A method for transmitting a public key and a method for transmitting a diagnostic message

Abstract

The application relates to a public key transmission method and a diagnostic message transmission method. The public key transmission method is applied to a switch equipment end and comprises the following steps: receiving a first key negotiation message sent by a terminal device, sending a second key negotiation message to the terminal device in response to the first key negotiation message, the second key negotiation message comprising a first public key; receiving a third key negotiation message sent by the terminal device, using a first private key to decrypt a second public key in the third key negotiation message, the second public key being a second public key in a second key pair stored by the terminal device for asymmetric encryption; and sending a fourth key negotiation message to the terminal device, the fourth key negotiation message comprising a public key encrypted by the second public key. In this way, the public key is transmitted between the switch equipment and the terminal device, so that only the terminal device obtaining the public key can decode the diagnostic message content.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method for transmitting public keys and a method for transmitting diagnostic messages. Background Technology

[0002] As users become increasingly reliant on the internet, information security within the internet has become particularly important. In train operation networks, numerous switching devices and terminal devices are distributed, communicating with each other by transmitting messages.

[0003] like Figure 1 As shown, switch-1, switch-2, and switch-3 are three switching devices. They send train-related messages to terminal devices in the network via the TRDP protocol. The format of these messages is customized by the customer company and carries the operating status information of the switching devices. This operating status information typically includes life signals, device names, manufacturer identifiers, ring network status, port traffic statistics, etc. After the function is enabled, these messages are periodically sent to the designated multicast address. Upon receiving the messages, the terminal devices perform corresponding processing.

[0004] If unauthorized terminal devices connect to the train operation network, they may receive this message, and because the message content is in plaintext (e.g., ... Figure 2 As shown in the image, it can be easily parsed, which not only leaks the train's operating status information, but may also lead to problems such as message theft or tampering, resulting in low security. Summary of the Invention

[0005] In view of the above-mentioned problems of the prior art, this application provides a method for transmitting public keys, a method for transmitting diagnostic messages, a computing device, and a storage medium to solve the problem that diagnostic messages are easily stolen or tampered with by unauthorized terminals when transmitted by switching devices and terminal devices, thereby improving the security of diagnostic message transmission.

[0006] To achieve the above objectives, a first aspect of this application provides a method for transmitting a public key, applied at a switch device. The switch device stores a first key pair for asymmetric encryption and a public key for symmetric encryption. The first key pair includes a first private key and a first public key. The method includes:

[0007] The device receives a first key negotiation message from a terminal device and responds to the first key negotiation message by sending a second key negotiation message to the terminal device, wherein the second key negotiation message includes the first public key.

[0008] receiving a third key negotiation message sent by the terminal device, and decrypting a second public key encrypted by the first public key in the third key negotiation message using the first private key, the second public key being a second public key in a second key pair for asymmetric encryption stored by the terminal device;

[0009] sending a fourth key negotiation message to the terminal device, the fourth key negotiation message including the public key encrypted by the second public key.

[0010] According to the above, the application provides a transmission method of a public key. When the switch device and the terminal device transmit a diagnosis message, a key exchange stage is performed first, and then a diagnosis message transmission stage is performed. The whole stage combines symmetric encryption and asymmetric encryption. Specifically, asymmetric encryption is used in the key exchange stage, and symmetric encryption is used in the diagnosis message transmission stage. Only the terminal device that has obtained the public key can decode the content of the diagnosis message. Therefore, the security of the public key is protected, the encryption efficiency of the diagnosis message is improved, and the problem that the diagnosis message transmitted between the switch device and the terminal device is stolen or tampered with by an illegal terminal is prevented.

[0011] As a possible implementation manner of the first aspect, the switch device further stores a user information list, and the method further includes:

[0012] decrypting a username encrypted by the first public key in the third key negotiation message using the first private key, and authenticating the username from the terminal device based on the username in the user information list.

[0013] According to the above, whether the first public key sent by the switch device is consistent with the local public key repository is compared to determine whether the switch device is a trusted communication device. The legality of the switch device is verified, the attack of the terminal device by a hacker is prevented, and the security of the key exchange process is improved.

[0014] As a possible implementation manner of the first aspect, the method further includes:

[0015] sending a fourth key negotiation message to the terminal device, the fourth key negotiation message including the username encrypted by the second public key, so that the terminal device verifies the username returned from the switch device based on the sent username.

[0016] According to the above, not only the switch device needs to verify the security of the username from the terminal device, but also the terminal device needs to verify the security of the username returned from the switch device. Bidirectional verification is implemented, and the security of the key exchange process is further improved.

[0017] As a possible implementation of the first aspect, the method further comprises:

[0018] receiving a fifth key negotiation message sent by the terminal device, decrypting the user password corresponding to the username encrypted by the first public key in the fifth key negotiation message using the first private key, and authenticating the user password from the terminal device based on the password corresponding to the username in the user information list.

[0019] From the above, after verifying that the usernames of the switch device and the terminal device are consistent, it is further verified whether the passwords are consistent, that is, through double verification of the username and the user password, the problem of false claims caused by single verification of the username and the user password is avoided, and the security of the key exchange process is further improved, which is conducive to the subsequent secure transmission of the diagnostic message between the switch device and the terminal device.

[0020] To achieve the above object, the second aspect of the present application provides a public key transmission method applied to a terminal device end, wherein the terminal device stores a second key pair for asymmetric encryption, and the second key pair includes a second private key and a second public key; the method comprises:

[0021] sending a first key negotiation message to the switch device;

[0022] receiving a second key negotiation message sent by the switch device in response to the first key negotiation message, wherein the second key negotiation message includes the first public key, and the first public key is a first public key in a first key pair stored on the switch device for asymmetric encryption;

[0023] sending a third key negotiation message to the switch device, wherein the third key negotiation message includes the second public key encrypted by the first public key;

[0024] receiving a fourth key negotiation message sent by the switch device, and decrypting the public key encrypted by the second public key in the fourth key negotiation message using the second private key.

