Hierarchical key management method, device and storage medium

Abstract

The application provides a hierarchical key management method, device and storage medium, and the method comprises the following steps: obtaining a first key server of a first terminal, wherein the first key server is located in an access network in a label-land separation network, and the first key server comprises at least three levels of keys; generating a 0-level key based on the first key server according to a first pseudo-random function; generating a 1-level key for communication with a second key server based on the first key server according to the 0-level key; when the first terminal communicates with a second terminal, calling the first terminal to perform a key request based on the first key server in the local access network to obtain a 2-level key, wherein the 2-level key is derived based on the 1-level key, and the 2-level key is used for communication from the first terminal to the second terminal. Through the application, the terminal of different networks can be provided with fast and safe key management services in the label-land separation network.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a hierarchical key management method, apparatus, and storage medium. Background Technology

[0002] Key management typically includes key generation, storage, protection, updating, distribution, verification, use, and destruction, covering the entire lifecycle of a key.

[0003] In related technologies, symmetric-key encryption is commonly used. This involves placing a Message Authentication Code (MAC) on each data packet. Each MAC is calculated using a key shared by the source application server and application servers along the path, allowing autonomous systems along the route to independently verify the validity of the source address. However, this requires the authentication system to store the symmetric keys between all autonomous systems, resulting in high key storage pressure and low management efficiency.

[0004] It is evident that the key management methods in related technologies suffer from technical problems such as high storage pressure and low management efficiency in the key management system. Summary of the Invention

[0005] This invention provides a hierarchical key management method, apparatus, and storage medium to address the shortcomings of existing key management methods, such as high storage pressure and low management efficiency. It can provide fast and secure key management services for terminals in different networks in a target-location separation network.

[0006] This invention provides a hierarchical key management method, apparatus, and storage medium, comprising the following steps: Obtaining a first key server for a first terminal, wherein the first key server is located in an access network within a target-location separation network, and the first key server includes at least three levels of keys; generating a level 0 key based on the first key server according to a first pseudo-random function; generating a level 1 key for communication with a second key server based on the level 0 key, wherein the direction of the level 1 key is from the communication sender to the communication receiver; when the first terminal communicates with the second terminal, invoking the first terminal to request a key based on the first key server in the local access network to obtain a level 2 key, wherein the level 2 key is derived from the level 1 key, and the level 2 key is used for communication from the first terminal to the second terminal.

[0007] According to a hierarchical key management method provided by the present invention, the step of generating a level 1 key for communication with a second key server based on the level 0 key by the first key server includes: generating a level 1 key based on the level 0 key, a first identifier of the first key server, a second identifier of the second key server, and a random value according to a second pseudo-random function, wherein the level 1 key is used for communication from the first key server to the second key server.

[0008] According to a hierarchical key management method provided by the present invention, the first identifier is the identity identifier of the first key server, and the second identifier is the identity identifier of the second key server; or, the first identifier is the router management port address of the local access network where the first key server is located, and the second identifier is the router management port address of the local access network where the second key server is located.

[0009] According to a hierarchical key management method provided by the present invention, after the first key server generates a level 1 key for communicating with a second key server based on the level 0 key, the method further includes: calling the first key server to send a reverse level 1 key acquisition request to other key servers to obtain a reverse level 1 key sent by the other key servers for communicating with the first key server, wherein the level 1 key and the reverse level 1 key are symmetric keys.

[0010] According to a hierarchical key management method provided by the present invention, the step of calling the first terminal to make a key request based on the first key server in the local access network to obtain a level 2 key includes: determining the first identity identifier of the first key server and the second identity identifier of the second terminal's second key server; and deriving the level 2 key based on the level 1 key, the first identity identifier, and the second identity identifier according to a third pseudo-random function.

[0011] According to a hierarchical key management method provided by the present invention, after the first terminal requests a key based on the first key server in the local access network and obtains a Level 2 key, the method further includes: updating the Level 0 key according to a preset first time interval based on the first key server, wherein the update process of the Level 0 key is decoupled from the Level 1 key; updating the Level 1 key according to a preset second time interval within a first reserved update time based on the first key server, wherein the first reserved update time is much shorter than the second time interval; and updating the Level 2 key according to the preset second time interval within a second reserved update time based on the first key server, wherein the expiration time of the Level 1 key and the Level 2 key is the same.

