Communication method and communication device

Abstract

The present application provides a communication method and communication device, comprising: configuring a first security connectivity set key; receiving a key agreement protocol message from a second network device, the key agreement protocol message including a preset extended parameter set, the preset extended parameter set including a multi-bit random number generated based on the second security connectivity set key and a security association key; wherein the second network device acts as a key server for providing the security association key, and the second network device is configured with the second security connectivity set key; determining the security association key based on the multi-bit random number and the first security connectivity set key; and using the security association key to encrypt communication messages between the first network device and the second network device. The present application improves the security of security association key distribution, thereby improving the security of communication messages transmitted between network devices.

Description

Technical Field

[0001] The present application relates to the field of communication technology. More specifically, the present application can provide a communication method and a communication device. Background Art

[0002] MACsec (Media Access Control Security) defines a secure data communication method based on IEEE 802 (LAN / MAN Standards Committee) local area networks. It provides secure MAC (Media Access Control) layer data transmission and reception services, including user data encryption, frame integrity verification, and data authenticity verification, enabling wire-speed forwarding of encrypted data. MACsec supports both terminal devices and switch ports, located between the MAC media layer and the logical link layer. It leverages the existing MAC services of Ethernet ports to provide security protection for port transmission and reception.

[0003] A MACsec-protected session in which both ends of a MACsec link use the same SAK (Security Association Key) to transmit messages is called an SA (Security Association) security session. The SAK used by SA is generated by the Key Server and then issued to participants with non-key server identities. SA session establishment is a negotiation process in which the same SAK is used on both the key server and non-key server ends for message sending and receiving protection. When the key server decides that the MACsec protection service needs to be enabled, it generates a new SAK and begins to establish an SA security session. In related technologies, SAK is issued via an MKA (MACsec Key Agreement) protocol message, from the key server to participants with non-key server identities.

[0004] However, if the MKA protocol message used for SAK distribution is intercepted by an attacker (e.g., a "man-in-the-middle attack") and then the intercepted MKA protocol message is decrypted, there is a high risk of SAK leakage, leading to insecure communication between network devices. Therefore, in the related art, as long as the SAK is transmitted in the message, no matter which encryption algorithm is used to encrypt the SAK, the message used to transmit the SAK may be decrypted after being intercepted, resulting in the problem of communication messages between network devices being easily leaked. Summary of the Invention

[0005] In order to solve the problem of leakage risk when transmitting SAK in MKA protocol messages, the present application can provide a communication method and communication device to avoid transmitting SAK in messages, thereby effectively preventing SAK from being intercepted and decrypted, and improving the security of communication message transmission between network devices.

[0006] To achieve the above-mentioned technical objectives, the present application provides a communication method, which is applied to a first network device; the communication method includes: configuring a first security connectivity set key; receiving a key negotiation protocol message sent by a second network device, the key negotiation protocol message including a preset extended parameter set, the preset extended parameter set including a multi-bit random number generated based on the second security connectivity set key and the security association key; wherein the second network device serves as a key server for providing the security association key, and the second network device is configured with the second security connectivity set key; determining the security association key based on the multi-bit random number and the first security connectivity set key; the security association key is used to encrypt the communication message between the first network device and the second network device.

[0007] In at least one embodiment of the present application, determining a security association key based on a multi-bit random number and a first security connectivity set key includes: using the first security connectivity set key as a key decryption key, decrypting the multi-bit random number using a preset decryption method to decrypt the security association key; wherein the multi-bit random number is obtained by encrypting the security association key using the second security connectivity set key by the second network device, and the preset decryption method corresponds to the encryption method of the security association key.

[0008] In at least one embodiment of the present application, the communication method further includes: monitoring the encrypted communication message data traffic between the first network device and the second network device; if the data traffic reaches a threshold, performing session negotiation between the first network device and the second network device again to negotiate a new security association key.

[0009] In at least one embodiment of the present application, the preset extended parameter set includes a message body, and the multi-bit random number is set at a target position in the message body.

[0010] In at least one embodiment of the present application, the multi-bit random numbers are multiple random numbers in which all bit values ​​are non-repeating.

