends.

[0151] As another optional implementation, the server determines whether the node device is a node device that has been connected to the Mesh network based on the device identifier included in the first network key update request, compares the random number decrypted from the fifth data with the first random number, and compares the generation time of the network key decrypted from the fifth data with the generation time of the second network key. If the node device is a node device that has been connected to the Mesh network, the random number decrypted from the fifth data is the same as the first random number, and the generation time of the network key decrypted from the fifth data is earlier than the generation time of the second network key, it is determined that the legitimacy verification has passed and the subsequent process continues to execute; otherwise, it is determined that the legitimacy verification has not passed and the process ends.

[0152] S38: When determining that the legitimacy verification has passed, the server sends a first network key update response to the first node device.

[0153] The first network key update response includes the device identification of the first node device and second data, and the second data is data obtained by encrypting the second network key and the generation time of the second network key by using the device key of the first node device.

[0154] The network key update method disclosed in the present application is as follows: after receiving a verification request sent by a first node device (sent when the first node device switches from an offline state to an online state and the currently used network key is invalid), the server performs identity authentication based on the device identifier contained in the verification request, and sends a first network key update notification containing a first random number to the first node device if the identity authentication is passed; after receiving the first network key update request, the server uses the corresponding device key to decrypt the fifth data contained in the first network key update request to obtain the random number contained in the fifth data and the generation time of the network key; the server obtains the second network key and the generation time of the second network key, wherein the second network key is the network key sent by the server to the Mesh network for the last time before receiving this verification request; the server performs legitimacy verification based on at least the random number contained in the fifth data and the first random number, and sends a first network key update response to the first node device if it is determined that the legitimacy verification is passed, so that the first node device decrypts the second network key and the generation time of the second network key from the first network key update response, and immediately takes effect on the second network key, and deletes the first network key. Based on the network key update method disclosed in this application, if a node device misses the network key update in an offline state, it can obtain the network key currently used by the Mesh network from the server when it comes online again, and communicate with other node devices based on the updated network key. In addition, for node devices that have been deleted from the Mesh network, the network key cannot be updated because the node device cannot pass the server's identity authentication.

[0155] This application Figure 3 The scheme shown discloses how the server updates the network key of the node device after the node device switches from an offline state to an online state. On this basis, the application also discloses how the server updates the network key of the online node device in the Mesh network under normal conditions.

[0156] See also Figure 4 , Figure 4 This is a flow chart of another network key update method disclosed in this application. The method is applied to a server and includes:

[0157] S41: When a preset update condition is met, the server generates a second network key update notification, where the second network key update notification includes a second random number.

[0158] Optionally, the preset update condition includes any one of the following conditions:

[0159] 1) Reach the specified update time;

[0160] 2) Delete the node device from the Mesh network.

[0161] When the specified update time arrives, the network key of the Mesh network needs to be updated to ensure the secure operation of the Mesh network.

[0162] In addition, when a node device is deleted from the Mesh network, in order to prevent the deleted node device from continuing to communicate with other node devices in the Mesh network, the network key of the Mesh network is updated so that the network key used by the deleted node device is invalidated, thereby preventing the deleted node device from continuing to communicate with other node devices in the Mesh network.

[0163] It should be noted that when a node device is deleted from the Mesh network, the server will delete the pre-saved configuration information of the node device to ensure that the deleted node device cannot pass the server's identity authentication. If the server maintains a device list, the device ID of the node device will be deleted from the device list.

[0164] S42: The server sends a second network key update notification to online node devices in the Mesh network.

[0165] Optionally, the server generates a random number based on a random algorithm, and the random number is called a second random number. The server sends a second network key update notification carrying the second random number to an online node device in the Mesh network. In addition, the server also needs to store the second random number for subsequent use.

[0166] During implementation, the server sends a second network key update notification to node devices that can communicate directly, and each node device then sends a second network key update notification to other online node devices, so that all online node devices in the Mesh network can receive the second network key update notification.

