A hierarchical nested authentication and encryption communication method for metering terminals

Abstract

This invention discloses a hierarchical nested authentication and encrypted communication method for metering terminals, comprising: establishing an isolated environment between a metering terminal and other metering terminals or a master station; establishing a trust relationship between the virtual computing architecture modules corresponding to the two components when the two components do not belong to the same metering terminal or master station; then establishing a hierarchical trust relationship between the two components through the corresponding computing architecture modules, and obtaining inter-component and inter-architecture session keys; and the two components engaging in hierarchical nested encrypted communication through the computing architecture modules using the corresponding session keys. Implementing this invention can improve the security of communication between metering terminals or between a metering terminal and a master station.

Description

Technical Field

[0001] The present invention relates to the field of power grid security technology, and in particular to a hierarchical nested authentication and encryption communication method for a metering terminal. Background Art

[0002] Electricity metering systems consist of metering terminals, master stations, and networks. As these systems evolve, risks such as Trojan horse propagation and data lock-up increase. For example, a virus could spread from an office network to an industrial control network, where it could replicate and carry out destructive activities, posing a significant threat to the power grid and control systems.

[0003] Metering terminals are becoming increasingly intelligent. Software has evolved from operating systems without to systems with operating systems, virtualization, and container architectures. Hardware has evolved from single processors to multi-processor or multi-core processing capabilities. The security of communication between metering terminals, or between a metering terminal and a master station, is particularly important. However, existing technologies lack a satisfactory solution for achieving trusted communication between components. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a hierarchical nested authentication and encryption communication method for metering terminals, thereby improving the security of communication between metering terminals or between a metering terminal and a master station.

[0005] In one aspect of the present invention, a hierarchical nested authentication and encryption communication method for a metering terminal is provided, which comprises the following steps:

[0006] Step S10: establishing an isolation environment between the metering terminal and other metering terminals or a master station, separating different components in each metering terminal or master station into corresponding containers, and adopting virtualization isolation between the containers; and constructing a corresponding virtual computing architecture module for each metering terminal or master station;

[0007] Step S11: When two components need to communicate, first confirm whether the two components belong to the same metering terminal or master station;

[0008] Step S12: If the two components do not belong to the same metering terminal or master station, a trust relationship is first established between the virtual computing architecture modules corresponding to the two components. A hierarchical trust relationship is then established between the two components through the corresponding computing architecture modules, and inter-component and inter-architecture session keys are obtained. The two components perform hierarchical nested encrypted communication through the computing architecture modules using the corresponding session keys.

[0009] Step S13: If the two components belong to the same metering terminal or master station, a trust relationship is established between the two components, and a session key between the components is negotiated. The two components use the session key for encrypted communication.

[0010] Preferably, in step S12, the step of establishing a trust relationship between the virtual computing architecture modules corresponding to the two components further includes:

[0011] The virtual computing architecture module at the sending end generates a first random number, and uses the pre-stored first computing function, the second computing function, and the shared key to perform calculations to obtain the inter-architecture session key and the first message authentication code, and sends the random number and the first message authentication code to the virtual computing architecture module at the receiving end;

[0012] The virtual computing architecture module at the receiving end uses a pre-stored first computing function, a second computing function, and a third computing function to calculate the first random number and the shared key to obtain a second message authentication code, an inter-architecture session key, and a third message authentication code; if the second message authentication code is determined to be the same as the first message authentication code, the virtual computing architecture module at the sending end is deemed to have passed authentication;

[0013] The virtual computing architecture module of the receiving end sends the first random number and the third message authentication code to the virtual computing architecture module of the sending end;

[0014] The virtual computing framework module at the sending end calculates and generates a fourth message authentication code based on the first random number using a pre-stored third computing function. If the third message authentication code and the fourth message authentication code are the same, the virtual computing framework module at the sending end is considered to have passed; then a trust relationship is established between the virtual computing framework module at the sending end and the virtual computing framework module at the receiving end.

