Mesh network data encryption transmission method, device, equipment and medium

Abstract

The present invention discloses a data encryption transmission method, device, equipment and medium for a Mesh network. When the method is applied to a key management node, it includes: generating a random number of preset bytes through a preset random number algorithm at a preset generation time interval; generating a key to be updated through a preset key derivation function, and determining the corresponding index value according to the index value of the current synchronization key; encrypting the key to be updated and its index value according to the preset encryption algorithm and the current synchronization key and its index value to generate a key update message and send it to a network communication node. When applied to a network communication node, it includes: receiving a key update message, parsing and verifying it, and obtaining the latest key and its index value; encrypting the data to be communicated according to the latest key and its index value to generate an encrypted message and send it to the node to be communicated. By implementing the method of the present invention, the problem of lack of security and reliability of data transmission in the Mesh network can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of information processing of the Internet of Things, and in particular to a data encryption transmission method, device, equipment and medium for a Mesh network. Background Art

[0002] Various industries are carrying out electrical intelligent energy-saving transformation. Accurate carbon metering and intelligent control require a large number of terminals to join the network, but traditional wired, WiFi and cellular networks are expensive, so Mesh networks are favored due to their low cost and flexibility. However, the security issues of Mesh networks are becoming increasingly prominent. Fixed key encryption such as the MESH standard of SIG (Bluetooth Special Interest Group) has the risk of leakage and is easy to be cracked. The traditional dynamic key method is limited by the performance of low-power terminals and clock accuracy, and it is difficult to synchronize and update keys in the Mesh network. Since Mesh networks mostly use broadcast protocols, it is difficult to synchronize the sending and receiving ends, resulting in a lack of dynamic key synchronization update methods in Mesh networks, which makes the data transmission of Mesh networks in the existing technology lack security and reliability. Summary of the invention

[0003] The present invention provides a data encryption transmission method, device, equipment and medium for a Mesh network, aiming to solve the problem of lack of security and reliability of data transmission in the Mesh network in the prior art.

[0004] In the first aspect, the present invention provides a data encryption transmission method for a Mesh network. When the method is applied to a key management node, it includes: generating a random number of preset bytes through a preset random number algorithm at each preset generation time interval; generating a key to be updated by using the random number through a preset key derivation function, and incrementing the index value of the current synchronization key to obtain the index value of the key to be updated; encrypting the key to be updated and its index value with the current synchronization key and its index value according to a preset encryption algorithm to generate a key update message; and sending the key update message to a network communication node.

[0005] In the second aspect, the present invention provides a data encryption transmission method for a Mesh network. When the method is applied to a network communication node, it includes: receiving a key update message sent by a key management node, and parsing and verifying the key update message according to the current synchronization key and synchronization index value to obtain the latest key and its index value; encrypting the data to be communicated according to the latest key and its index value and a preset encryption algorithm to generate an encrypted message; and sending the encrypted message to the node to be communicated.

[0006] In a third aspect, the present invention further provides a data encryption transmission device for a Mesh network, which includes a unit for executing any method as described in the first aspect, or includes a unit for executing any method as described in the second aspect.

[0007] In a fourth aspect, the present invention further provides a computer device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above method when executing the computer program.

[0008] In a fifth aspect, the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, wherein the computer program includes program instructions, and wherein the program instructions can implement the above method when executed by a processor.