[0167] It should be noted that Figure 4 The scheme shown is to update the network key for the online node devices in the Mesh system, and each online node device uses the same network key. The server sends a second network key update notification to the node devices that can communicate directly. When each node device sends a second network key update notification to other online node devices, it needs to use the current network key to encrypt the second network key update notification. Correspondingly, after receiving the data, each node device uses the current network key to decrypt the received data to obtain the second network key update notification.

[0168] S43: The server generates a fourth network key, records the generation time of the fourth network key, and configures the activation time of the fourth network key.

[0169] How to configure the activation time of the fourth network key has been explained in the previous text and will not be repeated here.

[0170] S44: The server receives a second network key update request sent by the node device, where the second network key update request includes a device identifier of the node device and sixth data.

[0171] S45: The server obtains a device key corresponding to the device identifier included in the second network key update request, and uses the device key to decrypt the sixth data to obtain the random number and the generation time of the network key included in the sixth data.

[0172] S46: The server performs legitimacy verification based on at least the random number and the second random number included in the sixth data.

[0173] As an optional implementation, the server compares the random number decrypted from the sixth data with the second random number. If the two are the same, it is determined that the legitimacy verification has passed and the subsequent process continues. Otherwise, it is determined that the legitimacy verification has not passed and the process ends.

[0174] As another optional implementation, the server compares the random number decrypted from the sixth data and the second random number, and compares the generation time of the network key decrypted from the sixth data with the generation time of the fourth network key. If the random number decrypted from the sixth data and the second random number are the same, and the generation time of the network key decrypted from the sixth data is earlier than the generation time of the fourth network key, it is determined that the legitimacy verification has passed and the subsequent process continues. Otherwise, it is determined that the legitimacy verification has not passed and the process ends.

[0175] As another optional implementation, the server determines whether the node device is a node device that has been connected to the Mesh network based on the device identifier included in the second network key update request, compares the random number decrypted from the sixth data and the second random number, and compares the generation time of the network key decrypted from the sixth data with the generation time of the fourth network key. If the node device is a node device that has been connected to the Mesh network, the random number decrypted from the sixth data and the second random number are the same, and the generation time of the network key decrypted from the sixth data is earlier than the generation time of the fourth network key, it is determined that the legitimacy verification has passed and the subsequent process continues to execute; otherwise, it is determined that the legitimacy verification has not passed and the process ends.

[0176] S47: When determining that the legitimacy verification has passed, the server sends a second network key update response to the node device.

[0177] The second network key update response includes the device identification of the node device and fourth data, where the fourth data is data obtained by encrypting the fourth network key, the generation time and the activation time of the fourth network key by using the device key of the node device.

[0178] It should be noted that step S43 is not limited to Figure 4 The position shown only needs to be executed before executing step S46.

[0179] This application Figure 4 The network key update method shown in Figure 3 The network key update method shown adds a scheme in which the server updates the network key of the online node device in the Mesh network under normal conditions. In addition, the second network key update response sent by the server to the node device not only includes the fourth network key (i.e., the new network key) and the generation time of the fourth network key, but also includes the activation time of the fourth network key. This enables each online node device in the Mesh network to synchronously activate the fourth network key and synchronously delete the third network key (i.e., the old network key), providing a simple and effective network key synchronization switching mechanism. In addition, for a node device that has been deleted from the Mesh network, the network key cannot be updated because the node device cannot pass the legitimacy verification of the server.

[0180] The present application discloses a network key updating method applied to a node device and a server. Correspondingly, the present application also discloses a network key updating device applied to a node device and a server. The descriptions of the two in the specification can be referenced to each other.

[0181] See also Figure 5 , Figure 5 The schematic diagram of the structure of the network key updating device for node equipment disclosed in the present application includes a verification request sending unit 51, a first update notification receiving unit 52, a first update request sending unit 53, a first update response receiving unit 54 and a first network key updating unit 55.