[0025] From the above, the present application proposes a public key transmission method, which first performs a key exchange stage and then performs a diagnostic message transmission stage when the switch device and the terminal device transmit the diagnostic message. The whole stage combines the symmetric encryption and asymmetric encryption methods. Specifically, the asymmetric encryption is used in the key exchange stage, and the symmetric encryption is used in the diagnostic message transmission stage. Only the terminal device that has obtained the public key can decode the diagnostic message content, so that the security of the public key is protected, the encryption efficiency of the diagnostic message is improved, and the problem of stealing or tampering of the diagnostic message transmitted between the switch device and the terminal device by an illegal terminal is prevented.

[0026] As a possible implementation manner of the second aspect, the terminal device stores a local public key repository for verifying the security of the public key, and the method further includes:

[0027] receiving the second key exchange message sent by the switch device, the second key exchange message including the first public key, and verifying the first public key from the switch device based on the local public key repository.

[0028] Accordingly, by comparing the first public key sent by the switch device with the local public key repository, it is determined whether the switch device is a trusted communication device, the legality of the switch device is verified, the attack of the terminal device by hackers is effectively prevented, and the security of the key exchange process is improved.

[0029] As a possible implementation manner of the second aspect, the method further includes:

[0030] receiving the fourth key exchange message sent by the switch device, decrypting the username encrypted by the second public key in the fourth key exchange message using the second private key, and verifying the username returned from the switch device based on the sent username.

[0031] Accordingly, not only does the switch device need to verify the security of the username from the terminal device, but also the terminal device needs to verify the security of the username returned from the switch device, bidirectional verification is achieved, and the security of the key exchange process is further improved.

[0032] As a possible implementation manner of the second aspect, the method further includes:

[0033] sending a fifth key exchange message to the switch device, the fifth key exchange message including the user password encrypted by the first public key, for the switch device to authenticate the user password from the terminal device based on the sent user password.

[0034] Accordingly, after verifying that the usernames of the switch device and the terminal device are consistent, it is further verified whether the passwords are consistent, that is, through the double verification of the username and the user password, the false claim caused by the single verification of the username and the user password is avoided, the security of the key exchange process is further improved, and it is beneficial for the subsequent switch device and terminal device to securely transmit the diagnostic message.

[0035] To achieve the above object, the third aspect of the present application provides a transmission method of a public key, a first key pair for asymmetric encryption and a public key for symmetric encryption are stored on a switch device, the first key pair includes a first private key and a first public key; a second key pair for asymmetric encryption is stored on a terminal device, the second key pair includes a second private key and a second public key; the method includes:

[0036] The terminal device sends a first key negotiation message to the switch device;

[0037] The switch device receives the first key negotiation message, and sends a second key negotiation message to the terminal device, the second key negotiation message including the first public key;

[0038] The terminal device receives the second key negotiation message, and sends a third key negotiation message to the switch device, the third key negotiation message including the second public key encrypted by the first public key;

[0039] The switch device receives the third key negotiation message, and decrypts the second public key encrypted by the first public key in the third key negotiation message by using the first private key;

[0040] The switch device sends a fourth key negotiation message to the terminal device, the fourth key negotiation message including the public key encrypted by the second public key;

[0041] The terminal device receives the fourth key negotiation message, and decrypts the public key encrypted by the second public key in the fourth key negotiation message by using the second private key.

[0042] To achieve the above object, the fourth aspect of the present application provides a transmission method of a diagnostic message, including:

[0043] The terminal device acquires the public key stored on the switch device by using the transmission method of the public key of the third aspect;

[0044] The switch device transmits a diagnostic message encrypted by the public key to the terminal device;

[0045] The terminal device decrypts the diagnostic message by using the public key.

[0046] To achieve the above object, the fifth aspect of the present application provides a computing device, including:

[0047] A processor, and

[0048] a memory having stored thereon program instructions that, when executed by the processor, cause the processor to perform the method for transmitting a public key applied to a switch device end according to any one of the first aspect, the method for transmitting a public key applied to a terminal device end according to any one of the second aspect, the method for transmitting a public key according to the third aspect, or the method for transmitting a diagnostic packet according to the fourth aspect.

[0049] To achieve the above object, the sixth aspect of the present application provides a storage medium having stored thereon program instructions that, when executed by a computer, cause the computer to perform the method for transmitting a public key applied to a switch device end according to any one of the first aspect, the method for transmitting a public key applied to a terminal device end according to any one of the second aspect, the method for transmitting a public key according to the third aspect, or the method for transmitting a diagnostic packet according to the fourth aspect.

[0050] To achieve the above object, the seventh aspect of the present application provides a device for transmitting a public key, applied to a switch device end, the switch device having stored thereon a first key pair for asymmetric encryption and a public key for symmetric encryption, the first key pair comprising a first private key and a first public key; the device comprising:

[0051] a first receiving unit configured to receive a first key negotiation packet sent by a terminal device, and send a second key negotiation packet to the terminal device in response to the first key negotiation packet, the second key negotiation packet comprising the first public key;

[0052] a second receiving unit configured to receive a third key negotiation packet sent by the terminal device, and decrypt a second public key encrypted by the first public key in the third key negotiation packet using the first private key, the second public key being a second public key in a second key pair for asymmetric encryption stored by the terminal device;

[0053] a sending unit configured to send a fourth key negotiation packet to the terminal device, the fourth key negotiation packet comprising the public key encrypted by the second public key.

[0054] To achieve the above object, the eighth aspect of the present application provides a device for transmitting a public key, applied to a terminal device end, the terminal device having stored thereon a second key pair for asymmetric encryption, the second key pair comprising a second private key and a second public key; the device comprising:

[0055] a first sending unit configured to send a first key negotiation packet to a switch device;

[0056] a first receiving unit, configured to receive a second key negotiation message sent by the switch device in response to the first key negotiation message, the second key negotiation message comprising a first public key, the first public key being a first public key in a first key pair for asymmetric encryption stored on the switch device;

[0057] a second sending unit, configured to send a third key negotiation message to the switch device, the third key negotiation message comprising the second public key encrypted using the first public key;

[0058] a second receiving unit, configured to receive a fourth key negotiation message sent by the switch device, and decrypt a public key encrypted using the second public key in the fourth key negotiation message using the second private key.

