Communication method and related device

Abstract

A communication providing method and a related device are applied to the field of communication technology and intelligent vehicles. The method comprises the steps that a first message from a first node is received, the first message comprises a first key negotiation parameter, the first key negotiation parameter is obtained through a first private key and an intermediate parameter, the intermediate parameter is obtained through a security parameter and a public parameter, and the security parameter is a first password or PSK; determining a first key according to the first key negotiation parameter and a second private key; a second message is sent to the first node, the second message comprises a second key negotiation parameter, and the second key negotiation parameter is obtained through the second private key and the intermediate parameter; and obtaining a first key according to the first key negotiation parameter and the second private key. According to the embodiment of the invention, the security of the shared key can be improved, the access of an untrusted attacker is avoided, and the node security is improved.

Description

Communication method and related device Technical Field

[0001] This application relates to the fields of communication technology and smart car technology, and in particular to short-range communication technology, such as communication in scenarios such as smart cars, smart homes, smart terminals, and smart manufacturing, and specifically to communication methods and related devices. Background Art

[0002] In today's rapidly developing information age, mobile devices, such as smartphones, tablets, and other portable smart devices, are essential personal tools. While we enjoy the convenience brought by information technology, we also face the threat of security vulnerabilities and privacy leaks. Take smart cars, for example. With the widespread use of vehicle-to-vehicle communications, wireless communications have also brought a series of security risks to vehicles. For example, through existing long-range communication technologies, hackers can invade vehicle information systems, obtain vehicle information, and even remotely control the vehicle, posing a serious threat to user privacy and vehicle safety.

[0003] To ensure communication security, nodes typically encrypt data before storing or transmitting it. The receiving node decrypts the ciphertext and restores the plaintext. Specifically, when a second node connects to a first node, it typically first determines a shared key used by both parties to encrypt communication. However, the confidentiality of the generated shared key in existing connection processes is low.

[0004] For example, when a mobile phone connects to a wireless fidelity (Wi-Fi) device, simply entering an 8-digit security parameter (in this scenario, the Wi-Fi password) allows the two devices to obtain a shared key. However, since the security parameter may be short, or the user may use a simpler security parameter for ease of memorization, these situations can easily lead to untrusted nodes accessing the device, or the key generated based on the security parameter may be cracked. Clearly, this access method can easily lead to data leakage and threaten user privacy and security.

[0005] Therefore, how to improve the security of the shared key and prevent untrusted attackers from accessing the key is a technical problem that is being studied by those skilled in the art.

[0006] Summary of the Invention

[0007] The embodiments of the present application provide a communication method and related devices that can improve the security of shared keys and prevent untrusted attackers from accessing them.

[0008] In a first aspect, an embodiment of the present application provides a communication method, the method comprising:

[0009] receiving a first message from a first node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node;

[0010] Sending a second message to the first node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with a second private key and the intermediate parameter;

[0011] A first key is obtained according to the first key negotiation parameter and the second private key.

[0012] The PSK between the first and second nodes is a secret value shared between the first and second nodes. The first password can be considered the password for the first node to access the second node. The first private key is the private key corresponding to the first node. For example, the first node can determine a random number as the private key. The second private key is the private key corresponding to the second node. For example, the second node can determine a random number as the private key.

[0013] Optionally, the above method may be applied to the second node, for example, implemented by a chip or a software module in the second node.

[0014] In the embodiment of the present application, an intermediate parameter is first obtained based on the security parameter and the public parameter, and then used to participate in the generation of the first key negotiation parameter. The security parameter is not directly used to generate the key, nor is the key negotiation parameter directly used to generate the key. Therefore, even if the security parameter is short in number of bits, the public parameter can be used to improve the confidentiality of the security parameter, thereby reducing the possibility of the security parameter being cracked. This correspondingly improves the security of the first key, reduces the possibility of an attacker accessing the second node, and improves the node's communication security and data security.

[0015] In a possible implementation of the first aspect, the method further includes:

[0016] receiving a third message from the first node, the third message including first authentication information, the first authentication information being associated with a second key, the second key being associated with the second key negotiation parameter and the first private key;

[0017] The first authentication information is verified according to the first key.

[0018] In the embodiment of the present application, the security parameters obtained by the first node need to be consistent with the security parameters in the second node. In this way, the first node and the second node can participate in generating a consistent key through the consistent security parameters. Specifically, when the second node generates the first key, the parameters used include the second private key, the security parameters (in the first node), the public parameters, and the first private key; when the first node generates the second key, the parameters used include the first private key, the security parameters (in the second node), the public parameters, and the second private key. Since the parameters used to generate the first key and the second key are the same, if the security parameters in the first node and the second node are consistent, the generated first key and the second key are consistent.

[0019] The first node can obtain the first authentication information based on the second key, and the second node verifies the authentication information based on the first key. If the verification is successful, it means that the first key and the second key are consistent, that is, the second node and the first node have the same security parameters, indicating that the identity of the second node is credible.

[0020] When an attacker requests to access the second node, since the attacker does not have security parameters consistent with the second node, the attacker cannot generate a shared key consistent with the second node, making it impossible for the attacker to access the second node. Therefore, the attacker can be prevented from accessing the second node and the second node can be prevented from successfully associating with an attacker whose identity is untrustworthy.

[0021] In another possible implementation of the first aspect, the first key is used to obtain one or more keys.

[0022] As a possible solution, the first key is used to derive an encryption key, an integrity key, or an identity authentication key.

[0023] With this arrangement, a dedicated key can be derived from the first key for different scenarios, avoiding direct use of the first key for communication, thereby further improving the security of the first key.

[0024] In another possible implementation of the first aspect, the method further includes:

[0025] If the first authentication information is verified successfully, an association establishment message is sent to the first node.

[0026] In the above embodiment, if the first authentication information is verified successfully, the second key obtained by the first node and the first key obtained by the second node are consistent, indicating that the security parameters of the first node are consistent with the security parameters of the second node, and the identity of the first node is credible. The association establishment message indicates that the first node has successfully connected to the second node, or that the association of the first node is complete. At this point, the second node and the second node can proceed with further data transmission operations, determine communication keys, or complete communication configuration information.

[0027] In another possible implementation of the first aspect, the method further includes:

[0028] When the integrity of the third message and the first authentication information are verified, an association establishment message is sent to the first node.

[0029] In the above embodiment, the second node may verify the message integrity of the third message and send an association establishment message to the first node if the integrity of the third message and the first authentication information are verified successfully.

[0030] In another possible implementation of the first aspect, the method further includes:

[0031] Receive indication information of a key agreement algorithm sent by the first node, where the key agreement algorithm includes a Two-Basis Password Exponential Key Exchange (TBPEKE) algorithm.

[0032] Optionally, the indication information of the key agreement algorithm includes indication information of a first key agreement algorithm, and the indication information of the first key agreement algorithm is used to indicate a TBPEKE algorithm.

[0033] Among them, the TBPEKE algorithm is a security algorithm based on the mathematical theory of elliptic curves. It allows the communicating parties to create a key in an insecure channel. This key can be used as a key to encrypt the communication content in subsequent communications.

[0034] In the above embodiment, the first node and the second node may each support multiple key agreement algorithms. When the first node requests access to the second node, the first node may indicate to the second node in a first message which key agreement algorithm to use, thereby enabling the first node and the second node to negotiate a key based on a consistent key agreement algorithm, thereby improving key agreement efficiency.

[0035] Optionally, due to the different elliptic curves used, there can be multiple TBPEKE algorithms. For example, the elliptic curves used by the TBPEKE algorithm include one or more of the following elliptic curves: the elliptic curve defined by SM2, Curve25519, etc. Therefore, TBPEKE algorithms may include: a TBPEKE algorithm using the elliptic curve defined by SM2, a TBPEKE algorithm using Curve25519, etc. It should be understood that this is an illustrative description of TBPEKE algorithms using different elliptic curves for convenience. In specific implementations, other elliptic curves may also be used, which are not listed here.

[0036] In another possible implementation of the first aspect, the at least one common parameter includes: a first common parameter and a second common parameter;

[0037] The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a key agreement algorithm, and the key agreement algorithm includes the TBPEKE algorithm.

[0038] In the above implementation, the public parameter is a point on an elliptic curve, while the security parameter is a secret value. Due to the discrete logarithm problem on elliptic curves, it is relatively easy to calculate the intermediate parameter using the security parameter and the public parameter. However, it is difficult to decipher the security parameter by obtaining the first key negotiation parameter and the public parameter. Therefore, the TBPEKE algorithm and the public parameter can reduce the possibility of deciphering the security parameter and improve node security.

[0039] In another possible implementation of the first aspect, the first public parameter and the second public parameter belong to points on the first elliptic curve.

[0040] In another possible implementation of the first aspect, the first public parameter is predefined, and the second public parameter is determined by the first public parameter, a first random number, and a second random number, where the first random number comes from the first node and the second random number comes from the second node.

[0041] In a possible implementation of the first aspect, the at least one common parameter includes at least one base point, and the at least one base point belongs to a group of order p, where p is a prime number.

[0042] In mathematics, a group represents an algebraic structure with binary operations that satisfy closure, associativity, identity, and inverses. In the embodiments of the present application, the operations associated with the group can be operations on a first elliptic curve. The operations on the elliptic curve include one or more of elliptic curve point multiplication or elliptic curve point addition.

[0043] Optionally, in each embodiment of the present application, the group may be a cyclic subgroup of an elliptic curve.

[0044] A base point, also known as a generator, is a parameter in elliptic curve cryptography. A base point is a point on the elliptic curve chosen by the cryptographic algorithm.

[0045] Generally speaking, the elliptic curves suitable for cryptographic algorithms are defined in a finite field, so the points on the elliptic curve in the finite field are also finite.

[0046] The order refers to the number of points in the group. That is, for a group of order p, the number of points on the elliptic curve is p. Optionally, any point A in the group satisfies A = d * base point, where * is the elliptic curve point multiplication operation and d is in the range [1, p-1].

[0047] Optionally, the aforementioned group may be a cyclic group or a cyclic subgroup of operations on the first elliptic curve.

[0048] Optionally, in some scenarios, the base point can also be replaced by a generator.

[0049] In another possible implementation of the first aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: some or all elements in a group of order p, where p is a prime number.

[0050] The base point (or generator) of the subgroup of order p is U. For a selected number d in the range [1, p-1], then dU is included in the group.

[0051] Optionally, the at least one public parameter includes a base point U. Further optionally, the at least one public parameter further includes V obtained by operating U, where V=dU, and the range of d is [1, p).

[0052] In another possible implementation of the first aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: two points in a group of order p, where p is a prime number.

[0053] Alternatively, the two points may be two base points. Alternatively, one of the two points may be a base point, and the other may be a second base point calculated based on the base point. For ease of description, the present application will collectively refer to them as the first base point and the second base point.

[0054] In another possible implementation of the first aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the public parameters of TBPEKE include: a cyclic group whose order is a prime number p, and two independent base points U and V in the group.

[0055] It should be understood that “independent” means that U and V are two points with different values, and is not intended to limit the lack of correlation between U and V. Optionally, U can be called the first base point, and V can be called the second base point.

[0056] In another possible implementation of the first aspect, the method further includes:

[0057] receiving a first calculated value from the first node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node, and the first public parameter is predefined (e.g., predefined based on a TBPEKE algorithm);

[0058] determining the second public parameter according to a second random number and the first calculated value;

[0059] A second calculated value is sent to the first node, where the second calculated value is related to the second random number and the first public parameter, and the second calculated value is used by the first node to determine the second public parameter.

[0060] Optionally, the first public parameter is the aforementioned first base point, and the second public parameter is the aforementioned base point.

[0061] In another possible implementation of the first aspect, the intermediate parameter satisfies the following formula:

[0062] b=U+s*V,

[0063] Among them, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, "*" is the elliptic curve point multiplication operation, and "+" is the elliptic curve point addition operation.

[0064] In a possible implementation of the first aspect, U is the first base point, and V is the second base point. Further, U and V belong to a cyclic group of order p, where p is a prime number.

[0065] Optionally, the group-related operation is an operation on a first elliptic curve. The first elliptic curve is the elliptic curve used by the selected key agreement algorithm. For example, taking the selected key agreement algorithm as the TBPEKE algorithm, the first elliptic curve can be: an elliptic curve defined using SM2, or Curve25519, etc.

[0066] In the above embodiment, the intermediate parameter (U+s*V) is obtained by performing point addition and point multiplication operations on the security parameter and the public parameter.

[0067] Those skilled in the art will recognize that for a selected elliptic curve Ep(a,b), given a scalar k and a point P (point P is on the elliptic curve), calculating R = k*P (* is the elliptic curve point multiplication) is easy. However, given points P and R (points P and R are on the elliptic curve), calculating the k that makes kP = R is very difficult. This is because in practical elliptic curves, P and R are generally quite large, and calculating each k point and comparing them with R is a mathematically challenging task. Therefore, the TBPEKE algorithm and public parameters can reduce the possibility of cracking the security parameter s, thereby improving node security.

[0068] In another possible implementation of the first aspect, the first key negotiation parameter KEt satisfies the following formula:

[0069] KEt=SKt*b,

[0070] The first key satisfies the following formula:

[0071] First key = SKg*KEt,

[0072] The second key negotiation parameter KEg satisfies the following formula:

[0073] KEg=SKg*b,

[0074] The second key satisfies the following formula:

[0075] Second key = SKt*KEg;

[0076] Among them, SKt is the first private key, and SKg is the second private key.

[0077] Since the point product operation satisfies the associative law, the first key = SKg*KEt = SKg*(SKt*b) = SKt*(SKg*b) = the second key, so the first key determined by the first node and the second key determined by the second node are the same.

[0078] Specifically, the first key = SKg*KEt = SKg*(SKt*b) = (SKt.SKg)*(U+s*V), and the second key = SKt*KEg = SKt*(SKg*b) = (SKt.SKg)*(U+s*V), where "." represents a multiplication operation. Therefore, the first key and the second key are the same.

[0079] The above implementation method provides a possible method for obtaining the first key negotiation parameter, the second key negotiation parameter, the first key and the second key. When generating the first key negotiation parameter and the second key negotiation parameter, the security parameter is not directly used for calculation. Instead, the intermediate parameter is first obtained based on the security parameter and the public parameter, and the intermediate parameter is used to participate in the generation of the first key negotiation parameter, thereby reducing the possibility of the security parameter being cracked, reducing the possibility of an attacker accessing the second node, and improving the communication security and data security of the node.

[0080] In another possible implementation of the first aspect, the value range of the first private key (SKt) is [1, p), and the value range of the second private key (SKg) is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

[0081] In another possible implementation of the first aspect, before receiving the first message from the first node, the method further includes:

[0082] The key agreement algorithm capability of the second node is broadcasted, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

[0083] In another possible implementation of the first aspect, the key agreement algorithms supported by the first node are arranged in order of priority.

[0084] In another possible implementation of the first aspect, the first message also includes a first freshness parameter, and the first authentication information is associated with a pre-shared key PSK between the first node and the second node, the second key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

[0085] In another possible implementation of the first aspect, verifying the first authentication information according to the first key includes:

[0086] The first authentication information is verified based on the PSK between the first node and the second node, the first key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

[0087] In the above embodiment, the parameters involved in generating the first authentication information include one or more of the PSK between the first and second nodes, the second key, the second message, the first freshness parameter, and the key agreement algorithm capabilities of the second node. Therefore, when verifying the first authentication information, all parameters involved in generating the first authentication information must be consistent, except for the first and second keys. This protects the integrity of these parameters, reduces the possibility of attackers accessing the second node, and improves security.

[0088] For example, if the first fresh parameter sent by the first node to the second node is tampered with, the first fresh parameter used by the second node when verifying the first authentication information will be different from the first fresh parameter used by the second node when generating the first authentication information, which will cause the first authentication information to fail verification.

[0089] In yet another possible implementation of the first aspect, the second message further includes second authentication information and a second fresh parameter, and the method further includes:

[0090] Second authentication information is obtained through the PSK between the first node and the second node, the first key, the second fresh parameter, and the first message.

[0091] In the above embodiment, the second authentication information can be used by the first node to authenticate the identity of the second node. For example, the second node can generate verification information based on the same parameters. If the verification information is identical to the first authentication information, it indicates that the second key generated by the first node and the first key generated by the second node are consistent. This allows authentication of the second node's identity, preventing the node from communicating with attackers and improving node security.

[0092] In another possible implementation of the first aspect, the first message further includes a first fresh parameter, and the second message further includes a second fresh parameter; and the method further includes:

[0093] A third key is obtained according to the first key, the first fresh parameter, and the second fresh parameter.

[0094] In another possible implementation of the first aspect, the PSK is preconfigured, predefined, or obtained according to the first password.

[0095] In another possible implementation of the first aspect, the method further includes:

[0096] A PSK between the first node and the second node is obtained according to the first corresponding relationship.

[0097] It can be seen that the second node can store the correspondence between the PSK and the first node in the form of a correspondence. Therefore, the PSK between the first node and the second node can be obtained according to the correspondence.

[0098] In another possible implementation of the first aspect, the method further includes:

[0099] A PSK between the first node and the second node is determined according to the first password, a first fresh parameter, and a second fresh parameter.

[0100] In one possible design, the PSK is determined based on the first password, the first key, the first freshness parameter, and the second freshness parameter. For example, when the first node associates with the second node for the first time or when the second node does not obtain the PSK corresponding to the first node, the second node may determine a new PSK.

[0101] In a second aspect, an embodiment of the present application provides a communication method, characterized in that the method includes:

[0102] Sending a first message to the second node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node;

[0103] receiving a second message from the second node, the second message including a second key negotiation parameter, the second key negotiation parameter being associated with a second private key and the intermediate parameter;

[0104] A second key is obtained according to the second key negotiation parameter and the first private key.

[0105] In a possible implementation of the second aspect, the method further includes:

[0106] A third message is sent to the first node, where the third message includes the first authentication information, and the first authentication information is associated with the second key.

[0107] Optionally, the above method may be applied to the first node, for example, implemented by a chip or a software module in the first node.

[0108] The PSK between the first node and the second node is a secret value shared between the first node and the second node, and the first password can be regarded as a password for the first node to access the second node.