[0182] in:

[0183] The verification request sending unit 51 is used to send a verification request to the server when the first node device switches from an offline state to an online state and determines that the first network key is invalid. The verification request includes the device identification of the first node device, and the first network key is the network key currently used by the first node device.

[0184] The first update notification receiving unit 52 is configured to receive a first network key update notification sent by the server, wherein the first network key update notification includes a first random number.

[0185] The first update request sending unit 53 is used to encrypt the first random number and the generation time of the first network key by using the device key to obtain the first data, and send a first network key update request including the device identification and the first data to the server.

[0186] The first update response receiving unit 54 is used to receive the first network key update response sent by the server. The first network key update response includes the device identification of the first node device and the second data, the second data is the data obtained by encrypting the second network key and the generation time of the second network key using the device key of the first node device, and the second network key is the network key sent by the server to the Mesh network for the last time before receiving the verification request.

[0187] The first network key updating unit 55 is used to obtain the second data included in the first network key update response, decrypt the second data using the device key to obtain the second network key and the generation time of the second network key, save the second network key and the generation time of the second network key, immediately take effect on the second network key, and delete the first network key.

[0188] In another embodiment of the present application, Figure 5 The network key updating device further comprises a second update notification receiving unit, a second update request sending unit, a second update response receiving unit, an update response processing unit and a second network key updating unit.

[0189] in:

[0190] The second update notification receiving unit is configured to receive a second network key update notification sent by the server, wherein the second network key update notification includes a second random number.

[0191] The second update request sending unit is used to encrypt the second random number and the generation time of the third network key by using the device key to obtain the third data, and send a second network key update request containing the device identification and the third data to the server, where the third network key is the network key currently used by the first node device.

[0192] The second update response receiving unit is used to receive a second network key update response sent by the server, wherein the second network key update response includes the device identification of the first node device and fourth data, and the fourth data is data obtained by encrypting the fourth network key, the generation time and the activation time of the fourth network key using the device key of the first node device.

[0193] The update response processing unit is used to obtain the fourth data included in the second network key update response, decrypt the fourth data using the device key to obtain the fourth network key, the generation time and activation time of the fourth network key, and save the fourth network key and the generation time of the fourth network key.

[0194] The second network key updating unit is used to validate the fourth network key when the activation time is reached, and delete the third network key when the deletion time is reached, wherein the deletion time is after the activation time and differs from the activation time by a specified time interval.

[0195] Optionally, after the first node device takes effect on the fourth network key, the first node device uses the fourth network key to encrypt the data to be sent when sending data to other node devices in the Mesh network.

[0196] Optionally, between the activation time of the fourth network key and the deletion time of the third network key, the first node device uses the third network key and the fourth network key respectively to decrypt data sent by other node devices in the Mesh network.

[0197] Optionally, the verification request sending unit 51 sends a verification request to the server, specifically: broadcasting a search proxy request; determining a target proxy device from node devices that respond to the search proxy request; sending a verification request to the target proxy device, so that the target proxy device transmits the verification request to the server.

[0198] See also Figure 6 , Figure 6 The present invention is a schematic diagram of the structure of the network key updating device for a server disclosed in the present application. The device includes a verification request receiving unit 61, an identity authentication unit 62, a first update notification sending unit 63, a first update request receiving unit 64, a first update request processing unit 65, a network key obtaining unit 66, a first legitimacy verification unit 67 and a first update response sending unit 68.

[0199] in:

[0200] The verification request receiving unit 61 is configured to receive a verification request sent by a first node device in the Mesh network, wherein the verification request includes a device identifier of the first node device.

[0201] The identity authentication unit 62 is used to perform identity authentication based on the device identification included in the authentication request.

[0202] The first update notification sending unit 63 is configured to send a first network key update notification to the first node device when the identity authentication is determined to be passed, wherein the first network key update notification includes a first random number.

[0203] The first update request receiving unit 64 is configured to receive a first network key update request sent by a first node device, wherein the first network key update request includes a device identification of the first node device and fifth data.