[0011] In at least one embodiment of the present application, the first secure connectivity set key and the second secure connectivity set key are the same, the first secure connectivity set key and the second secure connectivity set key are both pre-shared keys, or the first secure connectivity set key and the second secure connectivity set key are both secure connectivity set keys generated during the mutual identity authentication process between the second network device and the first network device.

[0012] To achieve the above technical objectives, the present application can also provide a communication device. The communication device may include but is not limited to a key configuration unit, a message receiving unit, and a key determination unit. The communication method is applied to a first network device.

[0013] A key configuration unit is used to configure the first secure connectivity set key.

[0014] A message receiving unit is used to receive a key negotiation protocol message sent by a second network device, where the key negotiation protocol message includes a preset extended parameter set, and the preset extended parameter set includes a multi-bit random number generated based on the second security connectivity set key and the security association key; wherein the second network device serves as a key server for providing the security association key, and the second network device is configured with the second security connectivity set key.

[0015] The key determination unit is used to determine a security association key according to a multi-bit random number and a first security connectivity set key; the security association key is used to encrypt communication messages between the first network device and the second network device.

[0016] In at least one embodiment of the present application, a key determination unit is configured to use the first security connectivity set key as a key decryption key and decrypt the multi-bit random number using a preset decryption method to decrypt a security association key; wherein the multi-bit random number is obtained by encrypting the security association key using the second security connectivity set key by the second network device, and the preset decryption method corresponds to the encryption method of the security association key.

[0017] In at least one embodiment of the present application, the communication device also includes: a key refresh unit, which is used to monitor the encrypted communication message data traffic between the first network device and the second network device; the key refresh unit is used to re-negotiate the session between the first network device and the second network device based on the data traffic reaching a threshold, so as to negotiate a new security association key.

[0018] In at least one embodiment of the present application, the preset extended parameter set includes a message body, and the multi-bit random number is set at a target position in the message body.

[0019] In at least one embodiment of the present application, the multi-bit random numbers are multiple random numbers in which all bit values ​​are non-repeating.

[0020] In at least one embodiment of the present application, the first secure connectivity set key and the second secure connectivity set key are the same, the first secure connectivity set key and the second secure connectivity set key are both pre-shared keys, or the first secure connectivity set key and the second secure connectivity set key are both secure connectivity set keys generated during the mutual identity authentication process between the second network device and the first network device.

[0021] To achieve the above technical objectives, the present application may also provide a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the communication method in any embodiment of the present application.

[0022] To achieve the above technical objectives, the present application can also provide a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the communication method in any embodiment of the present application.

[0023] The beneficial effects of the present application include: the present application, as a second network device serving as a key server, sets a multi-digit random number generated based on a security association key and a pre-configured second security connectivity set key in a preset extended data set; after the first network device serving as a non-key server receives a key negotiation message containing the multi-digit random number, the first network device determines the security association key based on the pre-configured first security connectivity set key and the parsed multi-digit random number; it can be seen that the present application avoids directly transmitting the security association key in the key negotiation protocol message, but instead achieves the purpose of security association key distribution by transmitting random numbers and decrypting random numbers. Even if the key negotiation protocol message transmitted by the present application may be intercepted and decrypted by an attacker, the attacker can only obtain the multi-digit random number, but cannot obtain the security association key. Therefore, the technical solution of the present application greatly improves the security of security alliance key distribution, thereby improving the security of communication messages transmitted between network devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram showing the flow of a communication method in one or more embodiments of the present application is shown.

[0025] Figure 2 A schematic diagram of the EAPOL (Extensible Authentication Protocol Over LAN) message format in one or more embodiments of the present application is shown.

[0026] Figure 3 A schematic diagram of the MKPDU (MACsec Key Agreement Protocol Data Unit) message format in one or more embodiments of the present application is shown.

[0027] Figure 4 A schematic diagram showing the extended parameter set format in one or more embodiments of the present application is shown.

[0028] Figure 5 A schematic diagram showing the structure of a communication device in one or more embodiments of the present application is shown.

[0029] Figure 6 A schematic diagram showing a network device structure in one or more embodiments of the present application. DETAILED DESCRIPTION

[0030] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0031] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the corresponding listed items.

