A key distribution method in wireless terminal self-organizing network mode

Abstract

The present invention relates to the field of wireless communication and network security technology, and in particular to a key distribution method in a wireless terminal self-organizing network mode, comprising: S1, when a first terminal receives a first instruction message, the first terminal generates a public key information package and uses a first key in a key table to encrypt the public key information package to obtain a ciphertext, and puts the ciphertext and a key ID corresponding to the first key into a message payload to form a first message for broadcasting in the self-organizing network; the first terminal is any terminal in the self-organizing network; the key table is respectively stored in each terminal in the self-organizing network, the key table includes multiple keys and key IDs corresponding to the keys one by one; the first key is any key in the key table; S2, the terminal corresponding to the first instruction message in the self-organizing network receives the first message, and uses the first key corresponding to the key ID recorded in the first message in the key table to decrypt the ciphertext in the first message to obtain the public key information package of the first terminal.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless communication and network security, and in particular to a key distribution method in a wireless terminal ad hoc network mode. Background Art

[0002] An ad hoc network is a network that does not require infrastructure and consists of multiple mobile terminals that can communicate directly through a wireless local area network without forwarding through a central node. The principle of an ad hoc network is based on a distributed network structure, in which each node has the ability to route and forward data, and the communication between nodes is peer-to-peer, with no fixed central node. Ad hoc networks have many advantages, such as high flexibility, easy deployment, and low cost, so they have been widely used in many application scenarios. For example, ad hoc networks play an important role in disaster relief, intelligent transportation and other fields.

[0003] With the widespread application of ad hoc networks, how to protect data security in ad hoc networks and prevent attacks and intrusions from malicious nodes has become an increasingly important research topic. In order to ensure data transmission efficiency, symmetric encryption algorithms are currently usually used to encrypt transmitted data. Before data transmission, the session key for data encryption needs to be shared between both parties. Currently, asymmetric encryption is more popular to securely transmit session keys. However, the use of asymmetric encryption to negotiate session keys is prone to man-in-the-middle attacks. In order to avoid man-in-the-middle attacks, it is usually necessary to rely on a certificate authority (CA) for identity authentication. The use of asymmetric encryption to exchange session keys requires the introduction of CA for identity authentication, and communication with CA needs to go through an external network, which not only brings additional security risks to the internal network, but also the certificate cannot be updated in real time. If the interval is too long, the risk of being cracked will increase. For ad hoc network terminals, there is no central node and the certificate authority cannot be introduced, so the security of asymmetric encryption public key distribution cannot be guaranteed. Summary of the invention

[0004] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a key distribution method in a wireless terminal ad hoc network mode.

[0005] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0006] An embodiment of the present invention provides a key distribution method in a wireless terminal ad hoc network mode, comprising:

[0007] S1. When the first terminal receives the first instruction information, the first terminal generates a public key information package and encrypts the public key information package using the first key in the key table to obtain a corresponding ciphertext, and further puts the ciphertext and the key ID corresponding to the first key into a message payload to form a first message for broadcasting in the ad hoc network;

[0008] The first terminal is any terminal in the ad hoc network;

[0009] The key table is stored in each terminal in the ad hoc network, and the key table includes multiple keys and key IDs corresponding to the keys one by one;

[0010] The first key is any key in the key table;

[0011] S2. The terminal corresponding to the first instruction information in the self-organizing network receives the first message, and uses the first key corresponding to the key ID recorded in the first message in the stored key table to decrypt the ciphertext in the first message to obtain the public key information package of the first terminal.

[0012] Preferably, in S1, the first terminal generates a public key information package, which specifically includes:

[0013] The first terminal generates a public key and a private key of the first terminal using a first preset algorithm;

[0014] The first terminal packages the public key with the pre-acquired IP address and identifier of the first terminal to obtain a public key information package corresponding to the first terminal.