[0009] The present invention provides a data encryption transmission method, device, equipment and medium for a Mesh network. Wherein, when the method is applied to a key management node, a random number of preset bytes is generated by a preset random number algorithm at each preset generation time interval; the random number is used to generate a key to be updated through a preset key derivation function, and the index value of the current synchronization key is incremented to obtain the index value of the key to be updated; the key to be updated and its index value are encrypted with the current synchronization key and its index value according to a preset encryption algorithm to generate a key update message; the key update message is sent to a network communication node. When the method is applied to a network communication node, a key update message sent by a key management node is received, and the key update message is parsed and verified according to the current synchronization key and synchronization index value to obtain the latest key and its index value; the data to be communicated is encrypted according to the latest key and its index value and a preset encryption algorithm to generate an encrypted message; the encrypted message is sent to the node to be communicated. In the embodiment of the present invention, the key management node can dynamically generate the key to be updated at a preset interval, and encrypt it and send it to other network communication nodes, making the transmission of data more secure and reliable. After receiving the key update message, the network communication node decrypts it and communicates according to the latest key received. By continuously updating the key and using the latest key for encrypted communication, the security and reliability of Mesh network encrypted transmission are jointly guaranteed. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0011] Figure 1A schematic diagram of a flow chart of a data encryption transmission method for a Mesh network provided by an embodiment of the present invention applied to a key management node;

[0012] Figure 2 A schematic diagram of a first sub-process of applying the data encryption transmission method of a Mesh network provided by an embodiment of the present invention to a key management node;

[0013] Figure 3 A schematic diagram of a second sub-process of applying the data encryption transmission method of a Mesh network provided by an embodiment of the present invention to a key management node;

[0014] Figure 4 A schematic diagram of a third sub-process of applying the data encryption transmission method of a Mesh network provided by an embodiment of the present invention to a key management node;

[0015] Figure 5 A schematic diagram of a flow chart of a data encryption transmission method for a Mesh network provided by an embodiment of the present invention applied to a network communication node;

[0016] Figure 6 A schematic diagram of a first sub-process of applying the data encryption transmission method of a Mesh network provided by an embodiment of the present invention to a network communication node;

[0017] Figure 7 A schematic diagram of a second sub-process of applying the data encryption transmission method of a Mesh network provided by an embodiment of the present invention to a network communication node;

[0018] Figure 8 A schematic block diagram of a data encryption transmission device for a Mesh network provided by an embodiment of the present invention applied to a key management node;

[0019] Fig. 9 A schematic block diagram of a data encryption transmission device for a Mesh network provided by an embodiment of the present invention applied to a network communication node;

[0020] Fig.10 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0023] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0024] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0025] See also Figure 1 , Figure 1 A flow chart of a data encryption transmission method for a Mesh network provided in an embodiment of the present invention. The data encryption transmission method for a Mesh network in this embodiment can be applied to the data encryption transmission process of each node in a Mesh network, wherein a Mesh network refers to a wireless network based on a wireless network that connects different types of nodes to each other to achieve mutual transmission of information. In this network, each node forms a whole and shares an address. In the Mesh network, each node is connected to each other wirelessly, wherein there is a key update node that generates a key, and other network communication nodes can communicate according to the key generated by the key update node. By using the method of the present invention, the security and reliability of encrypted transmission in the Mesh network can be jointly guaranteed.

[0026] Figure 1 The method for data encryption transmission in a Mesh network provided by an embodiment of the present invention is applied to a key management node. As shown in the figure, the method includes the following steps S110-S140.

[0027] S110 , generating a random number of preset bytes by using a preset random number algorithm at every preset generation time interval.

[0028] In this embodiment, the preset generation time refers to the time interval between each random number generation. This time interval can be fixed, such as generating a random number every 30 minutes or every hour; or it can be variable, such as determining the time of the next random number generation according to a certain rule or condition. The preset generation time ensures the frequency of random number generation so that this process can be carried out according to a predetermined rhythm. Among them, there is no limitation on the specific preset generation time, which can be much less than the time when the current key is cracked by brute force. The preset random number algorithm is a specific method or formula for generating random numbers. There are many kinds of random number algorithms, including linear congruential generator, Mersenne rotation algorithm, random number generator based on physical phenomena, etc. Among them, the specific selection of which random number algorithm is not limited. The preset random number algorithm ensures that the generated random number is random and unpredictable. The preset bytes refer to the bytes of the random number generated each time. Specifically, in this embodiment, the key management node randomly generates 8 bytes of random number R0 every hour and fills it with 0 to 16 bytes. By generating a random number of preset bytes at each preset time interval, it is ensured that the data of the generated key is random and unpredictable.

