A method and device for updating key of edge device
By updating its public and private keys in edge devices, the problem of low communication security of edge devices is solved, and the regular update of keys is realized, and the security of the system is improved.
Patent Information
- Application Number
- CN202210949970.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-09
- Publication Date
- 2024-12-13
- Estimated Expiration
- 2042-08-09
AI Technical Summary
The communication between existing edge devices is low, mainly due to the long time spent in the stored encryption key, which leads to extremely low security.
By obtaining the identification of the edge device, the master key generated by the key center and the clock information of the key update, the public and private keys are updated based on the preset mapping relationship, and a new key pair is generated regularly and sent to the edge device to complete Key update.
It improves the security of communication between edge devices, so that the private keys that were originally used for a long time can be updated and used according to the key update time parameters, enhancing the security of the system.
Smart Images
Figure CN115314199B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of data processing, and in particular to a method for updating a key of an edge device. Background Art
[0002] The concept of identity-based cryptography was proposed by Shamir in 1984. In the following decade, some scholars proposed identity-based encryption schemes, but they all had defects. It was not until 2001 that Boneh and Franklin proposed an identity-based encryption based on admissible bilinear pairings.
[0003] Designing a secure communication solution between resource-constrained edge devices requires both ensuring the security of communication and considering the amount of computation, which requires the designed communication protocol to be as lightweight as possible while ensuring security. Currently, the security of communication data between edge devices is ensured by private key and public key encryption. However, due to the long storage time of the encryption key, the key is usually used for a long time, and the security is extremely low.
[0004] Therefore, how to improve the security of communications between edge devices is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention
[0005] The present application provides an edge device key update method to update stored keys and improve the security of communication between edge devices. The present application also provides an edge device key update device.
[0006] In a first aspect, the present application provides a method for updating a key of an edge device, the method comprising:
[0007] Obtain the edge device identification, the master key generated by the key center, the key update time parameter, and the key update clock information;
[0008] Determine a first public key of the edge device according to the identifier of the edge device, and determine a first private key of the edge device according to the master key generated by the key center;
[0009] According to the identifier of the edge device, the key update time parameter, and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are updated to obtain a second public key and a second private key;
[0010] The second public key and the second private key are sent to the edge device to complete the edge device key update.
[0011] Optionally, the key update parameter includes: a key update time interval, and updating the first public key and the first private key based on a preset mapping relationship according to the identifier of the edge device, the key update time parameter, and the clock information of the key update, including:
[0012] According to the identifier of the edge device, the key update time interval and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are regularly updated.
[0013] Optionally, the second public key and the second private key are sent to the edge device, including:
[0014] Establish a secure channel;
[0015] The second public key and the second private key are sent to the edge device through the secure channel.
[0016] Optionally, the method further comprises:
[0017] Determine a communication key according to the first private key and the first public key;
[0018] encrypting the second public key and the second private key according to the communication key;
[0019] The encrypted second public key and the encrypted second private key are sent to the edge device.
[0020] Optionally, before obtaining the identifier of the edge device, the method further includes:
[0021] In response to a request to register an edge device, an identifier is assigned to the edge device.
[0022] In a second aspect, the present application further provides an edge device key update device, the device comprising:
[0023] An acquisition unit, used to acquire the identifier of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update;
[0024] A first determining unit, configured to determine a first public key of the edge device according to an identifier of the edge device, and determine a first private key of the edge device according to a master key generated by the key center;
[0025] An updating unit, configured to update the first public key and the first private key based on a preset mapping relationship according to the identifier of the edge device, the key update time parameter, and the clock information of the key update, to obtain a second public key and a second private key;
[0026] The first sending unit is used to send the second public key and the second private key to the edge device to complete the key update of the edge device.
[0027] Optionally, the key update parameter includes: a key update time interval, and the updating unit is specifically configured to:
[0028] According to the identifier of the edge device, the key update time interval and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are regularly updated.
[0029] Optionally, it is characterized in that the sending unit is specifically used to:
[0030] Establish a secure channel;
[0031] The second public key and the second private key are sent to the edge device through the secure channel.