[0015] Preferably, the first instruction information is any one of a notification information instruction, a configuration information instruction, a first query information instruction, a second query information instruction, and an update public key instruction;

[0016] The notification information instruction is an instruction for notifying the public key of the first terminal in the ad hoc network;

[0017] The configuration information instruction is information that enables the first terminal to form a network with a first terminal set; the first terminal set is other terminals in the self-organizing network except the first terminal;

[0018] The first query information instruction is a second message sent by a second terminal in the ad hoc network; the second terminal is any terminal other than the first terminal in the ad hoc network; the second message carries an identifier of the first terminal and the first information; the first information is information indicating that a public key of the first terminal needs to be obtained;

[0019] The second query information instruction is a third message sent by a second terminal in the ad hoc network; the third message carries the second information; the second information is information indicating that a public key of the terminal receiving the third message needs to be obtained;

[0020] The instruction to update the public key is an instruction to update the public key of the first terminal in the ad hoc network.

[0021] Preferably, if the first instruction information is any one of a notification information instruction, a configuration information instruction, a second query information instruction, and an update public key instruction, then the terminals in the ad hoc network corresponding to the first instruction information are all terminals in the ad hoc network except the first terminal;

[0022] If the first instruction information is a first query information instruction, the terminal corresponding to the first instruction information in the ad hoc network is the second terminal corresponding to the first query information instruction in the ad hoc network.

[0023] Preferably, the method further comprises:

[0024] S3. If the first instruction information is any one of a notification information instruction, a configuration information instruction, a first query information instruction, and a second query information instruction, each terminal corresponding to the first instruction information in the ad hoc network stores the obtained public key information package of the first terminal in a local contact list.

[0025] Preferably, the method further comprises:

[0026] S4. If the first instruction information is an instruction to update the public key, each terminal corresponding to the first instruction information in the ad hoc network will respectively compare the public key information package of the first terminal with the public key information package of the first terminal pre-stored in the stored contact list to obtain a comparison result;

[0027] If the comparison result is that the IP address in the obtained public key information package of the first terminal is the same as the IP address in the pre-stored public key information package of the first terminal, the pre-stored public key information package of the first terminal in the contact list is deleted and the obtained public key information package of the first terminal is stored in the contact list;

[0028] If the comparison result is that the obtained IP address in the public key information package of the first terminal is the same as the IP address in the public key information package of any other terminal stored in advance, a fourth message is returned to the first terminal;

[0029] The fourth message carries third information, and the third information is information indicating that a conflict occurs in the IP addresses of the terminals in the ad hoc network.

[0030] Preferably, the method further comprises:

[0031] S5. When the first terminal receives an instruction to conduct a session with a target terminal specified in the ad hoc network, the first terminal and the target terminal conduct an encrypted session based on the same first session key;

[0032] Wherein, the first session key is generated by the first terminal through a second preset algorithm;

[0033] Each of the target terminals obtains the first session key generated by the first terminal in a preset manner.

[0034] Preferably, the target terminal obtains the first session key generated by the first terminal in a preset manner, specifically including:

[0035] The target terminal uses the private key generated by the first preset algorithm to decrypt the encryption result k'' to obtain the signature result k';

[0036] The target terminal determines the public key of the first terminal in the contact list stored in the target terminal, and uses the public key of the first terminal to decrypt the signature result k' to obtain a first session key;

[0037] The encryption result k'' is obtained by the first terminal encrypting the signature result k' using the public key of the target terminal in the contact list storing the first terminal;

[0038] The signature result k' is obtained by the first terminal signing the first session key k with the private key.

[0039] Preferably, the first preset algorithm is the SM2 elliptic curve public key cryptography algorithm.

[0040] Preferably, the second preset algorithm is an SM4 block cipher algorithm.

[0041] The beneficial effects of the present invention are as follows: the key distribution method of the present invention in the wireless terminal ad hoc network mode does not rely on the CA outside the ad hoc network for identity authentication, but uses the key table independently stored by each terminal in the ad hoc network. This reduces the dependence on the external network and reduces the security risks introduced by external communications.

[0042] The invention provides a key distribution method in a wireless terminal ad hoc network mode, in which the terminal can dynamically generate and use keys without waiting for the CA certificate to be updated, which means that the keys can be updated more frequently, reducing the risk of the keys being cracked.