[0029] In one embodiment, if Figure 2 As shown, the step S110 also includes steps S1101 - S1102 before the step S110.

[0030] S1101, receiving a preset initial network key and an initial transmission key and corresponding key index values, and generating a key index list having index values ​​and keys therefrom;

[0031] S1102: Write the key index list to the network communication node through a preset secure communication method.

[0032] In this embodiment, the initial network key and the initial transmission key are both generated by a password set by the user. Specifically, when building a Mesh network, the user can set a password, such as fdHG#@0d5, and generate 32 bytes 0x36ef8ec8e5c721d8db8624917d026ae8b8e15c63cb34748f20e6d38ca2cdb54e through the SHA256 (Secure Hash Algorithm 256-bit, a secure hash algorithm). The first 16 bytes 0x36ef8ec8e5c721d8db8624917d026ae8 are used as the initial network key K0, and the last 16 bytes 0xb8e15c63cb34748f20e6d38ca2cdb54e are used as the initial transmission key K1, wherein the index value of K0 is 0 and the index value of K1 is 1. The initial network key K0 is a fixed key used for encrypted transmission and is used as a backup. K1 is the initial key currently used for encrypted transmission. A key index list with index values ​​and keys is generated based on the initial network key and the initial transmission key. For example, the key index list can be expressed as:

[0033] Key index K0 (initial network key) 0 K1 (initial transmission key) 1

[0034] Among them, it should be noted that the key index list can store keys and index values. This list is arranged from new to old. According to the storage space size of the node, generally only the latest 2-3 keys and K0 are saved. The old indexes and keys exceeding the number will be deleted (applicable to key communication nodes and the network communication nodes). The key index list is written to the network communication node through a preset secure communication method. Specifically, it can be read from the key management node by using a near-field communication instrument offline, and then written to the network communication node through the near-field communication instrument to safely write the key index list into the network communication node. There is no limitation on the specific secure communication method, and it is sufficient to be able to safely transmit the key index list. By receiving the initial key and distributing the list to the network communication node through a secure communication method, the security and reliability of the system are significantly improved.

[0035] S120: Generate a key to be updated by using the random number through a preset key derivation function, and increment the index value of the current synchronization key to obtain the index value of the key to be updated.

[0036] In this embodiment, the synchronization key and the key to be updated are keys required for current or upcoming network communication. The preset key derivation function is a function for generating keys. The random number is used to generate the key to be updated through the preset key derivation function. The specific generation process can be expressed as: K2=KDF(Km, R), where K2 is the newly generated key to be updated. It should be noted that the key is 16 bytes, Km is the synchronization key currently used, and R is a random number. KDF (Key Derivation Function) is not a specific encryption algorithm, but a type of algorithm or process for deriving a key suitable for a specific purpose from the original key material (such as a password, a random number or other key). Among them, the specific algorithm used is not limited, and encryption can be performed. For example, KDF can be implemented based on the encryption function E. After the random number is used to generate the key to be updated through the preset key derivation function, the index value of the key to be updated is obtained by incrementing according to the index value of the current synchronization key. For example, if the index value of the current synchronization key is 2, the index value of the key to be updated is 3. By generating the key to be updated and its index value according to the synchronization key and its index value, the synchronization key can be updated later, thereby improving the security of the system.

[0037] In one embodiment, if Figure 3 As shown, step S120 also includes steps S1201-S1202.

[0038] S1201, determining whether the index value of the key to be updated is greater than a preset maximum index value;

[0039] S1202: If it is greater than the preset maximum index value, determine the index value of the key to be updated according to the preset initial index value.

