Key management methods, systems, devices, and media for digital twin services

Abstract

This invention provides a key management method, system, device, and medium for digital twin services. The key management method includes: upon receiving a key request from a data sharing repository, determining the device corresponding to the key request; querying the encrypted public key corresponding to the device; and sending a key request response to the data sharing repository. The key request response carries first information, which includes at least an encrypted public key and a first derived key. The first derived key is derived from the key and vector obtained by the device during device authentication. The first information is used to establish secure communication between multiple twin instances corresponding to the device and the device. This invention, by adding a twin management network element, avoids multiple encryption and decryption operations in the digital twin network, improves the processing efficiency of device data, and reduces network storage and load pressure.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a key management method, system, device, and medium for digital twin services. Background Technology

[0002] A Digital Twin Network (DTN) is a network system that has a physical network entity and a virtual twin, and the two can interact and map in real time. A digital twin is a real-time mirror image of a physical entity in the digital world. With the continuous development of technologies such as cloud computing, big data, and artificial intelligence, and the ubiquitous nature of information, digital twin technology will be widely used in fields such as intelligent manufacturing, smart cities, and scientific research.

[0003] Please refer to Figure 1 The core of a digital twin network is data-driven modeling, providing data model instances for various network applications to maximize the agility and programmability of network services. The service mapping model of the twin network layer consists of two parts: a basic model and a functional model. The basic model refers to the device and topology models of the twin network entity corresponding to the physical network, built based on information such as the basic configuration of physical devices, environmental information, operating status, and link topology, achieving a real-time and accurate description of the physical network. The functional model refers to various data models for network analysis, simulation, diagnosis, prediction, and assurance, built by fully utilizing network data in the data warehouse for specific application scenarios.

[0004] Please refer to Figure 2 In various twin application scenarios, a single physical device may have multiple twin instances at the twin network layer. A twin instance refers to the device's digital model within the twin network, and these digital models may differ depending on the application. Digital twin networks require data collection and storage in a shared data warehouse. Given the massive data storage and usage involved, distributed technologies such as cloud storage and cloud computing are utilized. However, storing data in plaintext carries the risk of data leakage.

[0005] If traditional encryption mechanisms are used, physical devices need to encrypt network data using keys from different instances to generate multiple ciphertexts, which are then sent to the twin instances in the digital twin network to achieve state synchronization between the twin devices and the physical devices. Digital twin networks are characterized by high real-time requirements; multiple encryption and decryption operations increase processing latency and pose significant challenges to network storage and load when a large number of devices connect to the network. Summary of the Invention

[0006] This invention provides a key management method, system, device, and medium for digital twin services to solve the problem of low data processing efficiency caused by multiple encryption and decryption in existing digital twin networks.

[0007] To solve the above-mentioned technical problems, the present invention is implemented as follows:

[0008] In a first aspect, embodiments of the present invention provide a key management method for a digital twin service, executed by a twin management network element, comprising:

[0009] When a key request is received from the data sharing warehouse, the device corresponding to the key request is determined;

[0010] Query the public encryption key corresponding to the device;

[0011] Send a key request response to the data sharing repository, wherein the key request response carries first information, the first information including at least the encryption public key and a first derived key, the first derived key being derived from the key and vector of the device during the device authentication process, and the first information being used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0012] Optionally, the first information may also include:

[0013] The key validity period is used to establish secure communication between multiple twin instances corresponding to the device and the device within the key validity period.

[0014] Optionally, the step of determining the device corresponding to the key request before receiving the key request from the data sharing repository includes:

[0015] When a twin key anchoring request is received from a device authentication network element, the second information carried in the twin key anchoring request is saved. The second information includes the first derived key, the device ID, and the key validity period.

[0016] Optionally, when the key request carries the device ID;

[0017] The device corresponding to the key request includes:

[0018] Based on the device ID, determine the device corresponding to the key request.

[0019] Optionally, before determining the device corresponding to the key request when receiving a key request from the data sharing repository, the method further includes:

[0020] When a twin service subscription request is received from the device, the encrypted public key and device ID carried in the twin service subscription request are saved;

[0021] When a digital twin data access structure update request is received from the device, the stored digital twin data access structure update request corresponding to the device is updated with the new encrypted public key and device ID carried in the request.

