Connection establishment method, device, equipment, system and storage medium

Abstract

Disclosed in the present application are a connection establishment method, apparatus, device and system, and a storage medium, relating to the technical field of communications wherein a first device, a second device and a third device included in the connection establishment system are located in the same trust ring, and the first device establishes connections with the second device and the third device separately. The second device sends a first connection establishment message including the first security information to the first device, the first device performs security verification on the first connection establishment message by using the first security information, and the second device forwards the first connection establishment message to a third device under the condition that the security verification of the first connection establishment message is passed, and the second equipment and the third equipment realize cross-hop connection establishment based on the connection establishment message. The first device forwards the connection establishment message after the security verification of the connection establishment message is passed, and the connection establishment message is true if the security verification is passed, so that the problem that the first device cannot confirm the authenticity of the message is solved, and the network security is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a method, apparatus, device, system and storage medium for establishing a connection. Background Art

[0002] In smart communication scenarios, multiple devices are grouped into the same ad hoc network to facilitate communication.

[0003] In some ad hoc network scenarios, when two devices cannot communicate directly, the first device as an intermediate node needs to undertake the task of data forwarding. For example, the first device is connected to the second device via Bluetooth, and the first device is connected to the third device via wireless fidelity (Wi-Fi) technology. Since the second device and the third device use different wireless access technologies, during the process of establishing a connection between the second device and the third device, the first connection establishment message transmitted between the second device and the third device for establishing a connection needs to be forwarded by the first device.

[0004] In the above-mentioned related technologies, when the first device receives a message to be forwarded, it directly sends the message to the destination node, which poses a network security risk. Summary of the invention

[0005] The present application proposes a method, device, equipment, system and storage medium for establishing a connection to improve network security.

[0006] In a first aspect, the present application provides a method for establishing a connection, which is applied to a first device, wherein the first device, a second device and a third device are located in the same trust ring, and the first device establishes connections with the second device and the third device, respectively. The method includes: receiving a first connection establishment message sent by the second device, the first connection establishment message including first security information; performing security verification on the first connection establishment message using the first security information; and sending a first connection establishment message to the third device when the security verification of the first connection establishment message passes, the first connection establishment message being used to instruct the third device to establish a communication connection with the second device.

[0007] Compared with the case where the first device directly forwards the message to the destination node when it receives the message that needs to be forwarded, in the present application, the first device uses security information to perform security verification on the first connection establishment message. When the security verification of the first connection establishment message passes, it indicates that the connection establishment message is authentic. That is, the first connection establishment message is forwarded to the third device only after it is verified that the first connection establishment message is authentic. This solves the problem that the first device cannot confirm the authenticity of the message, thereby improving network security.

[0008] In one possible implementation, the first security information includes a first verification code and a verification code algorithm, and the first connection establishment message carries an identifier of a third device; the first connection establishment message is security verified using the first security information, including: querying a routing table of the first device based on the identifier of the third device to obtain a first verification key; processing the first verification key using a verification code algorithm to obtain a second verification code; and determining that the security verification of the first connection establishment message has passed when the first verification code is consistent with the second verification code.

[0009] If the second verification code is consistent with the first verification code, it indicates that the credential key used by the second device in the process of generating the first verification code is the same as the credential key used by the first device in the process of generating the second verification code, and both are the first credential keys of the third device. This indicates that the first device, the second device, and the third device are in the same trust ring, and the first device, the second device, and the third device are mutually trusted devices, which further indicates that the source node and the destination node of the first connection establishment message are both authentic, thereby improving network security.

[0010] In one possible implementation, when the first verification code is consistent with the second verification code, determining that the security verification of the first connection establishment message has passed includes: when the first verification code is consistent with the second verification code, obtaining the first sequence number of the first connection establishment message carried in the first security information; obtaining the second sequence number of the second connection establishment message, the sending time of the second connection establishment message being earlier than the sending time of the first connection establishment message; and when the first sequence number and the second sequence number are inconsistent, determining that the security verification of the first connection establishment message has passed.

[0011] When the first sequence number is inconsistent with the second sequence number, it indicates that the first connection establishment message is a timeout retransmission message sent by the second device. At this time, the source of the first connection establishment message is clear and authentic.

[0012] In a possible implementation, when the first sequence number and the second sequence number are consistent, the first connection establishment message is discarded. If the first sequence number and the second sequence number are consistent, it means that the source node has continuously sent connection establishment messages with the same sequence number. In order to avoid the problem that the attacker sends a message that has been received by the destination node to deceive the first device, the connection establishment messages with the same sequence number are discarded to prevent replay attacks.

[0013] In a possible implementation manner, the first connection establishment message includes a synchronize sequence numbers (SYN) message in a transmission control protocol (TCP) connection establishment process.

[0014] The first device only needs to perform security verification on the SYN message. When the SYN message security verification passes, the TCP SYN-acknowledgement (ACK) message and the ACK message corresponding to the SYN message can be confirmed as secure messages. In this way, the problem of high security verification calculation overhead caused by verifying each TCP message can be avoided.

[0015] In a possible implementation, before receiving the first connection establishment message sent by the second device, it also includes: receiving a first link state advertisement (LSA) message sent by a third device, wherein the first LSA message carries a first credential key of the third device; saving the first credential key in the routing table of the first device as the first verification key of the third device; and sending the first LSA message to the second device. Since the first credential key is carried in the first LSA message, the credential key does not need to be distributed separately, thereby reducing the resource overhead caused by the credential key distribution process.

[0016] In a possible implementation, the first LSA message sent by the third device is encrypted using a first session key, which is a session key between the first device and the third device; the first LSA message sent to the second device is encrypted using a second session key, which is a session key between the first device and the second device. By encrypting the LSA message using the session key, the confidentiality of the LSA message can be improved.