[0040] In this embodiment, the preset maximum index value is the maximum index value in the pre-set encrypted communication. Specifically, when an index value greater than the preset maximum index value is used for encryption, it indicates that the transmitted message is plain text, that is, a non-encrypted file. In order to distinguish the encrypted message from the non-encrypted file in detail, the preset maximum index value is set. In this embodiment, the preset maximum index value is 254. It is judged whether the index value of the key to be updated is greater than the preset maximum index value. If the index value is greater than 254, the index value of the key to be updated is 1. It should be noted that 0 is the index value of the initial network key, and the index value of the initial network key will not change, so the index value of the key to be updated is 1. By judging whether the index value of the key to be updated is greater than the preset maximum index value, the index value of the key to be updated is further determined, and while avoiding the index value from increasing infinitely, the index of the encrypted message and the non-encrypted message are distinguished, which increases the practicality of the key to be updated.

[0041] S130: Encrypt the key to be updated and its index value with the current synchronization key and its index value according to a preset encryption algorithm to generate a key update message.

[0042] In this embodiment, the key update message is a message for updating the key sent to other network nodes. The key to be updated and its index value are encrypted with the current synchronization key and its index value according to a preset encryption algorithm. Specifically, the transmission form of the message is T=Type||DST||TTL||CRC||Ext||Kindex||IV||content. Type is the message type, identified by a byte 0-255. DST is the destination address. TTL is the forwarding life value, which is reduced by one each time it is forwarded. When it is reduced to 0, the message will be discarded. CRC is the CRC check value of the normal text. Ext is some extended fields. Kindex is the encrypted key index, one byte. Content is the message service content. If Kindex is 0, it means that K0 encryption is used. If Kindex is 1-254, it is encrypted with the key corresponding to Kindex. IV is the encrypted initialization vector (InitializationVector), which is randomly generated. If Kindex is 255, it means that content is plain text and IV is empty. Among them, Type in the key update message is 0xF1, which means "update key", DST is 0xFFFF, which means the whole Mesh network, and TTL=10. Kindex=1, content (message content) is the key to be updated and its index value (encrypted by the synchronization key and IV), IV is a vector encrypted by the key, and Kindex is the index value of the synchronization key. By encrypting the key to be updated and its index value according to the synchronization key and its index value, a key message is generated, so that the key to be updated can be synchronized to other communication network nodes and can be decrypted according to the current synchronization key.

[0043] S140: Send the key update message to a network communication node.

[0044] In this embodiment, the network communication nodes are all nodes in the Mesh network except the key management node. Network communication nodes can also communicate with each other. In order to ensure that the network communication nodes can receive the key update message, the key update node propagates once every fifteen seconds, for a total of three times. Among them, the specific number of propagations can be determined based on information such as the number of nodes, and this is not limited. By sending the key update message to the network communication node, the network communication node can timely update the currently used key according to the key update message to ensure the security of the transmitted information.

[0045] In one embodiment, if Figure 4 As shown, the step S140 also includes steps S1401-S1403.

[0046] S1401. If a latest key request message sent by a certain network communication node is received, decrypt and verify the latest key request message according to the initial network key and its index value;

[0047] S1402. If the decryption and verification are successful, encrypt the key to be updated and its index value after a preset sending time interval to generate a key reply message, wherein the encryption is performed according to the key and index value carried in the latest key request message;

[0048] S1403. Send the key reply message to the network communication node.

[0049] In this embodiment, the latest key request message is a message issued by the network communication node to obtain the current latest key. Specifically, if the network communication node is not clear whether the current key index is the latest due to other reasons such as restart, and there is no encrypted message sent by other nodes for reference, it will send a latest key request message to the key management node to determine the key. Among them, the latest key request message sent by the network communication node is encrypted using the initial network key K0, and the body carries the current key index and key value. Therefore, after receiving the message, the network communication node will decrypt and verify the latest key request message according to the initial network key and its index value in the key index list. Specifically, the corresponding initial network key is determined according to the index value of the initial network key, and it is decrypted by the initial network key. And the CRC check value in the message is verified to verify its integrity. If the decryption and verification are successful, the key to be updated and its index value are encrypted after the preset sending time to generate a key reply message. Specifically, if the decryption and verification are successful, the key index and key value in the text are recorded first, and the reply is not made immediately, because if the terminals in an area are powered off for several hours and then powered on again, there may be multiple nodes requesting at the same time. After waiting for 30 seconds (preset sending time), the key to be updated and its index value are encrypted according to the key and index value carried in the latest key request message as recorded to generate a key reply message, wherein the specific encryption method is similar to that in step S130 and will not be repeated here. By generating a key reply message and sending it to the network communication node, it is ensured that all network communication nodes in the Mesh have the latest key and index value currently in use, avoiding the situation where network communication fails due to the lack of the latest key.