[0022] Secondly, embodiments of the present invention provide a key management method for a digital twin service, executed by a twin instance, including:

[0023] The system receives first information sent by a data sharing repository. The first information includes at least an encrypted public key and a first derived key, wherein the first derived key is derived from the key and vector of the device corresponding to the twin instance during the device authentication process.

[0024] Based on the twin private key corresponding to the twin instance and the first information, establish secure communication with the device.

[0025] Optionally, the first information may also include:

[0026] A key validity period is used to enable the twin instance to establish secure communication with the device within the key validity period.

[0027] Optionally, establishing secure communication with the device based on the twin private key corresponding to the twin instance and the first information includes:

[0028] The first random key is obtained by decrypting the encrypted public key in the first information using the corresponding twin private key;

[0029] The second derived key is determined based on the first random key and the first derived key;

[0030] Establish secure communication with the device based on the second derived key.

[0031] Thirdly, embodiments of the present invention provide a key management method for a digital twin service, executed by a device, comprising:

[0032] After device authentication is completed in the device authentication network element, a first derived key is obtained based on the key and vector in the device authentication process. The first derived key is used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0033] The second derived key is determined based on the first random key and the first derived key, wherein the first random key is randomly derived from the root key or certificate;

[0034] Secure communication is established between the second derived key and multiple twin instances corresponding to the device.

[0035] Optionally, the process further includes the following before the device authentication network element completes device authentication:

[0036] If you order the digital twin service, the first random key will be randomly generated based on the root key or certificate;

[0037] Based on the device twin public key obtained from the Twin Trust Center, and based on the data access structure, the first random key is encrypted using an attribute encryption algorithm to obtain the encryption public key;

[0038] Send a twin service subscription request to the twin management network element, the twin service subscription request carrying the encrypted public key and device ID.

[0039] Optional, also includes:

[0040] If the data access structure is modified, a new first random key is derived from the root key or certificate.

[0041] Based on the device twin public key, and using the new data access structure, the first random key is encrypted using an attribute encryption algorithm to obtain a new encryption public key;

[0042] Send a digital twin data access structure update request to the twin management network element. The digital twin data access structure update request carries the new encryption public key and device ID.

[0043] Fourthly, embodiments of the present invention provide a key management system for a digital twin service, executed by a twin management network element, comprising:

[0044] The first receiving module is used to determine the device corresponding to the key request when it receives a key request sent by the data sharing warehouse;

[0045] The query module is used to query the encryption public key corresponding to the device;

[0046] The request module is used to send a key request response to the data sharing repository. The key request response carries first information, which includes at least the encryption public key and a first derived key. The first derived key is derived from the key and vector obtained by the device during the device authentication process. The first information is used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0047] Fifthly, embodiments of the present invention provide a key management system for a digital twin service, executed by a twin instance, including:

[0048] The second receiving module is used to receive first information sent by the data sharing warehouse. The first information includes at least an encryption public key and a first derived key, wherein the first derived key is derived from the key and vector of the device corresponding to the twin instance in the device authentication process.

[0049] The first communication module is used to establish secure communication with the device based on the twin private key corresponding to the twin instance and the first information.

[0050] Sixthly, embodiments of the present invention provide a key management system for a digital twin service, executed by a device, comprising:

[0051] The authentication module is used to complete device authentication at the device authentication network element. It derives a first derived key based on the key and vector in the device authentication process. The first derived key is used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0052] A derivation module is used to determine a second derivation key based on a first random key and the first derivation key, wherein the first random key is randomly derived from a root key or a certificate;

[0053] The second communication module is used to establish secure communication with multiple twin instances corresponding to the device based on the second derived key.

[0054] In a seventh aspect, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the key management method as described in the first aspect above; or, when the program is executed by the processor, it implements the steps of the key management method as described in the second aspect above; or, when the program is executed by the processor, it implements the steps of the key management method for digital twin services as described in the third aspect above.

[0055] Eighthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, wherein when executed by a processor, the computer program implements the steps of the key management method for a digital twin service as described in the first aspect above; or, when executed by a processor, the computer program implements the steps of the key management method for a digital twin service as described in the second aspect above; or, when executed by a processor, the computer program implements the steps of the key management method for a digital twin service as described in the third aspect above.