[0109] In a possible implementation of the second aspect, the second key is used to obtain one or more keys.

[0110] As a possible solution, the second key is used to derive an encryption key, an integrity key, or an identity authentication key.

[0111] In a possible implementation of the second aspect, the method further includes:

[0112] An association establishment message is received from the second node.

[0113] In yet another possible implementation of the second aspect, before sending the first message to the second node, the method further includes:

[0114] The first key agreement algorithm is selected according to the key agreement algorithm capability of the second node, wherein the key agreement algorithm capability of the second node can indicate one or more key agreement algorithms supported by the second node.

[0115] In another possible implementation of the second aspect, the method further includes:

[0116] Send indication information of a key agreement algorithm to the second node, where the indication information of the key agreement algorithm indicates a double-base cryptographic exponential function key exchange (TBPEKE) algorithm.

[0117] Among them, the TBPEKE algorithm is a security algorithm based on the mathematical theory of elliptic curves. It allows the communicating parties to create a key in an insecure channel. This key can be used as a key to encrypt the communication content in subsequent communications.

[0118] Optionally, there may be multiple TBPEKE algorithms due to the different elliptic curves used. For example, the elliptic curves used by the TBPEKE algorithm include one or more of the following elliptic curves: the elliptic curve defined by SM2, or Curve25519. Therefore, the TBPEKE algorithm may include: a TBPEKE algorithm using the elliptic curve defined by SM2, a TBPEKE algorithm using Curve25519, and so on.

[0119] In another possible implementation of the second aspect, the at least one common parameter includes: a first common parameter and a second common parameter;

[0120] The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a key agreement algorithm, and the key agreement algorithm includes the TBPEKE algorithm.

[0121] In another possible implementation of the second aspect, the first public parameter and the second public parameter belong to points on the first elliptic curve.

[0122] In another possible implementation of the second aspect, the first public parameter is predefined, and the second public parameter is determined by the first public parameter, a first random number, and a second random number, where the first random number comes from the first node and the second random number comes from the second node.

[0123] In a possible implementation of the second aspect, the at least one common parameter includes at least one base point, and the at least one base point belongs to a group of order p, where p is a prime number.

[0124] Optionally, the group may be a cyclic group or a cyclic subgroup with respect to the operation on the first elliptic curve.

[0125] Optionally, in some scenarios, the base point can also be replaced by a generator.

[0126] In another possible implementation of the second aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: some or all elements in a group of order p, where p is a prime number.

[0127] The base point (or generator) of the subgroup of order p is U. For a selected number d in the range [1, p-1], then dU is included in the group.

[0128] Optionally, the at least one public parameter includes a base point U. Further optionally, the at least one public parameter further includes V obtained by operating on U, where V=dU, and the range of d is [1, p-1].

[0129] In yet another possible implementation of the second aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: two points in a group of order p.

[0130] Alternatively, the two points may be two base points. Alternatively, one of the two points may be a base point, and the other may be a second base point calculated based on the base point. For ease of description, the present application will collectively refer to them as the first base point and the second base point.

[0131] In another possible implementation of the second aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the public parameters of TBPEKE include: a cyclic group of order p, and two independent base points U and V in the group.

[0132] It should be understood that “independent” means that U and V are two points with different values, and is not intended to limit the relationship between U and V to no correlation.

[0133] In another possible implementation of the second aspect, the method further includes:

[0134] Sending a first calculated value to the second node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node and the first public parameter is predefined;

[0135] receiving a second calculated value from the second node, the second calculated value being related to the second random number and the first public parameter;

[0136] The second public parameter is determined according to a second random number and the first calculated value.

[0137] Optionally, the first public parameter is the aforementioned first base point, and the second public parameter is the aforementioned second base point.

[0138] In a possible implementation of the second aspect, the first key agreement algorithm is a key agreement algorithm supported by the first node, and the first key agreement algorithm has the highest priority among the key agreement algorithms supported by the second node.

[0139] In a possible implementation of the second aspect, the intermediate parameter satisfies the following formula:

[0140] b=U+s*V,

[0141] Among them, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, "*" is the elliptic curve point multiplication operation, and "+" is the elliptic curve point addition operation.

[0142] In one possible implementation of the second aspect, U is the first base point, and V is the second base point. Furthermore, U and V belong to a group of order p, where p is a prime number. The operation associated with the group is an operation on the first elliptic curve.

[0143] The first elliptic curve is an elliptic curve used by the selected key agreement algorithm. For example, taking the selected key agreement algorithm as the TBPEKE algorithm, the first elliptic curve can be: an elliptic curve defined by SM2, or Curve25519, etc.

[0144] In a possible implementation of the second aspect, the first key negotiation parameter KEt satisfies the following formula:

[0145] KEt=SKt*b,

[0146] The first key satisfies the following formula:

[0147] First key = SKg*KEt,

[0148] The second key negotiation parameter KEg satisfies the following formula:

[0149] KEg=SKg*b,

[0150] The second key satisfies the following formula:

[0151] Second key = SKt*KEg;

[0152] Among them, SKt is the first private key, and SKg is the second private key.

[0153] Since the point product operation satisfies the associative law, the first key = SKg*KEt = SKg*(SKt*b) = SKt*(SKg*b) = the second key, so the first key determined by the first node and the second key determined by the second node are the same.

[0154] Specifically, the first key = SKg*KEt = SKg*(SKt*b) = (SKt.SKg)*(U+s*V), and the second key = SKt*KEg = SKt*(SKg*b) = (SKt.SKg)*(U+s*V), where "." represents a multiplication operation. Therefore, the first key and the second key are the same.

[0155] In a possible implementation of the second aspect, the value range of the first private key (SKt) is [1, p), and the value range of the second private key (SKg) is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

[0156] In a possible implementation of the second aspect, before sending the first message to the second node, the method further includes:

[0157] Receive the key agreement algorithm capability of the second node sent by the second node, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

[0158] In a possible implementation of the second aspect, the key agreement algorithms supported by the first node are arranged in order of priority.

[0159] In a possible implementation of the second aspect, the first message further includes a first freshness parameter, and the first authentication information is associated with a pre-shared key PSK between the first node and the second node, the second key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

[0160] In a possible implementation of the second aspect, the second message further includes second authentication information and a second fresh parameter, and the second authentication information is associated with the PSK between the first node and the second node, the first key, the second fresh parameter, and the first message.

[0161] In a possible implementation of the second aspect, the method further includes:

[0162] verifying the second authentication information based on the PSK between the first node and the second node, the second key, the second fresh parameter, and the first message;

[0163] When the integrity of the second message and the second authentication information are verified, the first authentication information is generated.

[0164] In a possible implementation of the second aspect, the first message further includes a first fresh parameter, and the second message further includes a second fresh parameter; and the method further includes:

[0165] A fourth key is obtained according to the second key, the first fresh parameter, and the second fresh parameter.

[0166] In a possible implementation of the second aspect, the PSK is preconfigured, predefined, or obtained according to the first password.

[0167] In another possible implementation of the second aspect, the method further includes:

[0168] The PSK between the first node and the second node is obtained according to the second corresponding relationship.

[0169] It can be seen that the first node can store the correspondence between the PSK and the second node in the form of a correspondence. Therefore, the PSK between the first node and the second node can be obtained according to the correspondence.

[0170] In another possible implementation of the second aspect, the method further includes:

[0171] A PSK between the first node and the second node is determined according to the first password, a first fresh parameter, and a second fresh parameter.

[0172] In one possible design, the PSK is determined based on the first password, the first key, the first freshness parameter, and the second freshness parameter. When the first node associates with the second node for the first time or when the first node does not obtain the PSK corresponding to the second node, the first node may determine a new PSK.

[0173] In a third aspect, an embodiment of the present application provides a communication device, which includes a receiving unit, a sending unit and a processing unit, and the communication device is used to implement the method described in any embodiment of the first aspect.

[0174] In a possible implementation of the third aspect, the receiving unit is configured to receive a first message from a first node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node;

[0175] The sending unit is further configured to send a second message to the first node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with a second private key and the intermediate parameter;

[0176] The processing unit is configured to obtain a first key according to the first key negotiation parameter and the second private key.

[0177] In a possible implementation of the third aspect, the receiving unit is further configured to receive a third message from the first node, where the third message includes first authentication information, where the first authentication information is associated with a second key, and where the second key is associated with the second key negotiation parameter and the first private key;

[0178] The processing unit is further configured to verify the first authentication information according to the first key.

[0179] In yet another possible implementation of the third aspect, the first key is used to obtain one or more keys.

[0180] As a possible solution, the first key is used to derive an encryption key, an integrity key, or an identity authentication key, etc. In another possible implementation of the third aspect, the sending unit is further used to:

[0181] If the first authentication information is verified successfully, an association establishment message is sent to the first node.

[0182] In yet another possible implementation of the third aspect, the sending unit is further configured to:

[0183] If the integrity of the third message and the first authentication information are verified, an association establishment message is sent to the first node.

[0184] In yet another possible implementation manner of the third aspect, the receiving unit is further configured to:

[0185] Receive indication information of a key agreement algorithm sent by the first node, where the key agreement algorithm includes a TBPEKE algorithm.

[0186] Optionally, the indication information of the key agreement algorithm includes indication information of a first key agreement algorithm, and the indication information of the first key agreement algorithm is used to indicate a TBPEKE algorithm.

[0187] Optionally, there may be multiple TBPEKE algorithms due to the different elliptic curves used. For example, the elliptic curves used by the TBPEKE algorithm include one or more of the following elliptic curves: the elliptic curve defined by SM2, or Curve25519. Therefore, the TBPEKE algorithm may include: a TBPEKE algorithm using the elliptic curve defined by SM2, a TBPEKE algorithm using Curve25519, and so on.

[0188] In yet another possible implementation of the third aspect, the at least one common parameter includes: a first common parameter and a second common parameter;

[0189] The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a key agreement algorithm, and the key agreement algorithm includes the TBPEKE algorithm.

[0190] In another possible implementation of the third aspect, the first public parameter and the second public parameter belong to points on the first elliptic curve.

[0191] In another possible implementation of the third aspect, the first public parameter is predefined, and the second public parameter is determined by the first public parameter, a first random number, and a second random number, the first random number comes from the first node, and the second random number comes from the second node.

[0192] In a possible implementation of the third aspect, the at least one common parameter includes at least one base point, and the at least one base point belongs to a group of order p, where p is a prime number.

[0193] Optionally, the group may be a cyclic group or a cyclic subgroup with respect to the operation on the first elliptic curve.

[0194] Optionally, in some scenarios, the base point can also be replaced by a generator.

[0195] In another possible implementation of the third aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: some or all elements in a group of order p, where p is a prime number.

[0196] The base point (or generator) of the subgroup of order p is U. For a selected number d in the range [1, p-1], then dU is included in the group.

[0197] Optionally, the at least one public parameter includes a base point U. Further optionally, the at least one public parameter further includes V obtained by operating on U, where V=dU, and the range of d is [1, p-1].

[0198] In yet another possible implementation of the third aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: two points in a group of order p.

[0199] Alternatively, the two points may be two base points. Alternatively, one of the two points may be a base point, and the other may be a second base point calculated based on the base point. For ease of description, the present application will collectively refer to them as the first base point and the second base point.

[0200] In another possible implementation of the third aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the public parameters of TBPEKE include: a cyclic group of order p, and two independent base points U and V in the group.

[0201] It should be understood that “independent” means that U and V are two points with different values, and is not intended to limit the relationship between U and V to no correlation.

[0202] In yet another possible implementation of the third aspect, the receiving unit is further configured to receive a first calculated value from the first node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node, and the first public parameter is predefined.

[0203] The processing unit is further configured to determine the second public parameter according to the second random number and the first calculated value;

[0204] The sending unit is further configured to send a second calculated value to the first node, where the second calculated value is related to the second random number and the first public parameter, and the second calculated value is used by the first node to determine the second public parameter.

[0205] Optionally, the first public parameter is the aforementioned first base point, and the second public parameter is the aforementioned second base point.

[0206] In another possible implementation of the third aspect, the at least one public parameter is two points, each of which is a point on the elliptic curve used by the TBPEKE algorithm.

[0207] In another possible implementation of the third aspect, the intermediate parameter satisfies the following formula:

[0208] b=U+s*V,

[0209] Among them, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, "*" is the elliptic curve point multiplication operation, and "+" is the elliptic curve point addition operation.

[0210] In one possible implementation of the third aspect, U is the first base point, and V is the second base point. Furthermore, U and V belong to a group of order p, where p is a prime number. The operations associated with the group are operations on the first elliptic curve.

[0211] The first elliptic curve is an elliptic curve used by the selected key agreement algorithm. For example, taking the selected key agreement algorithm as the TBPEKE algorithm, the first elliptic curve can be: an elliptic curve defined by SM2, or Curve25519, etc.

[0212] In another possible implementation of the third aspect, the first key negotiation parameter KEt satisfies the following formula:

[0213] KEt=SKt*b,

[0214] The first key satisfies the following formula:

[0215] First key = SKg*KEt,

[0216] The second key negotiation parameter KEg satisfies the following formula:

[0217] KEg=SKg*b,

[0218] The second key satisfies the following formula:

[0219] Second key = SKt*KEg;

[0220] Among them, SKt is the first private key, and SKg is the second private key.

[0221] Since the point product operation satisfies the associative law, the first key = SKg*KEt = SKg*(SKt*b) = SKt*(SKg*b) = the second key, so the first key determined by the first node and the second key determined by the second node are the same.

[0222] Specifically, the first key = SKg*KEt = SKg*(SKt*b) = (SKt.SKg)*(U+s*V), and the second key = SKt*KEg = SKt*(SKg*b) = (SKt.SKg)*(U+s*V), where "." represents a multiplication operation. Therefore, the first key and the second key are the same.

[0223] In another possible implementation of the third aspect, the value range of the first private key (SKt) is [1, p), and the value range of the second private key (SKg) is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

[0224] In yet another possible implementation of the third aspect, the sending unit is further configured to:

[0225] The key agreement algorithm capability of the second node is broadcasted, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

[0226] In yet another possible implementation of the third aspect, the key agreement algorithms supported by the first node are arranged in order of priority.

[0227] In another possible implementation of the third aspect, the first message also includes a first fresh parameter, and the first message also includes a first fresh parameter, and the first authentication information is associated with the pre-shared key PSK between the first node and the second node, the second key, the second message, the first fresh parameter and the key agreement algorithm capability of the second node.

[0228] In yet another possible implementation manner of the third aspect, the processing unit is further configured to:

[0229] The first authentication information is verified based on the PSK between the first node and the second node, the first key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

[0230] In yet another possible implementation of the third aspect, the second message further includes second authentication information and a second fresh parameter, and the processing unit is further configured to:

[0231] Second authentication information is obtained through the PSK between the first node and the second node, the first key, the second fresh parameter, and the first message.

[0232] In yet another possible implementation of the third aspect, the first message further includes a first freshness parameter, and the second message further includes a second freshness parameter; and the processing unit is further configured to:

[0233] A third key is obtained according to the first key, the first fresh parameter, and the second fresh parameter.

[0234] In another possible implementation of the third aspect, the PSK is preconfigured, predefined, or obtained according to the first password.

[0235] In yet another possible implementation manner of the third aspect, the processing unit is further configured to:

[0236] A PSK between the first node and the second node is obtained according to the first corresponding relationship.

[0237] It can be seen that the second node can store the correspondence between the PSK and the first node in the form of a correspondence. Therefore, the PSK between the first node and the second node can be obtained according to the correspondence.

[0238] In yet another possible implementation manner of the third aspect, the processing unit is further configured to:

[0239] A PSK between the first node and the second node is determined according to the first password, a first fresh parameter, and a second fresh parameter.

[0240] In one possible design, the PSK is determined based on the first password, the first key, the first fresh parameter, and the second fresh parameter.

[0241] In a fourth aspect, an embodiment of the present application provides a communication device, which includes a sending unit, a receiving unit and a processing unit, and the communication device is used to implement the method described in any embodiment of the second aspect.

[0242] In a possible implementation of the fourth aspect, the sending unit is configured to send a first message to the second node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node;

[0243] The receiving unit is further configured to receive a second message from the second node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with a second private key and the intermediate parameter;

[0244] The processing unit is configured to obtain a second key according to the second key negotiation parameter and the first private key.

[0245] In a possible implementation of the fourth aspect,

[0246] The sending unit is further configured to send a third message to the first node, where the third message includes the first authentication information, and the first authentication information is associated with the second key.

[0247] In another possible implementation of the fourth aspect, the second key is used to obtain one or more keys.

[0248] As a possible solution, the second key is used to derive an encryption key, an integrity key, or an identity authentication key.

[0249] In yet another possible implementation manner of the fourth aspect, the receiving unit is further configured to:

[0250] An association establishment message is received from the second node.

[0251] In yet another possible implementation of the fourth aspect, the communication device further includes a processing unit, wherein the processing unit is configured to:

[0252] The first key agreement algorithm is selected according to the key agreement algorithm capability of the second node, wherein the key agreement algorithm capability of the second node can indicate one or more key agreement algorithms supported by the second node.

[0253] In another possible implementation of the fourth aspect, the sending unit is further used to send indication information of the first key agreement to the second node, where the indication information of the first key agreement algorithm is used to indicate a double-base cryptographic exponential function key exchange TBPEKE algorithm.

[0254] Optionally, there may be multiple TBPEKE algorithms due to the different elliptic curves used. For example, the elliptic curves used by the TBPEKE algorithm include one or more of the following elliptic curves: the elliptic curve defined by SM2, or Curve25519. Therefore, the TBPEKE algorithm may include: a TBPEKE algorithm using the elliptic curve defined by SM2, a TBPEKE algorithm using Curve25519, and so on.

[0255] In yet another possible implementation of the fourth aspect, the at least one common parameter includes: a first common parameter and a second common parameter;

[0256] The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a key agreement algorithm, and the key agreement algorithm includes the TBPEKE algorithm.

[0257] In another possible implementation of the fourth aspect, the first public parameter and the second public parameter belong to points on the first elliptic curve.