[0032] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0033] The following is a detailed explanation and description of a communication method and a communication device provided by the present application in conjunction with the accompanying drawings.

[0034] MACsec itself consists of two functional entities: SecY (Security Entity) and KaY (Key Agreement Entity). SecY is implemented by a hardware chip at the driver level and is located on the link port, providing MAC security forwarding services for controlled port users and non-security services for uncontrolled port users. SecY uses the SAK key issued by KaY to encrypt messages sent through the channel according to the SA, and can decrypt and restore messages received through the secure channel; at the same time, it provides replay protection for each SA on the receiving channel. KaY is implemented by software and is responsible for key generation and issuance, discovering and establishing secure channels between devices; it provides SecY with the same SAK across the end-to-end secure channel for message encryption protection. The SAK is sent by the key server to participants who are not key server participants. Specifically, it can be released through the SAK distribution parameter set contained in the MKA protocol message. Although the SAK parameters can be encrypted in the MKA protocol message, the MKA protocol message is likely to be snooped by an attacker, especially when the MKA protocol message distributes the SAK. If the attacker listens to the MKA protocol message in the link and decrypts it, there is a risk of leakage of the SAK distributed by the key server, which in turn makes the communication messages between network devices prone to leakage.

[0035] Compared with conventional technologies, the present application provides a communication method that can be applied to a first network device; the communication method includes: configuring a first secure connectivity set key; receiving a key negotiation protocol message sent by a second network device, the key negotiation protocol message including a preset extended parameter set, the preset extended parameter set including a multi-bit random number generated based on a second secure connectivity set key and a security association key; wherein the second network device serves as a key server for providing a security association key, and the second network device is configured with a second secure connectivity set key; determining a security association key based on the multi-bit random number and the first secure connectivity set key; the security association key is used to encrypt communication messages between the first network device and the second network device. Therefore, the second network device of the present application, which serves as a key server, sets a multi-bit random number generated based on the security association key and the pre-configured second security connectivity set key in a preset extended data set. After the first network device, which serves as a non-key server, receives a key negotiation message containing the multi-bit random number, it determines the security association key based on the pre-configured first security connectivity set key and the parsed multi-bit random number. It can be seen from this that the present application avoids directly transmitting the security association key in the key negotiation protocol message, but instead achieves the purpose of security association key distribution by transmitting random numbers and decrypting random numbers. Even if the key negotiation protocol message transmitted by the present application may be intercepted and decrypted by an attacker, the attacker can only obtain the multi-bit random number and cannot obtain the security association key. Therefore, the present application scheme can greatly improve the security of security alliance key distribution, thereby improving the data security of communication messages transmitted between network devices.

[0036] like Figure 1 As shown, at least one embodiment of the present application can provide a communication method, which is applied to a first network device; the communication method includes but is not limited to steps S100 to S300, which are specifically described as follows.

[0037] Step S100: Configure a first secure connectivity set key. In this embodiment, the first network device is configured with a first secure connectivity set key. The secure connectivity set key in this application is specifically CAK, which stands for Connectivity Association KEY.

[0038] In one or more optional embodiments of the present application, the first secure connectivity set key may be a pre-shared key (PSK, Pre-Shared Key), or the first secure connectivity set key may be the first secure connectivity set key generated between the second network device and the first network device during the mutual identity authentication process; wherein, the mutual identity authentication process may be performed before the execution of this method, and the identity authentication process in this embodiment may specifically be an 802.1X (a client / server-based access control and authentication protocol) authentication process.

[0039] Step S200: Receive a key negotiation protocol message sent by a second network device, wherein the key negotiation protocol message includes a preset extended parameter set, wherein the preset extended parameter set includes a multi-bit random number generated based on the second security connectivity set key and the security association key; wherein the second network device acts as a key server (Key Server) for providing the security association key, and the second network device is configured with the second security connectivity set key; the first network device acts as a key client (KeyClient), and it should be understood that the method of selecting the key server from multiple network devices is determined based on the port priority method, and the network device with the high-priority port will be elected as the key server. The second network device of the embodiment of the present application can be used to send a key negotiation protocol message to the first network device according to a specified configuration instruction, and the specified configuration instruction can be generated based on a command line (e.g., mka sak asymmetric-encryption-algorithm) input by the user to the second network device.