[0056] In this embodiment of the invention, a twin management network element is added to the physical network to provide secure transmission keys for physical layer devices (terminals or network elements) and twin instances in the twin layer. Specifically, upon receiving a key request from a data sharing repository, a key request response is sent to the data sharing repository. This key request response carries first information, which includes at least the encrypted public key and a first derived key corresponding to the device. By adding the twin management network element, when multiple twin instances corresponding to a device establish secure communication with the device, the twin instances can use the encrypted public key and the first derived key contained in the first information sent by the twin management network element for decryption. This eliminates the need to encrypt and generate multiple ciphertexts for the keys of different instances, avoiding multiple encryption and decryption operations in the digital twin network, improving the processing efficiency of device data, reducing network storage and load pressure when a large number of devices access the network, and adding the first derived key to the twin key response information to encrypt data transmission increases the security and reliability of communication. Attached Figure Description

[0057] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0058] Figure 1 This is an architecture diagram of a digital twin network provided in an embodiment of the present invention;

[0059] Figure 2 This is an architecture diagram of a twin application scenario provided by an embodiment of the present invention;

[0060] Figure 3 This is an architecture diagram of a twin application scenario with a twin trust center provided by an embodiment of the present invention;

[0061] Figure 4 This is a flowchart of a key management method for digital twin services performed by a twin management network element, provided by an embodiment of the present invention;

[0062] Figure 5 This is an overall architecture diagram of a key management method for a digital twin service provided in an embodiment of the present invention;

[0063] Figure 6 This is an overall flowchart of a key management method for a digital twin service provided in an embodiment of the present invention;

[0064] Figure 7 This is a flowchart illustrating the process of ordering a digital twin service and accessing a structure update, as provided in an embodiment of the present invention.

[0065] Figure 8This is a flowchart of a key management method for performing digital twin services by a twin instance, provided by an embodiment of the present invention;

[0066] Figure 9 This is a flowchart of a key management method for performing digital twin services by a device, provided by an embodiment of the present invention;

[0067] Figure 10 This is a schematic diagram of the structure of a key management system in which a twin management network element performs digital twin services, as provided in an embodiment of the present invention.

[0068] Figure 11 This is a schematic diagram of the structure of a key management system for performing digital twin services by a twin instance, provided by an embodiment of the present invention;

[0069] Figure 12 This is a schematic diagram of the structure of a key management system for performing digital twin services by a device, provided in an embodiment of the present invention;

[0070] Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0071] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0072] This invention derives a symmetric session key based on the authentication parameters and attribute encryption parameters of devices (physical terminals and physical network elements). Specifically, a twin trusted center generates public and private keys based on the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) algorithm.

[0073] CP-ABE is an attribute-based encryption mechanism that embeds the policy into the ciphertext and the attributes into the user key. The ciphertext corresponds to an access structure, and the key corresponds to a set of attributes. Decryption occurs if and only if the attributes in the set satisfy the access structure. CP-ABE uses cryptographic mechanisms to protect data, with the data owner defining the policy for accessing the ciphertext and associating the attribute set with the accessed resource. Data users can access ciphertext information based on their authorized attributes.

[0074] Digital twin technology has been successfully applied in various industries such as urban construction, aerospace, and manufacturing workshops. Introducing digital twin technology into networks and building digital twin networks is an inevitable trend in the development of next-generation networks. Digital twin networks are characterized by digitization, networking, and intelligence. Their application environment is more open, interconnected, and shared. However, as their application areas continue to expand, network security issues will gradually become more prominent. In physical networks, authentication and authorization of network devices are mostly done through digital certificates. Due to the virtual nature and rapid changes of digital models in twin networks, it is impossible to apply for digital certificates for every single digital model. Introducing a twin trust center at the twin network layer ensures the authenticity and trustworthiness of the twin model's identity. Based on this trust, a series of security protections such as authentication, authorization, and encryption are implemented, promoting the secure development of digital twin networks.

[0075] Please refer to Figure 3 A Twin Trusted Center is a security service used for the secure management of twin key transmission. It primarily achieves secure communication by providing security protection mechanisms. The Twin Trusted Center generates public and private keys based on the CP-ABE algorithm, embeds the model instance's attributes into the private key, sends it to the twin instance, and sends the public key to the physical device. If the device has subscribed to the digital twin service, the Twin Trusted Center generates {PK,MK} = Setup() using the CP-ABE initialization algorithm, where PK is used as the device's public key, and MK is stored in the Trusted Center as the master key for generating the private key. When the twin layer generates a new twin instance, it requests a twin private key SK from the Twin Trusted Center. The Twin Trusted Center generates the key SK = KeyGen(MK,S) using the CP-ABE private key generation algorithm, where S is the set of attributes of the twin instance.