[0043] The key distribution method in the wireless terminal ad hoc network mode of the present invention uses the key corresponding to the key ID for encryption and decryption, and the terminals can directly exchange keys without the need for additional identity authentication steps. This makes the key distribution process more efficient and reduces communication delays.

[0044] The present invention provides a key distribution method in a wireless terminal ad hoc network mode. In a dynamically changing ad hoc network environment, terminals can join or leave the network at any time, and each terminal can independently process keys, so that the entire network can flexibly adapt to different security requirements.

[0045] The key distribution method in the wireless terminal ad hoc network mode of the present invention allows any terminal to independently generate and broadcast a public key information package in the ad hoc network, thereby enhancing the flexibility and adaptability of the network. The terminals can efficiently exchange keys without central control, thereby improving the reliability and robustness of the ad hoc network. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flow chart of a key distribution method in a wireless terminal ad hoc network mode of the present invention;

[0047] Figure 2 This is a flow chart of a key distribution method in a wireless terminal ad hoc network mode according to an embodiment of the present invention;

[0048] Figure 3 The present invention is a flowchart of another method for distributing keys in a wireless terminal ad hoc network mode according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation modes in conjunction with the accompanying drawings.

[0050] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0051] See also Figure 1 This embodiment provides a key distribution method in a wireless terminal ad hoc network mode, including:

[0052] S1. When the first terminal receives the first instruction information, the first terminal generates a public key information package and encrypts the public key information package using the first key in the key table to obtain a corresponding ciphertext, and further puts the ciphertext and the key ID corresponding to the first key into a message payload to form a first message for broadcasting in the ad hoc network;

[0053] The first terminal is any terminal in the ad hoc network;

[0054] The key table is stored in each terminal in the ad hoc network, and the key table includes multiple keys and key IDs corresponding to the keys one by one;

[0055] The first key is any key in the key table;

[0056] In this embodiment, the first terminal generates a public key information package and encrypts it. By putting the ciphertext and key ID into the message for broadcasting, the security of key exchange and public key distribution in the wireless terminal ad hoc network is ensured. Because each terminal stores a key table, the key in the table and the corresponding key ID are used to encrypt and decrypt the message. This method provides a seamless key management mechanism, making the communication encryption between terminals in a distributed network environment more secure and efficient. Compared with the existing distributed network solution, this method reduces the complexity of key exchange in communication through the broadcast mechanism in the ad hoc network, and at the same time ensures the transmission security of the public key through the encryption mechanism, enhancing the network's anti-attack capability, especially preventing man-in-the-middle attacks.

[0057] For example, assume a wireless ad hoc network consisting of three devices (A, B, C). When terminal A (the first terminal) receives the first instruction information (such as a notification information instruction), A will perform the following steps:

[0058] Generate public key information package: A generates its own public and private key pair through a preset algorithm. For example, A generates a public key "PK_A" and a private key "SK_A".

[0059] Packaging public key information: A packages its own public key "PK_A" with the pre-acquired IP address "192.168.0.1" and the terminal identifier "Device_A" to form a public key information package "PK_A_Bundle". This information package ensures that other devices in the network can identify A through this information and confirm A's public key.

[0060] Encrypting the public key information bundle: A selects a key from the key table (for example, the first key "K1" in the key table), and uses the key to encrypt "PK_A_Bundle" to obtain the encryption result "Enc(PK_A_Bundle)".

[0061] Form a message and broadcast: A puts the encrypted public key information package "Enc(PK_A_Bundle)" and the corresponding key ID (the ID identifying the key K1, such as "ID_K1") into the message payload to form the first message "Message1", and broadcasts the message in the ad hoc network.

[0062] This process ensures that A's public key information is encrypted before being received by other terminals, preventing unauthorized parties from stealing the public key information.

[0063] S2. The terminal corresponding to the first instruction information in the self-organizing network receives the first message, and uses the first key corresponding to the key ID recorded in the first message in the stored key table to decrypt the ciphertext in the first message to obtain the public key information package of the first terminal.