[0204] The first update request processing unit 65 is used to obtain the device key of the first node device, and decrypt the fifth data using the device key of the first node device to obtain the generation time of the random number and the network key included in the fifth data.

[0205] The network key acquisition unit 66 is used to acquire the second network key and the generation time of the second network key, wherein the second network key is the network key that the server sent to the Mesh network for the last time before receiving the verification request.

[0206] The first legitimacy verification unit 67 is used to perform legitimacy verification based on at least the random number included in the fifth data and the first random number.

[0207] The first update response sending unit 68 is used to send a first network key update response to the first node device when it is determined that the legitimacy verification has passed. The first network key update response includes the device identification of the first node device and second data, and the second data is data obtained by encrypting the second network key and the generation time of the second network key using the device key of the first node device.

[0208] In another embodiment of the present application, Figure 6 The network key updating device shown in the figure further includes a second update notification sending unit, a network key generating unit, a second update request receiving unit, a second update request processing unit, a second legitimacy verification unit and a second update response sending unit.

[0209] in:

[0210] The second update notification sending unit is used to generate a second network key update notification when a preset update condition is met, and send the second network key update notification to online node devices in the Mesh network, wherein the second network key update notification includes a second random number.

[0211] The network key generating unit is used to generate a fourth network key, record the generation time of the fourth network key, and configure the activation time of the fourth network key.

[0212] The second update request receiving unit is used to receive a second network key update request sent by the node device, where the second network key update request includes a device identification of the node device and sixth data.

[0213] The second update request processing unit is used to obtain a device key corresponding to the device identifier included in the second network key update request, and decrypt the sixth data using the currently obtained device key to obtain the random number and network key generation time included in the sixth data.

[0214] The second legitimacy verification unit is used to perform verification based on at least the random number and the second random number included in the sixth data.

[0215] The second update response sending unit is used to send a second network key update response to the node device when the verification is determined to be passed. The second network key update response includes the device identification of the node device and fourth data, and the fourth data is data obtained by encrypting the fourth network key, the generation time and the activation time of the fourth network key using the device key.

[0216] The present application also provides an electronic device.

[0217] See also Figure 7 , Figure 7 The hardware structure of the electronic device is shown. The electronic device includes: a processor 701 , a memory 702 , a communication interface 703 , and a communication bus 704 .

[0218] In the embodiment of the present application, the number of the processor 701, the memory 702, the communication interface 703, and the communication bus 704 is at least one, and the processor 701, the memory 702, and the communication interface 703 communicate with each other through the communication bus 704. The communication bus 704 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0219] It should be noted that those skilled in the art can understand that Figure 7 The structure of the electronic device shown in the figure does not constitute a limitation on the electronic device, and the electronic device may include Figure 7 More or fewer components may be shown, or certain components may be combined, or the components may be arranged differently.

[0220] Combine the following Figure 7 Provide a detailed introduction to the various components of electronic equipment.

[0221] The processor 701 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. It executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 702 and calling data stored in the memory 702, thereby monitoring the electronic device as a whole.

[0222] The processor 701 may be a central processing unit (CPU), or an application specific integrated circuit ASIC (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention, etc.;

[0223] The memory 702 may include a memory, such as a high-speed random-access memory (RAM) and a read-only memory (ROM), and may also include a large-capacity storage device, such as at least one disk storage.

[0224] The memory 702 stores a program, and the processor 701 can call the program stored in the memory, and the program is used to:

[0225] When the first node device switches from an offline state to an online state and determines that the first network key is invalid, the first node device sends a verification request to a server, where the verification request includes a device identifier of the first node device, and the first network key is a network key currently used by the first node device;

[0226] receiving a first network key update notification sent by the server, wherein the first network key update notification includes a first random number;

[0227] encrypting the first random number and the generation time of the first network key by using the device key to obtain first data, and sending a first network key update request including the device identifier and the first data to the server;

[0228] receiving a first network key update response sent by the server, where the first network key update response includes a device identifier of the first node device and second data, where the second data is data obtained by encrypting a second network key and a generation time of the second network key using a device key of the first node device, and the second network key is a network key that the server last sent to the Mesh network before receiving the verification request;

[0229] The second data included in the first network key update response is obtained, and the second data is decrypted using the device key to obtain the second network key and the generation time of the second network key, and the second network key and the generation time of the second network key are saved, the second network key is immediately effective, and the first network key is deleted.