[0050] Figure 5 The method for data encryption transmission in a Mesh network provided by an embodiment of the present invention is applied to a network communication node. As shown in the figure, the method includes the following steps S210-S230.

[0051] S210: Receive a key update message sent by a key management node, and parse and verify the key update message according to a current synchronization key and a synchronization index value to obtain the latest key and its index value.

[0052] In this embodiment, the synchronization key and synchronization index value are the keys and their corresponding index values ​​used in all network communication nodes during the current communication. After receiving the key update message sent by the key management node, the key index in the key update message is first parsed, and the corresponding synchronization key index value is matched according to the key index, and the corresponding key is determined. Because the key update message is encrypted by the synchronization key and the synchronization index value, the message can also be decrypted according to the synchronization key and the synchronization index value, and the integrity of the message is verified. If the message is complete, the latest key and its index value in the message are obtained, and the latest key and index value are written to the key index list in the network communication node for subsequent use, and the latest key is used to replace the current synchronization key. By parsing and verifying the key update message according to the current synchronization key and synchronization index value, the latest key and its index value are obtained, and the timed update of the key is realized, thereby better protecting the communication data.

[0053] In one embodiment, if Figure 6 As shown, the step S210 also includes steps S211-S214.

[0054] S211, preliminarily parsing the key update message to obtain a key index value used when encrypting the message;

[0055] S212, querying a key index list according to the key index value to obtain a corresponding synchronization key;

[0056] S213, performing advanced parsing on the key update message according to the synchronization key, and performing integrity check on the message if the parsing is successful;

[0057] S214: If the analysis and verification are both passed, the latest key and its index value carried in the key update message are obtained, and stored in the key index list of the network communication node.

[0058] In this embodiment, after receiving the key update message, the network communication node performs preliminary analysis to obtain the key index value used when encrypting the message. Specifically, the message format is: T=Type||DST||TTL||CRC||Ext||Kindex||IV||content. Type is the message type, identified by a byte 0-255. DST is the destination address. TTL is the forwarding life value. CRC is the CRC check value of the main text. Ext is some extended fields. Kindex is the encrypted key index, one byte. Content is the message service content. If Kindex is 0, it means that K0 is used for encryption. That is, a key update message with Type 0xF1 representing "update key" is received, and Kindex in the message is read to obtain the index of the current encryption key. If the index value is 1, the synchronization key K1 is found in its own key index list, and then K1 and the complete IV are used to decrypt the content to obtain the communication data, and then the CRC-16 check value of the communication data is calculated and compared with the CRC value in the message. If the comparison is consistent, it means that the main text has passed the analysis and verification. Among them, IV is the initialization vector (randomly generated). There is no limitation on the specific IV generation and decryption method, as long as it can further protect the security of the data. If the parsing and verification are passed, the latest key and its index value carried in the key update message are obtained, and stored in the key index list of the network communication node, so as to update the key index list. By obtaining the latest key and its index value, the key is updated regularly to better protect the communication data.

[0059] S220. Encrypt the data to be communicated according to the latest key and its index value and a preset encryption algorithm to generate an encrypted message.