[0012] This invention also provides a hierarchical key management device, comprising the following modules: an acquisition module, configured to acquire a first key server of a first terminal, wherein the first key server is located in an access network within a target-location separation network, and the first key server includes at least three levels of keys; a first generation module, configured to generate a level 0 key based on the first key server and according to a first pseudo-random function; a second generation module, configured to generate a level 1 key for communication with a second key server based on the first key server and the level 0 key, wherein the direction of the level 1 key is from the communication sender to the communication receiver; and a calling module, configured to, when the first terminal communicates with the second terminal, call the first terminal to make a key request based on the first key server in the local access network to obtain a level 2 key, wherein the level 2 key is derived from the level 1 key, and the level 2 key is used for communication from the first terminal to the second terminal. This invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the hierarchical key management methods described above.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the hierarchical key management method as described above.

[0014] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the hierarchical key management method as described above.

[0015] The hierarchical key management method, apparatus, and storage medium provided by this invention obtain a first key server for a first terminal in a target-location separation network, generate a level 0 key based on the first key server, then generate a level 1 key for communication with a second key server based on the level 0 key, and derive a level 2 key from the first key server when the first terminal communicates with the second terminal. Thus, based on the high efficiency of the hierarchical key server, corresponding multi-level keys can be generated in real time based on the key servers of both communicating parties, and fast and secure key management services can be provided for terminals in different networks within a target-location separation network. This solves the technical problems of high storage pressure and low management efficiency in related key management methods. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced one by one below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This invention provides a hierarchical key management method.

[0018] Figure 2 This is a schematic diagram of the target-ground separation network provided by the present invention.

[0019] Figure 3 This is a schematic diagram of the multi-level hierarchical key structure provided by the present invention.

[0020] Figure 4 This is a schematic diagram of key deployment in the target-location separation network provided by the present invention.

[0021] Figure 5 This is a schematic diagram of the multi-level key update mechanism provided by the present invention.

[0022] Figure 6 This is a schematic diagram of the hierarchical key architecture provided by the present invention.

[0023] Figure 7 This is a schematic diagram of the hierarchical key update mechanism provided by the present invention.

[0024] Figure 8 This is a schematic diagram of the hierarchical key management device provided by the present invention.

[0025] Figure 9 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] Key management typically includes key generation, storage, protection, updating, distribution, verification, use, and destruction, covering the entire key lifecycle. Keys play a crucial role in network security, and efficient and secure key acquisition helps provide the network with rich security features such as user authentication, secure access control, packet source address authentication, and packet encryption.

[0028] To address the problems of high storage pressure, poor compatibility, and inability to simultaneously handle cross-domain and intra-domain key negotiation in existing key management systems, this invention proposes a hierarchical key management method, apparatus, and storage medium for target-location separated networks. It can provide key management services for terminals across domains or within the same domain, facilitating symmetric key negotiation between terminals. This allows terminals on different networks to quickly obtain symmetric keys from a local key server without cross-domain communication. Furthermore, the key server, based on a hierarchical key architecture, can statelessly generate and distribute symmetric keys for terminal communication.

[0029] In summary, this invention solves the problems of high storage pressure, poor compatibility, and inability to simultaneously handle cross-domain and intra-domain key negotiation in existing key management systems within a target-location separation network.

[0030] refer to Figure 1 , Figure 1 This invention provides a hierarchical key management method, such as... Figure 1 As shown, the method includes the following:

[0031] Step 101: Obtain the first key server of the first terminal, wherein the first key server is located in the access network of the target-land separation network, and the first key server includes at least three levels of keys.

[0032] It should be noted that the hierarchical key management method in the embodiments of the present invention may include multiple levels of keys. The embodiments of the present invention exemplify a typical three-level hierarchical key (i.e., level 0 key, level 1 key, and level 2 key), and the specific level can be determined according to the actual application scenario.

[0033] In this embodiment of the invention, in the target-land separation network, each access network needs to deploy a key server, and each key server only manages and distributes keys to the terminals of its access network.

[0034] The aforementioned identifier-locator separation network is a technology or protocol used to separate the identifier and location identifier of a node in a network architecture. It is a network architecture that separates the identifier (such as the identity part of an IP address) and the location (such as the network part of an IP address) in the network.

