Communication method and device

Abstract

The present application provides a communication method and device, which include: generating a current SAK according to a national secret algorithm; creating an SA using the current SAK; sending a first MKPDU protocol message to a second network device after a first receiving SA has been installed locally, the first MKPDU protocol message including a first extended type parameter set and a second extended type parameter set, the first extended type parameter set including an algorithm identifier of the national secret algorithm, and the second extended type parameter set including the current SAK; when a second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed a second receiving SA, installing the first sending SA locally; sending a third MKPDU protocol message to the second network device, the third MKPDU protocol message being used to enable the second network device to install the second sending SA locally.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] Media Access Control Security (MACsec) defines a data security communication method within a local area network based on the IEEE 802 protocol, which can provide users with secure MAC layer data sending and receiving services. For example, user data encryption, data frame integrity check and data source authenticity verification, providing users with line-speed forwarding of encrypted data, etc.

[0003] MACsec consists of two functional entities: one is the MAC security entity (SecY), and the other is the MAC security key negotiation subject (KaY). SecY is implemented by the hardware chip at the driver level. It is located on the link port and provides MAC security forwarding services for controlled port users and non-security services for uncontrolled port users. SecY uses the SAK key issued by KaY to encrypt the messages sent by the channel according to the security set (English: Secure Association, referred to as: SA), and decrypt and restore the messages received by the secure channel. At the same time, replay protection is performed on each SA in the receiving channel.

[0004] KaY is implemented by software. It is responsible for key generation and release, discovery and establishment of secure channels between devices. It provides SecY with the same SAK for message encryption protection between end-to-end secure channels. The MKPDU protocol messages exchanged between KaY entities are distinguished from MACsec protected data messages (MACsec Frame) by Ethernet Type = 0x88-8e (reuses the message type of 802.1x, subtype is EAPOL_MKA).

[0005] Currently, the encryption suites supported by the MACsec IEEE802.1X-2020 protocol include four symmetric encryption algorithms: GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128, and GCM-AES-XPN-256. The IEEE document states that only the encryption suites specified in the above protocols can be implemented, and other encryption suites cannot be implemented.

[0006] The National Encryption Algorithm is a set of data encryption processing algorithms independently developed and innovated by my country. From SM1 to SM4, they realize the functions of symmetric, asymmetric, and digest algorithms respectively. The National Encryption Algorithm is suitable for application in related fields such as embedded Internet of Things to complete functions such as identity authentication and data encryption and decryption.

[0007] However, since the MACsec protocol document states that only the four symmetric encryption suites supported by the MACsec protocol can be implemented, and other encryption suites cannot be implemented, such as the national encryption algorithm, there are certain limitations; and the cryptographic algorithm is the core technology for ensuring information security. In order to enhance the security of state-owned data communication equipment, how to apply the national encryption algorithm in the MACsec protocol is now an urgent problem to be solved. Summary of the invention

[0008] In view of this, the present application provides a communication method and device to solve the problem that the existing MACsec protocol cannot support the national encryption algorithm.

[0009] In a first aspect, the present application provides a communication method, the method is applied to a first network device, the first network device supports a national encryption algorithm, the first network device has generated an original SAK, the original SAK is used to encrypt and decrypt a message sent or received, the method comprising:

[0010] Generate the current SAK according to the national secret algorithm;

[0011] Using the current SAK, creating an SA, wherein the SA includes a first receiving SA and a first sending SA;

[0012] After the first receiving SA has been installed locally, a first MKPDU protocol message is sent to the second network device, wherein the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, wherein the first extended type parameter set includes an algorithm identifier of the national encryption algorithm, and the second extended type parameter set includes the current SAK;

[0013] When a second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed a second receiving SA, locally installing the first sending SA;

[0014] A third MKPDU protocol message is sent to the second network device, where the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and to install the second sending SA locally.