[0076] The public and private keys generated by the CP-ABE algorithm based on attribute encryption can achieve secure one-to-many data transmission. However, the encryption efficiency of the public key encryption mechanism is relatively low. Digital twin networks have high requirements for network real-time performance. Directly using the public and private keys generated by CP-ABE to encrypt and decrypt data will increase data processing latency.

[0077] Therefore, please refer to Figure 4 , Figure 5 and Figure 6 This invention provides a key management method for digital twin services, executed by a twin management network element, including:

[0078] Step 11: When a key request is received from the data sharing warehouse, determine the device corresponding to the key request;

[0079] Step 12: Query the encryption public key corresponding to the device;

[0080] Step 13: Send a key request response to the data sharing repository, wherein the key request response carries first information, the first information including at least the encryption public key and the first derived key, the first derived key being derived from the key and vector of the device during the device authentication process, and the first information being used to establish secure communication between the multiple twin instances corresponding to the device and the device.

[0081] In this embodiment of the invention, a twin management network element is added to the physical network to provide secure transmission keys for physical layer devices (terminals or network elements) and twin instances in the twin layer. Specifically, upon receiving a key request from a data sharing repository, a key request response is sent to the data sharing repository. This key request response carries first information, which includes at least the encrypted public key and a first derived key corresponding to the device. By adding the twin management network element, when multiple twin instances corresponding to a device establish secure communication with the device, the twin instances can use the encrypted public key and the first derived key contained in the first information sent by the twin management network element for decryption. This eliminates the need to encrypt and generate multiple ciphertexts for the keys of different instances, avoiding multiple encryption and decryption operations in the digital twin network, improving the processing efficiency of device data, reducing network storage and load pressure when a large number of devices access the network, and adding the first derived key to the twin key response information to encrypt data transmission increases the security and reliability of communication.

[0082] In one embodiment, the first information further includes:

[0083] The key validity period is used to establish secure communication between multiple twin instances corresponding to the device and the device within the key validity period.

[0084] In this embodiment of the invention, setting an expiration date can better manage the key, prevent the key from being used after it expires, thereby reducing the risk of network security, improving the security of the first information during transmission, and preventing improper transmission.

[0085] In one embodiment, before determining the device corresponding to the key request when a key request is received from the data sharing repository, the method further includes:

[0086] When a twin key anchoring request is received from a device authentication network element, the second information carried in the twin key anchoring request is saved. The second information includes the first derived key, the device ID, and the key validity period.

[0087] In this embodiment of the invention, the first derived key K carried in the twin key anchoring request sent by the device authentication network element is stored. AT The device ID and key validity period can prevent the twin management network element from repeatedly obtaining the first derived key K from the device authentication network element when sending the first information.AT Information such as...

[0088] In one embodiment, when the key request carries a device ID, determining the device corresponding to the key request includes:

[0089] Based on the device ID, determine the device corresponding to the key request.

[0090] In this embodiment of the invention, a method for verifying a device using a device ID is provided. The device ID distinguishes devices, is convenient to obtain, secure, and effective. The encrypted public key K corresponding to the device can be retrieved using the device ID. ET .

[0091] For further details, please refer to... Figure 7 Before providing twin services, the twin management network element needs to receive a twin service subscription request from the device. Specifically, before determining the device corresponding to the key request upon receiving a key request from the data sharing warehouse, the process further includes:

[0092] When a twin service subscription request is received from the device, the encrypted public key and device ID carried in the twin service subscription request are saved;

[0093] When a digital twin data access structure update request is received from the device, the stored digital twin data access structure update request corresponding to the device is updated with the new encrypted public key and device ID carried in the request.

[0094] In this embodiment of the invention, the encrypted public key K carried in the twin service subscription request sent by the storage device is used. ET This enables the query to find the encrypted public key K corresponding to the device. ET In such cases, the information can be directly retrieved from the saved encrypted public key information without the need for the device to send it again, thus reducing repetitive work.