[0015] Preferably, in step S12, the step of establishing a hierarchical trust relationship between the two components through corresponding computing framework modules further includes:

[0016] The sending end component generates a second random number, and uses the pre-stored fourth calculation function, fifth calculation function, and shared key to perform calculation to obtain the session key and the fifth message authentication code between the components, and sends the second random number and the fifth message authentication code to the virtual computing architecture module of the sending end;

[0017] The virtual computing architecture module at the sending end sends the second random number and the fifth message authentication code to the virtual computing architecture module at the receiving end in an encrypted manner; the virtual computing architecture module at the receiving end decrypts the code and sends the code to the receiving end component;

[0018] The receiving component uses the pre-stored fourth calculation function, the fifth calculation function, and the sixth calculation function to calculate the second random number and the shared key to obtain a sixth message authentication code, the inter-component session key, and the seventh message authentication code; if it is determined that the sixth message authentication code is the same as the fifth message authentication code, the sending component is deemed to have passed authentication;

[0019] The receiving end component sends the second random number and the seventh message authentication code to the virtual computing framework module of the receiving end;

[0020] The virtual computing architecture module at the receiving end sends the second random number and the seventh message authentication code to the virtual computing architecture module at the sending end in an encrypted manner; the virtual computing architecture module at the sending end decrypts the code and sends the code to the sending end component;

[0021] The sending end component uses the pre-stored sixth calculation function to calculate according to the second random number to generate an eighth message authentication code. If the eighth message authentication code is the same as the seventh message authentication code, the receiving end component is considered to have passed the authentication; then a hierarchical trust relationship is established between the sending end component and the receiving end component.

[0022] Preferably, in step S12, the step of the two components performing hierarchical nested encrypted communication using the corresponding session key through the computing architecture module further includes:

[0023] The sending end component encrypts the original data using the inter-component session key to generate first encrypted data, and sends the first encrypted data to the sending end virtual computing architecture module corresponding to the sending end component;

[0024] The virtual computing architecture module of the sending end encrypts the first encrypted data using the session key between the architectures to generate second encrypted data; and sends the second encrypted data to the receiving end virtual computing architecture module corresponding to the receiving end component;

[0025] The receiving end virtual computing architecture module decrypts the second encrypted data using the inter-architecture session key to obtain the first encrypted data and transmits the first encrypted data to the receiving end component;

[0026] The receiving component uses the session key between components to decrypt the first encrypted data to obtain the original data.

[0027] Preferably, in step S13, the step of establishing a trust relationship between the two components and obtaining a corresponding session key further includes:

[0028] The sending component generates a third random number and uses the pre-stored eighth calculation function, ninth calculation function, and shared key to perform calculation to obtain the inter-component session key and ninth message authentication code, and sends the third random number and ninth message authentication code to the receiving component.

[0029] The receiving component uses the pre-stored eighth calculation function, the ninth calculation function, and the tenth calculation function to calculate the third random number and the shared key to obtain a tenth message authentication code, the inter-component session key, and an eleventh message authentication code; if the ninth message authentication code and the tenth message authentication code are determined to be the same, the sending component is deemed to have passed authentication;

[0030] The receiving end component sends the third random number and the eleventh message authentication code to the sending end component;

[0031] The sending end component uses the pre-stored tenth calculation function to calculate according to the third random number to generate the twelfth message authentication code. If the eleventh message authentication code and the twelfth message authentication code are the same, the receiving end component is considered to have passed the authentication; then a trust relationship is established between the sending end component and the receiving end component.

[0032] Preferably, in step S13, the step of using the session key to perform encrypted communication between the two components further includes:

[0033] The sending component uses the session key between components to encrypt the original data, obtains the encrypted data, and sends it directly to the receiving component;

[0034] The receiving component receives the encrypted data and decrypts it using the session key between components to obtain the original data.

[0035] The implementation of the embodiments of the present invention has the following beneficial effects:

[0036] The present invention proposes a hierarchical nested authentication and encryption communication method for metering terminals. It adopts the concept of hierarchical nesting, realizes mutual authentication between internal components of smart metering terminals, realizes authentication between virtual computing architecture modules across metering terminals, and realizes nested authentication, establishes trusted relationships between components and between virtual computing architecture modules, and the component trust relationship is built on the virtual computing architecture module trust relationship to realize the construction of multi-layer nested trust relationships. After the trusted relationship is established, encrypted communication is carried out between components and between virtual computing architecture modules. The component encrypted communication is based on the virtual computing architecture module encrypted communication to realize a hierarchical nested encryption communication mechanism. In an embodiment of the present invention, in order to defend against virus attacks, the concept of zero trust is adopted to isolate internal software components so that the communication between internal components is carried out under certain control.