[0035] Namespace-location separation networks differ from the traditional internet. The traditional internet uses the Internet Protocol (IP) as the network layer identifier. IP identifiers at the network layer can effectively identify both device identity and location information, completing the tasks of path addressing and packet routing between hosts and the network. An IP address is a unified identification address format provided by the IP protocol, assigning a globally unique identifier to every host or router on the internet. The core idea of ​​namespace-location separation networks is to introduce two namespaces: a node identifier space, used to uniquely identify nodes (this can be a node's identity, location, service, or other types of identifiers); and a location space, used to represent the actual location information on the internet, which can be a network address, routing path, or other information indicating the location of resources. It guides routing to forward packets to their destination. Namespace-location separation networks offer a better solution to many challenges facing the current internet, such as routing scalability, mobility support, multihoming, and traffic engineering.

[0036] refer to Figure 2 , Figure 2 This is a schematic diagram of a target-ground separation network provided by the present invention, which includes a mapping server, multiple access networks (including multiple terminals) and a core network (including multiple access routers and a core router). The specific process includes mapping / registration / query data streams and data transmission paths.

[0037] In a target-location separation network, the network is divided into an access network and a core network, such as... Figure 2 As shown. The access network is the physical or logical network that connects terminals to the core network. User data and request information within the access network are encapsulated in a protocol stack based on a target-ground separation network architecture. Its egress router uses tunneling technology to encapsulate access network data packets with a header before transmitting them to the core network.

[0038] The core network is the central part of the network communication architecture, responsible for handling the transmission, routing, and switching of data sent by the access network to provide connectivity and data transmission services between networks.

[0039] In a geographic location-separated network, the mapping server manages user information within the network. When a user joins the network, they need to register with the mapping server, which associates and manages the user's geographic location (NID) with other attributes such as identity (UID). During communication, the user only needs to know the other party's UID to query the other party's geographic location from the mapping server.

[0040] Step 102: Based on the first key server, generate a level 0 key according to the first pseudo-random function.

[0041] In this embodiment of the invention, the level 0 key generation process of the hierarchical key system may be as follows: each key server generates an independent level 0 key SV, and uses a pseudo-random function (PRF) to generate a... Byte random number export 0-level key SV of bytes.

[0042] in, It is the length of the level 0 key, which can be a sufficiently long random value (e.g., N bytes) to ensure sufficient entropy (uncertainty) to generate a secure key. This invention does not limit this.

[0043] For example, the level 0 key is derived from a relatively long random number using a pseudo-random function. This random number is then processed by the pseudo-random function to generate a key of length [length missing]. 0-level key SV of bytes.

[0044] For example, a pseudo-random number generator (PRNG) can produce seemingly random sequences of numbers, but these numbers are actually predictable because they are generated based on an initial value (seed) and the algorithm. The random number sequences generated by this function exhibit statistical randomness.

[0045] Step 103: Based on the first key server and the level 0 key, generate a level 1 key for communication with the second key server, wherein the direction of the level 1 key is from the communication sender to the communication receiver.

[0046] In this embodiment of the invention, the Level 1 key is directional. Based on the Level 0 key, each key server generates keys for interaction with other key servers. Byte Level 1 Key .

[0047] in, This refers to the length of the Level 1 key, which can be a sufficiently long random value (e.g., N bytes) to ensure sufficient entropy (uncertainty) to generate a secure key. This invention does not impose any limitations on this. Level 1 key The direction is from the local access network to the target access network.

[0048] Step 104: When the first terminal communicates with the second terminal, the first terminal calls the first key server in the local access network to make a key request and obtain a level 2 key. The level 2 key is derived from the level 1 key and is used for communication from the first terminal to the second terminal.

[0049] In this embodiment of the invention, the hierarchical key system deploys a key server in each access network. When a terminal communicates with a remote device (another access network), it can quickly obtain a symmetric key from the key server of the local access network, and the remote device can also quickly obtain the same symmetric key from the key server of its local access network.

[0050] refer to Figure 3 , Figure 3 This is a schematic diagram of a multi-level hierarchical key structure provided by the present invention, which includes a level 0 key, a level 1 key, and a level 2 key.

[0051] This scheme's hierarchical key establishment framework uses a multi-level hierarchical key structure. Taking a three-level architecture as an example, the details are as follows: Figure 3 As shown.

[0052] Among them, SV is a level 0 key, which is generated and managed independently by each key server.