[0064] For example, when B and C (other terminals in the ad hoc network) receive the first message "Message 1" broadcast by A, they will perform the following steps:

[0065] Identify the key ID: B and C extract the key ID "ID_K1" from the message and find the corresponding key from their own key table.

[0066] Decrypting ciphertext: B and C use the key to decrypt the ciphertext "Enc(PK_A_Bundle)" in the message and obtain A's public key information package "PK_A_Bundle".

[0067] Parsing the public key information package: B and C parse "PK_A_Bundle", obtain A's public key "PK_A", IP address "192.168.0.1" and identifier "Device_A", and store A's public key in their respective contact lists for subsequent communication.

[0068] Through this mechanism, B and C can securely obtain and store A's public key, and subsequent communications can be encrypted and authenticated based on this public key to ensure the security of communication.

[0069] Through the above steps, the public key information in this embodiment is encrypted during the transmission process, which avoids unauthorized interception and improves the security of the network, especially resisting man-in-the-middle attacks. Each terminal has a key table, and the key required for encryption and decryption is quickly identified through the key ID, which simplifies the key management process. When a terminal updates the key or public key, other terminals in the ad hoc network can be updated in time to ensure that each node in the network can maintain a consistent key state, thereby improving the robustness and anti-attack capability of the network.

[0070] In the actual application of this embodiment, in S1, the first terminal generates a public key information package, which specifically includes:

[0071] The first terminal generates a public key and a private key of the first terminal using a first preset algorithm;

[0072] The first terminal packages the public key with the pre-acquired IP address and identifier of the first terminal to obtain a public key information package corresponding to the first terminal.

[0073] The first terminal generates its own public and private key pair and packages the public key with the IP address and terminal identifier, which ensures that each terminal has a unique identifier and the mapping relationship between the public key and the terminal is guaranteed through the packaging mechanism. This mechanism facilitates the subsequent secure communication and authentication process. This packaging method ensures the uniqueness and traceability of the public key, thereby improving the reliability of identity authentication and reducing potential risks in the key distribution process.

[0074] Specifically, the first instruction information is any one of a notification information instruction, a configuration information instruction, a first query information instruction, a second query information instruction, and an update public key instruction;

[0075] The notification information instruction is an instruction for notifying the public key of the first terminal in the ad hoc network;

[0076] The configuration information instruction is information that enables the first terminal to form a network with a first terminal set; the first terminal set is other terminals in the self-organizing network except the first terminal;

[0077] The first query information instruction is a second message sent by a second terminal in the ad hoc network; the second terminal is any terminal other than the first terminal in the ad hoc network; the second message carries an identifier of the first terminal and the first information; the first information is information indicating that a public key of the first terminal needs to be obtained;

[0078] The second query information instruction is a third message sent by a second terminal in the ad hoc network; the third message carries the second information; the second information is information indicating that a public key of the terminal receiving the third message needs to be obtained;

[0079] The instruction to update the public key is an instruction to update the public key of the first terminal in the ad hoc network.

[0080] In this embodiment, if the first instruction information is any one of a notification information instruction, a configuration information instruction, a second query information instruction, and an update public key instruction, then the terminals in the ad hoc network corresponding to the first instruction information are all terminals in the ad hoc network except the first terminal;

[0081] If the first instruction information is a first query information instruction, the terminal corresponding to the first instruction information in the ad hoc network is the second terminal corresponding to the first query information instruction in the ad hoc network.

[0082] See also Figure 2 Specifically, the method further includes:

[0083] S3. If the first instruction information is any one of a notification information instruction, a configuration information instruction, a first query information instruction, and a second query information instruction, each terminal corresponding to the first instruction information in the ad hoc network stores the obtained public key information package of the first terminal in a local contact list.

[0084] In this embodiment, by storing the public key information package in the contact list of each terminal, it is ensured that the terminal can quickly find the public key information of other terminals, reduce the delay in subsequent communication and improve the security of data transmission. In the prior art, the public key search process between terminals depends on a third party or a central server, which is inefficient and has security risks. In this embodiment, by implementing distributed public key storage in the ad hoc network, the dependence on external servers is reduced, and the independence and security of the ad hoc network are improved.