[0258] In another possible implementation of the fourth aspect, the first public parameter is predefined, and the second public parameter is determined by the first public parameter, a first random number, and a second random number, the first random number comes from the first node, and the second random number comes from the second node.

[0259] In a possible implementation of the fourth aspect, the at least one common parameter includes at least one base point, and the at least one base point belongs to a group of order p, where p is a prime number.

[0260] Optionally, the group may be a cyclic group or a cyclic subgroup with respect to the operation on the first elliptic curve.

[0261] Optionally, in some scenarios, the base point can also be replaced by a generator.

[0262] In another possible implementation of the fourth aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: some or all elements in a group of order p, where p is a prime number.

[0263] The base point (or generator) of the subgroup of order p is U. For a selected number d in the range [1, p-1], then dU is included in the group.

[0264] Optionally, the at least one public parameter includes a base point U. Further optionally, the at least one public parameter further includes V obtained by operating on U, where V=dU, and the range of d is [1, p-1].

[0265] In yet another possible implementation of the fourth aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: two points in a group of order p.

[0266] Alternatively, the two points may be two base points. Alternatively, one of the two points may be a base point, and the other may be a second base point calculated based on the base point. For ease of description, the present application will collectively refer to them as the first base point and the second base point.

[0267] In another possible implementation of the fourth aspect, when the selected key agreement algorithm is the TBPEKE algorithm, the public parameters of TBPEKE include: a cyclic group whose order is a prime number p, and two independent base points U and V in the group.

[0268] It should be understood that “independent” means that U and V are two points with different values, and is not intended to limit the relationship between U and V to no correlation.

[0269] In yet another possible implementation of the fourth aspect, the sending unit is configured to send a first calculated value to the second node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node, and the first public parameter is predefined.

[0270] The receiving unit is configured to receive a second calculated value from the second node, where the second calculated value is related to the second random number and the first public parameter;

[0271] The apparatus further includes a processing unit configured to determine the second public parameter according to a second random number and the first calculated value.

[0272] Optionally, the first public parameter is the aforementioned first base point, and the second public parameter is the aforementioned second base point.

[0273] In another possible implementation of the fourth aspect, when the first key agreement algorithm is a double-base cryptographic exponential function key exchange (TBPEKE) algorithm, the at least one public parameter is two points, each of which is a point on the elliptic curve used by the TBPEKE algorithm.

[0274] In another possible implementation of the fourth aspect, the first key agreement algorithm is a key agreement algorithm supported by the first node, and the first key agreement algorithm has the highest priority among the key agreement algorithms supported by the second node.

[0275] In another possible implementation of the fourth aspect, the intermediate parameter satisfies the following formula:

[0276] b=U+s*V,

[0277] Among them, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, "*" is the elliptic curve point multiplication operation, and "+" is the elliptic curve point addition operation.

[0278] In one possible implementation of the fourth aspect, U is the first base point, and V is the second base point. Furthermore, U and V belong to a group of order p, where p is a prime number. The operation associated with the group is an operation on the first elliptic curve.

[0279] The first elliptic curve is an elliptic curve used by the selected key agreement algorithm. For example, taking the selected key agreement algorithm as the TBPEKE algorithm, the first elliptic curve can be: an elliptic curve defined by SM2, or Curve25519, etc.

[0280] In another possible implementation of the fourth aspect, the first key negotiation parameter KEt satisfies the following formula:

[0281] KEt=SKt*b,

[0282] The first key satisfies the following formula:

[0283] First key = SKg*KE,

[0284] The second key negotiation parameter KEg satisfies the following formula:

[0285] KEg=SKg*b,

[0286] The second key satisfies the following formula:

[0287] Second key = SKt*KEg;

[0288] Among them, SKt is the first private key, and SKg is the second private key.

[0289] Since the point product operation satisfies the associative law, the first key = SKg*KEt = SKg*(SKt*b) = SKt*(SKg*b) = the second key, so the first key determined by the first node and the second key determined by the second node are the same.

[0290] Specifically, the first key = SKg*KEt = SKg*(SKt*b) = (SKt.SKg)*(U+s*V), and the second key = SKt*KEg = SKt*(SKg*b) = (SKt.SKg)*(U+s*V), where "." represents a multiplication operation. Therefore, the first key and the second key are the same.

[0291] In another possible implementation of the fourth aspect, the value range of the first private key (SKt) is [1, p), and the value range of the second private key (SKg) is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

[0292] In yet another possible implementation manner of the fourth aspect, the receiving unit is further configured to:

[0293] Receive the key agreement algorithm capability of the second node sent by the second node, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

[0294] In yet another possible implementation of the fourth aspect, the key agreement algorithms supported by the first node are arranged in order of priority.

[0295] In another possible implementation of the fourth aspect, the first message further includes a first fresh parameter, and the first message also includes a first fresh parameter, and the first authentication information is associated with the pre-shared key PSK between the first node and the second node, the second key, the second message, the first fresh parameter and the key agreement algorithm capability of the second node.

[0296] In another possible implementation of the fourth aspect, the second message further includes second authentication information and a second fresh parameter, and the second authentication information is associated with the PSK between the first node and the second node, the first key, the second fresh parameter, and the first message.

[0297] In yet another possible implementation of the fourth aspect, the processing unit is further configured to:

[0298] verifying the second authentication information based on the PSK between the first node and the second node, the second key, the second fresh parameter, and the first message;

[0299] When the integrity of the second message and the second authentication information are verified, the first authentication information is generated.

[0300] In a possible implementation of the fourth aspect, the first message further includes a first freshness parameter, and the second message further includes a second freshness parameter; and the processing unit is further configured to:

[0301] A fourth key is obtained according to the second key, the first fresh parameter, and the second fresh parameter.

[0302] In a possible implementation of the fourth aspect, the PSK is preconfigured, predefined, or obtained according to the first password.

[0303] In yet another possible implementation of the fourth aspect, the processing unit is further configured to:

[0304] The PSK between the first node and the second node is obtained according to the second corresponding relationship.

[0305] In yet another possible implementation of the fourth aspect, the processing unit is further configured to:

[0306] A PSK between the first node and the second node is determined according to the first password, a first fresh parameter, and a second fresh parameter.

[0307] In a fifth aspect, an embodiment of the present application discloses a communication device, comprising a processor and a communication interface, wherein the communication interface is used to receive and / or send data, and / or the communication interface is used to provide input and / or output for the processor, and the processor is used to call a computer program stored in a memory to implement the method described in the first aspect or any possible implementation method of the first aspect.

[0308] In the sixth aspect, an embodiment of the present application discloses a communication device, comprising a processor and a communication interface, wherein the communication interface is used to receive and / or send data, and / or the communication interface is used to provide input and / or output for the processor, and the processor is used to call a computer program stored in a memory to implement any possible implementation method of the second aspect or the third aspect.

[0309] It should be noted that the processor included in the communication device described in the fifth aspect and / or the sixth aspect may be a processor specifically used to execute these methods (referred to as a dedicated processor for ease of distinction), or may be a processor that executes these methods by calling a computer program, such as a general-purpose processor. Optionally, the at least one processor may include both a dedicated processor and a general-purpose processor.

[0310] Optionally, the computer program may be stored in a memory. For example, the memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same device or provided on separate devices. The embodiments of the present application do not limit the type of memory or the configuration of the memory and the processor.

[0311] In a possible implementation, the at least one memory is located outside the communication device.

[0312] In another possible implementation, the at least one memory is located within the communication device.

[0313] In another possible implementation, part of the at least one memory is located inside the communication device, and another part of the memory is located outside the communication device.

[0314] In this application, the processor and the memory may also be integrated into one device, that is, the processor and the memory may also be integrated together.

[0315] In the seventh aspect, an embodiment of the present application also provides a chip system, which includes at least one processor and a communication interface, the communication interface is used to send and / or receive data, and the at least one processor is used to call a computer program stored in at least one memory, so that the chip system implements the method described in the first aspect or any possible implementation of the first aspect; or implements the method described in the second aspect or any possible implementation of the second aspect.

[0316] In an eighth aspect, an embodiment of the present application further provides a communication system, comprising a first node and a second node. The second node comprises the communication device described in the third aspect or any possible implementation of the third aspect, or the second node is a node that implements the first aspect or any possible implementation of the first aspect. The first node comprises the communication device described in the fourth aspect or any possible implementation of the fourth aspect, or the first node is a node that implements the second aspect or any possible implementation of the second aspect.

[0317] In the ninth aspect, an embodiment of the present application discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is run on a computer, the computer executes the method described in the first aspect or any possible implementation of the first aspect, or executes the method described in the second aspect or any possible implementation of the second aspect.

[0318] In the tenth aspect, an embodiment of the present application discloses a computer program product, which, when running on one or more processors, executes the method described in the first aspect or any possible implementation of the first aspect, or executes the method described in the second aspect or any possible implementation of the second aspect.

[0319] In the eleventh aspect, an embodiment of the present application discloses a terminal, which may be a smart cockpit product, a vehicle, etc., and the terminal includes a first node and / or a second node.

[0320] The second node includes the device described in the third aspect or any possible implementation manner of the third aspect.

[0321] The first node includes the communication device described in the fourth aspect or any possible implementation manner of the fourth aspect.

[0322] Optionally, the first node includes one or more modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, a keyless entry, a starting system controller, and a user equipment (UE).

[0323] Optionally, the second node includes one or more modules such as a gateway, a base station, a vehicle cockpit domain controller (CDC), etc. Alternatively, the above-mentioned vehicle can also be replaced by an intelligent terminal or transportation tool such as a drone or a robot.

[0324] The beneficial effects of the technical solutions provided in the second to eleventh aspects of this application can refer to the beneficial effects of the technical solution in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0325] The following is a brief introduction to the drawings used in describing the embodiments.

[0326] FIG1 is a schematic diagram of a point addition operation provided by an embodiment of the present application;

[0327] FIG2 is a schematic diagram of a communication system provided in an embodiment of the present application;

[0328] FIG3 is a schematic diagram of a communication scenario provided in an embodiment of the present application;

[0329] FIG4 is a flow chart of a communication method provided in an embodiment of the present application;

[0330] FIG5 is a flow chart of a method for determining common parameters provided by an embodiment of the present application;

[0331] FIG6 is a flow chart of another communication method provided in an embodiment of the present application;

[0332] FIG7 is a flow chart of another communication method provided in an embodiment of the present application;

[0333] FIG8 is a schematic structural diagram of another communication device provided in an embodiment of the present application;

[0334] FIG9 is a schematic structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0335] In order to facilitate understanding of the detailed implementation of the embodiments of the present application, the technical terms involved in the embodiments of the present application are described below.

[0336] 1. Node

[0337] A node is an electronic device with communication capabilities, also known as a communication node. For example, a node can include standalone devices such as handheld terminals, vehicles, on-board equipment, or network-side equipment, user equipment, access terminals, subscriber units, user stations, mobile stations, mobile stations, remote stations, remote terminals, wireless communication devices, user agents, or user devices. It can also be a component (such as a chip or integrated circuit) included in a standalone device. A node can be any possible intelligent terminal device (such as a mobile phone), intelligent transportation equipment (such as vehicles, drones, etc.), intelligent manufacturing equipment, smart home devices (such as large screens, speakers, etc.), etc.

[0338] For example, when a node is an in-vehicle device, it can be a cockpit domain device or a module within the cockpit domain device, such as one or more of a cockpit domain controller (CDC), camera, screen, microphone, audio system, electronic key, keyless entry or start system controller, etc. Within a vehicle, a node can also be a battery management system or a battery in a battery pack.

[0339] For example, when the node is a handheld terminal, it can be a mobile phone, a wearable device, a tablet computer (pad), or a computer with data transceiver functions (such as a laptop computer, a PDA, etc.).

[0340] The nodes in the embodiments of the present application can be applied to a variety of application scenarios, such as the following application scenarios: mobile internet (MI), industrial control, self-driving, transportation safety, Internet of Things (IoT), smart city, or smart home, etc.

[0341] The nodes in this application can be applied to various network types, for example, one or more of the following network types: long term evolution (LTE) network, fifth generation mobile communication technology (5G), wireless local area network (for example, Wi-Fi), Bluetooth (BT), Zigbee, SparkLink, or vehicle-mounted short-range wireless communication network, etc.

[0342] In some application scenarios or certain network types, devices with similar communication capabilities may not be called nodes. However, for the convenience of description, in the embodiments of the present application, devices with communication capabilities are collectively referred to as nodes.

[0343] 2. Security Algorithm (or Cryptographic Algorithm)

[0344] (1) Key Agreement Algorithm

[0345] Key agreement is the process by which two communicating parties exchange parameters to negotiate a key. The algorithm used for key agreement is called a key agreement algorithm, or key negotiation algorithm. Key agreement algorithms include the Two-Basis Password Exponential Key Exchange (TBPEKE) algorithm, the Diffie–Hellman key exchange (DH) algorithm, the DH algorithm based on Elliptic Curve Cryptosystems (ECC), national secret algorithms (such as SM2), and the Oakley algorithm.

[0346] It should be noted that the key agreement algorithm can also be regarded as a key agreement protocol, that is, for the two communicating parties, the key agreement algorithm defines the rules for key generation and exchange.

[0347] (2) Key derivation function (KDF)

[0348] A key derivation algorithm (also known as a key derivation algorithm) is used to deduce (or derive) one or more secret values ​​from a single secret value. For example, a new secret value DK derived from a secret value Key can be expressed as: DK = K DF(Key). Of course, the key here is merely an example; other parameters may also be involved in the key derivation process during implementation.

[0349] The key derivation algorithms involved in the embodiments of the present application may include password-based key derivation function (PBKDF), Scrypt algorithm, etc. Among them, the PBKDF algorithm includes the first generation PBKDF1 and the second generation PBKDF2.

[0350] It should be understood that some KDF algorithms can perform hash changes on the input secret value through a hash algorithm, so the KDF function can also receive an algorithm identifier as an input to indicate which hash algorithm to use.

[0351] It should be noted that KDF is not only used to derive secret values, but can also be used to generate authentication information, identity information, etc. In some possible implementations, when generating authentication information and identity information, the key derivation algorithm may also be called an authentication function (AUF, or AUTH function), which is used to obtain authentication information based on input parameters.

[0352] (3) Encryption algorithm

[0353] Encryption algorithms are used to protect data confidentiality and can encrypt plaintext to produce ciphertext. These algorithms can include cryptographic operations (such as elliptic point addition or exclusive-or operations) or various highly secure mathematical functions. Common encryption algorithms include exclusive-or operations, the Data Encryption Standard (DES), the Triple Data Encryption Algorithm (3DES), the Advanced Encryption Standard (AES), the RSA encryption algorithm, the Data Structure Analysis (DSA) algorithm, national secret algorithms (such as SM4), and the Zu Chongzhi Algorithm Suite (ZUC algorithms, such as the Zu Chongzhi algorithm, Encryption Algorithm 128-EEA3, or Integrity Algorithm 128-EIA3).

[0354] TBPEKE algorithm

[0355] In the embodiments of the present application, the TBPEKE algorithm is a security algorithm based on the mathematical theory of elliptic curves. It allows two communicating parties to establish a key in an insecure channel. This key can be used as a key to encrypt the communication content in subsequent communications. Optionally, the elliptic curve used by the TBPEKE algorithm in the embodiments of the present application includes one or more of the following elliptic curves: the elliptic curve defined by SM2 or Curve25519, etc.

[0356] The following is an introduction to elliptic curves.

[0357] The curve equation of an elliptic curve is a cubic equation of two variables. It has many forms, the most commonly used of which is the following general formula:

[0358] E={(x,y)∈R|y 2 =x 3 +ax+b,4a 3 +27b 2 ≠0}

[0359] It is easy to see from the curve equation that the elliptic curve is symmetric about the X axis. 3 +27b 2 ≠0 means that the elliptic curve has no singular points, that is, it is smooth and differentiable everywhere, which facilitates various operations on the elliptic curve: the details are as follows:

[0360] a. Elliptic Curve Point Addition Operation

[0361] See Figure 1, which is a schematic diagram of a possible point addition operation provided by this application. Referring to part (a) of Figure 1, the addition operation of the elliptic curve can be represented as follows: the curve (in Figure 1, the elliptic curve with a=0, b=7 is taken as an example, that is: y2=x 3 +7) Mark points P and Q on the curve. Draw a straight line through points P and Q that intersects the curve at a third point, -R. Continue with the line to draw a point R symmetrical about the X-axis about -R. Point R is the sum of points P and Q, and is written as P + Q = R.

[0362] It should be noted that the elliptic curve is symmetric about the X-axis, so R is the symmetric point of point -R. Since point -R is on the elliptic curve, point R must also be on the elliptic curve, that is, the point obtained by P+Q is on the elliptic curve.

[0363] Referring to part (b) of Figure 1, when P = Q, a tangent line is drawn to the elliptic curve using point P as the tangent point. This tangent line intersects the elliptic curve at another point, denoted as -R. Similarly, a point R is drawn that is symmetric to -R about the X-axis. This point R is the sum of points P and P, denoted as P + P = 2P = R.

[0364] b. Elliptic curve point subtraction operation

[0365] Refer to part (c) of Figure 1. Since RP = R + (-P), finding (RP) is the addition of points R and -P. And point -P is the symmetric point of point P. Therefore, draw a line through points R and -P. Since the elliptic curve is symmetric about the X-axis, it can be seen that the line and the elliptic curve are tangent at point -P. Therefore, draw a point P that is symmetric about the X-axis to point -P. Point P is the sum of points R and -P.

[0366] c. Elliptic curve point multiplication operation

[0367] By adding a point on an elliptic curve n times, we get the result of adding n points P, denoted as nP. The number of additions, n, is an integer, known as a scalar. Point multiplication on an elliptic curve is called scalar multiplication. When multiple scalars are involved, it's called multi-scalar multiplication.

[0368] It should be noted that the point multiplication algorithm may have different definitions in different computing scenarios. The implementation depends on the specific definition of the point multiplication algorithm. Here is a possible calculation method of the elliptic curve point multiplication algorithm.

[0369] The following introduces elliptic curves suitable for cryptographic algorithms.