[0060] In this embodiment, the latest key is the key to be updated sent by the key update node. After the network communication node receives the key update message, the key to be updated in the message is the latest key in the network communication node. The data to be communicated is encrypted according to the latest key and its index value and the preset encryption algorithm to generate an encrypted message. Specifically, if the latest key is K1, its index value is 1, and the network communication node encrypts the temperature and humidity data: temperature 298, unit 0.1℃, humidity 75, etc., the text data is converted to 0x9876012A004B (wherein the conversion method is not limited). Then the encrypted message is: Type||DST||TTL||CRC||Ext||Kindex||IV||content, where Type=0x56 indicates temperature and humidity data, DST=0xFFFF indicates broadcast of the entire Mesh network, TTL=0x07 indicates that the message is forwarded up to 7 times, CRC=0x2345 is the CRC-16 checksum of 0x9876012A004B, Ext is empty, and Kindex is 1, which is the index value of K1. The first two bytes of IV are randomly generated as 0xECA3 and put into the data message. The complete IV actually involved in encryption is 0xFE97BADB7C08214C127F56AA6BC6AF82. Content is the 16 bytes obtained by encrypting 0x9876012A004B using key K1 and IV. The encryption algorithm is the AES-CBC algorithm that complies with the PKCS standard, including byte padding of the PKCS#5 standard. The data to be communicated is encrypted according to the latest key and its index value and a preset encryption algorithm to generate an encrypted message to ensure the security of the data.

[0061] S230: Send the encrypted message to the node to be communicated with.

[0062] In this embodiment, the node to be communicated is a node that receives the encrypted message, which can be determined based on the transmitted information. The target address of the node to be communicated can be set in the DST in the message. The encrypted message can be transmitted to the node to be communicated according to the target address. By sending the encrypted message to the node to be communicated, encrypted communication between the network communication nodes is realized.

[0063] In one embodiment, if Figure 7 As shown, the step S230 also includes steps S2301-S2303.

[0064] S2301. If an encrypted message with a value higher than the current synchronization index is received, the initial network key and its index value are obtained from the key index list;

[0065] S2302, encrypting the current synchronization key and the synchronization index value by using the initial network key and its index value to generate a latest key request message;

[0066] S2303: Send the latest key request message to other network communication nodes to confirm the latest key. If no reply information is received, send the latest key request message to the key management node.

[0067] In this embodiment, if the network communication node receives an encrypted message sent by other network communication nodes and performs a preliminary analysis on it, and finds that the index value of the key therein is higher than the synchronization index value used by itself, then the network communication node cannot determine whether the key and its index value currently used by itself are the latest encrypted data. Therefore, the initial network key and its index value are obtained from the key index list, the current key index and key value are used as the text content, and the initial network key and its index value are used for encryption, and the latest key request message is generated and sent to other network communication nodes to confirm the latest key, that is, to confirm whether the key of the network communication node itself is the latest key. If other network communication nodes that receive the latest key request message cannot send reply information about the latest key to the network communication key because the key carried in the latest key request message is too old and has been deleted from its own key index list, the network communication node does not receive the reply information. At this time, the address information in the latest key request message is modified to send the latest key request to the key management node to confirm the current synchronization key. If a key reply message sent by the key management node is received, the latest key is stored and immediately activated. The latest key is obtained by generating the latest key request message to ensure that the encryption key used for communication remains the latest key, thereby ensuring data security.

[0068] Corresponding to the above data encryption transmission method of Mesh network, the present invention also provides a data encryption transmission device of Mesh network. The data encryption transmission device of Mesh network includes a unit for executing the above data encryption transmission method of Mesh network, and the device can be configured in a desktop computer, tablet computer, laptop computer, etc. Figure 8 300 is a schematic block diagram of a Mesh network data encryption transmission applied to a key management node provided by an embodiment of the present invention. Fig. 9 It is a schematic block diagram 400 of a data encryption transmission device of a Mesh network provided by an embodiment of the present invention applied to a network communication node.

[0069] like Figure 8As shown, the data encryption transmission device of the Mesh network, when applied to a key management node, includes a random number generation unit 310, an increment unit 320, an encryption unit 330 and a sending unit 340.

[0070] The random number generating unit 310 is used to generate a random number of preset bytes by using a preset random number algorithm at every preset generation time interval.

[0071] In one embodiment, the random number generating unit 310 includes a list generating unit and a writing unit.