[0015] In a second aspect, the present application provides a communication device, the device is applied to a first network device, the first network device supports a national encryption algorithm, the first network device has generated an original SAK, the original SAK is used to encrypt and decrypt a message sent or received, the device includes: a generation unit, a creation unit, an installation unit, a sending unit, and a receiving unit;

[0016] The generating unit is used to generate the current SAK according to the national encryption algorithm;

[0017] The creating unit is used to create an SA using the current SAK, wherein the SA includes a first receiving SA and a first sending SA;

[0018] The sending unit is used to send a first MKPDU protocol message to the second network device after the installation unit has installed the first receiving SA locally, wherein the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, wherein the first extended type parameter set includes an algorithm identifier of the national encryption algorithm, and the second extended type parameter set includes the current SAK;

[0019] The installation unit is configured to locally install the first sending SA when the receiving unit receives a second MKPDU protocol message sent by the second network device within a preset time and the second MKPDU protocol message indicates that the second network device has installed the second receiving SA;

[0020] The sending unit is further used to send a third MKPDU protocol message to the second network device, and the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and to install the second sending SA locally.

[0021] In a third aspect, the present application provides a network device, including a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to execute the method provided in the first aspect of the present application.

[0022] Therefore, by applying the communication method and device provided in the present application, the first network device generates the current SAK according to the national secret algorithm; using the current SAK, the first network device creates an SA, and the SA includes a first receiving SA and a first sending SA; when the first receiving SA has been installed locally, the first network device sends a first MKPDU protocol message to the second network device, and the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, the first extended type parameter set includes an algorithm identifier of the national secret algorithm, and the second extended type parameter set includes the current SAK; when the second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed the second receiving SA, the first network device installs the first sending SA locally; the first network device sends a third MKPDU protocol message to the second network device, and the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and install the second sending SA locally.

[0023] In this way, by carrying the algorithm identifier of the national encryption algorithm in the extended type parameter set, whether to support the national encryption algorithm can be negotiated during the MKA negotiation. If both devices at both ends support the national encryption algorithm, each will create an SA locally based on the SAK generated by the national encryption algorithm. When the data frame message is subsequently sent, the SAK is used for encryption and decryption operations. This solves the problem that the existing MACsec protocol cannot support the national encryption algorithm. The MACsec protocol supports the national encryption algorithm, enhancing the security of state-owned data communication equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flow chart of a communication method provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of the EAPOL message structure provided in an embodiment of the present application;

[0026] Figure 3 The MKPDU protocol message provided for the embodiment of the present application includes multiple parameter set structure schematic diagrams;

[0027] Figure 4 A schematic diagram of the structure of a first extension type parameter set provided in an embodiment of the present application;

[0028] Figure 5 A structural diagram of a communication device provided in an embodiment of the present application;

[0029] Figure 6 The network device hardware structure provided in the embodiment of the present application. DETAILED DESCRIPTION

[0030] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0031] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in this article refers to and includes any or all possible combinations of one or more corresponding listed items.

[0032] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0033] The communication method provided in the embodiment of the present application is described in detail below. Figure 1 , Figure 1 A flow chart of a communication method provided in an embodiment of the present application. The method is applied to a first network device. The communication method provided in an embodiment of the present application may include the following steps.

[0034] Step 110: Generate the current SAK according to the national encryption algorithm.

[0035] Specifically, the first network device establishes an MKA session with the second network device, and performs MKA negotiation on the MKA session.

[0036] According to the respective priorities of the first network device and the second network device, the roles of the first network device and the second network device in the MKA negotiation are respectively configured. For example, when configuring according to the priority, the one with a high priority is configured as the key server end, and the one with a low priority is configured as the key client end. In the embodiment of the present application, if the priority of the first network device is higher than that of the second network device, the first network device is the key server end, and the second network device is the key client end.

[0037] The first network device acts as a key server and generates the current SAK using the specified national encryption algorithm GCM-SM1, GCM-SM4-DRAFT, or GCM-SM4-STANDARD according to the local configuration.