[0053] and A Level 1 key is derived from a Level 0 key. Generally, Level 1 keys are not used for encryption or decryption operations. Level 1 keys are directional. This indicates that the data flow is from access network A to access network B. Generated by the key server of access network A. The key server must simultaneously possess symmetric keys in opposite directions. and Therefore, the key server needs to interact with the peer server to obtain the first-level key it generates.

[0054] and They are each made by a first-level key. and The generated secondary key is used for encryption and decryption operations during communication.

[0055] This invention proposes a hierarchical key management method for mark-to-domain (TTL) separation networks. Based on a hierarchical key establishment architecture, this method adapts to the identifier management regulations in TTL separation networks and enables rapid negotiation and distribution of symmetric keys across domains and within the same domain for terminals. Leveraging the high efficiency of the hierarchical key server, it provides fast and secure key management services for terminals in different networks within a TTL separation network.

[0056] Through the steps described in this embodiment of the invention, a first key server for the first terminal is obtained. The first key server is located in the access network of a target-location separation network and includes at least three levels of keys. A level 0 key is generated based on the first key server using a first pseudo-random function. A level 1 key for communication with a second key server is generated based on the level 0 key, with the direction of the level 1 key from the sender to the receiver. When the first terminal communicates with the second terminal, the first terminal requests a key from the first key server in its local access network to obtain a level 2 key, which is derived from the level 1 key and used for communication from the first terminal to the second terminal. Therefore, based on the high efficiency of the hierarchical key server, the communication terminal can generate corresponding multi-level keys in real time based on the key servers of both communicating parties, and can provide fast and secure key management services for terminals in different networks within a target-location separation network. This solves the technical problem in related technologies where key management methods suffer from high storage pressure and low management efficiency.

[0057] According to the hierarchical key management method provided by the present invention, a first key server generates a level 1 key for communication with a second key server based on a level 0 key, comprising:

[0058] Based on the second pseudo-random function, a level 1 key is generated using the level 0 key, the first identifier of the first key server, the second identifier of the second key server, and a random value. The level 1 key is used for communication from the first key server to the second key server.

[0059] In this embodiment of the invention, the formula for generating the Level 1 key can refer to the following formula (1).

[0060] (1)

[0061] in, This represents the Level 1 key from access network A to access network B. This represents a pseudo-random function (i.e., the second pseudo-random function). It is a level 0 key; The source address (i.e., the first identifier of the first key server) can be an IP address, port number, or other identifier used in network protocols to identify the sender; The destination address (i.e., the second identifier of the second key server) can also be an IP address, port number, or other identifier used to indicate the destination address to which the data packet should be sent. Represent a A random number (i.e., a random value) in bytes.

[0062] According to a hierarchical key management method provided by the present invention, the first identifier is the identity identifier of the first key server, and the second identifier is the identity identifier of the second key server; or, the first identifier is the router management port address of the local access network where the first key server is located, and the second identifier is the router management port address of the local access network where the second key server is located.

[0063] In this embodiment of the invention, the first identifier of the first key server and the second identifier of the second key server can be the UID of the first key server and the UID of the second key server, respectively; or they can be the management port IP of the router accessing the first key server's network and the management port IP of the router accessing the second key server's network.

[0064] For example, referring to formula (1) above, A and B can be the UIDs of the key servers of access network A and B, respectively, or the management port IPs of the routers of access network A and B. A UID is an abstract node identifier. In a target-location separation network, a UID can contain multi-dimensional information about a communication entity, including identity, service, and device information. From a service perspective, the UID of the key server represents the key service of this network and is abstractly bound to the access network.

[0065] According to the hierarchical key management method provided by the present invention, after the first key server generates a level 1 key for communication with the second key server based on the level 0 key, the method further includes:

[0066] The first key server sends a reverse level 1 key acquisition request to other key servers to obtain the reverse level 1 key sent by the other key servers for communication with the first key server. The level 1 key and the reverse level 1 key are symmetric keys.

[0067] In this embodiment of the invention, the Level 1 key is directional. Based on the Level 0 key, each key server generates keys for interaction with other key servers. Byte Level 1 Key At the same time, the key server requests a Level 1 key from all other key servers in the access network. In this way, each key server will have two Level 1 keys with opposite directions with any other key server. and (Assume the two key servers are A and B).