[0059] To achieve the above object, the ninth aspect of the present application provides a transmission system of a diagnostic message, comprising:

[0060] a switch device comprising the public key transmission device of the seventh aspect;

[0061] a terminal device comprising the public key transmission device of the eighth aspect;

[0062] the terminal device and the switch device are configured to transmit the public key on the switch device to the terminal device through the respective public key transmission devices;

[0063] the switch device is further configured to transmit a diagnostic message encrypted using the public key to the terminal device;

[0064] the terminal device is further configured to decrypt the diagnostic message using the public key. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 is a schematic diagram of the connection relationship between the switch device and the terminal device provided by the present application;

[0066] Figure 2 is a schematic diagram of a diagnostic message provided by the present application;

[0067] Figure 3 is a main step flowchart of a public key transmission method applied to the switch device end provided by the present application;

[0068] Figure 4 is a main step flowchart of a public key transmission method applied to the terminal device end provided by the present application;

[0069] Figure 5 is an interaction diagram of a switch device and a terminal device provided by the present application;

[0070] Figure 6 is an interaction diagram provided by the present application, in which a terminal device does not trust a first public key of a switch device;

[0071] Figure 7 is an interaction diagram provided by the present application, in which a switch device fails to verify a username from a terminal device;

[0072] Figure 8 is an interaction diagram provided by the present application, in which a terminal device fails to verify a username returned by a switch device;

[0073] Figure 9 is an interaction diagram provided by the present application, in which a switch device fails to verify a password from a terminal device;

[0074] Figure 10 is an interaction diagram provided by the present application, in which a terminal device re-sends a first packet PKT1 after sending a heartbeat packet for N times continuously;

[0075] Figure 11 is an interaction diagram provided by the present application, in which a terminal device re-sends a first packet PKT1 after modification;

[0076] Figure 12 is a structural schematic diagram of a packet encryption device applied to a switch device end;

[0077] Figure 13 is a structural schematic diagram of a packet encryption device applied to a terminal device end;

[0078] Figure 14 is a structural schematic diagram of a computing device provided by the present application;

[0079] Figure 15 is a structural schematic diagram of a diagnostic packet transmission system provided by the present application;

[0080] It should be understood that, in the above structural schematic diagrams, the size and shape of each block diagram are only for reference, and should not constitute exclusive interpretation of the embodiments of the present application. The relative position and inclusion relationship between each block diagram presented by the structural schematic diagram only schematically represent the structural association between each block diagram, and is not limited to the physical connection mode of the embodiments of the present application. DETAILED DESCRIPTION

[0081] The technical solutions provided by the present application are further described below with reference to the drawings and embodiments. It should be understood that the system structures and service scenarios provided in the embodiments of the present application are mainly for describing possible implementation manners of the technical solutions of the present application, and should not be interpreted as the only limitation of the technical solutions of the present application. Those skilled in the art can know that the technical solutions provided by the present application are also applicable to similar technical problems as the system structure evolves and new service scenarios appear.

[0082] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. If there is any inconsistency, the meaning as described in the specification or derived from the content described in the specification shall prevail. In addition, the terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0083] The embodiments of the present application provide a public key transmission method, as shown in Figure 3 applied to a switch device end, the switch device stores a first key pair for asymmetric encryption, a public key for symmetric encryption, and the first key pair includes a first private key and a first public key; the method comprises:

[0084] S301, receiving a first key negotiation message sent by a terminal device, and sending a second key negotiation message to the terminal device in response to the first key negotiation message, the second key negotiation message including the first public key;

[0085] S302, receiving a third key negotiation message sent by the terminal device, and decrypting a second public key encrypted by the first public key in the third key negotiation message using the first private key, the second public key being a second public key in a second key pair for asymmetric encryption stored by the terminal device;

[0086] S303, sending a fourth key negotiation message to the terminal device, the fourth key negotiation message including the public key encrypted by the second public key.

[0087] From the above, the present application provides a public key transmission method. When the switch device and the terminal device transmit a diagnostic message, a key exchange stage is performed first, and then a diagnostic message transmission stage is performed. The entire stage combines symmetric encryption and asymmetric encryption. Specifically, asymmetric encryption is used in the key exchange stage, and symmetric encryption is used in the diagnostic message transmission stage. Only the terminal device that has obtained the public key can decode the diagnostic message content. Therefore, the security of the public key is protected, the encryption efficiency of the diagnostic message is improved, and the problem of stealing or tampering of the diagnostic message transmitted between the switch device and the terminal device by an illegal terminal is prevented.

[0088] In some embodiments, the switch device also stores a user information list, and the method further comprises:

[0089] decrypting the username encrypted by the first public key in the third key agreement message using the first private key, and authenticating the username from the terminal device based on the username in the user information list.

[0090] The user information list includes a username and a password corresponding to the username, which will be described in detail in the following specific embodiments.

[0091] Specifically, authenticating the username from the terminal device based on the username in the user information list comprises:

[0092] determining whether the username from the terminal device is consistent with the username in the user information list;

[0093] if consistent, the verification is passed;

[0094] if inconsistent, the authentication is not passed.

[0095] From the above, by comparing whether the username from the terminal device is consistent with the username in the user information list, it is determined whether the key exchange between the switch device and the terminal device is to be performed. When the usernames of the two are consistent, it indicates that the identities of the two are trustworthy. Therefore, the security of the key exchange process is improved, and it is beneficial for the switch device and the terminal device to securely transmit the diagnostic message subsequently.

[0096] In some embodiments, the method further comprises:

[0097] sending a fourth key agreement message to the terminal device, the fourth key agreement message including the username encrypted by the second public key, for the terminal device to authenticate the username returned from the switch device based on the sent username.

[0098] From the above, the switch device first verifies the security of the username from the terminal device. After verifying that the username is secure, the terminal device also needs to verify the security of the username returned from the switch device. Since the username is not specific, in this way, it can not only prevent the fake switch device from replying to the message, but also verify the accuracy of the information in the exchanged message of the switch device end, thereby ensuring the security of the public key in the fourth key agreement message.