[0072] A list generating unit, configured to receive a preset initial network key and an initial transmission key and corresponding key index values, and generate a key index list having index values ​​and keys therefrom;

[0073] A writing unit is used to write the key index list to the network communication node through a preset secure communication method.

[0074] The incrementing unit 320 is configured to generate a key to be updated by using the random number through a preset key derivation function, and to increment the index value of the current synchronization key to obtain the index value of the key to be updated.

[0075] In one embodiment, the incrementing unit 320 includes a judging unit and a determining unit.

[0076] A judging unit, used to judge whether the index value of the key to be updated is greater than a preset maximum index value;

[0077] A determining unit is used to determine the index value of the key to be updated according to a preset initial index value if it is greater than the preset maximum index value.

[0078] The encryption unit 330 is used to encrypt the key to be updated and its index value and the current synchronization key and its index value according to a preset encryption algorithm to generate a key update message.

[0079] The sending unit 340 is configured to send the key update message to a network communication node.

[0080] In one embodiment, the sending unit 340 includes a decryption unit, a reply unit, and a reply sending unit.

[0081] a decryption unit, configured to decrypt and verify the latest key request message according to the initial network key and its index value if a latest key request message sent by a certain network communication node is received;

[0082] A reply unit, configured to encrypt the key to be updated and its index value after a preset sending time interval to generate a key reply message if the decryption and verification are successful, wherein the encryption is performed according to the key and index value carried in the latest key request message;

[0083] A reply sending unit is used to send the key reply message to the network communication node.

[0084] like Fig. 9 As shown, the data encryption transmission device of the Mesh network, when applied to a network communication node, includes a key receiving unit 410, a message encryption unit 420 and an encryption sending unit 430.

[0085] The key receiving unit 410 is used to receive a key update message sent by a key management node, and parse and verify the key update message according to the current synchronization key and synchronization index value to obtain the latest key and its index value.

[0086] In one embodiment, the key receiving unit 410 includes a parsing unit, a query unit, a verification unit, and an acquisition unit.

[0087] A parsing unit, used for preliminarily parsing the key update message to obtain a key index value used when encrypting the message;

[0088] A query unit, configured to query a key index list according to the key index value to obtain a corresponding synchronization key;

[0089] A verification unit, configured to perform advanced parsing of the key update message according to the synchronization key, and perform integrity verification on the message if the parsing is successful;

[0090] The obtaining unit is used to obtain the latest key and its index value carried in the key update message if both the parsing and the verification are passed, and store them in the key index list of the network communication node.

[0091] The message encryption unit 420 is used to encrypt the data to be communicated according to the latest key and its index value and a preset encryption algorithm to generate an encrypted message.

[0092] The encrypted sending unit 430 is used to send the encrypted message to the node to be communicated.

[0093] In one embodiment, the encryption sending unit 430 includes a message receiving unit, a generating unit and a request sending unit.

[0094] A message receiving unit, configured to obtain an initial network key and its index value from a key index list if an encrypted message having a value higher than the current synchronization index value is received;

[0095] A generating unit, configured to encrypt the current synchronization key and the synchronization index value by using the initial network key and its index value to generate a latest key request message;

[0096] The request sending unit is used to send the latest key request message to other network communication nodes for latest key confirmation, and if no reply information is received, send the latest key request message to the key management node.

[0097] It should be noted that technical personnel in the relevant field can clearly understand that the specific implementation process of each unit in the schematic block diagram 300 of the above-mentioned Mesh network data encryption transmission applied to the key management node and the schematic block diagram 400 of the Mesh network data encryption transmission applied to the network communication node can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and conciseness of the description, it will not be repeated here.

[0098] The data encryption transmission device of the Mesh network can be implemented in the form of a computer program. The computer program can be Fig.10 Runs on the computer device shown.

[0099] See also Fig.10 , Fig.10 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a terminal or a server, wherein the terminal may be an electronic device with communication functions such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, and a wearable device. The server may be an independent server or a server cluster composed of multiple servers.