[0037] The present invention implements functions such as establishing an isolated environment, setting up an authentication mechanism, establishing trust relationships, establishing hierarchical trust relationships, encrypting communications, and implementing hierarchical nested encrypted communications. This allows for external communication within the metering terminal using a hierarchical authentication and encryption mechanism. This allows for trust relationships between components to be established from a zero-trust perspective, enabling trusted communication between components. This makes communication between components more secure and reliable, improving the security of communication between metering terminals and between a metering terminal and a master station. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 A schematic diagram of the main process of an embodiment of a hierarchical nested authentication and encryption communication method for a metering terminal provided by the present invention;

[0040] Figure 2 Schematic diagram of the application environment of the present invention;

[0041] Figure 3 A flowchart of hierarchical nested authentication between components of different metering terminals in the present invention;

[0042] Figure 4 A flowchart of layered nested encrypted communication between components of different metering terminals in the present invention;

[0043] Figure 5 The present invention relates to a flow chart of authentication between internal components of the same metering terminal. DETAILED DESCRIPTION

[0044] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0045] The present invention provides a hierarchical nested authentication and encryption communication method for metering terminals, which needs to implement functions such as: isolation environment construction, authentication mechanism setting, trust relationship construction, hierarchical trust relationship construction, encrypted communication, hierarchical nested encryption communication, etc. The above functions are briefly described as follows:

[0046] Isolation environment construction: The metering terminal should include an operating system, have container virtualization capabilities, and be able to separate different components into different containers. The metering component should be isolated from other components through virtualization isolation measures (containers). Before this method is implemented, they cannot communicate with each other, and there is no trust relationship between components. The isolated components, placed in different containers, constitute the component layer. Below the component layer is the virtual computing architecture module layer, which includes the virtual computing architecture module. The relationship between each layer is as follows: Figure 2 shown.

[0047] Authentication mechanism setting: The authentication mechanism is divided into two categories, namely component authentication mechanism and virtual computing architecture module authentication mechanism, which are set in the component and virtual computing architecture module respectively.

[0048] Trust relationship building: Components authenticate and establish trust relationships. Virtual computing architecture modules authenticate and establish trust relationships.

[0049] Hierarchical trust relationship establishment: Trust relationships between components within the metering terminal can be established directly through inter-component authentication, without requiring authentication between virtual computing architecture modules. For external trust relationships within the metering terminal, authentication between virtual computing architecture modules must precede inter-component authentication to support external trust relationship establishment and communication. The inter-component trust layer is higher than the inter-virtual computing architecture module trust layer.

[0050] Encrypted communication: After components establish a trust relationship with each other, encrypted communication is possible. After virtual computing architecture modules establish a trust relationship with each other, encrypted communication is possible.

[0051] Layered and nested encrypted communication: Components can directly communicate encrypted within the metering terminal, building a component encrypted communication layer. In external encrypted communication, the virtual computing architecture modules first establish a virtual computing architecture module encrypted communication layer. The encrypted communication layer between components is then layered on top of the virtual computing architecture module encrypted communication layer, forming a layered and nested communication relationship.

[0052] The following will be combined Figures 1 to 5 The specific details of the present invention are described below.

[0053] like Figure 1 FIG. 1 is a schematic diagram of the main process of an embodiment of a hierarchical nested authentication and encryption communication method for a metering terminal provided by the present invention; and FIG. Figures 2 to 5 As shown, in this embodiment, the method at least includes:

[0054] Step S10: Establish an isolation environment between the metering terminal and other metering terminals or master stations, separate different components in each metering terminal or master station into corresponding containers, and use virtualization isolation between the containers; and build a corresponding virtual computing architecture module for each metering terminal or master station; Figure 2 In the figure, metering terminal 1 has three containers: containers 1, 2, and 3, which house components 1, 2, and 3, respectively; beneath the containers, virtual computing architecture module 1 is located. Furthermore, the external communication partner, such as metering terminal 2 (or the master station) communicating with metering terminal 1, also has three containers: 4, 5, and 6, which house components 4, 5, and 6, respectively; beneath the containers, virtual computing architecture module 2 is located.