[0370] The elliptic curves provided above are continuous and defined over the real number field, making them unsuitable for use in encryption. Therefore, elliptic curves used in cryptographic algorithms are typically defined over finite fields, which are sets with a finite number of elements. By constraining the finite field, points on the ellipse can generate cyclic subgroups.

[0371] The point addition and point product of elliptic curves over finite fields are slightly different from those over real number fields. For details, please refer to the definitions in the prior art.

[0372] For a selected elliptic curve, given a scalar k and a point G, calculating R = k*G (* represents the elliptic curve point multiplication) is easy. However, given a point G and a point R (both points G and R lie on the elliptic curve), determining which k such that kG = R is extremely difficult. This is because in practical elliptic curves, G and R are typically quite large, making calculating each k point and comparing them to R a mathematically challenging task. This is the discrete logarithm problem on elliptic curves.

[0373] The following describes the key exchange process based on the TBPEKE algorithm.

[0374] Assume that the two parties involved in the key exchange are the first and second nodes, and that they share a security parameter s. The elliptic curve used by the TBPEKE algorithm is E, with U and V being two points on the elliptic curve. The key exchange between the first and second nodes proceeds as follows:

[0375] Step 1: The first node calculates the intermediate parameter b, b = (U + s * V), where "+" represents point addition on the elliptic curve, "*" represents point multiplication on the elliptic curve, and "." in subsequent equations represents ordinary multiplication. The first node generates a random number as its private key SKt and calculates the public key PKt = SKt * (U + s * V), where the public key PKt serves as the key agreement parameter KEt.

[0376] Step 2: The first node sends the key negotiation parameter KEt to the second node.

[0377] Step 3: The second node calculates the intermediate parameter b, b = (U + s * V). A random number is generated as the second node's private key SKg. The second node calculates the public key PKg, PKg = SKg * (U + s * V), where the public key PKg serves as the key negotiation parameter KEg.

[0378] Step 4: The second node sends the KEg to the first node.

[0379] Step 5: The second node obtains the key K based on the second node's private key and the first node's public keyKE ,Right now:

[0380] K KE =SKg*KEt=SKg*(SKt*b)=(SKt.SKg)*(U+s*V).

[0381] Step 6: The first node obtains the key K based on the private key of the first node and the public key of the second node KE ',Right now:

[0382] K KE ′=SKt*KEg=SKt*(SKg*b)=(SKt.SKg)*(U+s*V).

[0383] And K KE =(SKt.SKg)*(U+s*V)=K KE ′, that is, both parties obtain the same key K KE Since the key K KE Without direct transmission, it is difficult for the attacker to calculate K from the obtained U, V, KEt, and KEg. KE , so the key K obtained by exchanging the TBPEKE algorithm is KE It is safe.

[0384] It is understood that the aforementioned explanation of the algorithm is merely a brief description of the implementation principle and does not necessarily require the use of the same parameters. Other improvements and variations may be made during the specific implementation of the algorithm, and the algorithms mentioned in this application may be improved and / or variant algorithms.

[0385] 4. Fresh parameters

[0386] A freshness parameter is a parameter used in information security to generate keys and authentication parameters, also known as freshness. Freshness parameters can include one or more of a random number, a counter, a serial number, or a sequence number. Freshness parameters generated at different times are typically different.

[0387] It can be understood that the specific value of the fresh parameter will change each time the fresh parameter is generated, so that the fresh parameter used to generate the key (or authentication parameter, etc.) this time is different from the fresh parameter used when the key (or authentication parameter, etc.) was generated last time, which can improve the security of the generated key.

[0388] The non-repeating random number (number once, NONCE) is a (non-repeating) random number that is used only once.

[0389] 5. Password

[0390] A password can be understood as a pre-configured or pre-defined password that a node uses to allow other nodes to access it, or as a secret value agreed upon between two nodes. Optionally, a password can be a string (or number) consisting of one or more numbers, letters, symbols, etc., and can be entered through a keyboard, voice, biometric information, etc. For example, in a scenario where a mobile phone terminal accesses a router that supports the Wireless Fidelity (Wi-Fi) protocol, the mobile phone terminal can use the "Wi-Fi password" to access the router, and the "Wi-Fi password" can be understood as the router's password.

[0391] For ease of understanding, this application exemplifies several possible password usage scenarios (taking the first node requesting access to the second node as an example):

[0392] Scenario 1: The second node has a predefined or preconfigured first password. The user of the first node can enter the first password in the first node to access the second node. For example, a car owner configures a first password for their vehicle through the administrator interface. When the owner's smartphone needs to access the vehicle, they enter the first password in their smartphone. The smartphone then requests access to the vehicle based on the entered first password.

[0393] Scenario 2: The second node predefines or preconfigures the first password. Similarly, the first node also preconfigures the first password for accessing the second node. When accessing the second node is needed, the first node can use the preconfigured first password. For example, when assembling a vehicle, the OEM can configure the first password in the vehicle's CDC and the CDC's first password in the vehicle's radar. This way, the radar can use the CDC's first password to access the CDC.

[0394] Scenario 3: A third-party device (such as a network-side device, a certificate center, an authentication server, etc., trusted by the second node) can assign an agreed value to the second node and the first node. The agreed value can be used for the first node to access the second node. The agreed value can be called the access password of the second node.

[0395] It should be noted that the association between parameters indicates that there is a connection between the parameters. For example, parameter A is associated with parameter B, which means that there is a corresponding relationship (or mapping relationship) between parameter A and parameter B, or that parameter B is used in the calculation process of parameter A (other parameters can also be used optionally).

[0396] The terms "authentication," "verification," and "verification" mentioned in the various embodiments of this application may refer to checking whether something is correct or reasonable. The term "access" mentioned in the various embodiments of this application indicates the process of establishing a connection between a first node and a third node. In some specific technical scenarios, the process of one node "accessing" another node may also be described as one node "associating" with another node.

[0397] In addition, in each embodiment of the present application, unless otherwise specified, "*" represents an elliptic curve point multiplication operation, "+" represents an elliptic curve point addition operation, and "." represents a multiplication operation.

[0398] The following describes the system architecture and business scenarios of the embodiments of the present application. It should be noted that the system architecture and business scenarios described in this application are intended to more clearly illustrate the technical solutions of this application and do not constitute a limitation on the technical solutions provided by this application. It is known to those skilled in the art that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided by this application are equally applicable to similar technical problems.

[0399] 2 is a schematic diagram of a possible communication system provided by an embodiment of the present application, wherein the communication system includes a first node 201 and a second node 202. The first node 201 can request to associate with the second node 202. After the association is successful, the second node 202 can perform data transmission with the first node 201.

[0400] Optionally, the communication link between the second node 202 and the first node 201 may include various types of connection media, including a wired link (e.g., optical fiber), a wireless link, or a combination of a wired link and a wireless link. For example, the short-range connection technology may include SparkLink, 802.11b / g, Bluetooth, Zigbee, radio frequency identification (RFID), ultra-wideband (UWB) technology, or a wireless short-range communication system (e.g., a vehicle-mounted wireless short-range communication system). For another example, the long-range connection technology may include a communication technology based on Long Term Evolution (LTE), fifth-generation mobile communication technology (5th generation mobile networks or 5th generation wireless systems, 5th-Generation, referred to as 5G or 5G technology), global system for mobile communications (GSM), general packet radio service (GPRS), universal mobile telecommunications system (UMTS), and other wireless access type technologies.

[0401] In some specific implementation scenarios, the second node may be referred to as a G node, a control node, or an access point. The first node may be referred to as a T node or a terminal. The communication link from a G node to a T node may be referred to as a G link, and the communication link from a T node to a G node may be referred to as a T link.

[0402] It should be understood that the systems shown in the figures of this application are merely examples, in which the number, location, and connection relationship of the nodes are shown as a possible situation for the convenience of description and are not intended to limit the specific communication system and communication scenario.

[0403] Second node 202 and first node 201 can be the same or different types of devices. For example, see Figure 3, which illustrates a possible communication scenario. The vehicle's cockpit domain controller (CDC) 302 is the control center of the vehicle's intelligent cockpit devices and can be considered the second node 202. Smartphone 301 is a device capable of transmitting and receiving data and can be considered the first node 201.

[0404] CDC 302 can be accessed via short-range communication technology, and smartphone 301 supports short-range communication technology, so smartphone 301 can request access to CDC 302. If the short-range communication technology uses digital pairing for access, smartphone 301 can simply click on the CDC 302 logo and confirm the pairing number with CDC 302 to connect to CDC 302 via short-range communication technology. In this case, if an attacker impersonates smartphone 301 to connect to CDC 302, CDC 302 will find it difficult to identify the attacker, resulting in successful access to CDC 302, threatening the privacy and safety of the vehicle.

[0405] Similarly, in other scenarios, nodes are often vulnerable to unidentified attackers, compromising communication security. For example, CDC302 supports access via a first password. The user enters the password into smartphone 301, and CDC302 connects after confirming that the password is correct. However, passwords are typically short for ease of input and memorization. If the password is used directly to obtain the communication key during communication, an attacker could potentially use brute force or offline cracking to obtain the CDC302 password, threatening the privacy and security of the vehicle.

[0406] In view of this, the communication method and device of the embodiments of the present application are provided to reduce the possibility of a node being successfully associated with an attacker whose identity is untrustworthy, thereby improving node security.

[0407] The method of the embodiment of the present application is described in detail below.

[0408] Please refer to Figure 4, which is a flow chart of a communication method provided in an embodiment of the present application. Optionally, the method can be implemented based on the communication system shown in Figure 2. The communication method shown in Figure 4 may include one or more steps from step S401 to step S406. It should be understood that this application is described in the order of S401 to S406 for the convenience of description, and is not intended to be limited to execution in the above order. The embodiment of the present application does not limit the order of execution, execution time, number of executions, etc. of the above one or more steps. S401 to step S406 are as follows:

[0409] Step S401: A first node sends a first message to a second node. Correspondingly, the second node receives the first message from the first node, wherein the first message includes a first key negotiation parameter.

[0410] Specifically, the key negotiation parameter is a parameter used in the key negotiation process. For the convenience of description, in each embodiment of the present application, the key negotiation parameter provided by the first node is referred to as the first key negotiation parameter.

[0411] In the embodiment of the present application, the first key negotiation parameter is associated with the first private key and an intermediate parameter, and the intermediate parameter is associated with the security parameter and the public parameter.

[0412] For ease of understanding, the following first introduces security parameters and public parameters.

[0413] (1) Security parameters may include a shared key between the first node and the second node (including a pre-shared key, a symmetric encryption key, etc.), a first password, pre-configured parameters between the first node and the second node, or parameters pre-defined in the communication protocol. For example, a pre-shared key (PSK) is a secret value shared between the first node and the second node. The PSK shared with the first node may be pre-defined, pre-configured, or generated through mutual negotiation.

[0414] The first password is the agreed-upon access password between the first and second nodes. It can also be understood as a password pre-configured or pre-defined by the second node (or the first node) to allow other nodes to access it, or as a secret value agreed upon between the first and second nodes. For more information about the first password, see the explanation of technical terms.

[0415] As a possible solution, if the first node has a PSK with the second node, the PSK is used as the security parameter. If the first node does not have a PSK with the second node, the first password is used as the security parameter. In other words, the first node preferentially uses the PSK to participate in the key negotiation process.

[0416] The first private key is determined by the first node and is the private key of the first node. The first private key can be a random number. Optionally, when the first node and the second node negotiate the key through the TBPEKE algorithm, the value range of the first private key is: [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm, or p is the order of the group related to the elliptic curve. It should be understood that "TBPEKE algorithm" is an algorithm name provided as an example in the embodiment of this application. During implementation, key negotiation algorithms using the same or similar parameters and calculation methods all fall within the scope of this application, although they may not be called "TBPEKE algorithm".

[0417] (2) Public parameters are parameters that can be used by multiple parties during the key negotiation process. The number of public parameters can be one or more, depending on the specific implementation. Optionally, when the first node and the second node select different key negotiation algorithms for key negotiation, the number and determination method of the public parameters may differ.

[0418] The following are several possible implementation methods for determining public parameters:

[0419] Implementation method 1: pre-define or pre-configure public parameters. Exemplarily, the number and value of public parameters are defined by a protocol. When a first node and a second node are associated through a protocol, key negotiation parameters are determined based on the public parameters defined by the protocol. Exemplarily, public parameters are pre-configured in multiple communicating parties (e.g., a first node and a second node). Exemplarily, public parameters are pre-configured in the second node (or the first node), and the second node can send them to other nodes via a message. The communicating parties determine the key negotiation parameters based on the consistent public parameters.

[0420] Implementation method 2: A node determines a parameter as a public parameter. The number of public parameters is not limited. Optionally, the number of public parameters can be one or more.

[0421] For example, the second node may generate a random number and use the random number as a public parameter.

[0422] For another example, the second node determines two points in the group of the first elliptic curve, and these two points serve as common parameters. For example, the first node selects a point as a base point (referred to as the first base point for ease of distinction), and obtains a second point (also referred to as the second base point) by performing an operation on the base point.

[0423] Optionally, the group may be a group related to operations on the first elliptic curve, where the operations on the elliptic curve include one or more operations such as elliptic curve point multiplication and elliptic curve point addition. Furthermore, the order corresponding to the group is p, which can be defined by the node, standard, manufacturer, or user. In various embodiments of the present application, the order p can be a prime number.

[0424] Implementation method three: Some common parameters are pre-defined, and some parameters are determined by the nodes.

[0425] For example, the number of public parameters may be two, wherein one public parameter is predefined, and the other public parameter is determined based on a known public parameter and random numbers provided by the first node and the second node respectively.

[0426] As a possible implementation, when the key agreement algorithm between the first node and the second node is the TBPEKE algorithm, the at least one public parameter includes: a group of order p (or some elements of the group), and / or a first base point and a second base point in the group. Optionally, the group may be a group related to operations on a first elliptic curve, where the operations on the elliptic curve include one or more operations such as elliptic curve point multiplication and elliptic curve point addition.

[0427] As another possible implementation, the second node can receive a first calculated value from the first node, the first calculated value is related to the first random number and the first public parameter, and the first random number is determined by the first node (in an embodiment of the present application, determination includes one or more of the operations of receiving, copying, reading or generating). The first public parameter is predefined, for example, obtained by protocol provisions, manufacturer configuration, or user input. The second node determines the second public parameter based on the second random number and the first calculated value. The second node sends a second calculated value to the first node, and the second calculated value is related to the second random number and the first public parameter. Furthermore, the first node can receive a second calculated value from the first node, and obtain a second public parameter consistent with the first node based on the second calculated value and the first random number.

[0428] FIG5 illustrates a possible process for determining public parameters provided by an embodiment of the present application. The public parameters include two base points U and V, where U is a predefined base point and U and V belong to a cyclic group of order p, where p is a prime number. The elliptic curve used may be an elliptic curve defined by the selected key agreement algorithm. The process shown in FIG5 may specifically include steps S51 to S55, as follows:

[0429] Step S51: The first node generates a random number x and calculates X=x*U.

[0430] Where * is the dot product operation, and X is the first calculated value.

[0431] Step S52: The first node sends X to the second node. Correspondingly, the second node receives X from the first node.

[0432] Step S53: The second node generates a random number y, calculates Y=y*U, and calculates V=y*X.

[0433] Where "*" is a dot multiplication operation. Y is the second calculated value mentioned above, and V is the second base point. Optionally, since X = x * U, V = y * X = y * (x * U) = (xy) * U, and "." is a multiplication operation.

[0434] Step S54: the second node sends Y to the first node. Correspondingly, the first node receives Y from the second node.

[0435] Step S55: The first node calculates V=x*Y.

[0436] Since Y = y*U, V = x*Y = x*(y*U) = (xy)*U, where "." represents a multiplication operation. Therefore, the second node and the first node can determine a consistent V through the embodiment shown in FIG5 . It should be noted that FIG5 is described sequentially from step S51 to step S52 for ease of description, and this application does not limit the order, execution, or number of executions of the steps.

[0437] The preceding describes public and security parameters. The following uses the TBPEKE algorithm as an example to provide two possible solutions for the first key negotiation parameter:

[0438] Solution 1: The first node calculates the intermediate parameter b based on the first password pw and the public parameters (U and V): b = (U + pw * V), where U and V are the first and second base points on the elliptic curve used by the TBPEKE algorithm. The first node generates a random number as the first private key SKt and calculates the first public key PKt, where PKt = SKt * b = SKt * (U + pw * V). This first public key PKt serves as the key agreement parameter KEt.

[0439] In some possible designs, points on the same elliptic curve can be added or multiplied. Therefore, if a parameter is not a point on the elliptic curve, the parameter can be mapped to a point on the elliptic curve before performing a point addition (or point multiplication) operation. Taking the first private key SKt as an example, a possible mapping method is as follows: the first node can use SKt as the horizontal coordinate (if it exceeds the domain of definition, SKt can be modulo), and obtain the mapping point R (SKt, y) on the elliptic curve. SKt can then be replaced by point R. Optionally, when a value of SKt corresponds to multiple y values, the conditions that the y value needs to meet can be agreed in advance to determine the corresponding point.

[0440] Solution 2: The first node calculates the intermediate parameter b based on the PSK and public parameters (U and V): b = (U + PSK * V), where + represents point addition and * represents point multiplication on the elliptic curve. The first node generates a random number as the first private key SKt and calculates the first public key PKt, where PKt = SKt * (U + PSK * V). This first public key PKt serves as the key agreement parameter KEt.

[0441] It should be noted that, in order to more clearly illustrate the solution, the above solution uses multiple steps to explain how to obtain the key negotiation parameter KEt. In actual processing, this can also be completed in a single step, and the intermediate parameters, the first public key, etc. may only be internal results. That is, the key negotiation parameter KEt satisfies: KEt = SKt * (U + s * V).

[0442] Optionally, the first node may also send key agreement algorithm indication information to the second node, indicating the algorithm used during the key agreement process. Specifically, this indication information may be indicated by a field (referred to as the first field for ease of description). For example, the first field may be the KE alg field. Different values ​​of the first field may indicate the algorithm used by the first node during the key agreement process. Optionally, the key agreement algorithm indication information may also be included in the aforementioned first message.