[0040] The second security connectivity set key in the embodiment of the present application is the same as the first security connectivity set key, that is, the second security connectivity set key in the embodiment of the present application may be a pre-shared key (PSK, Pre-Shared Key), or the second security connectivity set key may be a second security connectivity set key generated during the mutual identity authentication process between the second network device and the first network device; wherein, the mutual identity authentication process may be performed before the execution of this method, and the identity authentication process in this embodiment may specifically be an 802.1X (a client / server-based access control and authentication protocol) authentication process.

[0041] In an optional embodiment of the present application, the multi-bit random numbers can specifically be multiple random numbers whose bit values ​​are not repeated; the multi-bit random numbers form a random number sequence, and the multi-bit random numbers in this embodiment are random numbers whose positions are not repeated in all 32 bytes.

[0042] like Figure 2As shown, the key negotiation protocol message in the embodiment of the present application is specifically a message encapsulated by EAPOL (Extensible Authentication Protocol Over LAN), and this type of message includes a protocol version (Protocol Version), a message type (Packet Type), a message body length (Packet Body Length), and a message body (Packet Body). Among them, EAPOL is an encapsulation technology defined by the 802.1X protocol for carrying EAP (Extensible Authentication Protocol) messages, which can be mainly used to transmit EAP messages between the client and the device in a local area network.

[0043] like Figure 3 As shown, the EAP message in the embodiment of the present application is specifically an MKPDU (MACsec Key Agreement Protocol Data Unit) message. Among them, the value of the message type (Packet Type) in the EAP message in this embodiment is specifically 0000 0101, then the EAP message is specifically an MKPDU message, that is, the key agreement protocol message used in the embodiment of the present application. The MKPDU message includes a protocol version, a message type (its value is 0000 0101, which can be represented by EAPLO-MKA), a message body length, and a message body. The message body contained in the MKPDU message includes a basic parameter set (BasicParameter Set), one or more other parameter sets (Parameter Set), and an integrity check value (ICV, IntegrityCheckValue). The embodiment of the present application adds a preset extended parameter set (Expanded Types) to other parameter sets, and the preset extended parameter set can support third-party protocol extensions.

[0044] In the embodiment of the present application, the preset extended parameter set includes a message body, and a multi-bit random number is set at a target position in the message body.

[0045] like Figure 4As shown, this embodiment specifically provides an extended parameter set format, including a parameter set type (Parameter set type), version (Version), type (Type), length (Length) and a message body (Packet Body). In this embodiment, the preset extended parameter set type field value is specifically 254 (Parameter set type = 254), Version is 1, which can be used to indicate that the current preset extended protocol version is 1, type is 4, and it indicates that the asymmetric algorithm protects the symmetric key (Asymmetric Algorithms Protect Symmetric Keys). Length indicates the overall length of the message, including parameter set type (Parameter set type), version (Version), type (type), length (Length) and data (Data) fields, in bytes; the message body (Packet Body) stores the message content carried by the extended field, and the message format in the Packet Body is specifically the Distributed SAK (distributed SAK) parameter set. It can be seen that when negotiating SAK, the embodiment of the present application does not fill in the Distributed SAK parameter set that carries SAK in the MKPDU message, but adds a preset extended parameter set, and fills in the Type type of the preset extended parameter set as 4, and fills in the Distributed SAK parameter set in the Data field. Its definition is consistent with IEEE8021X-2010 (an IEEE802 protocol standard), but a 32-byte encrypted random number with non-repeating bit values ​​is filled in bytes 17 to 49.

[0046] In this embodiment of the present application, after receiving a key agreement protocol message from a second network device, the first network device parses the key agreement protocol message to obtain a preset extended parameter set; the preset extended parameter set is then parsed to obtain a multi-bit random number. This embodiment can directly obtain a multi-bit random number from the key agreement protocol message for use in the subsequent decryption process. In this embodiment of the present application, both the first network device and the second network device support extended parameter sets, and the first network device is capable of parsing the key agreement protocol message from the second network device.