[0055] Step S11, when two components need to communicate, first confirm whether the two components belong to the same metering terminal or master station; in the embodiment of the present invention, the authentication and communication process of two components in the same metering terminal is different from that of two components in different metering terminals, so it is necessary to determine the positional relationship between the two components.

[0056] Step S12: If the two components do not belong to the same metering terminal or master station, a trust relationship is first established between the virtual computing architecture modules corresponding to the two components. A hierarchical trust relationship is then established between the two components through the corresponding computing architecture modules, and inter-component and inter-architecture session keys are obtained. The two components perform hierarchical nested encrypted communication through the computing architecture modules using the corresponding session keys.

[0057] In a specific example, such as Figure 3 As shown, in step S12, the step of establishing a trust relationship between the virtual computing architecture modules corresponding to the two components further includes:

[0058] Step 101: Mutual authentication of virtual computing architecture modules of different metering terminals, establishment of external trust relationships, and formation of a virtual computing architecture module trust relationship layer;

[0059] Specifically, the virtual computing architecture module at the sending end (virtual computing architecture module 1 in the figure) generates a first random number RAND1, and uses the pre-stored first calculation function f1, second calculation function f2, and shared key to calculate to obtain the inter-architecture session key CKW and the first message authentication code XMAC1, and then sends the random number RAND1 and the first message authentication code XMAC1 to the virtual computing architecture module at the receiving end (virtual computing architecture module 2 in the figure); the virtual computing architecture module at the sending end retains the inter-architecture session key CKW;

[0060] After receiving (RAND1, XMAC1), the virtual computing architecture module at the receiving end uses the pre-stored first calculation function f1, second calculation function f2, and third calculation function f3 to calculate the first random number and shared key to obtain the second message authentication code XMAC2, the inter-architecture session key CKW, and the third message authentication code RMAC2. If the second message authentication code XMAC2 is determined to be the same as the first message authentication code XMAC1, the virtual computing architecture module at the sending end is considered to have passed authentication.

[0061] The virtual computing architecture module of the receiving end sends the first random number RAND1 and the third message authentication code RMAC3 to the virtual computing architecture module of the sending end;

[0062] The virtual computing architecture module at the sending end calculates and generates a fourth message authentication code RMAC4 based on the first random number RAND1 using a pre-stored third calculation function f3. If the third message authentication code RMAC3 and the fourth message authentication code RMAC4 are the same, the virtual computing architecture module at the sending end is considered to have passed.

[0063] A trust relationship is then established between the virtual computing architecture module at the sending end and the virtual computing architecture module at the receiving end.

[0064] In step 102, the virtual computing framework module at the sending end and the virtual computing framework module at the receiving end can communicate with each other.

[0065] Then, in step S12, the step of establishing a hierarchical trust relationship between the two components through the corresponding computing framework module further includes:

[0066] In step 101, the sending component initiates a two-way authentication to the receiving component. The following description uses the authentication mechanism in component 1 to initiate a two-way authentication to the authentication mechanism in component 4.

[0067] Specifically, the sending component (component 1) generates a second random number CRAND, and uses the pre-stored fourth calculation function ff4, the fifth calculation function ff5, and the shared key to perform calculations to obtain the inter-component session key CKN and the fifth message authentication code CXMAC5, and sends the second random number CRAND and the fifth message authentication code CXMAC5 to the sending virtual computing architecture module 1;

[0068] The sending end virtual computing architecture module 1 uses the trust relationship and encrypted communication channel between it and the virtual computing architecture module 2 to encrypt the second random number CRAND and the fifth message authentication code CXMAC5 to the receiving end virtual computing architecture module 2; the receiving end virtual computing architecture module 2 decrypts the decrypted information and sends it to the receiving end component (component 4);