[0443] Please refer to Table 1, which shows the values ​​and description of the indication information of a possible key negotiation algorithm provided in an embodiment of the present application. As shown in Table 1, when the value of the first field is 0x003, it indicates that the key is negotiated using the TBPEKE algorithm, and the elliptic curve used by the TBPEKE algorithm is the elliptic curve defined by the SM2 algorithm. Similarly, when the value of the first field is 0x001, it indicates that the first node selects the SM2 algorithm to negotiate the key. The remaining values ​​are similar and will not be detailed here.

[0444] Table 1 Possible values ​​and descriptions of the first field

[0445] Value Description 0x001SM2 0x002ECDH, elliptic curve based on curve25519 0x003TBPEKE, elliptic curve based on SM2 0x004TBPEKE, elliptic curve based on curve25519 …………

[0446] It should be understood that Table 1 is an exemplary field value and does not limit the indication information. In the specific implementation process, the format, number of bits, value and algorithm correspondence of the indication information may also have other designs.

[0447] As a possible solution, the second node can send (via broadcast, multicast, or unicast) its key agreement algorithm capabilities, which represent the key agreement algorithms supported by the second node. Accordingly, the first node selects a key agreement algorithm based on the key agreement algorithms supported by the second node. The first node sends key agreement algorithm indication information to the second node, indicating the key agreement algorithm it has selected.

[0448] Optionally, the second node carries its identity and supported key agreement algorithms in a broadcast message (or access message). The key agreement algorithms are arranged in order of priority, for example, algorithms with higher priority may be arranged first. The identity of the second node includes the second node's identifier (ID), domain ID, media access control (MAC) address, domain name, domain address, or other custom identifier, also referred to as the device identifier of the second node.

[0449] To facilitate understanding, the following example provides a possible solution: the second node supports the SM2 algorithm (identifier: 0x001), the ECDH algorithm (identifier: 0x002), the SM2-based elliptic curve TBPEKE algorithm (identifier: 0x003), and the curve25519-based elliptic curve TBPEKE algorithm (identifier: 0x004), with priorities 1, 2, 3, and 4, respectively (a higher number indicates a higher priority). In the broadcast message, the second node's key agreement algorithm capabilities are: "0x004, 0x003, 0x002, 0x001."

[0450] As a possible solution, the first key agreement algorithm is the key agreement algorithm supported by the first node, and the first key agreement algorithm has the highest priority among the key agreement algorithms supported by the second node. For example, the key agreement algorithms supported by the second node are: Algorithm A, Algorithm B, Algorithm C, and Algorithm D, with priorities of 4, 3, 2, and 1, respectively (the larger the number, the higher the priority). The key agreement algorithms supported by the first node are: Algorithm B, Algorithm D, and Algorithm E. The algorithms supported by both the first and second nodes are: Algorithm B and Algorithm D. Since Algorithm B has the highest priority, the first node selects Algorithm B as the algorithm to use for key agreement.

[0451] Of course, the first node can select the algorithm with the highest priority in the first node among the algorithms supported by both the first and second nodes. For example, the key agreement algorithms supported by the second node are: Algorithm A, Algorithm B, Algorithm C, and Algorithm D, with priorities of 4, 3, 2, and 1, respectively (the larger the number, the higher the priority). The key agreement algorithms supported by the first node are: Algorithm B, Algorithm D, and Algorithm E, with priorities of 1, 2, and 3, respectively (the larger the number, the higher the priority). The algorithms supported by both the first and second nodes are: Algorithm B and Algorithm D. Since the priority of Algorithm D is higher than that of Algorithm B, the first node selects Algorithm D as the algorithm to be used for key agreement.

[0452] Optionally, there may be other configurations for setting the priority, for example, by specifying the priorities of various algorithms through a protocol, and determining which algorithm to use based on the priorities specified by the protocol.

[0453] Optionally, the first message may also include a fresh parameter (fresh value) for easy distinction. Hereinafter, the fresh parameter provided by the first node is referred to as the first fresh parameter. The fresh parameter includes at least one of a random number (e.g., a NONCE), a count value, a sequence number, and the like. In various embodiments of the present application, the description is based on an example in which the fresh parameter includes a NONCE, but the present application is applicable to all types of fresh parameters. For ease of explanation, the first fresh parameter is represented by NONCEt.

[0454] Optionally, the first message further includes the identity of the first node, wherein the identity of the first node includes the ID, MAC address, domain name, domain address or other custom identifier of the first node, also referred to as the device identifier of the first node.

[0455] It should be noted that, in specific scenarios, the first message can be referred to as an access request message (or access request information), or can be referred to as an association request message (or association request information). In the various embodiments of this application, the names of the messages or information are not limited, and only the message content is exemplarily described and expressed. The names of the messages can be replaced.

[0456] It should be understood that this application uses the first message, second message, etc. as carriers for carrying data in order to facilitate the description of parameter transmission. In the specific implementation process, the first message can be one message or multiple messages. There is no limit on the number of messages contained in the first message. Similarly, there is no limit on the number of messages contained in the subsequent second message and third message. For example, when the first node sends the first key negotiation parameter and the first fresh parameter to the second node, the first key negotiation parameter can be carried by message 1, and the first fresh parameter can be carried by message 2. At this time, message 1 and message 2 are included in the first message.

[0457] Step S402: The second node sends a second message to the first node. Correspondingly, the first node receives the second message from the second node, wherein the second message includes a second key negotiation parameter.

[0458] Specifically, in each embodiment of the present application, the key negotiation parameter provided by the second node is referred to as a second key negotiation parameter. The second key negotiation parameter is associated with the second private key and an intermediate parameter, and the intermediate parameter is associated with the security parameter and the public parameter.

[0459] The second private key is a private key determined by the second node. The second private key can be a random number generated by the second node. Optionally, when the first and second nodes negotiate a key using the TBPEKE algorithm, the value range of the second private key is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm, or p is the order of the group. For detailed descriptions of security parameters and public parameters, please refer to the relevant description in step S401.

[0460] As a possible solution, the second key negotiation parameter can be expressed as follows: KEg = SKg*b, where b = (U + s*V), where SKg is the second private key, b is an intermediate parameter, U and V are public parameters, and s is a security parameter. Alternatively, the second key negotiation parameter can be expressed as follows: KEg = SKg*(U + s*V).

[0461] Optionally, the second message further includes a fresh parameter. For ease of description, in various embodiments of the present application, the fresh parameter provided by the second node is referred to as a second fresh parameter, and in some embodiments, it is represented by NONCEg.

[0462] Step S403: The second node obtains a first key according to the first key negotiation parameter and the second private key. The first key is associated with the first key negotiation parameter and the second private key.

[0463] As a possible solution, the second node obtains the first key in the following way: first key = SKg*KEt, where SKg is the second private key and KEt is the first key negotiation parameter. Since the first key negotiation parameter KEt satisfies the following formula: KEt = SKt*(U+s*V), the first key K KE The following formula can be satisfied:

[0464] K KE =SKg*KEt=(SKt.SKg)*(U+s*V).

[0465] For ease of description, the processes of determining the first private key and calculating the first key are described separately. However, in some specific designs, the above calculation processes can be encapsulated into a single calculation process, where the input of the calculation process is the first key negotiation parameter and the output is the first key.

[0466] Alternatively, the above process of obtaining the first key is indicated by the TBPEKE algorithm, so the above steps can also be expressed as: the second node obtains the first key based on the TBPEKE algorithm and the first key negotiation parameter.

[0467] Optionally, the first key can also be used to obtain one or more keys. As a possible solution, the first key can be used to derive an encryption key, an integrity key, or an identity authentication key. Exemplarily, the second node can calculate the key Kgt based on the first key. For example, Kgt=KDF(K KE ,NONCEt,NONCEg), where NONCEt is the fresh parameter provided by the first node and NONCEg is the fresh parameter provided by the second node.

[0468] As a possible implementation, the first key may be used to participate in generating identity authentication information to authenticate the identities of both communicating parties.

[0469] For example, the second node can use the first key to obtain the second identity authentication information, and the second authentication information is used to authenticate the identity of the second node and / or to verify whether the keys negotiated by the first node and the second node are consistent. In other words, the second identity authentication information is associated with the first key.

[0470] In some possible designs, the second authentication information may also be associated with one or more of the following parameters: the key Kgt, the PSK, the first fresh parameter, the second fresh parameter, the first message, and the second message. The above-mentioned message may be the entire message or a portion of the message. The following are several possible methods for calculating the second authentication information:

[0471] Calculation method 1, the second authentication information AUTHg satisfies: AUTHg=AUF(K KE ), where K KE is the first key. Of course, in addition to K KE , other parameters may also be involved in generating AUTHg, such as fresh parameters, messages, etc. Exemplarily, AUTHg satisfies: AUTHg=AUF(K KE , NONCEg), or satisfy: AUTHg=AUF(K KE , NONCEt), or satisfy: AUTHg=AUF(K KE , NONCEt, NONCEg).

[0472] Calculation method 2: The second authentication information AUTHg satisfies: AUTHg = AUF(PSK), where PSK is the PSK between the second node and the first node. Alternatively, PSK can be the PSK stored in the second node and corresponding to the identity of the first node.

[0473] Of course, in addition to PSK, other parameters may also be involved in generating AUTHg, such as freshness parameters, messages, etc. Exemplarily, AUTHg satisfies: AUTHg = AUF (PSK, NONCEg), or satisfies: AUTHg = AUF (PSK, NONCEt), or satisfies: AUTHg = AUF (PSK, NONCEt, NONCEg).

[0474] Calculation method 3, the second authentication information AUTHg satisfies: AUTHg = AUF (PSK, K KE , NONCEg, first message), related parameters can refer to the above.

[0475] Calculation method 4: Since the output value of the AUF algorithm may have a long number of bits, the second node can use a portion of the output value to make the second authentication information have a uniform and relatively short number of data bits, thereby reducing the data size of the second message and improving transmission efficiency. For example, AUTHg = AUF(PSK)| N比特 .

[0476] Among them, N bits can be predefined or preconfigured by OEM, manufacturer, standard or user. For example, N bits can be the upper 32 bits, that is, AUTHg satisfies: AUTHg = AUF (PSK, K KE , NONCEg, first news)| 高32 比特 For example, N bits may be the lower 16 bits, and AUTHg satisfies: AUTHg = AUF (PSK, NONCEg) | 低16 比特 .

[0477] Calculation method 5, based on the first key K KE Get the authentication information key Kauth, that is: Kauth = KDF (K KE ), optionally, the parameters involved in generating Kauth may also include one or more of fresh parameters (such as NONCEt, or NONCEg, etc.), random numbers, PSK, or the identity of the first node.

[0478] The identity authentication key can be used to generate the second authentication information. Of course, other parameters such as freshness parameters and messages can also be used to generate the second authentication information. As a possible solution, the second authentication information AUTHg satisfies: AUTHg = AUF (Kauth, NONCEg, first message) | N比特 .

[0479] It should be understood that the order of parameters in the algorithm of this application is only an example. During the specific implementation process, the input order of each parameter can be changed. Alternatively, the AUF algorithm used to generate the authentication information can also be replaced with other cryptographic algorithms, such as KDF algorithms, encryption algorithms, authentication algorithms, etc.

[0480] In the above, the second node uses PSK in some schemes for obtaining the second authentication information and the second key negotiation parameters. The following are two exemplary methods for obtaining PSK:

[0481] Method 1: A correspondence exists between the PSK and the first node's identity on the second node. That is, on the second node, the PSK between the first and second nodes can correspond to the first node's identity. The second node can obtain the corresponding PSK based on the first node's identity and the correspondence (also referred to as the first correspondence for ease of distinction).

[0482] Optionally, the correspondence between the PSK and the identity identifier of the first node can be a correspondence pre-configured and pre-defined correspondence in the second node, or it can be a correspondence saved after the first node and the second node generate the PSK through negotiation. The form of the correspondence can be one or more of a correspondence set, a data table, a database, etc., which is not limited in this application. Referring to Table 2, Table 2 is a possible correspondence set between the PSK and the identity identifier of the first node provided in an embodiment of the present application, and the correspondence set includes the identity identifiers of multiple first nodes, the corresponding PSKs, and the types of PSKs. For example, for the first node with the identity identifier "ID1", the second node can determine that its corresponding PSK is "PSK1" based on the temporary ID "ID1.1". Furthermore, the type of "PSK1" is pre-configured.

[0483] Table 2 Correspondence between PSK and the identity of the second node

[0484] Identity PSK type ID1 (temporary ID1.1) PSK1 pre-configured ID2 (temporary ID2.1) PSK2 generated ID3 (temporary ID3.1) PSK3 generated

[0485] It should be noted that, when the correspondence is preconfigured, the PSK preconfigured between the second node and the first node is the same as the PSK preconfigured between the first node and the second node. When the correspondence is saved after the PSK is generated, the method for generating the PSK and the parameters used by the first and second nodes are also the same.

[0486] Method 2: The second node generates a PSK with the first node. Optionally, the parameters used to generate the PSK may include one or more of the following: the first password, the first fresh parameter, the second fresh parameter, the identity of the first node, or the identity of the second node. It should be understood that the parameters used to generate the PSK by the second node and the first node must be consistent.

[0487] In some scenarios, the second message may be referred to as a security context request message (or security context request information).

[0488] Step S404 (optional): The first node obtains the second key according to the second key negotiation parameter and the first private key.

[0489] The second key corresponds to the second key negotiation parameter and the first private key, and is the key obtained by the first node during the key negotiation process.

[0490] Specifically, the first private key is a private key determined by the first node. In step S401, the first key negotiation parameter is obtained. The first private key may be a random number generated by the first node. Optionally, when the first node and the second node negotiate a key using the TBPEKE algorithm, the value range of the first private key is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm, or p is the order of a group associated with the elliptic curve.

[0491] As a possible solution, the first node obtains the second key in the following way: Second key = SKt*KEg, where SKt is the first private key and KEg is the second key negotiation parameter. Since the second key negotiation parameter KEg satisfies the following formula: KEg = SKg*(U+s*V), the second key K KE (In order to facilitate the first key K KE Distinguish below referred to as K KE ′) can satisfy the following formula:

[0492] K KE ′=SKt*KEg=(SKt.SKg)*(U+s*V).

[0493] Because K KE =(SKt.SKg)*(U+s*V)=K KE ′, so the first node and the second node obtain the same key K by exchanging key negotiation parameters KE .

[0494] For ease of description, the processes of determining the second private key and calculating the second key are described separately. However, in some specific designs, the above calculation processes can be encapsulated into a single calculation process, where the input of the calculation process is the second key negotiation parameter and the output is the second key.

[0495] As another possible solution, the process of obtaining the second key is indicated by the TBPEKE algorithm, so the above steps can also be expressed as: the first node obtains the second key based on the TBPEKE algorithm and the second key negotiation parameters.

[0496] Optionally, the second key can be used to obtain one or more keys. As a possible solution, the second key can be used to obtain an encryption key, an integrity key, an identity authentication key, etc.

[0497] For example, the first node may calculate the key Kgt based on the second key. For example, Kgt=KDF(K KE ′, NONCEt, NONCEg), where NONCEt is the fresh parameter provided by the first node, and NONCEg is the fresh parameter provided by the second node.

[0498] As a possible implementation, the first key may be used to participate in generating identity authentication information to authenticate the identities of both communicating parties, as shown in steps S405 and S406.

[0499] Step S405 (optional): The first node sends a third message to the second node. Correspondingly, the second node receives the third message from the first node, wherein the third message includes the first authentication information.

[0500] The first authentication information is used to authenticate the identity of the first node and / or is used by the second node to verify whether the keys negotiated between the second node and the first node are consistent. The first authentication information is associated with the second key.

[0501] In some possible designs, the optional parameters involved in generating the first authentication information may also include one or more of the key Kgt, PSK, first fresh parameter, second fresh parameter, first message, and second message. The above message may be the entire message or a portion of the message. The following are several possible methods for calculating the first authentication information:

[0502] Calculation method 1, the first authentication information AUTHt satisfies: AUTHt=AUF(K KE ′), where K KE ' is the second key. Of course, in addition to K KE , other parameters may also be involved in generating AUTHt, such as fresh parameters, messages, etc. Exemplarily, AUTHt satisfies: AUTHt=AUF(K KE ', NONCEt), or satisfy: AUTHt=AUF(K KE ', NONCEg), or satisfy: AUTHt=AUF(K KE′, NONCEt, NONCEg).

[0503] Calculation method 2: The first authentication information AUTHt satisfies: AUTHt=AUF(PSK), where PSK is the PSK between the second node and the first node. Alternatively, PSK can also be the PSK stored in the first node and corresponding to the identity of the second node.

[0504] Of course, in addition to PSK, other parameters may also be involved in generating AUTHt, such as freshness parameters, messages, etc. Exemplarily, AUTHt satisfies: AUTHt=AUF(PSK, NONCEg), or satisfies: AUTHt=AUF(PSK, NONCEt), or satisfies: AUTHt=AUF(PSK, NONCEt, NONCEg).

[0505] Calculation method 3, the first authentication information AUTHt satisfies: AUTHt = AUF (PSK, K KE ', second message, NONCEt, key negotiation algorithm capability of the first node), related parameters can refer to the above.

[0506] Calculation method 4: Since the output value of the AUF algorithm may have a long number of bits, the first node can use a portion of the output value to make the first authentication information have a uniform and relatively short number of data bits, thereby reducing the data size of the third message and improving transmission efficiency. For example, AUTHt = AUF(PSK)| N比特 .

[0507] Among them, N bits can be predefined or preconfigured by OEM, manufacturer, standard or user. For example, N bits can be the upper 32 bits, that is, AUTHt satisfies: AUTHt = AUF (PSK, K KE ′, second message, NONCEt, key agreement algorithm capability of the first node)| 高32比特 For example, N bits may be the lower 16 bits, and AUTHt satisfies: AUTHt=AUF(PSK, NONCEg)| 低16比特 .