[0085] For details, see Figure 3 , the method further comprises:

[0086] S4. If the first instruction information is an instruction to update the public key, each terminal corresponding to the first instruction information in the ad hoc network will respectively compare the public key information package of the first terminal with the public key information package of the first terminal pre-stored in the stored contact list to obtain a comparison result;

[0087] If the comparison result is that the IP address in the obtained public key information package of the first terminal is the same as the IP address in the pre-stored public key information package of the first terminal, the pre-stored public key information package of the first terminal in the contact list is deleted and the obtained public key information package of the first terminal is stored in the contact list;

[0088] If the comparison result is that the obtained IP address in the public key information package of the first terminal is the same as the IP address in the public key information package of any other terminal stored in advance, a fourth message is returned to the first terminal;

[0089] The fourth message carries third information, and the third information is information indicating that a conflict occurs in the IP addresses of the terminals in the ad hoc network.

[0090] In this embodiment, when the public key is updated, the terminal automatically compares the IP address and finds conflicts, and promptly feeds back to the relevant terminal, which helps to prevent communication barriers caused by IP address conflicts and ensures that the public key information of each terminal matches the actual network address. In the prior art, IP address conflict detection relies on manual configuration or centralized management, which is inefficient and prone to errors. In this embodiment, through the automatic comparison mechanism, conflicts can be discovered and resolved faster and more accurately, improving the automation and reliability of the system.

[0091] For example, assume a wireless ad hoc network consisting of four devices (A, B, C, D), device A is the terminal that initiates the public key update, and B, C, and D are the terminals that receive the public key update instruction. The public keys and IP address information of these devices have been pre-stored in their contact lists.

[0092] Step S4 is described in detail as follows:

[0093] Device A (the first terminal) decides to update its public key, so it generates a new public key information package PK_A_NEW_Bundle, which contains the public key of device A (PK_A_NEW), A's IP address (192.168.0.1) and the identifier of device A (Device_A). Subsequently, A broadcasts this public key information package to other terminals in the ad hoc network, namely B, C and D.

[0094] When B, C, and D receive A's public key update instruction, they perform the following operations respectively:

[0095] Device B: B finds the previously stored public key information package PK_A_OLD_Bundle of A from its contact list, and compares it with the new PK_A_NEW_Bundle, especially comparing the IP addresses in the two public key information packages. B finds that the IP address "192.168.0.1" in the old package is the same as the IP address "192.168.0.1" in the new package. Therefore, B deletes the old PK_A_OLD_Bundle in the contact list and stores the new PK_A_NEW_Bundle, completing the public key update.

[0096] Device C: Similarly, C also finds the old PK_A_OLD_Bundle in its contact list and compares it. C finds that the IP address is also the same, so C deletes the old bundle and stores the new bundle, successfully updating A's public key.

[0097] Device D: D encountered a special situation during the comparison process. D found that the IP address "192.168.0.1" in A's new public key information package was the same as the IP address in the public key information package of another terminal in its contact list (for example, the public key information package of device C). In other words, the IP address of A's new public key information package conflicted with the IP address in C's public key information package.

[0098] Since device D finds that the IP addresses of A and C conflict, D cannot directly store A's new public key information package. At this time, D will send a fourth message to A, which contains conflict prompt information Conflict_Info, informing A that its IP address "192.168.0.1" has conflicted with the IP address of another device C in the network. The payload of this fourth message contains the third information of device D, which indicates an "IP address conflict". After A receives the fourth message sent by D, it will know that its IP address conflicts with C's IP address. At this time, A needs to take appropriate measures to resolve this conflict, such as:

[0099] Device A can reconfigure its IP address to a new unique address (e.g. "192.168.0.2") to avoid conflict with C's IP address. A repackages the public key information package and broadcasts the new IP address and public key information to B, C, and D, updating the public key information in the ad hoc network. Through this mechanism, A can quickly know the problem of its own IP address conflict and make adjustments through the automatic feedback mechanism to ensure the uniqueness of the IP address in the network, thereby avoiding potential communication obstacles. In this process, the automatic IP address comparison and conflict detection mechanism has the following advantages: when the terminal receives the public key update, it will automatically compare the IP address in the public key information, and automatically feedback to the relevant terminal after the conflict is found, without manual intervention, thus improving efficiency. The conflict detection mechanism ensures that the IP address conflict can be discovered in time and resolved through feedback, avoiding the complexity of manual detection and processing in traditional distributed networks. Through this mechanism, it can be ensured that each terminal in the ad hoc network has a unique public key and corresponding IP address, avoiding communication problems caused by IP address conflicts, thereby improving the security and reliability of the entire network. Compared with traditional centralized management or manual configuration, this embodiment significantly improves the stability and security of terminal communications in an ad hoc network environment through a distributed and automated public key update and conflict detection mechanism.

[0100] Preferably, the method further comprises:

[0101] S5. When the first terminal receives an instruction to conduct a session with a target terminal specified in the ad hoc network, the first terminal and the target terminal conduct an encrypted session based on the same first session key;

[0102] Wherein, the first session key is generated by the first terminal through a second preset algorithm;

[0103] Each of the target terminals obtains the first session key generated by the first terminal in a preset manner.

[0104] In this embodiment, when an encrypted session is conducted between terminals, the first session key is used for encryption to ensure the security of communication. At the same time, this encryption mechanism further enhances the confidentiality and anti-attack capability of communication through the session key generated by the second preset algorithm (such as the SM4 algorithm). Compared with traditional encrypted sessions, this embodiment improves the security and efficiency of encrypted communication by dynamically generating session keys and combining efficient encryption algorithms, especially in resource-constrained wireless ad hoc network environments.

[0105] In the actual application of this embodiment, the target terminal obtains the first session key generated by the first terminal in a preset manner, specifically including:

[0106] The target terminal uses the private key generated by the first preset algorithm to decrypt the encryption result k'' to obtain the signature result k';

[0107] The target terminal determines the public key of the first terminal in the contact list stored in the target terminal, and uses the public key of the first terminal to decrypt the signature result k' to obtain a first session key;

[0108] The encryption result k'' is obtained by the first terminal encrypting the signature result k' using the public key of the target terminal in the contact list storing the first terminal;

[0109] The signature result k' is obtained by the first terminal signing the first session key k with the private key.

[0110] This embodiment uses the private key to decrypt the signature result, and then searches the public key in the terminal's contact list for verification, ensuring the integrity and reliability of the key exchange between terminals. This process effectively prevents security issues such as public key tampering. This embodiment ensures the authenticity and security of the exchanged public keys and session keys through multi-layer encryption verification, effectively preventing forgery and man-in-the-middle attacks.

[0111] In this embodiment, the first preset algorithm is the SM2 elliptic curve public key cryptographic algorithm. The second preset algorithm is the SM4 block cipher algorithm.

[0112] It adopts the SM2 elliptic curve public key cryptography algorithm and the SM4 block cipher algorithm, fully utilizing the advantages of the national secret algorithm, and can achieve efficient encryption and decryption operations with a small computing resource overhead, adapting to the key distribution and communication requirements in the self-organizing network mode.

[0113] The following are some examples:

[0114] In a wireless ad hoc network, there are two terminal devices A and B. A is the first terminal that initiates an encrypted session, and B is the target terminal of the session. A and B have stored each other's public keys in their respective contact lists in advance, and they can communicate with each other through these public keys.

[0115] Now, A receives an instruction to conduct an encrypted session with B. Next, we describe the process of how A and B conduct an encrypted session using the first session key.

[0116] A generates a session key called k (first session key) through the second preset algorithm (such as SM4 algorithm). This key will be used to encrypt the session content between A and B. At this time, k is generated dynamically by A through the second preset algorithm, and no external participation is required, ensuring that the key is unique during the session.