[0069] The receiving component 4 uses the pre-stored fourth calculation function ff4, fifth calculation function ff5, and sixth calculation function ff6 to calculate the second random number CRAND and the shared key to obtain a sixth message authentication code CXMAC6, the inter-component session key CKN, and a seventh message authentication code CRMAC7; if the sixth message authentication code CXMAC6 is determined to be the same as the fifth message authentication code CXMAC5, the sending component is deemed to have passed authentication;

[0070] The receiving end component sends the second random number CRAND and the seventh message authentication code CRMAC7 to the virtual computing framework module 2 of the receiving end;

[0071] The virtual computing architecture module 2 at the receiving end sends the second random number CRAND and the seventh message authentication code CRMAC7 to the virtual computing architecture module 1 at the sending end in an encrypted manner; the virtual computing architecture module 1 at the sending end decrypts the decrypted data and sends the decrypted data to the sending end component 1;

[0072] The sending end component 1 uses the pre-stored sixth calculation function ff6 to calculate according to the second random number CRAND to generate the eighth message authentication code CRMAC8. If the eighth message authentication code CRMAC8 is the same as the seventh message authentication code CRMAC7, the receiving end component is considered to have passed the authentication; then a hierarchical trust relationship is established between the sending end component 1 and the receiving end component 4.

[0073] Step 104: After component 1 and component 4 establish a hierarchical trust relationship, the two can communicate.

[0074] like Figure 4 As shown, a flowchart of hierarchical nested encrypted communication between components of different metering terminals in step S12 of the present invention is shown; the following description is based on the communication between component 1 and component 4.

[0075] Specifically, in step S12, the step of performing hierarchical nested encrypted communication between the two components using the corresponding session key through the computing architecture module further includes:

[0076] The sending end component 1 uses the inter-component session key CKN to encrypt the original data A, generates the first encrypted data B = EN (A, CKN), and sends it to the sending end virtual computing architecture module 1 corresponding to the sending end component;

[0077] The virtual computing architecture module 1 at the sending end encrypts the first encrypted data B using the inter-architecture session key CKW to generate second encrypted data C=EN(B,CKW); and sends the second encrypted data C=EN(B,CKW) to the receiving end virtual computing architecture module 1 corresponding to the receiving end component 1;

[0078] The receiving end virtual computing architecture module 2 uses the inter-architecture session key CKW to decrypt the second encrypted data C, obtain the first encrypted data B, and transmit it to the receiving end component 2;

[0079] The receiving component 2 uses the session key CKN between components to decrypt the first encrypted data B to obtain the original data A.

[0080] Step S13: If the two components belong to the same metering terminal or master station, a trust relationship is established between the two components, and a session key between the components is negotiated. The two components use the session key for encrypted communication.

[0081] In the embodiment of the present invention, authentication and encrypted communication are also required for two components in the same metering terminal or master station. The specific authentication process and encrypted communication process are similar to those shown above, but are simpler.

[0082] Specifically, if Figure 5 FIG. 1 is a flowchart of authentication between components within the same metering terminal according to the present invention. The following description uses the authentication between component 1 and component 2 in metering terminal 1 as an example.

[0083] In step 105 , the authentication mechanism in component 1 and the authentication mechanism in component 2 initiate a two-way authentication.

[0084] The sending-end component 1 generates a third random number CRAND3, and uses the pre-stored eighth calculation function ff8, the ninth calculation function ff9, and the shared key to perform calculations to obtain the inter-component session key CKN and the ninth message authentication code CXMAC9, and sends the third random number CRAND3 and the ninth message authentication code CXMAC9 to the receiving-end component.

[0085] The receiving end component uses the pre-stored eighth calculation function ff8, ninth calculation function ff9, and tenth calculation function ff 10 , calculating the third random number CRAND3 and the shared key to obtain a tenth message authentication code CXMAC9, the inter-component session key CKN, and an eleventh message authentication code CRMAC11; if it is determined that the ninth message authentication code CXMAC9 and the tenth message authentication code CXMAC10 are the same, then the sending component is deemed to have passed authentication;

[0086] The receiving end component sends the third random number CRAND3 and the eleventh message authentication code CRMAC11 to the sending end component;

[0087] The sending end component uses the pre-stored tenth calculation function ff according to the third random number CRAND3 10A calculation is performed to generate a twelfth message authentication code CRMAC12. If the eleventh message authentication code CRMAC11 and the twelfth message authentication code CRMAC12 are the same, it is considered that the receiving component 2 has passed the authentication; a trust relationship is established between the sending component 1 and the receiving component 2.