[0038] It is understandable that the first network device may generate the current SAK using the national encryption algorithm by referring to the existing method of generating SAK, which will not be repeated here.

[0039] Optionally, before this step, the method further includes a step in which the first network device receives a configuration instruction input by a user.

[0040] Furthermore, the user issues a configuration instruction to the first network device by inputting a command line to the first network device. The configuration instruction includes an algorithm identifier of a specified supported algorithm, wherein the specified supported algorithm includes a national encryption algorithm or an algorithm already supported by the MACsec protocol.

[0041] For example, the command line is: macsec cipher-suite[gcm-sm1|gcm-sm4-draft| gcm-sm4-standard]

[0042] Or, the command line is macsec cipher-suite[gcm-aes-128|gcm-aes-256| gcm-sm1|gcm-sm4-draft|gcm-sm4-standard]

[0043] Among them, in the embodiment of the present application, the encryption algorithm can be specified to use the national secret symmetric algorithm SM1, SM4 (such as the first command line mentioned above). Due to the differences in the versions of the SM4 algorithm, when the network device acts as the initiator to conduct MKA negotiation with network devices of other manufacturers, it is necessary to specify the SM4 algorithm version through the above configuration instructions to ensure that the network devices at both ends use the same version of the SM4 algorithm for negotiation. After the negotiation is successful, the message is encrypted and decrypted according to the specified encryption algorithm.

[0044] Step 120: Create an SA using the current SAK, where the SA includes a first receiving SA and a first sending SA.

[0045] Specifically, according to the description of step 110, after the first network device generates the current SAK, it uses the current SAK to create an SA, which includes a first receiving SA and a first sending SA.

[0046] After the first network device creates the first receiving SA and the first sending SA, it first installs the first receiving SA locally.

[0047] It is understandable that the first network device may locally install the first receiving SA by referring to the existing method of installing the receiving SA, which will not be repeated here.

[0048] Step 130: After the first receiving SA has been installed locally, a first key negotiation protocol message (English: MACsec Key Agreement Protocol Data Unit, abbreviated as: MKPDU) is sent to the second network device, wherein the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, wherein the first extended type parameter set includes the algorithm identifier of the national encryption algorithm, and the second extended type parameter set includes the current SAK.

[0049] Specifically, according to the description of step 120, after the first network device has installed the first receiving SA locally, the first network device generates a first MKPDU protocol message. The first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set.

[0050] The first extended type parameter set includes the algorithm identifier of the national cryptographic algorithm, and the second extended type parameter set includes the current SAK. The algorithm identifier of the national cryptographic algorithm includes the algorithm identifier of the SM1 algorithm (GCM-SM1), or the algorithm identifier of the SM4 draft algorithm (GCM-SM4-DRAFT), or the algorithm identifier of the SM4 standard algorithm (GCM-SM4-STANDARD).

[0051] After the first network device generates the first MKPDU protocol message, it sends the first MKPDU protocol message to the second network device. After receiving the first MKPDU protocol message, the second network device obtains the algorithm identifier of the national encryption algorithm and the current SAK from the first extended type parameter set and the second extended type parameter set respectively.

[0052] Furthermore, the message format of the first MKPDU protocol message is described in detail below.

[0053] The first network device generates an Extensible Authentication Protocol message (EAP message for short), and encapsulates the EAP protocol through the EAP over LAN (EAPOL) technology to obtain an EAPOL message. The EAPOL technology is an encapsulation technology for carrying EAP messages defined by the 802.1X protocol, and is mainly used to transmit EAP messages between a client and a server in a local area network.

[0054] like Figure 2 As shown, Figure 2 A schematic diagram of the EAPOL message structure provided in the embodiment of the present application. Figure 2 In the EAPOL message, the EAPOL message includes a protocol version field, a packet type field, a packet body length field, and a packet body field (the packet body field may be referred to as a first packet body field).