[0100] See also Fig.10 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0101] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a data encryption transmission method for a Mesh network.

[0102] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0103] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a data encryption transmission method of a Mesh network.

[0104] The network interface 505 is used to communicate with other devices over the network. Fig.10 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0105] The processor 502 is used to run a computer program 5032 stored in the memory to implement the steps of the above method.

[0106] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0107] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0108] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the steps of the above method.

[0109] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0110] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0111] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0112] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0113] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0114] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A data encryption transmission method based on Mesh network, characterized in that: The method is applied to a key management node, and the method comprises: Generate a random number of preset bytes by using a preset random number algorithm at every preset generation time interval; The random number is used to generate a key to be updated through a preset key derivation function, and the index value of the current synchronization key is incremented to obtain the index value of the key to be updated; Encrypt the key to be updated and its index value with the current synchronization key and its index value according to a preset encryption algorithm to generate a key update message; Sending the key update message to a network communication node; Before the step of generating a random number of preset bytes by using a preset random number algorithm, the method includes: Receive a preset initial network key and an initial transmission key and corresponding key index values, and generate a key index list having index values ​​and keys therefrom; Writing the key index list to the network communication node via a preset secure communication method; After the step of sending the key update message to the network communication node, the method further comprises: If a latest key request message sent by a certain network communication node is received, decrypting and verifying the latest key request message according to the initial network key and its index value; If the decryption and verification are successful, the key to be updated and its index value are encrypted after a preset sending time interval to generate a key reply message, wherein the encryption is performed according to the key and index value carried in the latest key request message; The key reply message is sent to the network communication node.

2. The method according to claim 1, characterized in that After the step of incrementally increasing the index value of the current synchronization key to obtain the index value of the key to be updated, the method further comprises: Determine whether the index value of the key to be updated is greater than a preset maximum index value; If it is greater than the preset maximum index value, the index value of the key to be updated is determined according to the preset initial index value.

3. A data encryption transmission method based on Mesh network, characterized in that: The method is applied to a network communication node, and the method comprises: Receive a key update message sent by a key management node, and parse and verify the key update message according to the current synchronization key and synchronization index value to obtain the latest key and its index value; Encrypt the data to be communicated according to the latest key and its index value and a preset encryption algorithm to generate an encrypted message; Sending the encrypted message to the node to be communicated; After the step of sending the encrypted message to the node to be communicated, the method further comprises: If an encrypted message with a value higher than the current synchronization index is received, the initial network key and its index value are obtained from the key index list; Encrypting the current synchronization key and the synchronization index value by using the initial network key and its index value to generate a latest key request message; The latest key request message is sent to other network communication nodes for latest key confirmation. If no reply information is received, the latest key request message is sent to the key management node.

4. The method according to claim 3, characterized in that The step of parsing and verifying the key update message according to the current synchronization key and synchronization index value to obtain the latest key and its index value includes: Performing a preliminary analysis on the key update message to obtain a key index value used when encrypting the message; Query the key index list according to the key index value to obtain the corresponding synchronization key; Performing advanced parsing of the key update message according to the synchronization key, and performing integrity check on the message if the parsing is successful; If the analysis and verification are both passed, the latest key and its index value carried in the key update message are obtained and stored in the key index list of the network communication node.

5. A data encryption transmission device for a Mesh network, characterized in that: It comprises a key management node and a network communication node, wherein the key management node comprises a unit for executing the method as claimed in any one of claims 1-2, and the network communication node comprises a unit for executing the method as claimed in any one of claims 3-4.

6. A computer device, characterized in that: The computer device includes a memory and a processor connected to the memory; the memory is used to store a computer program; the processor is used to run the computer program stored in the memory to execute the steps of the method as described in any one of claims 1-2 or to execute the steps of the method as described in any one of claims 3-4.

7. A storage medium, characterized in that: The storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, they can implement the steps of the method as described in any one of claims 1 to 2, or implement the steps of the method as described in any one of claims 3 to 4.

Images