[0508] Calculation method 5, based on the second key K KE 'Get the authentication information key Kauth, that is: Kauth = KDF (K KE ′), optionally, the parameters involved in generating Kauth may also include one or more of a fresh parameter (such as NONCEt, or NONCEg, etc.), a random number, a PSK, or the identity of the first node, etc.

[0509] The identity authentication key can be used to generate the first authentication information. Of course, other parameters such as freshness parameters and messages can also be used to generate the first authentication information. As a possible solution, the first authentication information AUTHt satisfies: AUTHt = AUF (Kauth, NONCEt, second message, key agreement algorithm capability of the first node) | N比特 .

[0510] Alternatively, the AUF algorithm used to generate the authentication information mentioned above can also be replaced by other cryptographic algorithms, such as KDF algorithm, encryption algorithm, authentication algorithm, etc.

[0511] Optionally, when the second message includes the second authentication information AUTHg, the first node may verify the second authentication information AUTHg according to the second key. If the first node verifies that the second authentication information AUTHg is correct, the first node generates the first authentication information AUTHt.

[0512] As a possible solution, the second node uses the same parameters it obtained to generate AUTHg to generate verification information. If the verification information is consistent with AUTHg, the first node verifies that the second authentication information AUTHg is correct. If the verification information is inconsistent with AUTHg, the first node fails to verify the second authentication information AUTHg.

[0513] Furthermore, the second message may also include integrity verification information, and the first node may verify the integrity of the second message based on the integrity verification information. If the integrity of the second message and the second authentication information are verified successfully, the first node generates authentication information AUTHt.

[0514] The first node may obtain the PSK by obtaining the PSK through a corresponding relationship or generating the PSK through parameters. For related descriptions, please refer to the description of the second node in step S402, which will not be repeated here.

[0515] In some scenarios, the third message may be referred to as a security context response message (or security context response information).

[0516] Step S406 (optional): The second node verifies the first authentication information according to the first key.

[0517] In an optional solution, the second node should use the same parameters as the first node uses to generate the first authentication information to generate verification information. If the verification information is the same as the first authentication information, the verification is successful.

[0518] For example, if the first authentication information AUTHt satisfies: AUTHt=AUF(PSK, K KE', NONCEt, second message)| 高32比特 , then the second node generates the check information check1 = AUF (PSK, K KE ,NONCEt,second message)| 高32比特 If the verification information check1 is the same as AUTHt, the verification is successful.

[0519] As a possible solution, if the first authentication information is verified, the second node sends an association establishment message to the first node. Correspondingly, the first node receives the association establishment message and can establish an association with the second node.

[0520] As another possible solution, if the first authentication information fails to be verified, the second node may disconnect the communication connection with the first node, discard the first message, or discard the third message, etc. For example, if the first authentication information fails to be verified, it means that the first key K in the second node is KE and the second key K of the first node KE ' is different, so the identity of the first node is not trustworthy, and the first node may be a node disguised by the attacker, so the communication connection with the first node is disconnected to avoid accessing the untrustworthy node.

[0521] Optionally, one or more of the first message, second message, third message, association establishment message, etc. may include a message authentication code (MAC). This MAC is information (or a small piece of information) generated by a specific algorithm and can be used to check the integrity of a message segment and, optionally, identity verification. Therefore, the recipient can check the message integrity based on the MAC.

[0522] Optionally, if the second node determines an encryption key, the association establishment message may be encrypted using the encryption key to obtain ciphertext. Accordingly, the second node also determines a decryption key corresponding to the encryption key, and the decryption key may be used to decrypt the ciphertext to obtain the content of the association establishment message.

[0523] In the embodiment shown in Figure 4, the second node first derives an intermediate parameter based on the security parameter and the public parameter, and then uses the intermediate parameter to participate in the generation of the first key negotiation parameter. The security parameter is not directly used to generate the key, nor is the key negotiation parameter. Therefore, even if the security parameter is short in number of bits, the public parameter can be used to enhance the confidentiality of the security parameter, thereby reducing the possibility of the security parameter being compromised. This correspondingly improves the security of the first key, reduces the possibility of an attacker accessing the second node, and enhances the node's communication security and data security.

[0524] Furthermore, the security parameters obtained by the first node need to be consistent with the security parameters in the second node. In this way, the first and second nodes can participate in generating consistent keys using the consistent security parameters. Specifically, when the second node generates the first key, the parameters used include the second private key, the security parameters (in the first node), the public parameters, and the first private key; when the first node generates the second key, the parameters used include the first private key, the security parameters (in the second node), the public parameters, and the second private key. Since the parameters used to generate the first and second keys are the same, if the security parameters in the first and second nodes are consistent, the generated first and second keys are consistent.

[0525] The first node can obtain the first authentication information based on the second key, and the second node verifies the authentication information based on the first key. If the verification is successful, it means that the first key and the second key are consistent, that is, the second node and the first node have the same security parameters, indicating that the identity of the second node is credible.

[0526] When an attacker requests to access the second node, since the attacker does not have security parameters consistent with the second node, the attacker cannot generate a shared key consistent with the second node, making it impossible for the attacker to access the second node. Therefore, the attacker can be prevented from accessing the second node and the second node can be prevented from successfully associating with an attacker whose identity is untrustworthy.

[0527] The method embodiment shown in Figure 4 above includes many possible implementation schemes. Some of the implementation schemes are illustrated below in conjunction with Figures 6 and 7. It should be noted that the relevant concepts, operations or logical relationships not explained in Figure 5 can refer to the corresponding descriptions in the embodiment shown in Figure 4.

[0528] Please refer to Figure 6, which is a method flow chart of a possible communication method provided by an embodiment of the present application. Furthermore, the method can be implemented based on the architecture shown in Figure 2. The communication method shown in Figure 6 may include steps S601 to S611. It should be understood that this application is described in the order of S601 to S611 for the convenience of description, and is not intended to limit execution to the above order. The embodiment of the present application does not limit the order of execution of one or more steps above, the time of execution, the number of executions, etc. S601 to S611 are as follows:

[0529] Step S601: The first node selects the TPPEKE algorithm.

[0530] Specifically, the first node determines, from one or more key agreement algorithms, a key agreement algorithm to use when negotiating a key with the second node. Exemplarily, the available key agreement algorithms include: SM2, ECDH (elliptic curve based on curve25519), TBPEKE (elliptic curve based on SM2), and TBPEKE (elliptic curve based on curve25519).

[0531] As a possible solution, the key agreement algorithm selected by the first node includes the TPPEKE algorithm, that is, the TPPEKE algorithm is used as the algorithm for negotiating the key between the first node and the second node. The elliptic curve used by the TBPEKE algorithm includes one or more of the following elliptic curves: the elliptic curve defined by SM2, or Curve25519, etc. Therefore, the TBPEKE algorithm may include: the TBPEKE algorithm using the elliptic curve defined by SM2, the TBPEKE algorithm using Curve25519, etc. It should be understood that this is an exemplary description made for the convenience of describing the TBPEKE algorithm using different elliptic curves. In the specific implementation process, other elliptic curves can also be used, which are not listed here one by one.

[0532] Optionally, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: a group of order p (or some elements of the group), and / or two base points in the group, such as the first base point and the second base point described above. The group is related to the elliptic curve used by the TBPEKE algorithm.

[0533] In one possible design, the second node includes its supported key agreement algorithms in a broadcast message. The supported key agreement algorithms are prioritized, with higher-priority algorithms listed first. The first node selects a key agreement algorithm based on the second node's key agreement algorithm capabilities. In some possible designs, the algorithm selected by the first node is a key agreement algorithm supported by both the first and second nodes, and has the highest priority among the key agreement algorithms supported by the second node.

[0534] Step S602: The first node generates a first private key SKt and calculates a public key PKt, wherein the public key PKt serves as a first key negotiation parameter KEt.

[0535] Specifically, the first node generates a random number as the private key SKt, where 1≤SKt <p。

[0536] The first node calculates b (intermediate parameter) based on pw (first password), U and V (public parameter), where b = (U + pw * V). The first node calculates the public key PKt based on b and the private key SKt, where PKt = SKt * b.

[0537] The first node uses the public key PKt as the first key negotiation parameter KEt.

[0538] Step S603: The first node sends an association request message to the second node, which carries the ID of the T node, algorithm indication information KE alg, a first key negotiation parameter KEt, and a random number NONCEt.

[0539] KE alg is used to indicate the key agreement algorithm selected by the first node, and NONCEt is a random number determined by the first node.

[0540] Correspondingly, the second node receives the association request message from the first node.

[0541] Step S604: The second node generates a private key SKg and calculates a public key PKg, wherein the public key PKg serves as a second key negotiation parameter KEg.

[0542] Specifically, the second node generates a random number as the private key SKg, where 1≤SKg <p。

[0543] The second node calculates b (intermediate parameter) based on pw (first password), U and V (public parameter), where b = (U + pw * V). The second node calculates the public key PKg based on b and the private key SKg, where PKg = SKg * b.

[0544] The first node uses the public key PKg as the first key negotiation parameter KEg.

[0545] Step S605: The second node determines the first key K according to the private key SKg and the first key negotiation parameter KEt KE .

[0546] Specifically, the second node obtains the first key in the following manner: first key = SKg*KEt. Since the first key negotiation parameter KEt satisfies the following formula: KEt = SKt*(U+pw*V), the first key K KE The following formula can be satisfied:

[0547] K KE =SKg*KEt=(SKt.SKg)*(U+pw*V).

[0548] Optionally, the second node may also be based on the first key K KE Get other derived keys. For example, the second node uses the first key K KE , random number NONCEt and random number NONCEg calculate the shared key Kgt, that is: shared key Kgt = KDF (K KE , NONCEt, NONCEg).

[0549] Step S606: The second node is based on K KE The second authentication information AUTHg is calculated using the PSK.

[0550] The PSK is a shared key between the second node and the first node, which can be generated according to parameters such as a password or pre-configured.

[0551] As a possible solution, the second authentication information is calculated as follows: AUTHg = AUF (PSK, K KE )|High 32 bits.

[0552] As another possible solution, the optional parameters involved in generating the second authentication information may also include one or more of the key Kgt, PSK, the first fresh parameter, the second fresh parameter, the association request message, and the security context request message. Exemplarily, the second authentication information is calculated as follows: AUTHg=AUF(PSK, Kgt) KE ,NONCEg,association request message)| 高32比特 .

[0553] Optionally, the second node may also generate a random number NONCEg.

[0554] Step S607: The second node sends a security context request message to the first node. The security context request message carries the second key negotiation parameter KEg, the random number NONCEg, and the second authentication information AUTHg.

[0555] Correspondingly, the first node receives the security context request message from the second node.

[0556] Step S608: The first node determines the second key K according to the private key SKt and the second key negotiation parameter KEg. KE .

[0557] Specifically, the first node obtains the second key in the following manner: second key = SKt * KEg. Since the second key negotiation parameter KEg satisfies the following formula: KEg = SKg * (U + pw * V), the second key K KE The following formula can be satisfied:

[0558] K KE =SKt*KEg=(SKt.SKg)*(U+pw*V).

[0559] Since the first key K KE =(SKt.SKg)*(U+pw*V)=second key K KE Therefore, the first node and the second node obtain the same key K by exchanging key negotiation parameters. KE.

[0560] Optionally, the first node may also be based on the second key K KE For example, the first node obtains other derived keys based on the second key K KE , random number NONCEt and random number NONCEg calculate the shared key Kgt, that is: shared key Kgt = KDF (K KE , NONCEt, NONCEg).

[0561] Step S609: The first node is based on K KE The first authentication information AUTHt is calculated using the PSK.

[0562] The PSK is a shared key between the second node and the first node, which can be generated according to parameters such as a password or pre-configured.

[0563] As a possible solution, the first authentication information is calculated as follows: AUTHt=AUF(PSK, K KE )|High 32 bits.

[0564] As another possible solution, the optional parameters involved in generating the first authentication information may also include one or more of the key Kgt, PSK, first fresh parameter, second fresh parameter, association request message, and security context request message. Exemplarily, the first authentication information is calculated as follows:

[0565] AUTHt=AUF(PSK, KKE, security context request message, NONCEt, key negotiation algorithm capability of the second node)|high 32 bits.

[0566] As a possible solution, the first node verifies whether the second authentication information AUTHg is correct. If correct, the first node generates the first authentication information AUTHt.

[0567] Optionally, the security context request message includes integrity verification information. If the first node verifies the integrity of the security context request message and the second authentication information AUTHg, the first authentication information AUTHt is generated.

[0568] Step S610: The first node sends a security context response message to the second node. The security context response message carries the first authentication information AUTHt.

[0569] Correspondingly, the second node receives the security context response message from the first node.

[0570] The second node verifies the first authentication information AUTHt and executes step S511 if it is correct.

[0571] Step S611: The second node sends an association establishment message to the first node.

[0572] As a possible solution, the security context response message includes integrity verification information. When the second node verifies the integrity of the security context response message and the first authentication information AUTHt and passes the verification, the second node sends an association establishment message to the first node.

[0573] In the embodiment shown in Figure 6, when a first node requests access to a second node, the first node can select the TBPEKE algorithm based on elliptic curve theory for key negotiation. The public parameters selected during the key negotiation process are located on the elliptic curve. Due to the discrete logarithm problem on the elliptic curve, it is relatively easy to calculate the intermediate parameters using the security parameters and the public parameters. However, it is difficult to decipher the security parameters by obtaining the first key negotiation parameters and the public parameters. Therefore, the TBPEKE algorithm and the public parameters can reduce the possibility of security parameters being deciphered, thereby improving node security.

[0574] When an attacker requests to access the second node, a consistent shared key cannot be generated due to the lack of consistent security parameters, making it impossible for the attacker to access the second node. This can prevent the attacker from accessing the second node and prevent the second node from successfully associating with an untrusted attacker.

[0575] Please refer to Figure 7, which is a flow chart of another possible communication method provided by an embodiment of the present application. Furthermore, the method can be implemented based on the architecture shown in Figure 2. The communication method shown in Figure 7 may include steps S701 to S717. It should be understood that this application is described in the order of S701 to S717 for the convenience of description, and is not intended to limit execution to the above order. The embodiment of the present application does not limit the order of execution of one or more steps above, the time of execution, the number of executions, etc. S701 to S717 are as follows:

[0576] Step S701 (optional): The first node selects a key agreement algorithm.

[0577] Specifically, the first node determines, from one or more key agreement algorithms, a key agreement algorithm to use when negotiating a key with the second node. Exemplarily, the available key agreement algorithms include: SM2, ECDH (elliptic curve based on curve25519), TBPEKE (elliptic curve based on SM2), and TBPEKE (elliptic curve based on curve25519).

[0578] As a possible solution, the key agreement algorithm selected by the first node includes the TPPEKE algorithm, that is, the TPPEKE algorithm is used as the algorithm for negotiating the key between the first node and the second node. The elliptic curve used by the TBPEKE algorithm includes one or more of the following elliptic curves: the elliptic curve defined by SM2, or Curve25519, etc. Therefore, the TBPEKE algorithm may include: the TBPEKE algorithm using the elliptic curve defined by SM2, the TBPEKE algorithm using Curve25519, etc. It should be understood that this is an exemplary description made for the convenience of describing the TBPEKE algorithm using different elliptic curves. In the specific implementation process, other elliptic curves can also be used, which are not listed here one by one.

[0579] Optionally, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: a group of order p (or some elements of the group), and / or two base points in the group, such as the first base point and the second base point described above. The group is related to the elliptic curve used by the TBPEKE algorithm.

[0580] In one possible design, the second node includes its supported key agreement algorithms in a broadcast message. The supported key agreement algorithms are prioritized, with higher-priority algorithms listed first. The first node selects a key agreement algorithm based on the second node's key agreement algorithm capabilities. In some possible designs, the algorithm selected by the first node is a key agreement algorithm supported by both the first and second nodes, and has the highest priority among the key agreement algorithms supported by the second node.

[0581] Step S702: The first node generates a random number x and calculates X=x*U.

[0582] Optionally, step S703 is performed when the key agreement algorithm is the TPPEKE algorithm, where U is a predefined base point.

[0583] Optionally, U belongs to a group of order p (p can be a prime number), and the elliptic curve corresponding to the group is the elliptic curve used by the key agreement algorithm selected by the first node. For example, when the first node selects the TBPEKE (SM2-based elliptic curve) algorithm, U belongs to a point in the group of order p associated with the SM2 elliptic curve (i.e., the second base point).

[0584] Optionally, the first node may send information of a selected elliptic curve to the second node, for describing the elliptic curve related to the first public parameter.

[0585] Step 703 (optional): The first node sends indication information of the key agreement algorithm to the second node. Correspondingly, the second node receives the indication information of the key agreement algorithm from the first node.

[0586] For example, KEalg is used to indicate the key agreement algorithm selected by the first node.

[0587] Alternatively, the first node may send the key agreement algorithm supported by itself to the second node. Accordingly, the second node may obtain the key agreement algorithm selected by the first node based on the same selection method as the first node.

[0588] Step S704: The first node sends X to the second node. Correspondingly, the second node receives X from the first node.

[0589] Optionally, the key agreement algorithm indication information and X may be carried in the same message or sent in different messages.

[0590] Step S705: The second node generates a random number y, calculates Y=y*U, and calculates V=y*X.

[0591] Step S706: The second node generates a private key SKg and calculates a public key PKg, wherein the public key PKg serves as a second key negotiation parameter KEg.

[0592] Specifically, the second node generates a random number as the private key SKg, where 1≤SKg <p。

[0593] The second node calculates b (intermediate parameter) based on pw (first password), U and V (public parameter), where b = (U + pw * V). The second node calculates the public key PKg based on b and the private key SKg, where PKg = SKg * b.

[0594] The first node uses the public key PKg as the first key negotiation parameter KEg.

[0595] Step S707: The second node sends Y to the first node. Correspondingly, the first node receives Y from the second node.

[0596] Step S708: The first node calculates V=x*Y.

[0597] Step S709: Generate a private key SKt and calculate a public key PKt, wherein the public key PKt serves as a first key negotiation parameter KEt.

[0598] Specifically, the first node generates a random number as the private key SKt, where 1≤SKt <p。

[0599] The first node calculates b (intermediate parameter) based on pw (first password), U and V (public parameter), where b = (U + pw * V). The first node calculates the public key PKt based on b and the private key SKt, where PKt = SKt * b.