[0088] Step 106: After a trust relationship is established between component 1 and component 2, the two components can communicate.

[0089] More specifically, in step S13, the step of using the session key to perform encrypted communication between the two components further includes:

[0090] The sending component (e.g., component 1) uses the inter-component session key CKN to encrypt the original data A, obtain the encrypted data B, and directly send it to the receiving component (e.g., component 2);

[0091] The receiving component 2 receives the encrypted data B, decrypts it using the session key CKN between components, and obtains the original data A.

[0092] For more details, please refer to the above Figures 1 to 4 It is understood that, in the embodiments of the present invention, in the descriptions of the above figures, the functions involved therein may be partially the same.

[0093] The implementation of the embodiments of the present invention has the following beneficial effects:

[0094] The present invention proposes a hierarchical nested authentication and encryption communication method for metering terminals. It adopts the concept of hierarchical nesting, realizes mutual authentication between internal components of smart metering terminals, realizes authentication between virtual computing architecture modules across metering terminals, and realizes nested authentication, establishes trusted relationships between components and between virtual computing architecture modules, and the component trust relationship is built on the virtual computing architecture module trust relationship to realize the construction of multi-layer nested trust relationships. After the trusted relationship is established, encrypted communication is carried out between components and between virtual computing architecture modules. The component encrypted communication is based on the virtual computing architecture module encrypted communication to realize a hierarchical nested encryption communication mechanism. In an embodiment of the present invention, in order to defend against virus attacks, the concept of zero trust is adopted to isolate internal software components so that the communication between internal components is carried out under certain control.

[0095] The present invention implements functions such as establishing an isolated environment, setting up an authentication mechanism, establishing trust relationships, establishing hierarchical trust relationships, encrypting communications, and implementing hierarchical nested encrypted communications. This allows for external communication within the metering terminal using a hierarchical authentication and encryption mechanism. This allows for trust relationships between components to be established from a zero-trust perspective, enabling trusted communication between components. This makes communication between components more secure and reliable, improving the security of communication between metering terminals and between a metering terminal and a master station.

[0096] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the claims of the present invention. Therefore, any other equivalent changes or modifications that do not depart from the spirit disclosed by the present invention should be included in the scope of the claims of the present invention.

Claims

1. A hierarchical nested authentication and encryption communication method for metering terminals, characterized in that: The steps include: Step S10: establishing an isolation environment between the metering terminal and other metering terminals or the master station, separating different components in each metering terminal or the master station into corresponding containers, and adopting virtualization isolation between the containers; And build a corresponding virtual computing framework module for each metering terminal or master station; Step S11, when two components need to communicate, determine whether the two components belong to the same metering terminal or master station; Step S12: If the two components do not belong to the same metering terminal or master station, a trust relationship is first established between the virtual computing framework modules corresponding to the two components. A hierarchical trust relationship is then established between the two components through the corresponding computing framework modules, and inter-component and inter-framework session keys are obtained. The two components perform hierarchical nested encrypted communication through the computing framework modules using the corresponding session keys. Step S13: If the two components belong to the same metering terminal or master station, a trust relationship is established between the two components, and a session key between the components is negotiated. The two components use the session key for encrypted communication.

2. The method according to claim 1, wherein In step S12, the step of first establishing a trust relationship between the virtual computing architecture modules corresponding to the two components further includes: The virtual computing architecture module at the sending end generates a first random number, and uses the pre-stored first computing function, the second computing function, and the shared key to perform calculations to obtain the inter-architecture session key and the first message authentication code, and sends the random number and the first message authentication code to the virtual computing architecture module at the receiving end; The virtual computing architecture module at the receiving end uses a pre-stored first computing function, a second computing function, and a third computing function to calculate the first random number and the shared key to obtain a second message authentication code, an inter-architecture session key, and a third message authentication code; if the second message authentication code is determined to be the same as the first message authentication code, the virtual computing architecture module at the sending end is deemed to have passed authentication; The virtual computing architecture module of the receiving end sends the first random number and the third message authentication code to the virtual computing architecture module of the sending end; The virtual computing framework module at the sending end calculates and generates a fourth message authentication code based on the first random number using a pre-stored third computing function. If the third message authentication code and the fourth message authentication code are the same, the virtual computing framework module at the sending end is considered to have passed; then a trust relationship is established between the virtual computing framework module at the sending end and the virtual computing framework module at the receiving end.