[0032] Optionally, the device further comprises:
[0033] A second determining unit, configured to determine a communication key according to the first private key and the first public key;
[0034] an encryption unit, configured to encrypt the second public key and the second private key according to the communication key;
[0035] The second sending unit is used to send the encrypted second public key and the encrypted second private key to the edge device.
[0036] Optionally, the device further comprises:
[0037] The allocation unit is used to allocate an identifier to the edge device in response to a request to register the edge device.
[0038] In a third aspect, an embodiment of the present application provides a device, comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes any method described in the first aspect.
[0039] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which a code is stored. When the code is executed, a device executing the code implements the method described in any one of the first aspects above.
[0040] Compared with the prior art, this application has the following beneficial effects:
[0041] In this application, the identification of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update are obtained, and the first public key of the edge device is determined according to the identification of the edge device. The first private key of the edge device is determined according to the master key generated by the key center. According to the identification of the edge device, the key update time parameter and the clock information of the key update, based on the preset mapping relationship, the first public key and the first private key are updated to obtain the second public key and the second private key, and the second public key and the second private key are sent to the edge device to complete the edge device key update. In this application, according to the identification of the edge device, the key update time parameter and the clock information of the key update, based on the preset mapping relationship, the first public key and the first private key can be updated, so that the private key that has been used for a long time can be updated and used according to the key update time parameter, thereby improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0043] Figure 1 A flowchart of a method for updating a key of an edge device provided in an embodiment of the present application;
[0044] Figure 2 A flowchart of another edge device key update method provided in an embodiment of the present application;
[0045] Figure 3 A process diagram for distributing and updating keys provided for this application;
[0046] Figure 4 Update the state transition graph of the key node for the allocation it provides;
[0047] Figure 5 A schematic diagram of the structure of a specific implementation of the edge device key update device provided in this application. DETAILED DESCRIPTION
[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0049] It should be noted that the edge device key update method and device provided in this application can be applied to the field of data processing. The above is only an example and does not limit the application field of the method and device provided in this application.
[0050] The concept of identity-based cryptography was proposed by Shamir in 1984. In the following decade, some scholars proposed identity-based encryption schemes, but they all had defects. It was not until 2001 that Boneh and Franklin proposed an identity-based encryption based on admissible bilinear pairings.
[0051] Designing a secure communication solution between resource-constrained edge devices requires both ensuring the security of communication and considering the amount of computation, which requires the designed communication protocol to be as lightweight as possible while ensuring security. Currently, the security of communication data between edge devices is ensured by private key and public key encryption. However, due to the long storage time of the encryption key, the key is usually used for a long time, and the security is extremely low.
[0052] After research, the inventor proposed the technical solution of the present application. In the present application, the first public key and the first private key can be updated based on the preset mapping relationship according to the identification of the edge device, the key update time parameters and the clock information of the key update, so that the private key that has been used for a long time can be updated and used according to the key update time parameters, thereby improving the security of the system.
[0053] The method provided in the embodiment of the present application may be executed by a server, and the server may be a server having a key management system.
[0054] In order to make the technical personnel in this field better understand the present application, the present application is further described in detail below in combination with the drawings and specific implementation methods. The following is an example of the method provided in the present application embodiment being executed by the first device.
[0055] Figure 1 A flowchart of a method for updating a key of an edge device provided in an embodiment of the present application. Figure 1 As shown, the method includes:
[0056] S101: Obtain an identifier of an edge device, a master key generated by a key center, a key update time parameter, and clock information for key update.
[0057] The first device obtains the identifier of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update.
[0058] To further explain, the first device may first perform preparation work, which may include responding to a request to register an edge device, allocating an identifier to the edge device, establishing a secure channel, and securely storing a key module of the device.
[0059] Then, an identity-based cryptographic system can be established, which can include Setup, Keygen, Update and other algorithms, and these algorithms can be used to generate information about edge devices. A database of {identity-public key-private key-timestamp} for each legitimate device is maintained inside the key generation center PKG.
[0060] Correspondingly, in the Setup phase: the parameters of the key generation center (PKG) can be initialized, and the elliptic curve is defined in the finite field F p :E(F p ):y 2 =x 3 +x, where p is a 512-bit prime number. G1 is a q-order cyclic additive group defined on an elliptic curve, where q is a 160-bit prime number, P is a point on G1 (generator), and the bilinear pairing is defined Hash operation H. Select PRV = s, PUB=sP is the system master private key, and PUB=sP is the system master public key. The system publishes parameters other than the master private key PRV. See the table below for detailed instructions.