[0099] In some embodiments, the method further comprises:

[0100] receive the fifth key negotiation message sent by the terminal device, decrypt the user password corresponding to the username encrypted by the first public key in the fifth key negotiation message using the first private key, and authenticate the user password from the terminal device based on the password corresponding to the username in the user information list.

[0101] From the above, after verifying that the usernames of the switch device and the terminal device are consistent, the user password from the terminal device is compared with the user information list to determine whether they are consistent, that is, the username and the user password are double-verified, which avoids the problem of false claims caused by single verification of the username and the user password, further improves the security of the key exchange process, and is beneficial to the secure transmission of the diagnostic message between the switch device and the terminal device.

[0102] The embodiment of the application provides a transmission method of a public key, as shown in the figure, applied to a terminal device end, the terminal device stores a second key pair for asymmetric encryption, the second key pair includes a second private key and a second public key; the method comprises: Figure 4

[0103] S401, sending a first key negotiation message to the switch device;

[0104] S402, receiving a second key negotiation message sent by the switch device in response to the first key negotiation message, the second key negotiation message including the first public key, the first public key being a first public key in a first key pair stored on the switch device for asymmetric encryption;

[0105] S403, sending a third key negotiation message to the switch device, the third key negotiation message including the second public key encrypted by the first public key;

[0106] S404, receiving a fourth key negotiation message sent by the switch device, and decrypting the public key encrypted by the second public key in the fourth key negotiation message using the second private key.

[0107] From the above, the application provides a transmission method of a public key, which first performs a key exchange stage and then performs a diagnostic message transmission stage when the switch device and the terminal device transmit the diagnostic message. The whole stage combines the symmetric encryption and asymmetric encryption modes. Specifically, the asymmetric encryption is used in the key exchange stage, and the symmetric encryption is used in the diagnostic message transmission stage. Only the terminal device that has obtained the public key can decode the diagnostic message content, so that the security of the public key is protected, the encryption efficiency of the diagnostic message is improved, and the problem that the diagnostic message transmitted between the switch device and the terminal device is stolen or tampered with by an illegal terminal is prevented. ​

[0108] In some embodiments, the terminal device stores a local public key repository for verifying the security of the public key, and the method further comprises:

[0109] receiving the second key exchange message sent by the switch device, the second key exchange message including the first public key, and verifying the first public key from the switch device based on the local public key repository.

[0110] From the above, by comparing whether the first public key sent by the switch device is consistent with the local public key repository, it is determined whether the switch device is a trusted communication device, the legality of the switch device is verified, the attack of the terminal device by hackers is effectively prevented, and the security of the key exchange process is improved.

[0111] In some embodiments, the method further comprises:

[0112] receiving the fourth key exchange message sent by the switch device, decrypting the username encrypted by the second public key in the fourth key exchange message using the second private key, and verifying the username returned from the switch device based on the sent username.

[0113] From the above, not only does the switch device need to verify the security of the username from the terminal device, but also the terminal device needs to verify the security of the username returned from the switch device, bidirectional verification is achieved, and the security of the key exchange process is further improved.

[0114] In some embodiments, the method further comprises:

[0115] sending a fifth key exchange message to the switch device, the fifth key exchange message including the user password encrypted by the first public key, for the switch device to authenticate the user password from the terminal device based on the sent user password.

[0116] From the above, after verifying that the usernames of the switch device and the terminal device are consistent, it is further verified whether the passwords are consistent, that is, through the double verification of the username and the user password, the possibility of false claim caused by single verification of the username and the user password is avoided, the security of the key exchange process is further improved, and it is conducive to the subsequent secure transmission of diagnostic messages between the switch device and the terminal device.

[0117] The embodiment of the present application provides a public key transmission method, comprising: a switch device storing a first key pair for asymmetric encryption and a public key for symmetric encryption, the first key pair comprising a first private key and a first public key; a terminal device storing a second key pair for asymmetric encryption, the second key pair comprising a second private key and a second public key; the method comprising:

[0118] The terminal device sends a first key negotiation message to the switch device;

[0119] The switch device receives the first key negotiation message, and sends a second key negotiation message to the terminal device, wherein the second key negotiation message comprises the first public key;

[0120] The terminal device receives the second key negotiation message, and sends a third key negotiation message to the switch device, wherein the third key negotiation message comprises the second public key encrypted by using the first public key;

[0121] The switch device receives the third key negotiation message, and decrypts the second public key encrypted by using the first public key in the third key negotiation message by using the first private key;

[0122] The switch device sends a fourth key negotiation message to the terminal device, wherein the fourth key negotiation message comprises the public key encrypted by using the second public key;

[0123] The terminal device receives the fourth key negotiation message, and decrypts the public key encrypted by using the second public key in the fourth key negotiation message by using the second private key.

[0124] The embodiment of the present application further provides a diagnostic message transmission method, comprising:

[0125] The terminal device obtains the public key stored in the switch device by using the above public key transmission method;

[0126] The switch device transmits a diagnostic message encrypted by using the public key to the terminal device;

[0127] The terminal device decrypts the diagnostic message by using the public key.

[0128] In order to more clearly illustrate the above-mentioned public key transmission method, the following will be described in detail through specific embodiments, and the embodiments comprise steps 1 to 19.

[0129] Figure 5 An interaction diagram of the switch device and the terminal device.

[0130] Step 1, after the switch device is started, a first key pair, a public key, and a user information list are obtained.

[0131] The first key pair includes a first public key, a first private key, the first public key is represented by K1, the first private key is represented by K2, the public key is represented by K3, and the user information list is represented by L.

[0132] The user information list L is composed of a username and a password, and the username and the password are in one-to-one correspondence. The user can manually add, delete, and modify the user information list L according to actual conditions. The user information list L can be seen from Table 1.

[0133] Table 1

[0134]

[0135]

[0136] Step 2, the user adds the username and the password of the terminal device, and at the same time, a second key pair stored on the terminal device is obtained.

[0137] The second key pair includes a second public key and a second private key, the second public key is represented by K4, and the second private key is represented by K5.