[0230] Among them, the first node device is Figure 7 Electronic equipment shown.

[0231] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0232] The present application also provides a server.

[0233] See also Figure 8 , Figure 8 The hardware structure of the server is shown. The electronic device includes: a processor 801 , a memory 802 , a communication interface 803 , and a communication bus 804 .

[0234] In the embodiment of the present application, the number of the processor 801, the memory 802, the communication interface 803, and the communication bus 804 is at least one, and the processor 801, the memory 802, and the communication interface 803 communicate with each other through the communication bus 804. The communication bus 804 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0235] It should be noted that those skilled in the art can understand that Figure 8 The structure of the server shown in the figure does not constitute a limitation on the electronic device, and the server may include Figure 8 More or fewer components may be shown, or certain components may be combined, or the components may be arranged differently.

[0236] Combine the following Figure 8 Provide a detailed introduction to each component of the server.

[0237] Processor 801 is the control center of the server. It uses various interfaces and lines to connect various parts of the entire server. It executes various functions of the server and processes data by running or executing software programs and / or modules stored in memory 802 and calling data stored in memory 802, thereby monitoring the server as a whole.

[0238] The processor 801 may be a central processing unit (CPU), or an application specific integrated circuit ASIC (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention, etc.;

[0239] The memory 802 may include a memory, such as a high-speed random-access memory (RAM) and a read-only memory (ROM), and may also include a large-capacity storage device, such as at least one disk storage.

[0240] The memory 802 stores a program, and the processor 801 can call the program stored in the memory, and the program is used to:

[0241] Receiving a verification request sent by a first node device in the Mesh network, where the verification request includes a device identifier of the first node device;

[0242] Performing identity authentication based on the device identification included in the verification request;

[0243] If it is determined that the identity authentication is passed, sending a first network key update notification to the first node device, where the first network key update notification includes a first random number;

[0244] receiving a first network key update request sent by the first node device, where the first network key update request includes a device identifier of the first node device and fifth data;

[0245] Obtaining a device key of the first node device, and decrypting the fifth data using the device key of the first node device to obtain a generation time of a random number and a network key included in the fifth data;

[0246] Acquire a second network key and a generation time of the second network key, wherein the second network key is a network key that the server last sent to the Mesh network before receiving the verification request;

[0247] Performing legitimacy verification based at least on the random number included in the fifth data and the first random number;

[0248] If it is determined that the legitimacy verification has passed, a first network key update response is sent to the first node device, where the first network key update response includes a device identifier of the first node device and second data, where the second data is data obtained by encrypting the second network key and the generation time of the second network key using the device key of the first node device.

[0249] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0250] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0251] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0252] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network key updating method, characterized in that: Applied to a first node device in a Mesh network, the method comprises: The first node device switches from an offline state to an online state, and when it is determined that the first network key currently in use is invalid, sends a verification request to a server, wherein the verification request includes a device identifier of the first node device; Receiving a first network key update notification including a first random number sent by the server; Encrypting the first random number and the generation time of the first network key by using a device key to obtain first data, and sending a first network key update request including the device identifier and the first data to the server, so that the server performs legitimacy verification based on the device identifier, the first random number, and the generation time of the first network key; Receiving a first network key update response sent by the server; Obtaining second data included in the first network key update response, decrypting the second data using the device key to obtain a second network key and a generation time of the second network key, saving the second network key and the generation time of the second network key, immediately taking into effect the second network key, and deleting the first network key, wherein the second network key is the network key that the server last sent to the Mesh network before receiving the verification request; The method for updating the network key of a node device online in a normal state also includes: receiving a second network key update notification including a second random number sent by the server; encrypting the second random number and the generation time of the third network key currently in use by using the device key to obtain third data, and sending a second network key update request including the device identification and the third data to the server; receiving a second network key update response sent by the server; Acquire fourth data included in the second network key update response, decrypt the fourth data using the device key to obtain a fourth network key, a generation time and an activation time of the fourth network key, and save the fourth network key and the generation time of the fourth network key; Validating the fourth network key when the activation time is reached; deleting the third network key when a deletion time is reached, wherein the deletion time is after the activation time and differs from the activation time by a specified time interval; The activation time of the fourth network key enables each online node device in the Mesh network to synchronously activate the fourth network key, and the deletion time can synchronously delete the third network key, providing a simple and effective network key synchronization switching mechanism.