[0055] When the value of the Packet Type field is 0000 0101, it indicates that the EAPOL message is a MKPDU protocol message. That is, the value of the Packet Type field included in the first MKPDU protocol message is 0000 0101.

[0056] Each MKPDU protocol message includes multiple parameter sets, which are carried in the Packet Body field. The use standard of each parameter set is specified by the MACsec key protocol in Article 9 of IEEE802.1X-2010, which specifies the encoding of each parameter set.

[0057] like Figure 3 As shown, Figure 3 The MKPDU protocol message provided in the embodiment of the present application includes multiple parameter set structure diagrams. Figure 3 In the , the first parameter set is the basic parameter set (Basic Parameter Set), which always exists. The basic parameter set may be followed by 0 or more parameter sets, and finally the ICV field.

[0058] In an embodiment of the present application, the first network device uses the first extended parameter set after the basic parameter set to carry the algorithm identifier of the national encryption algorithm, and uses the second extended parameter set to carry the current SAK.

[0059] Among them, the first extended parameter set can be specifically a Distributed SAK parameter set, and the second extended parameter set can be specifically a MACsec SAK Use parameter set. The above two parameter sets are both existing parameter sets, and the fields included in each are all existing fields. The MACsec SAK Use parameter set carrying the current SAK can specifically refer to the existing method of carrying the current SAK, which will not be repeated here.

[0060] The following is an explanation of the algorithm identifier of the national encryption algorithm carried in the Distributed SAK parameter set. Figure 4 As shown, Figure 4 A schematic diagram of the first extended type parameter set structure provided in an embodiment of the present application. Figure 4In the specification, the first extended type parameter set includes a parameter set type (Parameter Set Type) field (the value of the parameter set type field is 4), a Distributed A Na field, a Confidentiality offset field, a Parameter set body length field, a Parameter set body length (cont) field, a Key Number field, a MACsec Cipher Suite field, and an AES key wrap of sak as specified in 9.8 field.

[0061] The MACsec cipher suite field is used to carry the cipher suite reference number supported by the network device. Currently, the cipher suite numbers supported by the MACsec protocol and the cipher suite numbers newly added in the embodiment of the present application are shown in the following table.

[0062] Table 1 Cipher suite numbers

[0063] Encryption Algorithm Cipher suites Defining the protocol GCM-AES-128 00-80-c2-00-01-00-00-01 802.1AE 2006 GCM-AES-256 00-80-c2-00-01-00-00-02 802.1AEbn 2011 GCM-AES-XPN-128 00-80-c2-00-01-00-00-03 802.1AEbw 2013 GCM-AES-XPN-256 00-80-c2-00-01-00-00-04 802.1AEbw 2013 GCM-SM1 50-98-B8-00-01-00-00-01 GCM-SM4-DRAFT 50-98-B8-00-01-00-00-02 GCM-SM4-STANDARD 50-98-B8-00-01-00-00-03

[0064] Among them, 00-80-c2 represents the OUI of the IEEE 802.1 Working Group (standards-oui.ieee.org), and the encryption algorithm defined by 00-01-00-00-01 is GCM-AES-128.

[0065] In the embodiment of the present application, the newly added cryptographic suite reference numbers are: 50-98-B8-00-01-00-00-01 to 50-98-B8-00-01-00-00-03. 50-98-B8 represents the equipment manufacturer; 01-00-00-01 represents the encryption suite is GCM-SM1; 01-00-00-02 represents the encryption suite is GCM-SM4-DRAFT; 01-00-00-03 represents the encryption suite is GCM-SM4-STANDARD.

[0066] Step 140: When a second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed a second receiving SA, the first sending SA is installed locally.

[0067] Specifically, according to the description of step 130, the first network device sends a first MKPDU protocol message to the second network device. After receiving the first MKPDU protocol message, the second network device first obtains the first extension type parameter set and the second extension type parameter set from the first message body field. Then, the second network device obtains the algorithm identifier of the national encryption algorithm supported by the first network device from the first extension type parameter set, and obtains the current SAK from the second extension type parameter set.