[0600] The first node uses the public key PKt as the first key negotiation parameter KEt.

[0601] Step S710: The first node sends an association request message to the second node. The association request message carries the first key negotiation parameter KEt, the random number NONCEt, the ID of the T node (optional), and the algorithm indication information KE alg (optional).

[0602] NONCEt is a random number determined by the first node.

[0603] Correspondingly, the second node receives the association request message from the first node.

[0604] Step S711: The second node determines the first key K according to the private key SKg and the first key negotiation parameter KEt KE .

[0605] Specifically, the second node obtains the first key in the following manner: first key = SKg*KEt. Since the first key negotiation parameter KEt satisfies the following formula: KEt = SKt*(U+pw*V), the first key K KE The following formula can be satisfied:

[0606] K KE =SKg*KEt=(SKt.SKg)*(U+pw*V).

[0607] Optionally, the second node may also be based on the first key K KE Get other derived keys. For example, the second node uses the first key K KE , random number NONCEt and random number NONCEg calculate the shared key Kgt, that is: shared key Kgt = KDF (K KE , NONCEt, NONCEg).

[0608] Optionally, the above step S706 can be performed when (or after) performing step S711.

[0609] Step S712: The second node is based on K KE The second authentication information AUTHg is calculated using the PSK.

[0610] The PSK is a shared key between the second node and the first node, which can be generated according to parameters such as a password or pre-configured.

[0611] As a possible solution, the second authentication information is calculated as follows: AUTHg = AUF (PSK, K KE )|High 32 bits.

[0612] As another possible solution, the optional parameters involved in generating the second authentication information may also include one or more of the key Kgt, the PSK, the first fresh parameter, the second fresh parameter, the association request message, and the security context request message. Exemplarily, the second authentication information is calculated as follows: AUTHg = AUF(PSK, KKE, NONCEg, association request message) | 高32比特 .

[0613] Optionally, the second node may also generate a random number NONCEg.

[0614] Step S713: The second node sends a security context request message to the first node. The security context request message carries the second key negotiation parameter KEg, the random number NONCEg, and the second authentication information AUTHg.

[0615] Correspondingly, the first node receives the security context request message from the second node.

[0616] Step S714: The first node determines the second key K according to the private key SKt and the second key negotiation parameter KEg. KE .

[0617] Specifically, the first node obtains the second key in the following manner: second key = SKt * KEg. Since the second key negotiation parameter KEg satisfies the following formula: KEg = SKg * (U + pw * V), the second key K KE The following formula can be satisfied:

[0618] K KE =SKt*KEg=(SKt.SKg)*(U+pw*V).

[0619] Since the first key K KE =(SKt.SKg)*(U+pw*V)=second key K KE Therefore, the first node and the second node obtain the same key K by exchanging key negotiation parameters. KE .

[0620] Optionally, the first node may also be based on the second key K KE For example, the first node obtains other derived keys based on the second key K KE , random number NONCEt and random number NONCEg calculate the shared key Kgt, that is: shared key Kgt = KDF (K KE , NONCEt, NONCEg).

[0621] Step S715: The first node is based on K KE The first authentication information AUTHt is calculated using the PSK.

[0622] The PSK is a shared key between the second node and the first node, which can be generated according to parameters such as a password or pre-configured.

[0623] As a possible solution, the first authentication information is calculated as follows: AUTHt=AUF(PSK, K KE )| 高32比特 .

[0624] As another possible solution, the optional parameters involved in generating the first authentication information may also include one or more of the key Kgt, PSK, first fresh parameter, second fresh parameter, association request message, and security context request message. Exemplarily, the first authentication information is calculated as follows:

[0625] AUTHt=AUF(PSK, KKE, security context request message, NONCEt, key agreement algorithm capability of the second node)| 高32比特 .

[0626] As a possible solution, the first node verifies whether the second authentication information AUTHg is correct. If correct, the first node generates the first authentication information AUTHt.

[0627] Optionally, the security context request message includes integrity verification information. If the first node verifies the integrity of the security context request message and the second authentication information AUTHg, the first authentication information AUTHt is generated.

[0628] Step S716: The first node sends a security context response message to the second node. The security context response message carries the first authentication information AUTHt.

[0629] Correspondingly, the second node receives the security context response message from the first node.

[0630] The second node verifies the first authentication information AUTHt and executes step S511 if it is correct.

[0631] Step S717 (optional): The second node sends an association establishment message to the first node.

[0632] As a possible solution, the security context response message includes integrity verification information. When the second node verifies the integrity of the security context response message and the first authentication information AUTHt and passes the verification, the second node sends an association establishment message to the first node.

[0633] In the embodiment shown in Figure 7, the first node and the second node obtain public parameters U and V by exchanging random numbers based on the elliptic curve defined by the TBPEKE algorithm. When the first node requests access to the second node, the first node can select the TBPEKE algorithm based on elliptic curve theory to perform key negotiation. During the key negotiation process, U and V are used to participate in the generation of key negotiation parameters. Due to the discrete logarithm problem on the elliptic curve, it is relatively easy to calculate the intermediate parameters by using the security parameters and the public parameters. However, it is difficult to crack the security parameters by obtaining the first key negotiation parameters and the public parameters. Therefore, the TBPEKE algorithm and public parameters can reduce the possibility of security parameters being cracked and improve the security of the node.

[0634] When an attacker requests to access the second node, a consistent shared key cannot be generated due to the lack of consistent security parameters, making it impossible for the attacker to access the second node. This can prevent the attacker from accessing the second node and prevent the second node from successfully associating with an untrusted attacker.

[0635] In the embodiments shown in FIG. 6 and FIG. 7 , the first password pw may be replaced by PSK.

[0636] The above describes in detail the method of the embodiment of the present application. The following provides an apparatus of the embodiment of the present application.

[0637] It is understandable that the multiple devices provided in the embodiments of the present application, such as communication devices, include hardware structures, software units, or combinations of hardware structures and software structures for performing the corresponding functions in order to implement the functions in the above-mentioned method embodiments. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different device implementations to implement the aforementioned method embodiments in different usage scenarios, and the different implementations of the devices should not be considered to exceed the scope of the embodiments of the present application.

[0638] The embodiments of the present application can divide the device into functional units. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one functional unit. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical functional division. In actual implementation, other division methods may be used.

[0639] Several possible arrangements are listed below.

[0640] The above describes in detail the method of the embodiment of the present application, and the following provides an apparatus of the embodiment of the present application.

[0641] Please refer to Figure 8, which is a schematic diagram of the structure of a communication device 80 provided in an embodiment of the present application. Optionally, the communication device 80 can be an independent device, such as a node. Alternatively, the communication device 80 can also be a component in an independent device (such as a node), such as a chip or integrated circuit.

[0642] The communication device 80 may include one or more of a receiving unit 801, a sending unit 802, and a processing unit 803. The communication device 80 is used to implement the aforementioned communication method, such as the communication method shown in FIG4, FIG6, or FIG7.

[0643] In one possible design, the communication device 80 includes a receiving unit 801, a sending unit 802 and a processing unit 803, and the communication device 80 is used to implement the method on the second node side in the aforementioned embodiment.

[0644] In a possible implementation, the receiving unit 801 is configured to receive a first message from a first node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node;

[0645] The sending unit 802 is further configured to send a second message to the first node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with a second private key and the intermediate parameter;

[0646] The processing unit 803 is configured to obtain a first key according to the first key negotiation parameter and the second private key.

[0647] In another possible implementation, the receiving unit 801 is further configured to receive a third message from the first node, where the third message includes first authentication information, where the first authentication information is associated with a second key, and where the second key is associated with the second key negotiation parameter and the first private key;

[0648] The processing unit 803 is further configured to verify the first authentication information according to the first key.

[0649] In yet another possible implementation, the first key is used to obtain one or more keys.

[0650] As a possible solution, the first key is used to derive an encryption key, an integrity key, or an identity authentication key.

[0651] In another possible implementation, the sending unit 802 is further configured to:

[0652] If the first authentication information is verified successfully, an association establishment message is sent to the first node.

[0653] In another possible implementation, the sending unit 802 is further configured to:

[0654] When the integrity of the third message and the first authentication information are verified, an association establishment message is sent to the first node.

[0655] In another possible implementation, the receiving unit 801 is further configured to:

[0656] Receive indication information of a key agreement algorithm sent by the first node, where the key agreement algorithm includes a TBPEKE algorithm.

[0657] Optionally, the indication information of the key agreement algorithm includes indication information of a first key agreement algorithm, and the indication information of the first key agreement algorithm is used to indicate a TBPEKE algorithm.

[0658] In yet another possible implementation, the at least one common parameter includes: a first common parameter and a second common parameter;

[0659] The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a key agreement algorithm, and the key agreement algorithm includes the TBPEKE algorithm.

[0660] In yet another possible implementation, the first public parameter and the second public parameter belong to points on the first elliptic curve.

[0661] In another possible implementation, the first public parameter is predefined, and the second public parameter is determined by the first public parameter, a first random number, and a second random number, where the first random number comes from the first node and the second random number comes from the second node.

[0662] In a possible implementation, the at least one common parameter includes at least one base point, and the at least one base point belongs to a group of order p, where p is a prime number.

[0663] Optionally, the group may be a cyclic group or a cyclic subgroup with respect to the operation on the first elliptic curve.

[0664] Optionally, in some scenarios, the base point can also be replaced by a generator.

[0665] In yet another possible implementation, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: some or all elements in a group of order p, where p is a prime number.

[0666] The base point (or generator) of the subgroup of order p is U. For a selected number d in the range [1, p-1], then dU is included in the group.

[0667] Optionally, the at least one public parameter includes a base point U. Further optionally, the at least one public parameter further includes V obtained by operating on U, where V=dU, and the range of d is [1, p-1].

[0668] In yet another possible implementation, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: two points in a group of order p.

[0669] Alternatively, the two points may be two base points. Alternatively, one of the two points may be a base point, and the other may be a second base point calculated based on the base point. For ease of description, the present application will collectively refer to them as the first base point and the second base point.

[0670] In another possible implementation, when the selected key agreement algorithm is the TBPEKE algorithm, the public parameters of TBPEKE include: a cyclic group whose order is a prime number p, and two independent base points U and V in the group.

[0671] It should be understood that “independent” means that U and V are two points with different values, and is not intended to limit the relationship between U and V to no correlation.

[0672] In another possible implementation, the receiving unit 801 is further configured to receive a first calculated value from the first node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node, and the first public parameter is predefined based on a TBPEKE algorithm;

[0673] The processing unit 803 is further configured to determine the second public parameter according to the second random number and the first calculated value;

[0674] The sending unit 802 is further configured to send a second calculated value to the first node, where the second calculated value is related to the second random number and the first public parameter, and the second calculated value is used by the first node to determine the second public parameter.

[0675] Optionally, the first public parameter is the aforementioned first base point, and the second public parameter is the aforementioned second base point.

[0676] In another possible implementation, the intermediate parameter satisfies the following formula:

[0677] b=U+s*V,

[0678] Among them, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, "*" is the elliptic curve point multiplication operation, and "+" is the elliptic curve point addition operation.

[0679] In one possible implementation, U is the first base point, and V is the second base point. Furthermore, U and V belong to a group of order p, where p is a prime number. The operations associated with the group are operations on the first elliptic curve.

[0680] The first elliptic curve is an elliptic curve used by the selected key agreement algorithm. For example, taking the selected key agreement algorithm as the TBPEKE algorithm, the first elliptic curve can be: an elliptic curve defined by SM2, or Curve25519, etc.

[0681] In another possible implementation, the first key negotiation parameter KEt satisfies the following formula:

[0682] KEt=SKt*b,

[0683] The first key satisfies the following formula:

[0684] First key = SKg*KEt = SKg*(SKt*b) = (SKt.SKg)*(U+s*V),

[0685] The second key negotiation parameter KEg satisfies the following formula:

[0686] KEg=SKg*b,

[0687] The second key satisfies the following formula:

[0688] Second key = SKt*KEg = SKt*(SKg*b) = (SKt.SKg)*(U+s*V);

[0689] Wherein, SKt is the first private key, SKg is the second private key, and “.” represents a multiplication operation.

[0690] In another possible implementation, the value range of the first private key (SKt) is [1, p), and the value range of the second private key (SKg) is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

[0691] In another possible implementation, the sending unit 802 is further configured to:

[0692] The key agreement algorithm capability of the second node is broadcasted, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

[0693] In yet another possible implementation, the key agreement algorithms supported by the first node are arranged in order of priority.

[0694] In another possible embodiment, the first message also includes a first fresh parameter, and the first message also includes a first fresh parameter, and the first authentication information is associated with the pre-shared key PSK between the first node and the second node, the second key, the second message, the first fresh parameter and the key agreement algorithm capability of the second node.

[0695] In another possible implementation, the processing unit 803 is further configured to:

[0696] The first authentication information is verified based on the PSK between the first node and the second node, the first key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

[0697] In another possible implementation, the second message further includes second authentication information and a second fresh parameter, and the processing unit is further configured to:

[0698] Second authentication information is obtained through the PSK between the first node and the second node, the first key, the second fresh parameter, and the first message.

[0699] In another possible implementation, the first message further includes a first fresh parameter, and the second message further includes a second fresh parameter; and the processing unit 803 is further configured to:

[0700] A third key is obtained according to the first key, the first fresh parameter, and the second fresh parameter.

[0701] In another possible implementation, the PSK is preconfigured, predefined, or obtained according to the first password.

[0702] In another possible implementation, the processing unit 803 is further configured to:

[0703] A PSK between the first node and the second node is obtained according to the first corresponding relationship.

[0704] It can be seen that the second node can store the correspondence between the PSK and the first node in the form of a correspondence. Therefore, the PSK between the first node and the second node can be obtained according to the correspondence.

[0705] In yet another possible implementation, the processing unit is further configured to:

[0706] A PSK between the first node and the second node is determined according to the first password, a first fresh parameter, and a second fresh parameter.

[0707] In one possible design, the PSK is determined based on the first password, the first key, the first fresh parameter, and the second fresh parameter.

[0708] In one possible design, the communication device 80 includes a receiving unit 801 and a sending unit 802, and the communication device 80 is used to implement the method on the first node side in the aforementioned embodiment.

[0709] In one possible implementation, the sending unit 802 is configured to send a first message to the second node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node.

[0710] The receiving unit 801 is further configured to receive a second message from the second node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with the second private key and the intermediate parameter;

[0711] The processing unit 803 is configured to obtain a second key according to the second key negotiation parameter and the first private key.

[0712] In a possible implementation, the sending unit 802 is further configured to send a third message to the first node, where the third message includes the first authentication information, and the first authentication information is associated with the second key.

[0713] In a possible implementation, the second key is used to obtain one or more keys.

[0714] As a possible solution, the second key is used to derive an encryption key, an integrity key, or an identity authentication key.

[0715] In another possible implementation, the receiving unit 801 is further configured to:

[0716] An association establishment message is received from the second node.

[0717] In yet another possible implementation, the communication device further includes a processing unit 803, wherein the processing unit 803 is configured to:

[0718] The first key agreement algorithm is selected according to the key agreement algorithm capability of the second node, wherein the key agreement algorithm capability of the second node can indicate one or more key agreement algorithms supported by the second node.

[0719] In another possible implementation, the sending unit 802 is further configured to send indication information of a key agreement algorithm to the second node, where the indication information of the key agreement algorithm is used to indicate a double-base cryptographic exponential function key exchange (TBPEKE) algorithm.

[0720] Optionally, there can be multiple TBPEKE algorithms depending on the elliptic curves used. For example, TBPEKEe includes one or more of the following elliptic curves: the elliptic curve defined by SM2, or Curve25519. Therefore, TBPEKE algorithms may include: a TBPEKE algorithm using the elliptic curve defined by SM2, a TBPEKE algorithm using Curve25519, and so on.

[0721] In yet another possible implementation, the at least one common parameter includes: a first common parameter and a second common parameter;

[0722] The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a key agreement algorithm, and the key agreement algorithm includes the TBPEKE algorithm.

[0723] In yet another possible implementation, the first public parameter and the second public parameter belong to points on the first elliptic curve.

[0724] In another possible implementation, the first public parameter is predefined, and the second public parameter is determined by the first public parameter, a first random number, and a second random number, where the first random number comes from the first node and the second random number comes from the second node.

[0725] In a possible implementation, the at least one common parameter includes at least one base point, and the at least one base point belongs to a group of order p, where p is a prime number.

[0726] Optionally, the group may be a cyclic group or a cyclic subgroup with respect to the operation on the first elliptic curve.

[0727] Optionally, in some scenarios, the base point can also be replaced by a generator.

[0728] In yet another possible implementation, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: some or all elements in a group of order p, where p is a prime number.

[0729] The base point (or generator) of the subgroup of order p is U. For a selected number d in the range [1, p-1], then dU is included in the group.

[0730] Optionally, the at least one public parameter includes a base point U. Further optionally, the at least one public parameter further includes V obtained by operating on U, where V=dU, and the range of d is [1, p-1].

[0731] In yet another possible implementation, when the selected key agreement algorithm is the TBPEKE algorithm, the at least one public parameter includes: two points in a group of order p.

[0732] Alternatively, the two points may be two base points. Alternatively, one of the two points may be a base point, and the other may be a second base point calculated based on the base point. For ease of description, the present application will collectively refer to them as the first base point and the second base point.

[0733] In another possible implementation, when the selected key agreement algorithm is the TBPEKE algorithm, the public parameters of TBPEKE include: a cyclic group whose order is a prime number p, and two independent base points U and V in the group.

[0734] It should be understood that “independent” means that U and V are two points with different values, and is not intended to limit the relationship between U and V to no correlation.

[0735] In another possible implementation, the sending unit 802 is further configured to send a first calculated value to the second node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node, and the first public parameter is predefined.

[0736] The receiving unit 801 is further configured to receive a second calculated value from the second node, where the second calculated value is related to the second random number and the first public parameter;

[0737] The processing unit 803 is configured to determine the second public parameter according to the second random number and the first calculated value.