[0068] Among them, Level 1 key and For symmetric keys with opposite directions, Level 1 key The direction is from the local access network to the target access network, Level 1 key. The direction is from the target access network to the local access network.

[0069] According to a hierarchical key management method provided by the present invention, a first terminal requests a key based on a first key server in a local access network to obtain a level 2 key, including:

[0070] Determine the first identity identifier of the first key server and the second identity identifier of the second key server of the second terminal;

[0071] Based on the third pseudo-random function, the second-level key is derived from the first-level key, the first identity identifier, and the second identity identifier.

[0072] In this embodiment of the invention, the Level 2 key inherits the directionality of the Level 1 key. When terminal HA needs to communicate with terminal HB, HA needs to request a Level 2 key from the key server of the local access network, with the request content being {src, dst}. After receiving the Level 2 key request, the key server finds the UID of the key server to which HA and HB belong from the mapping server, and then queries the key database for the Level 1 key from A to B. Afterwards, the key server uses the Level 1 key to derive a key of length [missing information]. The second-level key can be found in the following formula (2).

[0073] = (2)

[0074] in, This represents the Level 2 key from access network A to access network B. This represents a pseudo-random function (i.e., the third pseudo-random function). This indicates that the Level 1 keys from A to B were found in the keystore. Indicates the source address. Indicates the destination address.

[0075] Specifically, src is the UID of device A and dst is the UID of device B. In the secondary key, the UID has the function of uniquely identifying the device, which is equivalent to an identity token. In a target-location separation network, it naturally has the effect of preventing counterfeiting.

[0076] refer to Figure 4 , Figure 4 This is a schematic diagram of key deployment in a target-to-land separation network provided by the present invention, which includes a target-to-land separation network core network (including multiple routes) and multiple target-to-land separation network access networks ( Figure 4 Only three examples are shown in the diagram, and each target separates the network access network, including multiple terminals, a key server, and a router.

[0077] Through the embodiments of this invention, in the context of a target-location separation network, the key server can be migrated to any network while maintaining normal service operation. Because the server is accessed via a UID, which is a fixed and unique value, and the mapping relationship between the server's UID and its location identifier NID (Network Connection Identifier) ​​is managed by a mapping server, when the key server's location changes, it only needs to register a new NID (similar to the function of an IP address) in the migrated access network and rebind the mapping relationship between the UID and NID. Thus, users accessing the key server will not perceive that the server's location has changed. Therefore, the flexibility of the target-location separation network enables efficient responses to network attacks and failures.

[0078] According to the hierarchical key management method provided by the present invention, after the first terminal requests a key based on the first key server in the local access network and obtains the level 2 key, the method further includes:

[0079] Based on the first key server, the level 0 key is updated according to a preset first time interval, wherein the update process of the level 0 key is decoupled from that of the level 1 key;

[0080] Based on the first key server, the Level 1 key is updated according to a preset second time interval within a first reserved update time, wherein the first reserved update time is much shorter than the second time interval;

[0081] Based on the first key server, the level 2 key is updated according to the preset second time interval and the second reserved update time, wherein the expiration time of the level 1 key and the level 2 key is the same.

[0082] In this embodiment of the invention, taking a three-level hierarchical key architecture as an example, in terms of derivation, the level 0 key is the root key, the derivation of the level 1 key depends on the level 0 key, and the derivation of the level 2 key depends on the level 1 key.

[0083] It's important to note that key updates must be performed periodically to ensure the security of both the keys and communication. However, if every time the level 0 key is updated, the level 1 and level 2 keys are also updated sequentially from top to bottom, this will not only create a period of update peaks within the network but also disrupt communications that are currently being encrypted using the level 2 key.

[0084] For example, in the following scenario: Terminal A requests a Level 2 key from the key server to communicate with B within a very short period before its Level 0 key expires. When a data packet sent from A to B is transmitted in the core network, the Level 0 key is updated, triggering updates to the Level 1 and Level 2 keys as well. When the data packet arrives at B, B uses the updated Level 2 key. Decrypting the data packet will inevitably result in errors.

[0085] refer to Figure 5 , Figure 5 This is a schematic diagram of the multi-level key update mechanism provided by the present invention, which includes a level 0 key, a level 1 key, and a level 2 key. To solve the above problems, the multi-level key update mechanism proposed in this solution is as follows: Figure 5 As shown.