[0138] Step 3, it is necessary to note that the diagnostic message sent by the switch device to the terminal device is encrypted using the public key K3. In order for the terminal device to obtain the public key K3, the terminal device needs to first send a key exchange message to the switch device. The format of the message can be seen from Table 2.

[0139] Table 2

[0140] Field Field Meaning Field Length code Operation code 2 ret Return value, normal: 0, exception: 1 2 string len 1 String 1 length 2 string content 1 String 1 content 0…256 string len 2 String 2 length 2 string content 2 Figure 5 0…256

[0141] Step 4, specifically, the terminal device and the switch device have their own ip addresses. When the terminal device and the switch device transmit messages, the terminal device first initiates a request, and at the same time needs to specify the ip address of the switch device as the destination address. The ip address of the terminal device initiating the request is carried in the first key negotiation message initiating the request as the source address. The switch device receives the first key negotiation message, and determines the terminal device that replies to the request according to the source address in the first key negotiation message. In combination with Figure 6As shown, the terminal device sends a first packet PKT1 to the switch device, code is 1, ret is 0, string len1 is the length of the TRDP version number information used when the terminal device initiates the request, string content1 is the version number information used to indicate the TRDP protocol, the content of the first packet PKT1 is shown in Table 3, wherein the terminal device sends the version number information of the TRDP to the switch device, which is used to indicate the terminal device to the switch device the version information of the TRDP used by the terminal device, so as to facilitate the switch to use the protocol corresponding to the version number to parse, decapsulate, encapsulate and the like when supporting multiple versions of the TRDP protocol.

[0142] Table 3

[0143]

[0144] Step 5, after receiving the first packet PKT1, the switch device sends a second packet PKT2 to the terminal device, code is 2, ret is 0, string len1 is the length of the first public key K1, string content1 is the content of the first public key K1, and the content of the second packet PKT2 is shown in Table 4.

[0145] Table 4

[0146]

[0147] Step 6, after receiving the second packet PKT2, the terminal device verifies whether the first public key K1 is secure.

[0148] Specifically, it is judged whether the first public key K1 and one of the public keys in the local public key repository are consistent;

[0149] If consistent, it is determined that the first public key is secure, and step 7 is continued to be executed;

[0150] If inconsistent, the key exchange process is ended, at this time, the terminal device sends a third packet PKT3 to the switch device, code is 3, ret is 1, string len1 and string len2 are both 0, the content of the packet is encrypted with the public key K1 of the switch device, the content of the third packet PKT3 is shown in Table 5, and the interaction diagram is shown in Figure 7 .

[0151] Table 5

[0152]

[0153] Step 7, the terminal device sends a third packet PKT3 to the switch device, code is 3, ret is 0, string_len1 is the length of the public key K4 of the terminal device itself, string_content1 is the content of K4, string_len2 is the length of the username username authenticated by the terminal device, string_content2 is the content of username, the content of the packet is encrypted by the first public key K1 of the switch device, and the content of the third packet PKT3 is shown in Table 6.

[0154] Table 6

[0155]

[0156] Step 8, the switch device decrypts the third packet PKT3 using the first private key K2 to obtain the second public key K4 of the terminal device and the username, and checks the username and the user information list L.

[0157] Specifically, it is judged whether the received username is consistent with the username in the user information list;

[0158] If consistent, that is, the verification is passed, step 9 is continued to be executed;

[0159] If inconsistent, that is, the verification is not passed, the key exchange process is ended, at this time, the switch device sends a fourth packet PKT4 to the terminal device, code is 4, ret is 1, string_len1 and stirng_len2 are both 0, the fourth packet PKT4 is sent after being encrypted by the second public key K4 of the terminal device, the content of the fourth packet PKT3 is shown in Table 7, and the interaction diagram is shown in Figure 8 ;

[0160] Table 7

[0161]

[0162]

[0163] Step 9, the switch device sends a fourth packet PKT4 to the terminal device, code is 4, ret is 0, string_len1 is the length of username, string_content2 is the content of username, string_len2 is 0, the fourth packet PKT4 is sent after being encrypted by the second public key K4 of the terminal device, and the content of the fourth packet PKT4 is shown in Table 8.

[0164] Table 8

[0165]

[0166] Step 10, after receiving the fourth packet PKT4, the terminal device decrypts using the second private key K5 to obtain the username returned by the switch device, and verifies the username.

[0167] Specifically, it is judged whether the username is consistent with the username sent by itself;

[0168] If consistent, i.e. the verification is passed, step 11 is continued to be executed;

[0169] If inconsistent, i.e. the verification is failed, the key exchange process is ended, at this time, the terminal device sends the fifth packet PKT5 to the switch device, code is 5, ret is 1, string_len1 and stirng_len2 are both 0, the fifth packet PKT5 is encrypted using the first public key K1, wherein the content of the fifth packet PKT5 is shown in Table 9, and the interaction diagram is shown in Figure 9 ;

[0170] Table 9

[0171]

[0172] Step 11, the terminal device sends the fifth packet PKT5 to the switch device, code is 5, ret is 0, string_len1 is the password length, string_content1 is the password content, string_len2 is 0, the fifth packet PKT5 is encrypted using the first public key K1, wherein the content of the fifth packet PKT5 is shown in Table 10.

[0173] Table 10

[0174]

[0175] Step 12, the switch device decrypts the fifth packet PKT5 using the first private key K2 to obtain the password content, and verifies the password. The password is checked with the device list L.

[0176] Specifically, it is judged whether the received password is consistent with the password in the user information list;

[0177] If consistent, i.e. the verification is passed, at this time, the key exchange stage is completed, and the packet transmission stage is executed again, i.e. step 13 is continued to be executed;

[0178] If inconsistent, i.e. the verification fails, the key exchange process is ended, at this time, the switch device sends a sixth packet PKT6 to the terminal device, code is 6, ret is 1, string_len1 and stirng_len2 are both 0, the sixth packet PKT6 is encrypted by using the second public key K4 of the terminal device, wherein the content of the sixth packet PKT6 is shown in Table 11, and the interaction diagram is shown in Figure 10

[0179] Table 11

[0180]

[0181] Step 13, the switch device sends a sixth packet PKT6 to the terminal device, code is 6, ret is 0, string_len1 is the length of the public key K3, and string_content1 is the content of the public key K3; the sixth packet PKT6 is encrypted by using the second public key K4 of the terminal device, and the content of the sixth packet PKT6 is shown in Table 12.