[0047] In an optional embodiment of the present application, a preset extended parameter set is parsed to obtain a multi-bit random number, including: parsing a parameter set type in the preset extended parameter set to obtain a type parameter; the preset extended parameter set includes a parameter set type (Parameter set type) and a message body, and the preset extended parameter set can also include a parameter set body length (Parameter set body length), a key number (Key Number), a MACsec cryptographic component (MACsec CipherSuite), etc.; the type parameter in the embodiment of the present application can specifically be 4; determining the target position of the multi-bit random number in the message body according to the type parameter; the target position determined according to the type parameter being 4 in the present embodiment is specifically the last 17 to 49 bytes in the Distributed SAK parameter set; parsing the multi-bit random number from the preset extended parameter set according to the target position. Based on the above scheme, this embodiment can ensure the security and accuracy of parsing multiple random numbers, thereby improving the reliability of the key negotiation process of the present application.

[0048] Step S300: determining a security association key according to a multi-bit random number and a first security connectivity set key; the security association key is used to encrypt communication messages between the first network device and the second network device.

[0049] In an optional embodiment of the present application, determining a security association key based on a multi-digit random number and a first security connectivity set key includes: using the first security connectivity set key as a key decryption key, decrypting the multi-digit random number using a preset decryption method to decrypt the security association key. The multi-digit random number is obtained by encrypting the security association key using the second security connectivity set key by the second network device, i.e., encrypting the security association key using a key encryption key (KEK), and the preset decryption method corresponds to the encryption method of the security association key. In the embodiment of the present application, the encryption method of the security association key is, for example, AES (Advanced Encryption Standard), and the corresponding preset decryption method is also AES (Advanced Encryption Standard). In the embodiment of the present application, after decrypting the random number using the KEK and AES algorithms, the numerical value corresponding to the position of the configured CAK is extracted according to the value of each digit of the random number to form the SAK. The specific execution strategy of the KEK and AES algorithms can be selected according to actual needs in this embodiment and will not be further described. From this, it can be seen that this embodiment generates multiple random numbers based on the key encryption key, and determines the distributed SAK based on the key decryption key corresponding to the key encryption key according to the received random number. Therefore, this application further improves the security of SAK distribution based on the above scheme, and further improves the security of communication between network devices.

[0050] The embodiments of the present application will now illustrate the secure connectivity set key (CAK), random number, and security association key (SAK) using two specific application examples.

[0051] Example 1:

[0052] The pre-configured secure connectivity key (CAK) is: 1112131415161718192021222324252627282930313233343536373839404142

[0054] The random number parsed by the first network device is: 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 109 8 7 6 5 4 3 2 1

[0056] After decryption, the security association key (SAK) used by both parties is determined to be: 4241403938373635343332313029282726252423222120191817161514131211

[0058] Example 2:

[0059] The pre-configured secure connectivity key (CAK) is: 123456

[0061] The random number parsed by the first network device is: 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 109 8 7 6 5 4 3 2 1

[0063] After decryption, the security association key (SAK) used by both parties is determined to be: 000000000000000000000000000000000000000000000000000000000000000654321

[0065] It can be seen that when the different network devices in this application conduct MKA negotiation, specifically when the second network device as the initiator (key server) conducts MKA negotiation with the first network device (neighboring device of the second network device), this application cancels the traditional method of directly sending SAK in the MKA protocol message, but implements the SAK distribution function based on setting a multi-bit random number in the preset extended parameter set. Therefore, this application can still ensure that the communication message between the first network device and the second network device is encrypted with the same SAK. It can be seen that this application provides a method for MACsec to protect the symmetric algorithm key with an asymmetric algorithm. After the negotiation is passed according to the technical solution of this application, the communication message between the first network device and the second network device is encrypted according to the specified SAK. Therefore, this application effectively solves the problem of the risk of leakage of SAK transmitted in the MKA protocol message in conventional technology, and effectively improves the security of data communication between different network devices.