[0095] Please refer to Figure 5 , Figure 6 and Figure 8 This invention also provides a key management method for a digital twin service, executed by a twin instance, including:

[0096] Step 21: Receive the first information sent by the data sharing warehouse. The first information includes at least an encrypted public key and a first derived key, wherein the first derived key is derived from the key and vector of the device corresponding to the twin instance in the device authentication process.

[0097] Step 22: Establish secure communication with the device based on the twin private key corresponding to the twin instance and the first information.

[0098] In this embodiment of the invention, the twin instance receives the encrypted public key and the first derived key sent by the data sharing warehouse, and establishes secure communication with the device based on the twin private key corresponding to the twin instance. It is worth noting that the data sharing warehouse distributes the same first information (including the key) to multiple twin instances corresponding to the device. That is, for different twin instances, only their own twin private key and the unified encrypted public key are needed to establish secure communication with the device. This effectively reduces the workload and, when a large number of devices are connected to the network, reduces network storage and load pressure, increasing the processing efficiency of the digital twin network.

[0099] In one embodiment, the first information further includes:

[0100] A key validity period is used to enable the twin instance to establish secure communication with the device within the key validity period.

[0101] In this embodiment of the invention, setting an expiration date can better manage the key, prevent the key from being used after it expires, thereby reducing the risk of network security, improving the security of the first information during transmission, and preventing improper transmission.

[0102] Furthermore, embodiments of the present invention provide a method for establishing secure communication with a device based on first information. Specifically, establishing secure communication with the device based on the twin private key corresponding to the twin instance and the first information includes:

[0103] The first random key is obtained by decrypting the encrypted public key in the first information using the corresponding twin private key;

[0104] The second derived key is determined based on the first random key and the first derived key;

[0105] Establish secure communication with the device based on the second derived key.

[0106] In this embodiment of the invention, the twin instance uses its twin private key to decrypt the encrypted public key K. ET Obtain the first random key K DT , where K DT ==K_de(K ET K SK K_de is the CP-ABE decryption algorithm, K SK It is the private key of the twin instance.

[0107] The device (physical terminal / network element) and the twin instance are based on the first derived key K AT and the first random key K DT Derivation of the second derived key K ST K ST =KDF (K AT K DT ), where K DF () is the key derivation function.

[0108] The twin instance is based on the second derived key K ST Establish secure communication with the device, wherein the second derived key K ST It uses a symmetric key, meaning that only twin instances that satisfy the access structure H can decrypt the public key, and only twin instances that satisfy the access structure can derive the session encryption key, providing fine-grained access control capabilities.

[0109] Please refer to Figure 5 , Figure 6 and Figure 9 This invention also provides a key management method for digital twin services, executed by a device, comprising:

[0110] Step 31: Complete device authentication in the device authentication network element, and obtain a first derived key based on the key and vector in the device authentication process. The first derived key is used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0111] Step 32: Determine the second derived key based on the first random key and the first derived key, wherein the first random key is randomly derived from the root key or certificate;

[0112] Step 33: Establish secure communication with multiple twin instances corresponding to the device based on the second derived key.

[0113] In this embodiment of the invention, on the device side, a second derived key is determined by a first random key and a first derived key. Secure communication is established between the second derived key and multiple twin instances corresponding to the device, realizing secure communication based on symmetric session keys. This achieves fast encryption and decryption speeds, good performance, and can meet data security requirements. It effectively reduces redundant calculations. Furthermore, the first derived key is used to establish secure communication between the multiple twin instances corresponding to the device and the device. It eliminates the need to encrypt and generate multiple ciphertexts for the keys of different instances, avoiding multiple encryption and decryption operations in the digital twin network and improving the processing efficiency of device data.

[0114] In one embodiment, the step of further including: before the device authentication network element completes device authentication.

[0115] If you order the digital twin service, the first random key will be randomly generated based on the root key or certificate;

[0116] Based on the device twin public key obtained from the Twin Trust Center, and based on the data access structure, the first random key is encrypted using an attribute encryption algorithm to obtain the encryption public key;

[0117] Send a twin service subscription request to the twin management network element, the twin service subscription request carrying the encrypted public key and device ID.