[0182] Table 12

[0183]

[0184] Step 14, the terminal device decrypts the received sixth packet PKT6 by using the second private key K2 to obtain the public key K3, and decrypts the received diagnostic packet by using the public key K3.

[0185] Thus, the steps 1 to 14 can realize the key exchange between the terminal device and the switch device and the transmission of the public key, so that only the terminal device obtaining the public key can decode the diagnostic packet, and the security of the diagnostic packet transmission is improved.

[0186] However, in the actual diagnostic packet transmission process, the following situations can also occur:

[0187] Situation one: the terminal device sends a heartbeat packet PKT-KEEPALIVE to the switch device at an interval time T, and the switch device replies an acknowledgement packet immediately after receiving the heartbeat packet, if the terminal device does not receive the acknowledgement packet after continuously sending N heartbeat packets, the terminal device needs to send a key exchange packet to the switch device again, which is shown in the following steps 15 to 17.

[0188] Step 15, the terminal device sends a PKT-KEEPALIVE packet to the switch device at a regular time, code is 7, ret is 0, string_len1 and string_len2 are both 0, the packet is encrypted by using the first public key K1, and the content of the packet is shown in Table 13. ​

[0189] Table 13

[0190]

[0191] Step 16, the switch device receives the PKT-KEEPALIVE packet, and sends the PKT-ACK packet to the terminal device, code is 8, ret is 0, string_len1 and string_len2 are both 0, the packet is encrypted by the second public key K4, and the content of the packet is shown in Table 14.

[0192] Table 14

[0193]

[0194] Step 17, after the terminal device continuously sends N PKT-KEEPALIVE packets and does not receive the PKT-ACK packet sent by the switch device, the terminal device re-sends the PKT1 packet to the switch device, and re-obtains the key, as shown in Table 15. Figure 11

[0195] Case two: if the switch device deletes the security name that has been authenticated, or modifies the password corresponding to the security name, or modifies the public key K3, the switch device needs to send the PKT-RST packet to the terminal device, and the terminal device also needs to re-send the PKT1 packet to the switch device after receiving the RST packet, and details are shown in steps 18 to 19.

[0196] Step 18, the switch device sends the PKT-RST packet to the terminal device, code is 9, ret is 0, the packet is encrypted by the second public key K4, and the content of the packet is shown in Table 14.

[0197] Table 14

[0198]

[0199] Step 19, the terminal device receives the PKT-RST packet, and then re-sends the PKT1 packet to the switch device, and re-obtains the key, as shown in Table 15. Figure 12

[0200] Figure 13 It is a structural schematic diagram of a public key transmission device provided in the embodiment of the application. The embodiment of the application provides a public key transmission device 1200, applied to a switch device end, the switch device stores a first key pair for asymmetric encryption and a public key for symmetric encryption, the first key pair includes a first private key and a first public key; the device includes:

[0201] ​​The first receiving unit 1201 is configured to receive a first key negotiation message sent by a terminal device, and send a second key negotiation message to the terminal device in response to the first key negotiation message, wherein the second key negotiation message comprises the first public key;

[0202] The second receiving unit 1202 is configured to receive a third key negotiation message sent by the terminal device, and decrypt a second public key encrypted by the first public key in the third key negotiation message by using the first private key, wherein the second public key is a second public key in a second key pair for asymmetric encryption stored by the terminal device;

[0203] The sending unit 1203 is configured to send a fourth key negotiation message to the terminal device, wherein the fourth key negotiation message comprises the common key encrypted by the second public key.

[0204] According to the above, the application provides a common key transmission device. When a switch device and a terminal device transmit a diagnostic message, a key exchange stage is performed first, and then a diagnostic message transmission stage is performed. The whole stage combines a symmetric encryption and an asymmetric encryption. Specifically, the asymmetric encryption is used in the key exchange stage, and the symmetric encryption is used in the diagnostic message transmission stage. Only the terminal device that has obtained the common key can decode the diagnostic message content. Therefore, the security of the common key is protected, the encryption efficiency of the diagnostic message is improved, and the problem that the diagnostic message transmitted between the switch device and the terminal device is stolen or tampered by an illegal terminal is prevented.

[0205] Figure 14 FIG. 1 is a structural schematic diagram of a common key transmission device provided by an embodiment of the application. The application provides a common key transmission device 1300 applied to a terminal device. The terminal device stores a second key pair for asymmetric encryption. The second key pair comprises a second private key and a second public key. The device comprises:

[0206] The first sending unit 1301 is configured to send a first key negotiation message to the switch device.

[0207] The first receiving unit 1302 is configured to receive a second key negotiation message sent by the switch device in response to the first key negotiation message, wherein the second key negotiation message comprises the first public key, and the first public key is a first public key in a first key pair for asymmetric encryption stored by the switch device.

[0208] The second sending unit 1303 is configured to send a third key negotiation message to the switch device, wherein the third key negotiation message comprises the second public key encrypted by the first public key.

[0209] The second receiving unit 1304 is configured to receive the fourth key negotiation message sent by the switch device, and decrypt the public key encrypted by the second public key in the fourth key negotiation message by using the second private key.

[0210] According to the above, the application provides a public key transmission device. In the transmission of the diagnostic message between the switch device and the terminal device, a key exchange stage is performed first, and then a diagnostic message transmission stage is performed. The whole stage combines the symmetric encryption and the asymmetric encryption. Specifically, the asymmetric encryption is used in the key exchange stage, and the symmetric encryption is used in the diagnostic message transmission stage. Only the terminal device that has obtained the public key can decode the content of the diagnostic message. Therefore, the security of the public key is protected, the encryption efficiency of the diagnostic message is improved, and the problem that the diagnostic message transmitted between the switch device and the terminal device is stolen or tampered by an illegal terminal is prevented.