[0117] In order to ensure the authenticity and integrity of the first session key k, A signs k. A uses its private key Priv_A to sign k, generating a signature result k'. This signing process ensures that B can verify whether k is generated by A in the subsequent process and whether k is tampered with during transmission. k' represents the result of A signing the session key k with Priv_A.

[0118] In order to ensure the security of the session key to B, A encrypts the signature result k' with B's public key Pub_B to obtain the encrypted result k''. Since k'' is encrypted with B's public key, only B can use his own private key to decrypt and obtain the content.

[0119] The encryption result k'' sent by A is the signature result k' encrypted with B's public key Pub_B. When B receives the encrypted data k'' sent by A, B uses its own private key Priv_B to decrypt k'' and obtain the signature result k'. In this way, B can securely obtain the signature result sent by A.

[0120] After B obtains the signature result k' through decryption, he needs to verify the validity of the signature. To do this, B finds A's public key Pub_A from his contact list, and then decrypts k' with A's public key to obtain the session key k generated by A.

[0121] Through this process, B can not only verify the authenticity of k, but also confirm that the session key is indeed generated by A and has not been tampered with during transmission.

[0122] Now that both A and B have successfully generated and shared the same session key k, they can use this session key to encrypt the conversation. For example, both can use the session key k to encrypt their conversation data using a symmetric encryption algorithm (such as SM4 or AES) to ensure the confidentiality of the communication.

[0123] During this process, the following encryption and decryption mechanisms are used to ensure session security:

[0124] Session key generation and signature: A dynamically generates a session key k and signs it to ensure that B can verify the authenticity of the key.

[0125] Public key encryption and private key decryption: A uses B's public key to encrypt the signature result k', and B uses his own private key to decrypt, ensuring the security of key transmission.

[0126] Public key verification signature: B uses A's public key to decrypt the signature, confirm the source and integrity of the session key, and prevent tampering.

[0127] Session encryption: A and B share the same session key k, and can use an efficient symmetric encryption algorithm to encrypt the session to ensure the confidentiality of the communication content.

[0128] This mechanism ensures the security, confidentiality and anti-attack of encrypted communication between devices in the ad hoc network through dynamically generated session keys and multiple encryption verification processes. In resource-constrained environments (such as wireless ad hoc networks), this session key-based encryption mechanism can also reduce computing overhead and improve communication efficiency.

[0129] In the description of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0130] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0131] In the present invention, unless otherwise clearly specified and limited, when a first feature is “on” or “below” a second feature, it may be that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. Moreover, when a first feature is “above”, “above” or “above” a second feature, it may be that the first feature is directly above or obliquely above the second feature, or it may simply mean that the first feature is higher in level than the second feature. When a first feature is “below”, “below” or “below” a second feature, it may be that the first feature is directly below or obliquely below the second feature, or it may simply mean that the first feature is lower in level than the second feature.

[0132] In the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0133] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may alter, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A key distribution method in a wireless terminal ad hoc network mode, characterized in that: include: S1. When the first terminal receives the first instruction information, the first terminal generates a public key information package and encrypts the public key information package using the first key in the key table to obtain a corresponding ciphertext, and further puts the ciphertext and the key ID corresponding to the first key into a message payload to form a first message for broadcasting in the ad hoc network; The first terminal is any terminal in the ad hoc network; The key table is stored in each terminal in the ad hoc network, and the key table includes multiple keys and key IDs corresponding to the keys one by one; The first key is any key in the key table; S2. The terminal corresponding to the first instruction information in the self-organizing network receives the first message, and uses the first key corresponding to the key ID recorded in the first message in the stored key table to decrypt the ciphertext in the first message to obtain the public key information package of the first terminal.

2. The key distribution method in the wireless terminal ad hoc network mode according to claim 1, characterized in that: In S1, the first terminal generates a public key information package, which specifically includes: The first terminal generates a public key and a private key of the first terminal using a first preset algorithm; The first terminal packages the public key with the pre-acquired IP address and identifier of the first terminal to obtain a public key information package corresponding to the first terminal.