[0118] Please refer to Figure 7 In this embodiment of the invention, if a device (physical terminal / network element) subscribes to a digital twin service, a first random key K needs to be randomly derived based on the device's root key or certificate. DT Furthermore, this embodiment of the invention provides a process for obtaining an encryption public key, specifically including: using the device's (physical terminal / network element's) device twin public key obtained from the aforementioned twin trusted center, and encrypting a first random key K based on the data access structure H. DT Obtain the public key K. ET K ET =K_en(K PK K DT H), where K_en is the CP-ABE encryption algorithm K PK It is the device's twin public key.

[0119] Furthermore, the physical terminal / network element sends a twin service subscription request to the twin management network element, carrying the encrypted public key K. ET After receiving a request, the twin management network element can save the parameters KET and the device ID.

[0120] The encryption method described in this invention ensures that only twin instance attributes satisfying access structure H can decrypt K. ET .

[0121] Furthermore, physical layer devices can set their own data access structures, and these structures are only visible to the device during communication, effectively protecting device privacy.

[0122] Furthermore, if the physical terminal / network element needs to modify the device data access structure, this embodiment of the invention provides a method for updating the encryption public key K. ET The method, specifically:

[0123] If the data access structure is modified, a new first random key is derived from the root key or certificate.

[0124] Based on the device twin public key, and using the new data access structure, the first random key is encrypted using an attribute encryption algorithm to obtain a new encryption public key;

[0125] Send a digital twin data access structure update request to the twin management network element. The digital twin data access structure update request carries the new encryption public key and device ID.

[0126] Please refer to Figure 7In this embodiment of the invention, if the device (physical terminal / network element) needs to modify the device data access structure, a new first random key K needs to be derived. DT 'Use the digital twin public key to encrypt a new first random key K based on the new access structure H'. DT 'Obtain the new public encryption key K' ET ', where K ET '=K_en(K PK K DT ', H').

[0127] The device (physical terminal / network element) sends a digital twin access structure update request to the twin management network element, carrying the new encrypted public key K as a parameter. ET The device ID enables the twin management element to update the encrypted public key K upon receiving a request. ET and device ID.

[0128] In this embodiment of the invention, by adding a twin management network element to the physical network, a symmetric session key is derived based on the authentication parameters and attribute encryption parameters of the physical terminal and the physical network element, and the session key is sent to the twin instance for secure communication between the twin instance and the physical terminal or physical network element. This allows the physical layer device to encrypt data only once, avoiding repeated encryption of the same data, and the use of a symmetric encryption key does not increase the processing latency of the network.

[0129] Please refer to Figure 10 This invention also provides a key management system 40 for digital twin services, executed by a twin management network element, including:

[0130] The first receiving module 41 is used to determine the device corresponding to the key request when it receives a key request sent by the data sharing warehouse;

[0131] Query module 42 is used to query the encryption public key corresponding to the device;

[0132] The request module 43 is used to send a key request response to the data sharing warehouse. The key request response carries first information, which includes at least the encryption public key and a first derived key. The first derived key is derived from the key and vector of the device during the device authentication process. The first information is used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0133] In this embodiment of the invention, the first information further includes:

[0134] The key validity period is used to establish secure communication between multiple twin instances corresponding to the device and the device within the key validity period.

[0135] In this embodiment of the invention, the key management system 40 for the digital twin service further includes:

[0136] The third receiving module is used to save the second information carried in the twin key anchoring request when it receives the twin key anchoring request sent by the device authentication network element. The second information includes the first derived key, the device ID and the key validity period.

[0137] In this embodiment of the invention, when the key request carries the device ID;

[0138] The first receiving module 41 includes:

[0139] Based on the device ID, determine the device corresponding to the key request.

[0140] In this embodiment of the invention, optionally, the key management system 40 for the digital twin service further includes:

[0141] The fourth receiving module is used to save the encrypted public key and device ID carried in the twin service subscription request when it receives the twin service subscription request of the device.

[0142] When a digital twin data access structure update request is received from the device, the stored digital twin data access structure update request corresponding to the device is updated with the new encrypted public key and device ID carried in the request.

[0143] The key management system 40 for digital twin services provided in this embodiment of the invention can achieve... Figure 4 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0144] Please refer to Figure 11 This invention also provides a key management system 50 for a digital twin service, executed by a twin instance, including:

[0145] The second receiving module 51 is used to receive first information sent by the data sharing warehouse. The first information includes at least an encryption public key and a first derived key, wherein the first derived key is derived from the key and vector of the device corresponding to the twin instance in the device authentication process.