[0061]
[0062]
[0063] S102: Determine a first public key of the edge device according to the identifier of the edge device, and determine a first private key of the edge device according to the master key generated by the key center.
[0064] The first device can generate corresponding public and private keys according to the master key s generated by the key center and the identification ID of the edge device in the Keygen stage. When the PKG receives the edge device registration request, it can calculate its corresponding public key based on the first calculation formula through the identification of the edge device. The corresponding private key can be calculated based on the second calculation formula through the master key s.
[0065] First calculation formula: PU x =H(ID x );
[0066] Second calculation formula: PR x =sPU x
[0067] S103: According to the identifier of the edge device, the key update time parameter, and the clock information of the key update, based on a preset mapping relationship, update the first public key and the first private key to obtain a second public key and a second private key.
[0068] The first device can generate a new set of public and private keys for the edge device by enabling key update during the Update phase.
[0069] To further explain, the time parameter of key update is the key update period, which can be set to nHours, nDays, nWeeks, nMonths as needed. Secondly, key update relies on the real-time clock (RTC) embedded in the instrument controller to provide accurate timing information.
[0070] Specifically, the first public key is updated by the third calculation formula to obtain the second public key.
[0071] The third calculation formula:
[0072] The first private key is updated using the fourth calculation formula to obtain the second private key.
[0073] The fourth calculation formula: PR′ x =sPU′ x
[0074] PU x 'Represents the updated first public key, which is the second public key, PR x 'Represents the updated first private key, that is, the second private key, H() and ID x It is the mapping defined in the Setup phase to the group G and the identifier of the edge device. represents a serial operation. ι represents the clock information of the key update, that is, the current clock information of the key update. The RTC time is brought into the third calculation formula at the time interval set in the time parameter of the key update to perform a periodic key update, so that the {identification-public key-private key-timestamp} of the registered edge device is different in each set periodic time interval.
[0075] S104: Send the second public key and the second private key to the edge device to complete the edge device key update.
[0076] The first device can transmit the second public key and the second private key to the corresponding edge device through a public channel.
[0077] In this application, the identification of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update are obtained, and the first public key of the edge device is determined according to the identification of the edge device. The first private key of the edge device is determined according to the master key generated by the key center. According to the identification of the edge device, the key update time parameter and the clock information of the key update, based on the preset mapping relationship, the first public key and the first private key are updated to obtain the second public key and the second private key, and the second public key and the second private key are sent to the edge device to complete the edge device key update. In this application, according to the identification of the edge device, the key update time parameter and the clock information of the key update, based on the preset mapping relationship, the first public key and the first private key can be updated, so that the private key that has been used for a long time can be updated and used according to the key update time parameter, thereby improving the security of the system.
[0078] Figure 2 A flowchart of another edge device key update method provided in an embodiment of the present application, such as Figure 2 Shown include:
[0079] S201: Obtain an identifier of an edge device, a master key generated by a key center, a key update time parameter, and clock information for key update, wherein the key update parameter includes: a key update time interval.
[0080] S202: Determine a first public key of the edge device according to the identifier of the edge device, and determine a first private key of the edge device according to the master key generated by the key center.
[0081] S203: According to the identifier of the edge device, the key update time interval and the clock information of the key update, based on a preset mapping relationship, regularly update the first public key and the first private key to obtain a second public key and a second private key.
[0082] S204: Determine a communication key according to the first private key and the first public key.
[0083] S205: Encrypt the second public key and the second private key according to the communication key.