3. The method according to claim 2, wherein In step S12, the step of establishing a hierarchical trust relationship between the two components through the corresponding computing framework modules further includes: The sending end component generates a second random number, and uses the pre-stored fourth calculation function, fifth calculation function, and shared key to perform calculation to obtain the session key and the fifth message authentication code between the components, and sends the second random number and the fifth message authentication code to the virtual computing architecture module of the sending end; The virtual computing architecture module at the sending end sends the second random number and the fifth message authentication code to the virtual computing architecture module at the receiving end in an encrypted manner; the virtual computing architecture module at the receiving end decrypts the code and sends the code to the receiving end component; The receiving component uses the pre-stored fourth calculation function, the fifth calculation function, and the sixth calculation function to calculate the second random number and the shared key to obtain a sixth message authentication code, the inter-component session key, and the seventh message authentication code; if it is determined that the sixth message authentication code is the same as the fifth message authentication code, the sending component is deemed to have passed authentication; The receiving end component sends the second random number and the seventh message authentication code to the virtual computing framework module of the receiving end; The virtual computing architecture module at the receiving end sends the second random number and the seventh message authentication code to the virtual computing architecture module at the sending end in an encrypted manner; the virtual computing architecture module at the sending end decrypts the code and sends the code to the sending end component; The sending end component uses the pre-stored sixth calculation function to calculate according to the second random number to generate an eighth message authentication code. If the eighth message authentication code is the same as the seventh message authentication code, the receiving end component is considered to have passed the authentication; then a hierarchical trust relationship is established between the sending end component and the receiving end component.

4. The method according to claim 3, wherein In step S12, the two components further perform hierarchical nested encrypted communication using the corresponding session key through the computing architecture module, including: The sending end component encrypts the original data using the inter-component session key to generate first encrypted data, and sends the first encrypted data to the sending end virtual computing architecture module corresponding to the sending end component; The virtual computing architecture module of the sending end encrypts the first encrypted data using the session key between the architectures to generate second encrypted data; and sends the second encrypted data to the receiving end virtual computing architecture module corresponding to the receiving end component; The receiving end virtual computing architecture module decrypts the second encrypted data using the inter-architecture session key to obtain the first encrypted data and transmits the first encrypted data to the receiving end component; The receiving component uses the session key between components to decrypt the first encrypted data to obtain the original data.

5. The method according to claim 1, wherein In step S13, the step of establishing a trust relationship between the two components and obtaining a corresponding session key further includes: The sending component generates a third random number and uses the pre-stored eighth calculation function, ninth calculation function, and shared key to perform calculation to obtain the inter-component session key and ninth message authentication code, and sends the third random number and ninth message authentication code to the receiving component. The receiving component uses the pre-stored eighth calculation function, the ninth calculation function, and the tenth calculation function to calculate the third random number and the shared key to obtain a tenth message authentication code, the inter-component session key, and an eleventh message authentication code; if the ninth message authentication code and the tenth message authentication code are determined to be the same, the sending component is deemed to have passed authentication; The receiving end component sends the third random number and the eleventh message authentication code to the sending end component; The sending end component uses the pre-stored tenth calculation function to calculate according to the third random number to generate the twelfth message authentication code. If the eleventh message authentication code and the twelfth message authentication code are the same, the receiving end component is considered to have passed the authentication; then a trust relationship is established between the sending end component and the receiving end component.

6. The method according to claim 5, wherein In step S13, the step of using the session key to perform encrypted communication between the two components further includes: The sending component uses the session key between components to encrypt the original data, obtains the encrypted data, and sends it directly to the receiving component; The receiving component receives the encrypted data and decrypts it using the session key between components to obtain the original data.

Images