[0086] In this embodiment of the invention, the level 0 key serves as the root key, generated and managed by each key server and not circulated, thus offering high security. The update interval is set to... (i.e., the first time interval). However, an update to the level 0 key will not trigger an update to the level 1 key, thus achieving derivation dependency and update decoupling.

[0087] Level 1 keys are exchanged and synchronized between various key servers, with the update interval set to... (i.e., the second time interval), update management is handled by each key server itself. Level 1 key updates do not depend on Level 0 keys; that is, when a Level 0 key is updated, the Level 1 key does not need to be updated accordingly, thus reducing the scheduling of Level 1-2 key updates and significantly lowering complexity. Furthermore, Level 1 keys are pre-updated... The update is performed within the first reserved update time. This is because during the update, there may be peak communication periods, which could cause server resources to be heavily consumed and delay the key update. Therefore, it is necessary to reserve time for this. (in much smaller ).

[0088] Level 2 key expiration time The expiration time is consistent with that of the Level 1 key from which it is derived, i.e. = The management of Level 2 key updates is the responsibility of the terminal itself. After the update time, the terminal actively requests a new Level 2 key from the key server. The Level 2 key expires before [0- Updates are performed within a time interval of [0-] minutes (i.e., the second reserved update time), and the update offset is adjusted based on the source and destination identifier values, so that the update events of each Level 2 key are distributed across the [0-] minute interval before expiration. Within a 1-minute interval, update peaks can be avoided as much as possible.

[0089] Furthermore, to avoid the situation where the Level 2 key is updated during transmission of data packets encrypted with Level 2 keys in the core network (key synchronization delay failure), a dual-key mechanism is proposed: the terminal receives the updated Level 2 key... Afterwards, do not actively delete the old level 2 key. ,at this time There is still some time before it expires, during which time the terminal has two level 2 keys. and After this, terminal communication uses... Encryption and decryption are performed in Delete after it expires Instead use .

[0090] This invention designs an effective key update method for hierarchical key systems. This method, combined with the characteristics of the hierarchical key establishment architecture, can handle key update scenarios under extreme conditions such as update peaks and key synchronization delays. The method combines pre-update and dual-key schemes. On the one hand, it can minimize key update peaks in the network, thus reducing the performance burden on the key server; on the other hand, it can make key updates smoother, minimizing disruption to ongoing communication.

[0091] The following explains the application of the hierarchical key management method described above in a specific target-location separation network.

[0092] In this embodiment of the invention, the access network of the target-ground separation network uses custom data packets for data transmission during communication. After entering the core network, the data packets of the access network are encapsulated into IPv6 packets for forwarding.

[0093] The aforementioned target-and-ground separation network uses CID (Communication Identifier) ​​to uniquely identify devices. CID includes five types of entity identifiers: address, user, device, service, and data. The address identifier is the device's IP address. In this example, CID and AID (Address Identifier) ​​are respectively the UID and NID mentioned above in this invention.

[0094] This target-location mapping system stores the mapping relationship between UID and the corresponding access network router management port IP. Therefore, the formula for generating the Level 1 key is... In the diagram, src and dst are the management port IPs of the access routers in access networks A and B, respectively, and random is a... Byte-based random numbers; Level 2 key generation formula = In the diagram, src and dst are the CIDs of terminals A and B, respectively.

[0095] refer to Figure 6 , Figure 6 This is a schematic diagram of the hierarchical key architecture provided by the present invention. It includes a level 0 key, a level 1 key, and a level 2 key.

[0096] SV is a level 0 key, which is generated and managed independently by each key server.

[0097] and A Level 1 key is derived from a Level 0 key. Generally, Level 1 keys are not used for encryption or decryption operations. Level 1 keys are directional. This indicates that the data flow is from access network A to access network B. Generated by the key server of access network A. The key server must simultaneously possess symmetric keys in opposite directions. and Therefore, the key server needs to interact with the peer server to obtain the first-level key it generates.

[0098] and They are each made of a Level 1 key. and The generated Level 2 key is used for encryption and decryption operations during communication.