[0146] The first communication module 52 is used to establish secure communication with the device based on the twin private key corresponding to the twin instance and the first information.

[0147] In this embodiment of the invention, the first information further includes:

[0148] A key validity period is used to enable the twin instance to establish secure communication with the device within the key validity period.

[0149] In this embodiment of the invention, the first communication module 52 includes:

[0150] The first communication submodule is used to decrypt the encrypted public key in the first information based on the corresponding twin private key to obtain the first random key;

[0151] The second derived key is determined based on the first random key and the first derived key;

[0152] Establish secure communication with the device based on the second derived key.

[0153] The key management system 50 for digital twin services provided in this embodiment of the invention can achieve Figure 8 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0154] Please refer to Figure 12 This invention also provides a key management system 60 for digital twin services, executed by a device, including:

[0155] Authentication module 61 is used to complete device authentication in the device authentication network element, and to derive a first derived key based on the key and vector in the device authentication process. The first derived key is used to establish secure communication between multiple twin instances corresponding to the device and the device.

[0156] The derivation module 62 is used to determine a second derivation key based on a first random key and the first derivation key, wherein the first random key is randomly derived from a root key or a certificate;

[0157] The second communication module 63 is used to establish secure communication with multiple twin instances corresponding to the device based on the second derived key.

[0158] Please refer to Figure 12 In this embodiment of the invention, the key management system 60 for the digital twin service further includes:

[0159] The ordering module is used to randomly derive a first random key based on the root key or certificate if a digital twin service is ordered.

[0160] Based on the device twin public key obtained from the Twin Trust Center, and based on the data access structure, the first random key is encrypted using an attribute encryption algorithm to obtain the encryption public key;

[0161] Send a twin service subscription request to the twin management network element, the twin service subscription request carrying the encrypted public key and device ID.

[0162] In this embodiment of the invention, the key management system 60 for the digital twin service further includes:

[0163] The update module is used to derive a new first random key based on the root key or certificate if the data access structure is modified.

[0164] Based on the device twin public key, and using the new data access structure, the first random key is encrypted using an attribute encryption algorithm to obtain a new encryption public key;

[0165] Send a digital twin data access structure update request to the twin management network element. The digital twin data access structure update request carries the new encryption public key and device ID.

[0166] The key management system 60 for digital twin services provided in this embodiment of the invention can achieve Figure 9 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0167] This invention provides an electronic device 70, see [link to relevant documentation]. Figure 13 As shown, Figure 13 This is a schematic diagram of an electronic device 70 according to an embodiment of the present invention, including a processor 71, a memory 72, and a program or instructions stored in the memory 72 and executable on the processor 71. When the program or instructions are executed by the processor, they implement the steps in the key management method of any digital twin service of the present invention.

[0168] This invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements various processes of the key management method of the digital twin service as described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0169] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0170] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0171] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0172] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a service classification device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0173] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A key management method for a digital twin service, characterized in that, Performs by a twin management network element, comprising: When receiving a key request sent by a data sharing warehouse, determining a device corresponding to the key request; Querying an encryption public key corresponding to the device; Sending a key request response to the data sharing warehouse, wherein the key request response carries first information, the first information at least including the encryption public key and a first derived key, the first derived key being derived from a key and a vector in a device authentication process of the device, and the first information being used for a plurality of twin instances corresponding to the device to establish secure communication with the device.

2. The method of claim 1, wherein, The first information further includes: A key validity period, the key validity period being used for the plurality of twin instances corresponding to the device to establish secure communication with the device within the key validity period.

3. The method of claim 1, wherein, The determination of the device corresponding to the key request when receiving the key request sent by the data sharing warehouse further includes: When receiving a twin key anchoring request sent by a device authentication network element, saving second information carried by the twin key anchoring request, the second information including the first derived key, a device ID and a key validity period.

4. The method of claim 1, wherein, When the key request carries a device ID; The determination of the device corresponding to the key request includes: According to the device ID, determining the device corresponding to the key request.