[0211] Figure 14 Fig. 1 is a structural schematic diagram of a computing device 1400 provided by an embodiment of the application. The computing device performs the public key transmission method and the diagnostic message transmission method described above. As shown in Fig. 1, the computing device 1400 includes a processor 1410, a memory 1420, and a communication interface 1430. Figure 14

[0212] It should be understood that the communication interface 1430 in the computing device 1400 shown in Fig. 1 can be used for communication between the computing device 1400 and other devices. Specifically, the communication interface 1430 can include one or more transceiver circuits or interface circuits. Figure 14

[0213] The processor 1410 can be connected with the memory 1420. The memory 1420 can be used for storing the program code and the data. Therefore, the memory 1420 can be an internal storage unit of the processor 1410, can be an external storage unit independent of the processor 1410, or can be a component including the internal storage unit of the processor 1410 and the external storage unit independent of the processor 1410.

[0214] Optionally, the computing device 1400 can further include a bus. The memory 1420 and the communication interface 1430 can be connected with the processor 1410 through the bus. The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 15 In the above description, a line without an arrow is used to represent the bus, but it does not mean that there is only one bus or only one type of bus.​​

[0215] It should be understood that the processor 1410 can be a central processing unit (CPU) in the embodiments of the present application. The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. Alternatively, the processor 1410 employs one or more integrated circuits to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0216] The memory 1420 can include read-only memory and random access memory, and provide instructions and data to the processor 1410. A part of the processor 1410 can also include non-volatile random access memory. For example, the processor 1410 can also store device type information.

[0217] When the computing device 1400 is running, the processor 1410 executes computer execution instructions in the memory 1420 to perform any operation step of the above method and any optional embodiment thereof.

[0218] It should be understood that the computing device 1400 according to the embodiments of the present application can correspond to the execution of the corresponding subject in the method according to the embodiments of the present application, and the above and other operations and / or functions of each module in the computing device 1400 are respectively for implementing the corresponding flow of each method of the embodiments, and for the sake of brevity, will not be repeated here.

[0219] ​ is a structural schematic diagram of a diagnostic message transmission system provided by the embodiments of the present application. The embodiments of the present application provide a diagnostic message transmission system 1500, which comprises:

[0220] The switch device comprises the public key transmission device 1200 described above;

[0221] The terminal device comprises the public key transmission device 1300 described above;

[0222] The terminal device and the switch device are used to transmit the public key on the switch device to the terminal device through the respective public key transmission devices;

[0223] The switch device is further configured to transmit a diagnostic packet encrypted by using the public key to the terminal device.

[0224] The terminal device is further configured to decrypt the diagnostic packet by using the public key.

[0225] Those skilled in the art can understand that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0226] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0227] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0228] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. According to actual needs, some or all of the units can be selected to achieve the purpose of the embodiment.

[0229] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0230] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0231] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The program is executed by a processor to perform the above method, which includes at least one of the schemes described in the above embodiments.

[0232] The computer storage medium of the embodiments of the present application can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the computer readable storage medium include: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus.

[0233] The computer readable signal medium can include a data signal propagated in a baseband or as a part of a carrier wave, in which a computer readable program code is borne. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or apparatus.

[0234] The program code embodied on the computer readable media can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0235] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0236] In addition, the use of the terms "first", "second", "third" and the like in the description and the claims to refer to a number of steps in a method in the description and the claims, or modules A, B, C and the like in the description and the claims, is only to identify such steps or modules as they occur in the description or claims and does not require or imply that the steps or modules are to be performed in this order, unless the order is explicitly required by the description or the claims.

[0237] In the description above, reference has been made to steps represented by numerals such as S110, S120, etc. These numerals do not necessarily indicate that the steps are to be performed in the order in which they are described, unless the order is explicitly required by the description or the claims.

[0238] The term "comprising", used in the description and the claims, should not be interpreted as limiting to the contents listed thereafter; it does not exclude other elements or steps. It does therefore not exclude the presence of one or more additional features, integers, steps or components neither in a negative claim nor in an arbitrary claim describing several "means". The expression "means for" should therefore be construed in the sense indicated by the jurisprudence of the Boards of Appeal of the European Patent Office, and in particular by T 487 / 90 and T 1020 / 90.

[0239] Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment, but can refer to different embodiments. Furthermore, the particular features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0240] It is noted that the foregoing are merely preferred embodiments of, and the technical principles applied to, the present application. It can be understood by those skilled in the art that the present application is not limited to the particular embodiments described herein, and that various obvious changes, modifications and replacements can be made by those skilled in the art without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and all of the embodiments belong to the protection scope of the present application.

Claims

1. A method of communicating a public key, the method comprising: The method is applied to a switch device end, the switch device stores a first key pair for asymmetric encryption, a public key for symmetric encryption, and the first key pair includes a first private key and a first public key; the method includes: receiving a first key negotiation message sent by a terminal device, and sending a second key negotiation message to the terminal device in response to the first key negotiation message, the second key negotiation message including the first public key; receiving a third key negotiation message sent by the terminal device, and decrypting a second public key encrypted by the first public key in the third key negotiation message by using the first private key, the second public key being a second public key in a second key pair for asymmetric encryption stored by the terminal device; sending a fourth key negotiation message to the terminal device, the fourth key negotiation message including the public key encrypted by the second public key; The switch device also stores a user information list, and the method further includes: decrypting a username encrypted by the first public key in the third key negotiation message by using the first private key, and authenticating the username from the terminal device based on the user information list; sending a fourth key negotiation message to the terminal device, the fourth key negotiation message including the username encrypted by the second public key, for the terminal device to verify the username returned from the switch device based on the sent username; receiving a fifth key negotiation message sent by the terminal device, decrypting a user password corresponding to the username encrypted by the first public key in the fifth key negotiation message by using the first private key, and authenticating the user password from the terminal device based on the password corresponding to the username in the user information list.