[0099] , It is a Level 1 key The derived Level 2 protocol key is used to distribute keys for finer-grained protocol communications. Besides HTTP (Hypertext Transfer Protocol) and FTP (File Transfer Protocol), this invention can also distribute keys for standard protocols such as SMTP (Simple Mail Transfer Protocol) and DNS (Domain Name System). The Level 2 protocol key derivation formula is as follows: = Where src is the UID of device A, dst is the UID of device B, and proto is the port number of the protocol (e.g., HTTP: 80, FTP: 21, SMTP: 25, DNS: 53).

[0100] refer to Figure 7 , Figure 7 This is a schematic diagram of the hierarchical key update mechanism provided by the present invention, which includes a level 0 key, a level 1 key, a level 2 key, and a level 2 protocol key. The key update mechanism in the protocol-based hierarchical key establishment architecture of the present invention is as follows: Figure 7 As shown.

[0101] The update mechanism for level 0-2 keys is consistent with the normal level 3 key establishment architecture.

[0102] It should be noted that the update time of the Level 2 protocol key... The same as the second-level key from which it is derived, namely Meanwhile, the terminal is responsible for updating and managing the Level 2 protocol key. After the update time, the terminal actively requests a new Level 2 protocol key from the key server. The Level 2 protocol key expires before [0- Updates are performed within a 1-minute interval, with the update offset adjusted based on the source and destination identifier values, thus distributing the update events of each Level 2 protocol key across the [0-] minute interval before expiration. Within a minute interval.

[0103] The hierarchical key management device provided by the present invention is described below. The hierarchical key management device described below can be referred to in correspondence with the hierarchical key management method described above.

[0104] refer to Figure 8 , Figure 8 This is a schematic diagram of the hierarchical key management device provided by the present invention, which includes an acquisition module 801, a first generation module 802, a second generation module 803, and a calling module 804.

[0105] The acquisition module 801 is used to acquire the first key server of the first terminal, wherein the first key server is located in the access network of the target-land separation network, and the first key server includes at least three levels of keys;

[0106] The first generation module 802 is used to generate a level 0 key based on the first key server and a first pseudo-random function;

[0107] The second generation module 803 is used to generate a level 1 key for communicating with the second key server based on the level 0 key from the first key server, wherein the direction of the level 1 key is from the communication sender to the communication receiver.

[0108] The module 804 is used to call the first terminal to request a key from the first key server in the local access network when the first terminal communicates with the second terminal, so as to obtain a level 2 key. The level 2 key is derived from the level 1 key and is used for communication from the first terminal to the second terminal.

[0109] Specifically, the hierarchical key management device provided by the present invention can implement all the method steps implemented in the above-described hierarchical key management method embodiments and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0110] Figure 9 This is a schematic diagram of the physical structure of the electronic device provided by the present invention, such as... Figure 9As shown, the electronic device may include: a processor 910, a communications interface 920, a memory 930, and a communication bus 940, wherein the processor 910, the communications interface 920, and the memory 930 communicate with each other through the communication bus 940. The processor 910 can call logical instructions in the memory 930 to execute a hierarchical key management method, which includes: obtaining a first key server for the first terminal, wherein the first key server is located in the access network of a target-location separation network, and the first key server includes at least three levels of keys; generating a level 0 key based on the first key server according to a first pseudo-random function; generating a level 1 key for communication with a second key server based on the level 0 key, wherein the direction of the level 1 key is from the communication sender to the communication receiver; when the first terminal communicates with the second terminal, calling the first terminal to request a key based on the first key server in the local access network to obtain a level 2 key, wherein the level 2 key is derived from the level 1 key, and the level 2 key is used for communication from the first terminal to the second terminal.

[0111] Furthermore, the logical instructions in the aforementioned memory 930 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0112] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the hierarchical key management method provided by the above methods. The method includes: obtaining a first key server for a first terminal, wherein the first key server is located in an access network in a target-location separation network, and the first key server includes at least three levels of keys; generating a level 0 key based on the first key server according to a first pseudo-random function; generating a level 1 key for communication with a second key server based on the level 0 key, wherein the direction of the level 1 key is from the communication sender to the communication receiver; when the first terminal communicates with the second terminal, calling the first terminal to request a key based on the first key server in the local access network to obtain a level 2 key, wherein the level 2 key is derived from the level 1 key, and the level 2 key is used for communication from the first terminal to the second terminal.