[0068] The second network device identifies whether it supports the national encryption algorithm that matches the first network device based on the local configuration and supported algorithms. If supported, SA is created based on the current SAK. The SA includes a second receiving SA and a second sending SA. After the second network device creates the second receiving SA and the second sending SA, it installs the second receiving SA locally.

[0069] After the second network device installs the second receiving SA, it generates a second MKPDU protocol message. The second MKPDU protocol message includes a second extended type parameter set, that is, a MACsec SAK Use parameter set. The MACsec SAK Use parameter set includes an RX field. The second network device sets the RX field to indicate that the second network device has installed the second receiving SA.

[0070] The second network device sends a second MKPDU protocol message to the first network device. After receiving the second MKPDU protocol message, the first network device first obtains a second extended type parameter set, namely, a MACsec SAK Use parameter set, from the first message body field. According to the value of the RX field included in the MACsec SAK Use parameter set, it is determined that the second network device has installed a second receiving SA.

[0071] The first network device locally installs a first sending SA.

[0072] Optionally, if the second network device does not support the national encryption algorithm, the second network device cannot create SA even if it obtains the current SAK. In this way, the second network device cannot install the second receiving SA. The second network device does not set the RX field to indicate that the second network device has not installed the second receiving SA.

[0073] The second network device sends a second MKPDU protocol message to the first network device. After receiving the second MKPDU protocol message, the first network device first obtains a second extension type parameter set, namely, a MACsec SAK Use parameter set, from the first message body field. According to the value of the RX field included in the MACsec SAK Use parameter set, it is determined that the second network device has not installed the second receiving SA.

[0074] The first network device determines that the MACsec session negotiation between the first network device and the second network device fails. The first network device sets the port for establishing the MACsec session between the local device and the second network device to a link down state, and no longer forwards protocol messages and data frame messages to the second network device.

[0075] Optionally, after the first network device sends the first MKPDU protocol message to the second network device, a timer is started locally. The preset time of the timer may be specifically 6 seconds, and the timer waits for the second MKPDU protocol message sent by the second network device.

[0076] Step 150: Send a third MKPDU protocol message to the second network device, where the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and to install the second sending SA locally.

[0077] Specifically, according to the description of step 140, after the first network device locally installs the first sending SA, it generates a third MKPDU protocol message. The third MKPDU protocol message includes a second extension type parameter set, that is, a MACsec SAK Use parameter set. The MACsec SAK Use parameter set includes an RX field and a TX field. The first network device sets the RX field and the TX field to indicate that the first network device has installed the first receiving SA and the first sending SA.

[0078] The first network device sends a third MKPDU protocol message to the second network device.

[0079] After receiving the first MKPDU protocol message, the second network device first obtains the second extended type parameter set, namely the MACsec SAK Use parameter set, from the first message body field, and determines that the first network device has installed the first receiving SA and the first sending SA according to the values ​​of the RX field and the TX field of the MACsec SAK Use parameter set.

[0080] The second network device locally installs the second sending SA.

[0081] In this way, the network devices at both ends create SAs based on the current SAK, and both have completed the installation of receiving SAs and sending SAs locally. After the SA security session is established, the network devices at both ends can begin to use the national encryption algorithm to encrypt and decrypt the data frames sent to each other.

[0082] Therefore, by applying the communication method provided in the present application, the first network device generates a current SAK according to the national secret algorithm; using the current SAK, the first network device creates an SA, and the SA includes a first receiving SA and a first sending SA; when the first receiving SA has been installed locally, the first network device sends a first MKPDU protocol message to the second network device, and the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, the first extended type parameter set includes an algorithm identifier of the national secret algorithm, and the second extended type parameter set includes the current SAK; when the second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed the second receiving SA, the first network device installs the first sending SA locally; the first network device sends a third MKPDU protocol message to the second network device, and the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and install the second sending SA locally.