[0084] Since the edge device is registered with PKG, PKG transmits the public key and private key to the edge device through a secure channel, so PKG can obtain the public and private key pairs of all devices, and each edge device can obtain its own key. For the edge device identified as IDx, its communication key SK with PKG is SK=e(PR x ,PUB), where e is a bilinear map, PR xis the private key of the edge device identified as IDx, and PUB is the initialization parameter PKG public key. Since only PKG and IDx edge devices can obtain their corresponding private keys after registration, no other participants can calculate the key SK. Only PKG and edge devices can calculate SK. Use the master private key to encrypt the updated first public key, that is, the second public key, and the updated first private key, that is, the second private key. Figure 3 As shown, specifically:
[0085] PKG constructs the following data content. Using SK=e(PR x ,PUB) encrypts the updated key information and sends it to the edge device. The three unit data contents are represented as follows: timestamp; using the key pair, updating the first private key and the first public key, updating the signature of the first private key and the first public key, and encrypting the message authentication code; using the system private key to encrypt the signature of the hash value of the timestamp.
[0086] S206: Send the encrypted second public key and the encrypted second private key to the edge device.
[0087] After sending the encrypted second public key and second private key to the edge device, PKG starts the timer (2MLS), such as Figure 4 As described above, PKG does not immediately update the key information of the edge device stored in the database, but waits for the edge device to send an ACK to confirm receipt of the updated key. If the ACK of the edge device is received, the key is updated, otherwise the updated key information continues to be sent to the edge device.
[0088]
[0089] When the edge device receives the information sent by PKG, it decrypts and verifies the signature. Check whether the timestamp is the same as the timestamp of the current key. If the Timestamp is the same as the stored one, it means that the current device has updated the key, but PKG has not received the confirmation, so it continues to send ACK confirmation information to PKG; if the Timestamp is newer than the stored one, it accepts the updated {identification-public key-private key-TimeStamp} and constructs ACK confirmation information to send to PKG, otherwise no operation will be performed.
[0090] The constructed ACK is as follows, where the contents of the three data units are: Nonce is a random number; Use the private key of the edge device to sign the random number Nonce; A message authentication code for a random number and a signature.
[0091]
[0092] After PKG sends the key update information, the key in the database will not be updated immediately. Instead, a timer will be started. The value in the database will be updated only after the update confirmation from the edge device is obtained within a certain period of time. After receiving the key update, the edge device needs to send an ACK message to PKG immediately to inform PKG that the key update process is complete. If PKG does not receive the ACK confirmation from the edge device, it will continue to send the previous update information.
[0093] The above are some specific implementations of the edge device key update method provided in the embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiment of the present application will be introduced from the perspective of functional modularization. The device and the edge device key update method described above can be referenced to each other.
[0094] Figure 5 A schematic diagram of a specific implementation of the edge device key update device provided by the present application, referring to Figure 3 The device may include:
[0095] The acquisition unit 500 is used to obtain the identifier of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update; `
[0096] A first determining unit 510 is configured to determine a first public key of the edge device according to an identifier of the edge device, and determine a first private key of the edge device according to a master key generated by the key center;
[0097] An updating unit 520, configured to update the first public key and the first private key based on a preset mapping relationship according to the identifier of the edge device, the key update time parameter, and the clock information of the key update, to obtain a second public key and a second private key;
[0098] The first sending unit 530 is configured to send the second public key and the second private key to the edge device to complete the key update of the edge device.
[0099] Optionally, the key update parameter includes: a key update time interval, and the updating unit is specifically configured to:
[0100] According to the identifier of the edge device, the key update time interval and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are regularly updated.
[0101] Optionally, it is characterized in that the sending unit is specifically used to:
[0102] Establish a secure channel;
[0103] The second public key and the second private key are sent to the edge device through the secure channel.
[0104] Optionally, the device further comprises:
[0105] A second determining unit, configured to determine a communication key according to the first private key and the first public key;
[0106] an encryption unit, configured to encrypt the second public key and the second private key according to the communication key;
[0107] The second sending unit is used to send the encrypted second public key and the encrypted second private key to the edge device.
[0108] Optionally, the device further comprises:
[0109] The allocation unit is used to allocate an identifier to the edge device in response to a request to register the edge device.
[0110] The acquisition unit 500 in the device of the present application obtains the identification of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update. The first determination unit 510 determines the first public key of the edge device according to the identification of the edge device, and determines the first private key of the edge device according to the master key generated by the key center. The update unit 520 updates the first public key and the first private key based on a preset mapping relationship according to the identification of the edge device, the key update time parameter and the clock information of the key update, and obtains the second public key and the second private key. The first sending unit sends the second public key and the second private key to the edge device to complete the key update of the edge device. In the present application, the first public key and the first private key can be updated based on the identification of the edge device, the key update time parameter and the clock information of the key update, based on the preset mapping relationship, so that the private key that has been used for a long time can be updated and used according to the key update time parameter, thereby improving the security of the system.