2. The method according to claim 1, characterized in that Also includes: After the first node device takes effect with the fourth network key, the first node device uses the fourth network key to encrypt the data to be sent when sending data to other node devices in the Mesh network.

3. The method according to claim 1, characterized in that Also includes: Between the activation time and the deletion time, the first node device uses the third network key and the fourth network key to decrypt data sent by other node devices in the Mesh network.

4. The method according to claim 1, characterized in that: The sending of the verification request to the server comprises: Broadcast search agent request; Determine a target proxy device from the node devices that respond to the search proxy request; A verification request is sent to the target proxy device so that the target proxy device transmits the verification request to the server.

5. A network key updating method, characterized in that: Applied to a server, the method comprises: Receiving a verification request sent by a first node device in the Mesh network, where the verification request includes a device identifier of the first node device; Performing identity authentication based on the device identification included in the verification request; When it is determined that the identity authentication is passed, sending a first network key update notification including a first random number to the first node device; receiving a first network key update request sent by the first node device, where the first network key update request includes a device identifier of the first node device and fifth data; Obtaining a device key of the first node device, and decrypting the fifth data using the device key of the first node device to obtain a generation time of a random number and a network key included in the fifth data; Acquire a second network key and a generation time of the second network key, wherein the second network key is a network key that the server last sent to the Mesh network before receiving the verification request; Performing legitimacy verification based at least on the random number and the generation time of the network key included in the fifth data; If it is determined that the legitimacy verification has passed, sending a first network key update response to the first node device, where the first network key update response includes a device identifier of the first node device and second data, where the second data is data obtained by encrypting the second network key and the generation time of the second network key using the device key of the first node device; Among them, it also includes: When a preset update condition is met, generating a second network key update notification including a second random number; Sending the second network key update notification to online node devices in the Mesh network; Generate a fourth network key, record the generation time of the fourth network key, and configure the activation time of the fourth network key; receiving a second network key update request sent by a node device, wherein the second network key update request includes a device identification of the node device and sixth data; Acquire a device key corresponding to the device identifier included in the second network key update request, and decrypt the sixth data using the currently acquired device key to obtain a random number and a generation time of the network key included in the sixth data; Performing legitimacy verification based at least on the random number included in the sixth data and the second random number; If it is determined that the legitimacy verification has passed, sending a second network key update response to the node device, where the second network key update response includes a device identification of the node device and fourth data, where the fourth data is data obtained by encrypting the fourth network key, the generation time of the fourth network key, and the activation time by using the device key; The activation time of the fourth network key enables each online node device in the Mesh network to synchronously activate the fourth network key, providing a simple and effective network key synchronization switching mechanism.