3. The key distribution method in the wireless terminal ad hoc network mode according to claim 2, characterized in that: The first instruction information is any one of a notification information instruction, a configuration information instruction, a first query information instruction, a second query information instruction, and an update public key instruction; The notification information instruction is an instruction for notifying the public key of the first terminal in the ad hoc network; The configuration information instruction is information that enables the first terminal to form a network with a first terminal set; the first terminal set is other terminals in the self-organizing network except the first terminal; The first query information instruction is a second message sent by a second terminal in the ad hoc network; the second terminal is any terminal other than the first terminal in the ad hoc network; the second message carries an identifier of the first terminal and the first information; the first information is information indicating that a public key of the first terminal needs to be obtained; The second query information instruction is a third message sent by a second terminal in the ad hoc network; the third message carries the second information; the second information is information indicating that a public key of the terminal receiving the third message needs to be obtained; The instruction to update the public key is an instruction to update the public key of the first terminal in the ad hoc network.

4. The key distribution method in the wireless terminal ad hoc network mode according to claim 3, characterized in that: If the first instruction information is any one of a notification information instruction, a configuration information instruction, a second query information instruction, and an update public key instruction, then the terminals in the ad hoc network corresponding to the first instruction information are all terminals in the ad hoc network except the first terminal; If the first instruction information is a first query information instruction, the terminal corresponding to the first instruction information in the ad hoc network is the second terminal corresponding to the first query information instruction in the ad hoc network.

5. The key distribution method in the wireless terminal ad hoc network mode according to claim 4, characterized in that: The method further comprises: S3. If the first instruction information is any one of a notification information instruction, a configuration information instruction, a first query information instruction, and a second query information instruction, each terminal corresponding to the first instruction information in the ad hoc network stores the obtained public key information package of the first terminal in a local contact list.

6. The key distribution method in the wireless terminal ad hoc network mode according to claim 5, characterized in that: The method further comprises: S4. If the first instruction information is an instruction to update the public key, each terminal corresponding to the first instruction information in the ad hoc network will respectively compare the public key information package of the first terminal with the public key information package of the first terminal pre-stored in the stored contact list to obtain a comparison result; If the comparison result is that the IP address in the obtained public key information package of the first terminal is the same as the IP address in the pre-stored public key information package of the first terminal, the public key information package of the first terminal pre-stored in the contact list is deleted and the obtained public key information package of the first terminal is stored in the contact list; if the comparison result is that the IP address in the obtained public key information package of the first terminal is the same as the IP address in the pre-stored public key information package of any other terminal, a fourth message is returned to the first terminal; the fourth message carries third information, and the third information is information indicating that there is a conflict in the IP addresses of the terminals in the self-organizing network.

7. The key distribution method in the wireless terminal ad hoc network mode according to claim 6, characterized in that: The method further comprises: S5. When the first terminal receives an instruction to conduct a session with a target terminal specified in the ad hoc network, the first terminal and the target terminal conduct an encrypted session based on the same first session key; Wherein, the first session key is generated by the first terminal through a second preset algorithm; Each of the target terminals obtains the first session key generated by the first terminal in a preset manner.

8. The key distribution method in the wireless terminal ad hoc network mode according to claim 7, characterized in that: The target terminal obtains the first session key generated by the first terminal in a preset manner, specifically including: The target terminal uses the private key generated by the first preset algorithm to decrypt the encryption result k'' to obtain the signature result k'; The target terminal determines the public key of the first terminal in the contact list stored in the target terminal, and uses the public key of the first terminal to decrypt the signature result k' to obtain a first session key; The encryption result k'' is obtained by the first terminal encrypting the signature result k' using the public key of the target terminal in the contact list storing the first terminal; The signature result k' is obtained by the first terminal signing the first session key k with the private key.

9. The key distribution method in the wireless terminal ad hoc network mode according to claim 8, characterized in that: The first preset algorithm is the SM2 elliptic curve public key cryptography algorithm.

10. The key distribution method in the wireless terminal ad hoc network mode according to claim 8, characterized in that: The second preset algorithm is the SM4 block cipher algorithm.

Images