[0113] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the hierarchical key management method provided by the above methods. The method includes: obtaining a first key server for a first terminal, wherein the first key server is located in an access network within a target-location separation network, and the first key server includes at least three levels of keys; generating a level 0 key based on the first key server according to a first pseudo-random function; generating a level 1 key for communication with a second key server based on the level 0 key, wherein the direction of the level 1 key is from the communication sender to the communication receiver; and when the first terminal communicates with the second terminal, invoking the first terminal to request a key from the first key server in the local access network to obtain a level 2 key, wherein the level 2 key is derived from the level 1 key and is used for communication from the first terminal to the second terminal.

[0114] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A hierarchical key management method, characterized in that, include: Obtain the first key server of the first terminal, wherein the first key server is located in the access network of the target-land separation network, and the first key server includes at least three levels of keys; Based on the first key server generating a level 0 key according to the first pseudo-random function; Based on the first key server and the level 0 key, a level 1 key is generated for communication with the second key server, wherein the direction of the level 1 key is from the communication sender to the communication receiver; When the first terminal communicates with the second terminal, the first terminal requests a key based on the first key server in the local access network to obtain a level 2 key. The level 2 key is derived from the level 1 key and is used for communication from the first terminal to the second terminal. After the first terminal requests a key based on the first key server in the local access network and obtains the Level 2 key, the method further includes: Based on the first key server, the level 0 key is updated at a preset first time interval, wherein the update process of the level 0 key is decoupled from that of the level 1 key; Based on the first key server, the Level 1 key is updated according to a preset second time interval within a first reserved update time, wherein the first reserved update time is much shorter than the second time interval; Based on the first key server, the level 2 key is updated within a second reserved update time according to the preset second time interval, wherein the level 1 key and the level 2 key have the same expiration time.

2. The hierarchical key management method according to claim 1, characterized in that, The step of generating a Level 1 key for communication with the second key server based on the Level 0 key by the first key server includes: Based on the second pseudo-random function, a level 1 key is generated based on the level 0 key, the first identifier of the first key server, the second identifier of the second key server, and a random value. The level 1 key is used for communication from the first key server to the second key server.

3. The hierarchical key management method according to claim 2, characterized in that, The first identifier is the identity identifier of the first key server, and the second identifier is the identity identifier of the second key server; or, the first identifier is the router management port address of the local access network where the first key server is located, and the second identifier is the router management port address of the local access network where the second key server is located.

4. The hierarchical key management method according to claim 1, characterized in that, After the first key server generates a level 1 key for communicating with the second key server based on the level 0 key, the method further includes: The first key server is invoked to send a reverse level 1 key acquisition request to other key servers to obtain the reverse level 1 key sent by the other key servers for communication with the first key server, wherein the level 1 key and the reverse level 1 key are symmetric keys.

5. The hierarchical key management method according to claim 1, characterized in that, The step of invoking the first terminal to request a key based on the first key server in the local access network and obtain a level 2 key includes: Determine the first identity identifier of the first key server and the second identity identifier of the second key server of the second terminal; Based on the third pseudo-random function, a second-level key is derived from the first-level key, the first identity identifier, and the second identity identifier.

6. A hierarchical key management device, characterized in that, include: The acquisition module is used to acquire the first key server of the first terminal, wherein the first key server is located in the access network of the target-land separation network, and the first key server includes at least three levels of keys; The first generation module is used to generate a level 0 key based on the first key server according to a first pseudo-random function; The second generation module is used to generate a level 1 key for communicating with the second key server based on the level 0 key from the first key server, wherein the direction of the level 1 key is from the communication sender to the communication receiver. The calling module is used to call the first terminal to make a key request based on the first key server in the local access network when the first terminal communicates with the second terminal, and obtain a level 2 key. The level 2 key is derived from the level 1 key and is used for communication from the first terminal to the second terminal. After the first terminal requests a key based on the first key server in the local access network and obtains a Level 2 key, the device is further configured to: Based on the first key server, the level 0 key is updated at a preset first time interval, wherein the update process of the level 0 key is decoupled from that of the level 1 key; Based on the first key server, the Level 1 key is updated according to a preset second time interval within a first reserved update time, wherein the first reserved update time is much shorter than the second time interval; Based on the first key server, the level 2 key is updated within a second reserved update time according to the preset second time interval, wherein the level 1 key and the level 2 key have the same expiration time.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the hierarchical key management method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the hierarchical key management method as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the hierarchical key management method as described in any one of claims 1 to 5.

Images