5. The method of claim 1, wherein, The determination of the device corresponding to the key request when receiving the key request sent by the data sharing warehouse further includes: When receiving a twin service subscription request of the device, saving the encryption public key and the device ID carried in the twin service subscription request; When receiving a digital twin data access structure update request sent by the device, updating the saved encryption public key and device ID corresponding to the device according to a new encryption public key and a device ID carried in the digital twin data access structure update request. 6.A key management method of a digital twin service, performed by a twin instance, the method comprising: receiving, from a service provider, a request for a key of a service provider key; and transmitting, to the service provider, a response including the key of the service provider key. Comprise: Receiving first information sent by a data sharing warehouse, the first information at least including an encryption public key and a first derived key, wherein the first derived key is derived from a key and a vector in a device authentication process of a device corresponding to the twin instance; According to a twin private key corresponding to the twin instance and the first information, establishing secure communication with the device.

7. The method of claim 6, wherein, The establishment of secure communication with the device according to the twin private key corresponding to the twin instance and the first information includes: Decrypting the encryption public key in the first information according to the corresponding twin private key to obtain a first random key; Determining a second derived key according to the first random key and the first derived key; Establishing secure communication with the device according to the second derived key.

8. A key management method for a digital twin service, executed by a device, characterized in that, Comprise: Deriving a first derived key based on a key and a vector in a device authentication process when a device authentication network element completes device authentication, the first derived key being used for a plurality of twin instances corresponding to the device to establish secure communication with the device; Determining a second derived key according to a first random key and the first derived key, wherein the first random key is randomly derived from a root key or a certificate; Establishing secure communication with the plurality of twin instances corresponding to the device according to the second derived key.

9. The method of claim 8, wherein, The device authentication network element before completing device authentication further comprises: If the digital twin service is subscribed, a first random key is randomly derived according to a root key or a certificate; According to the device twin public key applied from the twin trusted center, the first random key is encrypted based on the data access structure using an attribute encryption algorithm to obtain an encrypted public key; The twin management network element is sent a twin service subscription request, and the twin service subscription request carries the encrypted public key and the device ID.

10. The method of claim 9, wherein, Further comprising: If the data access structure is modified, a new first random key is derived according to a root key or a certificate; According to the device twin public key, the first random key is encrypted based on the new data access structure using an attribute encryption algorithm to obtain a new encrypted public key; The digital twin data access structure update request is sent to the twin management network element, and the digital twin data access structure update request carries the new encrypted public key and the device ID.

11. A key management system for a digital twin service, characterized by, Executed by the twin management network element, comprising: A first receiving module configured to determine a device corresponding to a key request when receiving the key request sent by a data sharing warehouse; A query module configured to query an encrypted public key corresponding to the device; A request module configured to send a key request response to the data sharing warehouse, wherein the key request response carries first information, the first information at least including the encrypted public key and a first derived key, the first derived key being derived from a key and a vector in a device authentication process of the device, and the first information being used for a plurality of twin instances corresponding to the device to establish secure communication with the device. 12.A key management system of a digital twin service, executed by a twin instance, characterized in that, Comprising: A second receiving module configured to receive first information sent by a data sharing warehouse, the first information at least including an encrypted public key and a first derived key, wherein the first derived key is derived from a key and a vector in a device authentication process of a device corresponding to the twin instance; A first communication module configured to establish secure communication with the device according to a twin private key corresponding to the twin instance and the first information. 13.A key management system of a digital twin service, executed by a device, characterized in that, Comprising: An authentication module configured to derive a first derived key based on a key and a vector in a device authentication process when a device authentication network element completes device authentication, the first derived key being used for a plurality of twin instances corresponding to the device to establish secure communication with the device; A derivation module configured to determine a second derived key according to a first random key and the first derived key, wherein the first random key is randomly derived according to a root key or a certificate; A second communication module configured to establish secure communication with the plurality of twin instances corresponding to the device according to the second derived key.

14. An electronic device, comprising: Comprising: A processor, a memory, and a program stored on the memory and executable on the processor, the program being executed by the processor to implement the steps of the digital twin service key management method according to any one of claims 1 to 5; or, the program being executed by the processor to implement the steps of the digital twin service key management method according to claim 6 or 7; or, the program being executed by the processor to implement the steps of the digital twin service key management method according to any one of claims 8 to 10.

15. A computer-readable storage medium, characterized in that, A computer program is stored on a computer readable storage medium, and when executed by a processor, implements the steps of the key management method of the digital twin service according to any one of claims 1 to 5; or, when executed by a processor, implements the steps of the key management method of the digital twin service according to claim 6 or 7; or, when executed by a processor, implements the steps of the key management method of the digital twin service according to any one of claims 8 to 10.

Images