[0738] Optionally, the first common parameter is the aforementioned first base point, and the second common parameter is the aforementioned second base point. In another possible implementation, the intermediate parameter satisfies the following formula:

[0739] b=U+s*V,

[0740] Among them, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, "*" is the elliptic curve point multiplication operation, and "+" is the elliptic curve point addition operation.

[0741] In one possible implementation, U is the first base point, and V is the second base point. Furthermore, U and V belong to a group of order p, where p is a prime number. The operations associated with the group are operations on the first elliptic curve.

[0742] The first elliptic curve is an elliptic curve used by the selected key agreement algorithm. For example, taking the selected key agreement algorithm as the TBPEKE algorithm, the first elliptic curve can be: an elliptic curve defined by SM2, or Curve25519, etc.

[0743] In another possible implementation, the first key negotiation parameter KEt satisfies the following formula:

[0744] KEt=SKt*b,

[0745] The first key satisfies the following formula:

[0746] First key = SKg*KEt = SKg*(SKt*b) = (SKt.SKg)*(U+s*V),

[0747] The second key negotiation parameter KEg satisfies the following formula:

[0748] KEg=SKg*b,

[0749] The second key satisfies the following formula:

[0750] Second key = SKt*KEg = SKt*(SKg*b) = (SKt.SKg)*(U+s*V);

[0751] Wherein, SKt is the first private key, SKg is the second private key, and “.” represents a multiplication operation.

[0752] In another possible implementation, the value range of the first private key (SKt) is [1, p), and the value range of the second private key (SKg) is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

[0753] In another possible implementation, the receiving unit 801 is further configured to:

[0754] Receive the key agreement algorithm capability of the second node sent by the second node, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

[0755] In yet another possible implementation, the key agreement algorithms supported by the first node are arranged in order of priority.

[0756] In another possible embodiment, the first message further includes a first fresh parameter, and the first message also includes a first fresh parameter, and the first authentication information is associated with the pre-shared key PSK between the first node and the second node, the second key, the second message, the first fresh parameter and the key agreement algorithm capability of the second node.

[0757] In yet another possible implementation, the second message further includes second authentication information and a second fresh parameter, where the second authentication information is associated with the PSK between the first node and the second node, the first key, the second fresh parameter, and the first message.

[0758] In yet another possible implementation, the processing unit 803 is further configured to:

[0759] verifying the second authentication information based on the PSK between the first node and the second node, the second key, the second fresh parameter, and the first message;

[0760] When the integrity of the second message and the second authentication information are verified, the first authentication information is generated.

[0761] In a possible implementation, the first message further includes a first fresh parameter, and the second message further includes a second fresh parameter; and the processing unit 803 is further configured to:

[0762] A fourth key is obtained according to the second key, the first fresh parameter, and the second fresh parameter.

[0763] In a possible implementation manner, the PSK is preconfigured, predefined, or obtained according to the first password.

[0764] In another possible implementation, the processing unit 803 is further configured to:

[0765] The PSK between the first node and the second node is obtained according to the second corresponding relationship.

[0766] In another possible implementation, the processing unit 803 is further configured to:

[0767] A PSK between the first node and the second node is determined according to the first password, a first fresh parameter, and a second fresh parameter.

[0768] Please refer to Figure 9, which is a schematic structural diagram of a possible communication device 90 provided in an embodiment of the present application.

[0769] The communication device 90 can be an independent device such as a vehicle, a drone, a robot, or a device contained in an independent device, such as a chip, a software module, or an integrated circuit. The communication device 90 may include at least one processor 901 and a communication interface 902. Optionally, it may also include at least one memory 903. Further optionally, it may also include a connection line 904, wherein the processor 901, the communication interface 902 and / or the memory 903 are connected via the connection line 904, communicate with each other via the connection line 904, and transmit control and / or data signals. Optionally, the communication device 90 may also include one or more of a perception module, an output module, etc. (not shown in the figure).

[0770] in:

[0771] (1) The processor 901 is a module that performs arithmetic operations and / or logical operations, and may specifically include one or more of the following devices: CPU, MCU, GPU, MPU, ASIC, FPGA, CPLD, coprocessor (to assist the central processing unit in completing corresponding processing and applications), and / or NPU, etc.

[0772] (2) The communication interface 902 can be used to provide information input or output for the at least one processor. In some possible scenarios, the communication interface 902 may include an interface circuit. And / or, the communication interface 902 can be used to receive data sent from the outside and / or send data to the outside. For example, the communication interface 902 may include a wired link interface such as an Ethernet cable, or a wireless link (Wi-Fi, Bluetooth, general wireless transmission, vehicle-mounted short-range communication technology and other short-range wireless communication technologies, etc.) interface. Optionally, the communication interface 902 may also include a transmitter (such as a radio frequency transmitter, antenna, etc.) coupled to the interface, or a receiver, etc.

[0773] Alternatively, if the communication device 90 is a standalone device, the communication interface 902 may include a receiver and a transmitter. The receiver and the transmitter may be the same component or different components. When the receiver and the transmitter are the same component, the component may be referred to as a transceiver.

[0774] Optionally, if the communication device 90 is a chip or a circuit, the communication interface 902 may include an input interface and an output interface. The input interface and the output interface may be the same interface, or may be different interfaces.

[0775] Optionally, the functions of the communication interface 902 may be implemented by a transceiver circuit or a dedicated transceiver chip. The processor 901 may be implemented by a dedicated processing chip, a processing circuit, a processor or a general-purpose chip.

[0776] (3) Memory 903 is used to provide storage space for storing data such as an operating system and computer programs. Memory 903 can be one or a combination of random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or compact disc read-only memory (CD-ROM).

[0777] The functions and actions of the modules or units in the communication device 90 listed above are only for illustrative purposes.

[0778] Each functional unit in the communication device 90 can be used to implement the aforementioned communication method, such as the communication method shown in Figure 4, Figure 6 or Figure 7. To avoid redundancy, a detailed description thereof is omitted here.

[0779] Optionally, the processor 901 may be a processor specifically used to execute the aforementioned method (for convenience of distinction, referred to as a dedicated processor), or a processor that executes the aforementioned method by calling a computer program (for convenience of distinction, referred to as a dedicated processor). Optionally, the at least one processor may include both a dedicated processor and a general-purpose processor.

[0780] Optionally, in the case where the communication device 90 includes at least one memory 903 , if the processor 901 implements the aforementioned communication method by calling a computer program, the computer program may be stored in the memory 903 .

[0781] The present application also provides a chip system, which includes a processor and a communication interface, wherein the communication interface is used to receive and / or send data, and / or the communication interface is used to provide input and / or output to the processor. The chip system is used to implement the aforementioned communication method, such as the method described in Figures 4, 6, or 7.

[0782] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions. When the instructions are executed on at least one processor, the aforementioned communication method is implemented, such as the method described in FIG. 4 , FIG. 6 , or FIG. 7 .

[0783] An embodiment of the present application further provides a computer program product, which includes computer instructions, and the computer instructions are used to implement the aforementioned communication method, such as the method described in Figure 4, Figure 6 or Figure 7.

[0784] It should be noted that in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0785] In the embodiments of this application, "at least one" refers to one or more, and "more" refers to two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items.

[0786] For example, at least one of a, b, or c can represent: a, b, c, (a and b), (a and c), (b and c), or (a and b and c), where a, b, and c can be single or plural. "And / or" describes the relationship between associated objects, indicating that three possible relationships exist. For example, A and / or B can represent: A alone, A and B together, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0787] Furthermore, unless otherwise specified, ordinal numbers such as "first" and "second" in the embodiments of this application are used to distinguish multiple objects and are not used to limit the order, timing, priority, or importance of multiple objects. For example, the first device and the second device are only for ease of description and do not indicate differences in structure, importance, etc. between the first and second devices. In some embodiments, the first device and the second device can also be the same device.

[0788] In the above embodiments, the term "when" can be interpreted to mean "if...", "after...", "in response to determining...", or "in response to detecting...", depending on the context. The above are merely optional embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concepts and principles of the present application shall be included in the scope of protection of the present application.

[0789] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

Claims

1. A communication method, characterized in that: The method comprises: receiving a first message from a first node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node; Sending a second message to the first node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with a second private key and the intermediate parameter; A first key is obtained according to the first key negotiation parameter and the second private key.

2. The method according to claim 1, characterized in that The first key is used to obtain one or more of an encryption key, an integrity key, or an identity authentication key.

3. The method according to claim 1, characterized in that The method further comprises: receiving a third message from the first node, the third message including first authentication information, the first authentication information being associated with a second key, the second key being associated with the second key negotiation parameter and the first private key; The first authentication information is verified according to the first key.

4. The method according to claim 3, characterized in that The method further comprises: When the integrity of the third message and the first authentication information are verified, an association establishment message is sent to the first node.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Receive indication information of a first key agreement algorithm sent by the first node, where the indication information of the first key agreement algorithm is used to indicate a double-base cryptographic exponential function key exchange (TBPEKE) algorithm.

6. The method according to any one of claims 1 to 5, characterized in that The at least one common parameter includes a first common parameter and a second common parameter; The first public parameter and the second public parameter are related to a first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a first key agreement algorithm, and the first key agreement algorithm is a TBPEKE algorithm.

7. The method according to claim 6, characterized in that The method further comprises: receiving a first calculated value from the first node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node and the first public parameter is predefined; determining the second public parameter according to a second random number and the first calculated value; A second calculated value is sent to the first node, where the second calculated value is related to the second random number and the first public parameter.

8. The method according to any one of claims 5 to 7, characterized in that: The intermediate parameters satisfy the following formula: b=U+s*V, Wherein, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, * is the elliptic curve point multiplication operation, and + is the elliptic curve point addition operation.

9. The method according to any one of claims 5 to 8, characterized in that: The at least one common parameter includes: a cyclic group whose order is a prime number p, and two independent base points U and V in the cyclic group.

10. The method according to claim 8 or 9, characterized in that The first key negotiation parameter KEt satisfies the following formula: KEt=SKt*b, The first key satisfies the following formula: First key = SKg*KEt, The second key negotiation parameter KEg satisfies the following formula: KEg=SKg*b, The second key satisfies the following formula: Second key = SKt*KEg; Among them, SKt is the first private key, and SKg is the second private key.

11. The method according to any one of claims 5 to 10, characterized in that: The value range of the first private key is [1, p), and the value range of the second private key is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

12. The method according to any one of claims 1 to 11, characterized in that Before receiving the first message from the first node, the method further includes: The key agreement algorithm capability of the second node is broadcasted, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

13. The method according to claim 12, characterized in that The key agreement algorithms supported by the second node are arranged in order of priority.

14. The method according to claim 3 or 4, characterized in that The first message also includes a first freshness parameter; The first authentication information is associated with the PSK, the second key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node; The verifying the first authentication information according to the first key includes: The first authentication information is verified based on the PSK, the first key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

15. The method according to any one of claims 1 to 14, characterized in that The second message further includes second authentication information and a second fresh parameter, and the method further includes: The second authentication information is obtained through the PSK, the first key, the second fresh parameter and the first message.

16. A communication method, characterized in that: The method comprises: Sending a first message to the second node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node; receiving a second message from the second node, the second message including a second key negotiation parameter, the second key negotiation parameter being associated with a second private key and the intermediate parameter; A second key is obtained according to the second key negotiation parameter and the first private key.

17. The method according to claim 16, characterized in that The second key is used to obtain one or more of an encryption key, an integrity key, or an identity authentication key.

18. The method according to claim 16, characterized in that The method further comprises: A third message is sent to the first node, where the third message includes first authentication information, where the first authentication information is associated with the second key.

19. The method according to claim 17 or 18, characterized in that The method further comprises: An association establishment message is received from the second node.

20. The method according to any one of claims 16 to 19, characterized in that: Before sending the first message to the second node, the method further includes: selecting a first key agreement algorithm according to the key agreement algorithm capability of the second node; Indication information of a first key agreement algorithm is sent to the second node, where the indication information of the first key agreement algorithm is used to indicate a double-base cryptographic exponential function key exchange (TBPEKE) algorithm.

21. The method according to any one of claims 16 to 20, characterized in that: The at least one common parameter includes a first common parameter and a second common parameter; The first public parameter and the second public parameter are related to the first elliptic curve, the first elliptic curve is an elliptic curve corresponding to a first key agreement algorithm, and the first key agreement algorithm is a TBPEKE algorithm.

22. The method according to claim 21, characterized in that The method further comprises: Sending a first calculated value to the second node, where the first calculated value is related to a first random number and a first public parameter, where the first random number is determined by the first node and the first public parameter is predefined; receiving a second calculated value from the second node, the second calculated value being related to a second random number and the first public parameter; The second public parameter is determined according to the second random number and the first calculated value.

23. The method according to any one of claims 20 to 22, characterized in that The first key agreement algorithm is a key agreement algorithm supported by the first node, and the first key agreement algorithm has the highest priority among the key agreement algorithms supported by the second node.

24. The method according to any one of claims 20 to 23, characterized in that The intermediate parameters satisfy the following formula: b=U+s*V, Wherein, b is the intermediate parameter, U and V are the at least one public parameter, s is the security parameter, * is the elliptic curve point multiplication operation, and + is the elliptic curve point addition operation.

25. The method according to any one of claims 20 to 24, characterized in that U is the first base point, V is the second base point, U and V belong to a cyclic group of order p, where p is a prime number.

26. The method according to claim 24 or 25, characterized in that The first key negotiation parameter KEt satisfies the following formula: KEt=SKt*b, The first key satisfies the following formula: First key = SKg*KEt, The second key negotiation parameter KEg satisfies the following formula: KEg=SKg*b, The second key satisfies the following formula: Second key = SKt*KEg; Among them, SKt is the first private key, and SKg is the second private key.

27. The method according to any one of claims 20 to 26, characterized in that: The value range of the first private key is [1, p), and the value range of the second private key is [1, p), where p is the order of the elliptic curve used by the TBPEKE algorithm.

28. The method according to any one of claims 16 to 27, characterized in that Before sending the first message to the second node, the method further includes: Receive the key agreement algorithm capability of the second node sent by the second node, where the key agreement algorithm capability of the second node represents the key agreement algorithm supported by the second node.

29. The method according to claim 28, characterized in that The key agreement algorithms supported by the second node are arranged in order of priority.

30. The method according to any one of claims 16 to 29, characterized in that The first message further includes a first freshness parameter, and the first authentication information is associated with the PSK, the second key, the second message, the first freshness parameter, and the key agreement algorithm capability of the second node.

31. The method according to claim 18, wherein The second message further includes second authentication information and a second freshness parameter, the second authentication information being associated with the PSK, the first key, the second freshness parameter, and the first message; The method further comprises: verifying the second authentication information based on the PSK, the second key, the second fresh parameter, and the first message; When the integrity of the second message and the second authentication information are verified, the first authentication information is generated.

32. A communication device, characterized in that: include: a receiving unit, configured to receive a first message from a first node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node; The sending unit is further configured to send a second message to the first node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with a second private key and the intermediate parameter; A processing unit is configured to obtain a first key according to the first key negotiation parameter and the second private key.

33. The communication device according to claim 32, wherein: The first key is used to obtain one or more of an encryption key, an integrity key, or an identity authentication key.

34. The communication device according to claim 32, wherein: The receiving unit is further configured to receive a third message from the first node, the third message including first authentication information, the first authentication information being associated with a second key, the second key being associated with the second key negotiation parameter and the first private key; The processing unit is further configured to verify the first authentication information according to the first key.

35. The communication device according to any one of claims 32 to 34, characterized in that: The receiving unit is further configured to: Receive indication information of a first key agreement algorithm sent by the first node, where the indication information of the first key agreement algorithm is used to indicate a double-base cryptographic exponential function key exchange (TBPEKE) algorithm.

36. A communication device, characterized in that include: a sending unit, configured to send a first message to a second node, where the first message includes a first key negotiation parameter, where the first key negotiation parameter is associated with a first private key and an intermediate parameter, where the intermediate parameter is associated with a security parameter and at least one public parameter, where the security parameter is a first password or a pre-shared key (PSK) between the first node and the second node, and where the first password is an agreed access password between the first node and the second node; The receiving unit is further configured to receive a second message from the second node, where the second message includes a second key negotiation parameter, where the second key negotiation parameter is associated with the second private key and the intermediate parameter; A processing unit is configured to obtain a second key according to the second key negotiation parameter and the first private key.

37. The communication device according to claim 36, wherein: The second key is used to obtain one or more of an encryption key, an integrity key, or an identity authentication key.

38. The communication device according to claim 36, wherein: The sending unit is further configured to send a third message to the first node, where the third message includes the first authentication information, and the first authentication information is associated with the second key.

39. The communication device according to any one of claims 36 to 38, characterized in that: The communication device further includes a processing unit, The processing unit is configured to select a first key agreement algorithm according to the key agreement algorithm capability of the second node; The sending unit is further used to send indication information of a first key agreement algorithm to the second node, where the indication information of the first key agreement algorithm is used to indicate a double-base cryptographic exponential function key exchange (TBPEKE) algorithm.

40. A chip system, characterized in that: The chip system includes at least one processor and a communication interface, the communication interface is used to send and / or receive data, and the at least one processor is used to call a computer program stored in at least one memory, so that the chip system implements the method as described in any one of claims 1-15, or implements the method as described in any one of claims 16-31.

41. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program runs on a computer, the computer is enabled to execute the method according to any one of claims 1 to 15, or to execute the method according to any one of claims 16 to 31.

42. A communication system, characterized in that include: a second node, the second node comprising a communication device according to any one of claims 32 to 35; A first node, wherein the first node comprises the communication device according to any one of claims 36 to 39.

43. A vehicle, characterized in that: The vehicle comprises a first node and / or a second node, wherein: The second node comprises a communication device according to any one of claims 32 to 35, or the second node is a node implementing the method according to any one of claims 1 to 15; The first node includes the communication device according to any one of claims 36 to 39, or the first node is a node implementing the method according to any one of claims 16 to 31.

44. A communication system, characterized in that include: A second node implementing the method according to any one of claims 1-15 and a first node implementing the method according to any one of claims 16-31.

Images