2. A method of communicating a public key, the method comprising: The method is applied to a terminal device end, the terminal device stores a second key pair for asymmetric encryption, and the second key pair includes a second private key and a second public key; the method includes: sending a first key negotiation message to a switch device; receiving a second key negotiation message sent by the switch device in response to the first key negotiation message, the second key negotiation message including a first public key, the first public key being a first public key in a first key pair for asymmetric encryption stored by the switch device; sending a third key negotiation message to the switch device, the third key negotiation message including the second public key encrypted by the first public key; receiving a fourth key negotiation message sent by the switch device, and decrypting a public key encrypted by the second public key in the fourth key negotiation message by using the second private key; The method further includes receiving the fourth key negotiation message sent by the switch device, decrypting a username encrypted by the second public key in the fourth key negotiation message by using the second private key, and verifying the username returned from the switch device based on the sent username. sending a fifth key negotiation message to the switch device, the fifth key negotiation message comprising the user password encrypted using the first public key, for the switch device to authenticate the user password from the terminal device based on the sent user password.

3. The transmission method of claim 2, wherein, The terminal device stores a local public key repository for verifying the security of the public key, and the method further comprises: receiving the second key negotiation message sent by the switch device, the second key negotiation message comprising the first public key, and verifying the first public key from the switch device based on the local public key repository.

4. A method of transmitting a public key, characterized by, The switch device stores a first key pair for asymmetric encryption, a public key for symmetric encryption, the first key pair comprising a first private key and a first public key; and the terminal device stores a second key pair for asymmetric encryption, the second key pair comprising a second private key and a second public key; The switch device further stores a user information list, and the method comprises: The terminal device sends a first key negotiation message to the switch device; The switch device receives the first key negotiation message, sends a second key negotiation message to the terminal device, the second key negotiation message comprising the first public key; The terminal device receives the second key negotiation message, sends a third key negotiation message to the switch device, the third key negotiation message comprising the second public key and a username encrypted using the first public key; The switch device receives the third key negotiation message, decrypts the second public key and the username encrypted using the first public key in the third key negotiation message using the first private key, and authenticates the username from the terminal device based on the username in the user information list; The switch device sends a fourth key negotiation message to the terminal device, the fourth key negotiation message comprising the username and the public key encrypted using the second public key; The terminal device receives the fourth key negotiation message, verifies the username replied from the switch device based on the sent username, and decrypts the public key encrypted using the second public key in the fourth key negotiation message using the second private key; The terminal device sends a fifth key negotiation message to the switch device, the fifth key negotiation message comprising the user password encrypted using the first public key; receiving the fifth key negotiation message sent by the terminal device, decrypting the user password corresponding to the username encrypted using the first public key in the fifth key negotiation message using the first private key, and authenticating the user password from the terminal device based on the password corresponding to the username in the user information list.

5. A method of diagnosing transmission of a packet, characterized by, comprises: using the transmission method of the public key of claim 4 to enable the terminal device to obtain the public key stored on the switch device; The switch device transmits a diagnostic message encrypted using the public key to the terminal device; The terminal device decrypts the diagnostic message using the public key.

6. An apparatus for transmitting a public key, the apparatus comprising: a processor configured to generate a public key; and a transmitter configured to transmit the public key. The application is applied to a switch device end, and the switch device stores a first key pair for asymmetric encryption, a public key for symmetric encryption, and the first key pair includes a first private key and a first public key; The switch device also stores a user information list, and the device includes: A first receiving unit is configured to receive a first key negotiation message sent by a terminal device, and send a second key negotiation message to the terminal device in response to the first key negotiation message, wherein the second key negotiation message includes the first public key; A second receiving unit is configured to receive a third key negotiation message sent by the terminal device, and decrypt a second public key encrypted by the first public key in the third key negotiation message using the first private key, wherein the second public key is a second public key in a second key pair for asymmetric encryption stored by the terminal device; A sending unit is configured to send a fourth key negotiation message to the terminal device, and the fourth key negotiation message includes the public key encrypted by the second public key; The second receiving unit is further configured to decrypt a username encrypted by the first public key in the third key negotiation message using the first private key, and authenticate the username from the terminal device based on the username in the user information list; The sending unit is further configured to send a fourth key negotiation message to the terminal device, and the fourth key negotiation message includes the username encrypted by the second public key, so that the terminal device verifies the username returned from the switch device based on the sent username; The second receiving unit is further configured to receive a fifth key negotiation message sent by the terminal device, decrypt a user password corresponding to the username encrypted by the first public key in the fifth key negotiation message using the first private key, and authenticate the user password from the terminal device based on the password corresponding to the username in the user information list.

7. An apparatus for transmitting a public key, the apparatus comprising: a processor configured to generate a public key; and a transmitter configured to transmit the public key. The application is applied to a terminal device end, and the terminal device stores a second key pair for asymmetric encryption, and the second key pair includes a second private key and a second public key; and the device includes: A first sending unit is configured to send a first key negotiation message to a switch device; A first receiving unit is configured to receive a second key negotiation message sent by the switch device in response to the first key negotiation message, and the second key negotiation message includes a first public key, wherein the first public key is a first public key in a first key pair for asymmetric encryption stored by the switch device; A second sending unit is configured to send a third key negotiation message to the switch device, and the third key negotiation message includes the second public key encrypted by the first public key; A second receiving unit is configured to receive a fourth key negotiation message sent by the switch device, and decrypt a public key encrypted by the second public key in the fourth key negotiation message using the second private key. The second receiving unit is further configured to receive the fourth key negotiation message sent by the switch device, decrypt the username encrypted by the second public key in the fourth key negotiation message using the second private key, and verify the username returned from the switch device based on the sent username. The second sending unit is further configured to send a fifth key negotiation message to the switch device, where the fifth key negotiation message comprises the user password encrypted by the first public key, so as to authenticate the user password from the terminal device based on the sent user password.

8. A diagnostic message transmission system, characterized by Comprise: The switch device comprises the public key transmission device of claim 6; The terminal device comprises the public key transmission device of claim 7; The terminal device and the switch device are configured to transmit the public key on the switch device to the terminal device through the respective public key transmission devices; The switch device is further configured to transmit a diagnostic message encrypted by the public key to the terminal device; The terminal device is further configured to decrypt the diagnostic message using the public key.

Images