[0111] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.
[0112] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.
[0113] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.
[0114] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.
[0115] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0116] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0117] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.
Claims
1. A method for updating a key of an edge device, characterized in that: The method comprises: Obtain the edge device identification, the master key generated by the key center, the key update time parameter, and the key update clock information; Determine a first public key of the edge device according to the identifier of the edge device, and determine a first private key of the edge device according to the master key generated by the key center; In the Update phase, according to the identifier of the edge device, the key update time parameter, and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are updated to obtain a second public key and a second private key; Update the first public key through a third calculation formula to obtain a second public key; The third calculation formula is: Update the first private key using the fourth calculation formula to obtain the second private key; The fourth calculation formula is PR' x =sPU' x , where PUx' represents the updated first public key, that is, the second public key, PRx' represents the updated first private key, that is, the second private key, H() and ID x It is the mapping defined in the Setup phase to the group G and the identifier of the edge device. represents a serial operation; ι represents the clock information of the key update, that is, the current clock information of the key update; The second public key and the second private key are sent to the edge device to complete the edge device key update.
2. The method according to claim 1, characterized in that The key update parameters include: a key update time interval, and updating the first public key and the first private key based on a preset mapping relationship according to the identifier of the edge device, the key update time parameter, and the clock information of the key update, including: According to the identifier of the edge device, the key update time interval and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are regularly updated.
3. The method according to claim 1, characterized in that The second public key and the second private key are sent to the edge device, including: Establish a secure channel; The second public key and the second private key are sent to the edge device through the secure channel.
4. The method according to claim 3, characterized in that The method further comprises: Determine a communication key according to the first private key and the first public key; encrypting the second public key and the second private key according to the communication key; The encrypted second public key and the encrypted second private key are sent to the edge device.
5. The method according to claim 4, characterized in that Before obtaining the identifier of the edge device, the method further includes: In response to a request to register an edge device, an identifier is assigned to the edge device.
6. An edge device key update device, characterized in that: The device comprises: An acquisition unit, used to acquire the identifier of the edge device, the master key generated by the key center, the key update time parameter and the clock information of the key update; A first determining unit, configured to determine a first public key of the edge device according to an identifier of the edge device, and determine a first private key of the edge device according to a master key generated by the key center; An updating unit, configured to update the first public key and the first private key according to the identifier of the edge device, the key update time parameter, and the clock information of the key update in the Update phase, based on a preset mapping relationship, to obtain a second public key and a second private key; and update the first public key by a third calculation formula to obtain a second public key; The third calculation formula is: Update the first private key using the fourth calculation formula to obtain the second private key; The fourth calculation formula is PR' x =sPU' x , where PUx' represents the updated first public key, that is, the second public key, PRx' represents the updated first private key, that is, the second private key, H() and ID x It is the mapping defined in the Setup phase to the group G and the identifier of the edge device. represents a serial operation; ι represents the clock information of the key update, that is, the current clock information of the key update; The first sending unit is used to send the second public key and the second private key to the edge device to complete the key update of the edge device.
7. The device according to claim 6, characterized in that The key update parameters include: a key update time interval, and the update unit is specifically used to: According to the identifier of the edge device, the key update time interval and the clock information of the key update, based on a preset mapping relationship, the first public key and the first private key are regularly updated.
8. The device according to claim 6, characterized in that The sending unit is specifically used for: Establish a secure channel; The second public key and the second private key are sent to the edge device through the secure channel.
9. The device according to claim 8, characterized in that The device also includes: A second determining unit, configured to determine a communication key according to the first private key and the first public key; an encryption unit, configured to encrypt the second public key and the second private key according to the communication key; The second sending unit is used to send the encrypted second public key and the encrypted second private key to the edge device.
10. The device according to claim 6, characterized in that The device also includes: The allocation unit is used to allocate an identifier to the edge device in response to a request to register the edge device.