6. A network key updating device, characterized in that: A first node device applied to a Mesh network, the device comprising: a verification request sending unit, configured to send a verification request to a server when the first node device switches from an offline state to an online state and determines that the first network key currently in use is invalid, wherein the verification request includes a device identifier of the first node device; A first update notification receiving unit, configured to receive a first network key update notification including a first random number sent by the server; a first update request sending unit, configured to encrypt the first random number and the generation time of the first network key by using a device key to obtain first data, and send a first network key update request including the device identification and the first data to the server, so that the server performs legitimacy verification based on the device identification, the first random number and the generation time of the first network key; A first update response receiving unit, configured to receive a first network key update response sent by the server; a first network key updating unit, configured to obtain second data included in the first network key update response, decrypt the second data using the device key to obtain a second network key and a generation time of the second network key, save the second network key and the generation time of the second network key, immediately take effect on the second network key, and delete the first network key, wherein the second network key is the network key that the server last sent to the Mesh network before receiving the verification request; The network key updating device is also used for updating the network key of the node device online in the normal state, including: receiving a second network key update notification including a second random number sent by the server; encrypting the second random number and the generation time of the third network key currently in use by using the device key to obtain third data, and sending a second network key update request including the device identification and the third data to the server; receiving a second network key update response sent by the server; Acquire fourth data included in the second network key update response, decrypt the fourth data using the device key to obtain a fourth network key, a generation time and an activation time of the fourth network key, and save the fourth network key and the generation time of the fourth network key; Validating the fourth network key when the activation time is reached; deleting the third network key when a deletion time is reached, wherein the deletion time is after the activation time and differs from the activation time by a specified time interval; The activation time of the fourth network key enables each online node device in the Mesh network to synchronously activate the fourth network key, and the deletion time can synchronously delete the third network key, providing a simple and effective network key synchronization switching mechanism.

7. A network key updating device, characterized in that: Applied to a server, the device comprises: A verification request receiving unit, configured to receive a verification request sent by a first node device in the Mesh network, wherein the verification request includes a device identifier of the first node device; An identity authentication unit, configured to perform identity authentication based on a device identifier included in the authentication request; A first update notification sending unit, configured to send a first network key update notification including a first random number to the first node device when it is determined that the identity authentication is passed; A first update request receiving unit, configured to receive a first network key update request sent by the first node device, wherein the first network key update request includes a device identification of the first node device and fifth data; A first update request processing unit, configured to obtain a device key of the first node device, and decrypt the fifth data using the device key of the first node device to obtain a generation time of a random number and a network key included in the fifth data; A network key acquisition unit, configured to acquire a second network key and a generation time of the second network key, wherein the second network key is a network key that the server last sent to the Mesh network before receiving the verification request; A first legitimacy verification unit, configured to perform legitimacy verification based at least on the random number and the generation time of the network key included in the fifth data; A first update response sending unit, configured to send a first network key update response to the first node device when it is determined that the legitimacy verification has passed, wherein the first network key update response includes a device identifier of the first node device and second data, wherein the second data is data obtained by encrypting the second network key and a generation time of the second network key using a device key of the first node device; Wherein, the network key updating device further comprises: When a preset update condition is met, generating a second network key update notification including a second random number; Sending the second network key update notification to online node devices in the Mesh network; Generate a fourth network key, record the generation time of the fourth network key, and configure the activation time of the fourth network key; receiving a second network key update request sent by a node device, wherein the second network key update request includes a device identification of the node device and sixth data; Acquire a device key corresponding to the device identifier included in the second network key update request, and decrypt the sixth data using the currently acquired device key to obtain a random number and a generation time of the network key included in the sixth data; Performing legitimacy verification based at least on the random number included in the sixth data and the second random number; If it is determined that the legitimacy verification has passed, sending a second network key update response to the node device, where the second network key update response includes a device identification of the node device and fourth data, where the fourth data is data obtained by encrypting the fourth network key, the generation time of the fourth network key, and the activation time by using the device key; The activation time of the fourth network key enables each online node device in the Mesh network to synchronously activate the fourth network key, providing a simple and effective network key synchronization switching mechanism.

8. An electronic device, characterized in that: including a communication module, a processor and a memory; The memory is used to store programs; The processor is used to execute the program to implement each step of the network key updating method according to any one of claims 1 to 4.

9. A server, characterized in that: including a communication module, a processor and a memory; The memory is used to store programs; The processor is used to execute the program to implement each step of the network key updating method as claimed in claim 5.

Images