[0066] In an optional embodiment of the present application, the communication method further includes: monitoring the encrypted communication message data flow between the first network device and the second network device; if the data flow reaches a threshold, re-negotiating a session between the first network device and the second network device to negotiate a new security association key. In this embodiment, the encrypted communication message data flow can be monitored by the first network device and / or the second network device, and the first network device can send the monitored data flow results to the second network device. The threshold in this embodiment can be, for example, C000 0000 as specified in IEEE8021X-2010, but is of course not limited to this. In this embodiment, the process of re-negotiating the session between the first network device and the second network device, specifically the process from steps S100 to S300 in this application, continuously ensures that the SAK used between different network devices in this application is difficult to crack through message interception and decryption, that is, avoids the problem of cracking the SAK by monitoring messages, and improves the security of communication between network devices.

[0067] like Figure 5 As shown, the communication method specifically provided in at least one embodiment of the present application is based on the same inventive technical concept, and at least one embodiment of the present application can also provide a communication device, which is applied to the first network device.

[0068] The communication device may include but is not limited to a key configuration unit, a message receiving unit and a key determination unit, which are described in detail as follows.

[0069] A key configuration unit is used to configure the first secure connectivity set key.

[0070] A message receiving unit is used to receive a key negotiation protocol message sent by a second network device, where the key negotiation protocol message includes a preset extended parameter set, and the preset extended parameter set includes a multi-bit random number generated based on the second security connectivity set key and the security association key; wherein the second network device serves as a key server for providing the security association key, and the second network device is configured with the second security connectivity set key.

[0071] The key determination unit is used to determine a security association key according to a multi-bit random number and a first security connectivity set key; the security association key is used to encrypt communication messages between the first network device and the second network device.

[0072] In an optional embodiment of the present application, the communication device further includes a message parsing unit. The message parsing unit can be used to parse the key agreement protocol message to obtain a preset extended parameter set; the message parsing unit is further used to parse the preset extended parameter set to obtain a multi-bit random number.

[0073] In an optional embodiment of the present application, the key determination unit is configured to use the first secure connectivity set key as a key decryption key and decrypt the multi-bit random number in a preset decryption manner to decrypt the security association key.

[0074] The multi-digit random number is obtained by encrypting the security association key by the second network device using the second security connectivity set key, and the preset decryption method corresponds to the encryption method of the security association key.

[0075] In an optional embodiment of the present application, the communication device further includes a key refreshing unit.

[0076] The key refresh unit is used to monitor the encrypted communication message data flow between the first network device and the second network device.

[0077] The key refreshing unit is configured to perform session negotiation again between the first network device and the second network device to negotiate a new security association key according to the data flow reaching a threshold.

[0078] In an optional embodiment of the present application, the preset extended parameter set includes a message body, and a multi-bit random number is set at a target position in the message body.

[0079] In an optional embodiment of the present application, the multi-bit random numbers are multiple random numbers in which all bit values ​​are non-repeating.

[0080] In an optional embodiment of the present application, the first secure connectivity set key and the second secure connectivity set key are the same, both are pre-shared keys, or both are secure connectivity set keys generated during mutual identity authentication between the second network device and the first network device.

[0081] Based on the same inventive concept, the embodiment of the present application further provides a network device, Figure 6 As shown, the network device includes a processor, a transceiver and a machine-readable storage medium, the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to execute the communication method provided in the embodiment of the present application. Figure 5 The communication device shown can be used as Figure 6The network device hardware structure shown is implemented. The above-mentioned computer-readable storage medium may include random access memory (Random Access Memory, RAM), and may also include non-volatile memory (NVM), such as at least one disk storage. Optionally, the computer-readable storage medium may also be at least one storage device located away from the aforementioned processor. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0082] In the embodiment of the present application, the processor reads the machine-executable instructions stored in the machine-readable storage medium, and the machine-executable instructions enable the processor itself and the transceiver to execute the communication method described in the aforementioned embodiment of the present application.

[0083] In addition, an embodiment of the present application provides a machine-readable storage medium, which stores machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor itself and the calling transceiver to execute the communication method described in the aforementioned embodiment of the present application.