[0083] In this way, by carrying the algorithm identifier of the national encryption algorithm in the extended type parameter set, whether to support the national encryption algorithm can be negotiated during the MKA negotiation. If both devices at both ends support the national encryption algorithm, each will create an SA locally based on the SAK generated by the national encryption algorithm. When the data frame message is subsequently sent, the SAK is used for encryption and decryption operations. This solves the problem that the existing MACsec protocol cannot support the national encryption algorithm. The MACsec protocol supports the national encryption algorithm, enhancing the security of state-owned data communication equipment.

[0084] Optionally, after step 130 of the embodiment of the present application, a first timer is also started, and within the preset time of the first timer, the first network device is prohibited from generating SAK to prevent frequent refreshing. The preset time of the first timer can be specifically 6s.

[0085] Optionally, in an embodiment of the present application, after the first network device sends the third MKPDU protocol message to the second network device, the first network device also starts a second timer. When the preset time of the second timer is reached, the first network device deletes the original SAK so that when subsequently sending or receiving data frame messages, the first network device uses the current SAK for encryption and decryption.

[0086] The preset time of the second timer may be specifically 3 seconds, which is used to delay the deletion of the original SAK (it is understandable that before the SA security session is established, the network devices at both ends use the original SAK to encrypt and decrypt the data frame messages sent and received).

[0087] Based on the same inventive concept, the present application embodiment also provides a communication device corresponding to the communication method. Figure 5, Figure 5 A communication device provided in an embodiment of the present application, the device is applied to a first network device, the first network device supports a national encryption algorithm, the first network device has generated an original SAK, the original SAK is used to encrypt and decrypt a message sent or received, and the device includes: a generation unit 510, a creation unit 520, an installation unit 530, a sending unit 540, and a receiving unit 550;

[0088] The generating unit 510 is used to generate the current SAK according to the national encryption algorithm;

[0089] The creating unit 520 is used to create an SA using the current SAK, where the SA includes a first receiving SA and a first sending SA;

[0090] The sending unit 540 is configured to send a first MKPDU protocol message to the second network device after the installation unit 530 has installed the first receiving SA locally, wherein the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, wherein the first extended type parameter set includes an algorithm identifier of the national encryption algorithm, and the second extended type parameter set includes the current SAK;

[0091] The installation unit 530 is configured to install the first sending SA locally when the receiving unit 550 receives the second MKPDU protocol message sent by the second network device within a preset time and the second MKPDU protocol message indicates that the second network device has installed the second receiving SA;

[0092] The sending unit 540 is further used to send a third MKPDU protocol message to the second network device, where the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and to install the second sending SA locally.

[0093] Optionally, the device further includes: a starting unit (not shown in the figure), configured to start a first timer, and prohibit the generation of SAK within a preset time of the first timer.

[0094] Optionally, the first MKPDU protocol message includes a message body field, the message body field carries the first extended type parameter set and the second extended type parameter set; the first extended type parameter set includes a MACsec cipher suite field, the MACsec cipher suite field carries the algorithm identifier of the national encryption algorithm;

[0095] The algorithm identifier of the national secret algorithm includes the algorithm identifier of the SM1 algorithm, or the algorithm identifier of the SM4 draft algorithm, or the algorithm identifier of the SM4 standard algorithm.

[0096] Optionally, the receiving unit 550 is further used to receive a configuration instruction input by a user, where the configuration instruction includes an algorithm identifier of a specified supported algorithm, and the specified supported algorithm includes the national encryption algorithm or an algorithm supported by the MACsec protocol.

[0097] Optionally, the starting unit (not shown in the figure) is also used to start a second timer;

[0098] The device also includes: a deleting unit (not shown in the figure), which is used to delete the original SAK when the preset time of the second timer is reached, so that when the message is sent or received again, the current SAK is used for encryption and decryption processing.