[0084] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0085] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0086] As for the embodiments of the communication device and the machine-readable storage medium, since the method contents involved are basically similar to those of the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0087] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, and simple improvements made to the essential content of the present application shall be included in the scope of protection of the present application.

Claims

1. A communication method, characterized in that: The communication method is applied to a first network device; the communication method includes: Configure the first secure connectivity set key; receiving a key agreement protocol message sent by a second network device, the key agreement protocol message including a newly added preset extended parameter set, the preset extended parameter set including a multi-bit random number generated based on a second secure connectivity set key and a security association key; wherein the second network device functions as a key server for providing the security association key, and the second secure connectivity set key is configured on the second network device; Parsing the key agreement protocol message to obtain the preset extended parameter set, parsing the parameter set type in the preset extended parameter set to obtain a type parameter, determining a target position of the multi-bit random number in a message body included in the preset extended parameter set based on the type parameter, and parsing the multi-bit random number from the preset extended parameter set based on the target position; The security association key is determined according to the multi-bit random number and the first security connectivity set key; the security association key is used to encrypt communication messages between the first network device and the second network device.

2. The communication method according to claim 1, wherein: The determining the security association key according to the multi-bit random number and the first secure connectivity set key includes: Using the first secure connectivity set key as a key decryption key, decrypting the multi-bit random number using a preset decryption method to decrypt the security association key; The multi-digit random number is obtained by encrypting the security association key by the second network device using the second security connectivity set key, and the preset decryption method corresponds to the encryption method of the security association key.

3. The communication method according to claim 1 or 2, characterized in that: Also includes: monitoring encrypted communication message data traffic between the first network device and the second network device; If the data traffic reaches a threshold, session negotiation is performed again between the first network device and the second network device to negotiate a new security association key.

4. The communication method according to claim 1 or 2, characterized in that: The multi-bit random numbers are multiple random numbers in which all bit values ​​are non-repeating.

5. The communication method according to claim 1 or 2, characterized in that: The first secure connectivity set key and the second secure connectivity set key are the same, both are pre-shared keys, or both are secure connectivity set keys generated during mutual identity authentication between the second network device and the first network device.

6. A communication device, characterized in that: The communication device is applied to the first network device; The communication device comprises: A key configuration unit, configured to configure a first secure connectivity set key; a message receiving unit, configured to receive a key agreement protocol message sent by a second network device, the key agreement protocol message including a newly added preset extended parameter set, the preset extended parameter set including a multi-bit random number generated based on a second secure connectivity set key and a security association key; wherein the second network device serves as a key server for providing the security association key, and the second secure connectivity set key is configured on the second network device; a message parsing unit, configured to parse the key agreement protocol message to obtain the preset extended parameter set, parse the parameter set type in the preset extended parameter set to obtain a type parameter, determine a target position of the multi-bit random number in a message body included in the preset extended parameter set based on the type parameter, and parse the multi-bit random number from the preset extended parameter set based on the target position; A key determination unit is configured to determine the security association key according to the multi-bit random number and the first security connectivity set key; the security association key is used to encrypt communication messages between the first network device and the second network device.

7. The communication device according to claim 6, wherein: the key determination unit is configured to decrypt the multi-bit random number using the first secure connectivity set key as a key decryption key in a preset decryption manner to obtain the security association key; The multi-digit random number is obtained by encrypting the security association key by the second network device using the second security connectivity set key, and the preset decryption method corresponds to the encryption method of the security association key.

8. The communication device according to claim 6 or 7, characterized in that Also includes: a key refresh unit, configured to monitor encrypted communication message data traffic between the first network device and the second network device; The key refreshing unit is further configured to, based on the data flow reaching a threshold, perform session negotiation again between the first network device and the second network device to negotiate a new security association key.

9. The communication device according to claim 6 or 7, characterized in that The multi-bit random numbers are multiple random numbers in which all bit values ​​are non-repeating.

10. The communication device according to claim 6 or 7, characterized in that: The first secure connectivity set key and the second secure connectivity set key are the same, both are pre-shared keys, or both are secure connectivity set keys generated during mutual identity authentication between the second network device and the first network device.

Images