[0099] Optionally, the device further includes: a determination unit (not shown in the figure), configured to determine that the MACsec session negotiation with the second network device has failed when the receiving unit receives a second MKPDU protocol message sent by the second network device within a preset time and the second MKPDU protocol message indicates that the second network device has not installed a second receiving SA;

[0100] A setting unit (not shown in the figure) is used to set the port for establishing the MACsec session between the local and the second network device to a link down state.

[0101] Therefore, by applying the communication device provided in the present application, the first network device generates a current SAK according to the national secret algorithm; using the current SAK, the first network device creates an SA, and the SA includes a first receiving SA and a first sending SA; when the first receiving SA has been installed locally, the first network device sends a first MKPDU protocol message to the second network device, and the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, the first extended type parameter set includes an algorithm identifier of the national secret algorithm, and the second extended type parameter set includes the current SAK; when the second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed the second receiving SA, the first network device installs the first sending SA locally; the first network device sends a third MKPDU protocol message to the second network device, and the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and install the second sending SA locally.

[0102] In this way, by carrying the algorithm identifier of the national encryption algorithm in the extended type parameter set, whether to support the national encryption algorithm can be negotiated during the MKA negotiation. If both devices at both ends support the national encryption algorithm, each will create an SA locally based on the SAK generated by the national encryption algorithm. When the data frame message is subsequently sent, the SAK is used for encryption and decryption operations. This solves the problem that the existing MACsec protocol cannot support the national encryption algorithm. The MACsec protocol supports the national encryption algorithm, enhancing the security of state-owned data communication equipment.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a network device, such as Figure 6 As shown, it includes a processor 610, a transceiver 620 and a machine-readable storage medium 630, the machine-readable storage medium 630 stores machine-executable instructions that can be executed by the processor 610, and the processor 610 is prompted by the machine-executable instructions to execute the communication method provided in the embodiment of the present application. Figure 5 The communication device shown can be used as Figure 6 The network device hardware structure shown is implemented.

[0104] The computer-readable storage medium 630 may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the computer-readable storage medium 630 may also be at least one storage device located away from the processor 610.

[0105] The processor 610 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, or discrete hardware components.

[0106] In the embodiment of the present application, the processor 610 reads the machine executable instructions stored in the machine readable storage medium 630, and the machine executable instructions enable the processor 610 itself and call the transceiver 620 to execute the communication method described in the aforementioned embodiment of the present application.

[0107] In addition, an embodiment of the present application provides a machine-readable storage medium 630, which stores machine-executable instructions. When called and executed by the processor 610, the machine-executable instructions prompt the processor 610 itself and the calling transceiver 620 to execute the communication method described in the aforementioned embodiment of the present application.

[0108] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0109] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0110] As for the communication device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0111] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A communication method, characterized in that: The method is applied to a first network device, the first network device supports a national encryption algorithm, the first network device has generated an original SAK, and the original SAK is used to encrypt and decrypt a message sent or received, and the method includes: Generate the current SAK according to the national secret algorithm; Using the current SAK, creating an SA, wherein the SA includes a first receiving SA and a first sending SA; After the first receiving SA has been installed locally, a first MKPDU protocol message is sent to the second network device, wherein the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, wherein the first extended type parameter set includes an algorithm identifier of the national encryption algorithm, and the second extended type parameter set includes the current SAK; When a second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has installed a second receiving SA, locally installing the first sending SA; Sending a third MKPDU protocol message to the second network device, wherein the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and to install the second sending SA locally; Wherein, after sending the first MKPDU protocol message to the second network device, the method further includes: A first timer is started, and within a preset time of the first timer, generation of SAK is prohibited.

2. The method according to claim 1, characterized in that The first MKPDU protocol message includes a message body field, and the message body field carries the first extended type parameter set and the second extended type parameter set; the first extended type parameter set includes a MACsec cipher suite field, and the MACsec cipher suite field carries the algorithm identifier of the national encryption algorithm; The algorithm identifier of the national secret algorithm includes the algorithm identifier of the SM1 algorithm, or the algorithm identifier of the SM4 draft algorithm, or the algorithm identifier of the SM4 standard algorithm.

3. The method according to claim 1, characterized in that Before generating the current SAK according to the national secret algorithm, the method further includes: A configuration instruction input by a user is received, wherein the configuration instruction includes an algorithm identifier of a specified supported algorithm, and the specified supported algorithm includes the national encryption algorithm or an algorithm already supported by the MACsec protocol.

4. The method according to claim 1, characterized in that The method further comprises: Starting a second timer; When the preset time of the second timer is reached, the original SAK is deleted so that when a message is sent or received again, the current SAK is used for encryption and decryption processing.

5. The method according to claim 1, characterized in that The method further comprises: When a second MKPDU protocol message sent by the second network device is received within a preset time and the second MKPDU protocol message indicates that the second network device has not installed a second receiving SA, determining that the MACsec session negotiation with the second network device has failed; The port for establishing the MACsec session between the local device and the second network device is set to a link down state.

6. A communication device, characterized in that: The device is applied to a first network device, the first network device supports a national encryption algorithm, the first network device has generated an original SAK, and the original SAK is used to encrypt and decrypt a message sent or received. The device includes: a generation unit, a creation unit, an installation unit, a sending unit, and a receiving unit; The generating unit is used to generate the current SAK according to the national encryption algorithm; The creating unit is used to create an SA using the current SAK, wherein the SA includes a first receiving SA and a first sending SA; The sending unit is used to send a first MKPDU protocol message to the second network device after the installation unit has installed the first receiving SA locally, wherein the first MKPDU protocol message includes a first extended type parameter set and a second extended type parameter set, wherein the first extended type parameter set includes an algorithm identifier of the national encryption algorithm, and the second extended type parameter set includes the current SAK; The installation unit is configured to locally install the first sending SA when the receiving unit receives a second MKPDU protocol message sent by the second network device within a preset time and the second MKPDU protocol message indicates that the second network device has installed the second receiving SA; The sending unit is further used to send a third MKPDU protocol message to the second network device, where the third MKPDU protocol message is used to enable the second network device to determine that the first network device has installed the first receiving SA and the first sending SA, and to install the second sending SA locally; Wherein, the device further comprises: The starting unit is used to start a first timer, and within a preset time of the first timer, the generation of SAK is prohibited.

7. The device according to claim 6, characterized in that The first MKPDU protocol message includes a message body field, and the message body field carries the first extended type parameter set and the second extended type parameter set; the first extended type parameter set includes a MACsec cipher suite field, and the MACsec cipher suite field carries the algorithm identifier of the national encryption algorithm; The algorithm identifier of the national secret algorithm includes the algorithm identifier of the SM1 algorithm, or the algorithm identifier of the SM4 draft algorithm, or the algorithm identifier of the SM4 standard algorithm.

8. The device according to claim 6, characterized in that The receiving unit is also used to receive a configuration instruction input by a user, wherein the configuration instruction includes an algorithm identifier of a specified supported algorithm, and the specified supported algorithm includes the national encryption algorithm or an algorithm supported by the MACsec protocol.

9. The device according to claim 6, characterized in that The starting unit is also used to start a second timer; The device also includes: a deleting unit, which is used to delete the original SAK when the preset time of the second timer is reached, so that when the message is sent or received again, the current SAK is used for encryption and decryption processing.

10. The device according to claim 6, characterized in that The device also includes: a determining unit, configured to determine that the MACsec session negotiation with the second network device has failed when the receiving unit receives a second MKPDU protocol message sent by the second network device within a preset time and the second MKPDU protocol message indicates that the second network device has not installed a second receiving SA; A setting unit is used to set the port for establishing the MACsec session between the local and the second network device to a link down state.

Images