[0017] In a possible implementation, the method also includes: receiving an encrypted session key sent by the second device, the encrypted session key being obtained by encrypting a third session key with the first credential key, the third session key being used for encrypting and decrypting session data between the third device and the second device; sending the encrypted session key to the third device, for the third device to decrypt the encrypted session key using the first credential key to obtain the third session key.

[0018] Compared with the method of performing identity authentication and key negotiation based on the public-private key pair authentication protocol, which requires at least 1.5 round trip times (RTT), the third session key negotiation in the present application only takes 0.5 RTT, which can reduce the interaction overhead in the session key negotiation process. Furthermore, the second device encrypts the third session key using the first credential key to obtain an encrypted session key, and then the third device decrypts the encrypted session key using the first credential key to obtain the third session key. In the above process, the symmetric key is used to negotiate the session key, which reduces the computational overhead in the session key negotiation process compared with the method of negotiating the session key using the asymmetric key of the public-private key pair.

[0019] In a possible implementation, receiving an encrypted session key sent by a second device includes: receiving a session parameter sent by the second device, wherein the session parameter carries the encrypted session key. The encrypted session key is added to the session parameter, and the session parameter is usually carried in a session request message. When the first device forwards the session request message, the session request message can be forwarded as soon as it reaches the TCP layer, and the application layer of the first device does not need to perform decryption and encryption processing on the session request message, which effectively reduces the overhead of the first device in the cross-hop session key negotiation process and saves energy consumption of the first device.

[0020] In a second aspect, the present application provides a method for establishing a connection, which is applied to a second device, wherein the second device, a first device and a third device are located in the same trust loop, and the first device establishes connections with the second device and the third device, respectively. The method comprises: sending a first connection establishment message to the first device, wherein the first connection establishment message includes first security information, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and sending the first connection establishment message to the third device after the security verification of the first connection establishment message passes; and establishing a communication connection with the third device based on the first connection establishment message.

[0021] Compared with the case where the first device directly forwards the message to the destination node when it receives the message that needs to be forwarded, in the embodiment of the present application, since the first device can use the security information included in the first connection establishment message to perform security verification, if the security verification passes, it indicates that the connection establishment message is authentic. That is, the first connection establishment message is forwarded to the third device only after it is verified that the first connection establishment message is authentic, which solves the problem that the first device cannot confirm the authenticity of the message and improves network security.

[0022] In a possible implementation, the first security information includes a first verification code and a verification code algorithm; the first verification code is obtained by processing a first credential key using the verification code algorithm, wherein the first credential key is a credential key corresponding to the third device, and the first verification code is used to perform security verification on the first connection establishment message. The first verification code is generated using the verification code algorithm and the first credential key, so that the first device can use the first verification code to perform security verification on the first connection establishment message, further improving network security.

[0023] In a possible implementation, before sending a first connection establishment message to the first device, it also includes: receiving a first LSA message sent by the first device, wherein the first LSA message sent by the first device is encrypted using a second session key, and the first LSA message carries a first credential key; storing the first credential key carried in the first LSA message. Since the first credential key is carried in the first LSA message, there is no need to distribute the credential key separately, which reduces the resource overhead caused by the distribution of the credential key. Encrypting the LSA message using the session key can improve the confidentiality of the LSA message.

[0024] In a possible implementation, after sending the first connection establishment message to the first device, it also includes: if no response message forwarded by the first device is received within a preset time, the first sequence number in the first security information is updated to obtain the second security information, and the response message is a response message generated by the third device for the first connection establishment message; the second security information is added to the first connection establishment message to obtain the third connection establishment message; and the third connection establishment message is sent to the first device. When the second device retransmits the connection establishment message after a timeout, the sequence number in the security information is updated to avoid the problem that the attacker sends a message that has been received by the destination node to deceive the first device, prevent replay attacks, and further improve network security.

[0025] In a possible implementation, the method also includes: generating a third session key between the third device and the second device, the third session key being used for encrypting and decrypting session data between the third device and the second device; encrypting the third session key using the first credential key to obtain an encrypted session key; forwarding the encrypted session key to the third device via the first device, wherein the third device decrypts the encrypted session key using the queried first credential key to obtain the third session key.

[0026] Compared with the method of performing identity authentication and key negotiation based on the public-private key pair authentication protocol, which requires at least 1.5RTT, in the embodiment of the present application, the third session key negotiation only costs 0.5RTT, which can reduce the interaction overhead in the session key negotiation process. Further, the second device encrypts the third session key using the first credential key to obtain an encrypted session key, and then the third device decrypts the encrypted session key using the first credential key to obtain the third session key. In the above process, the symmetric key is used to negotiate the session key, which reduces the computational overhead in the session key negotiation process compared with the method of negotiating the session key using the asymmetric key of the public-private key pair.

[0027] In a third aspect, the present application provides a method for establishing a connection, which is applied to a third device, wherein the third device, the first device and the second device are located in the same trust loop, and the first device establishes connections with the second device and the third device, respectively. The method comprises: receiving a first connection establishment message sent by the first device, wherein the first connection establishment message includes first security information, a first connection request message is sent by the second device to the first device, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and after the first device passes the security verification on the first connection establishment message, sending the first connection establishment message to the third device; and establishing a communication connection with the second device based on the first connection establishment message.

[0028] Compared with the case where the first device directly forwards the message to the destination node when it receives the message that needs to be forwarded, in the present application, the first device uses security information to perform security verification on the first connection establishment message. If the security verification passes, it indicates that the connection establishment message is authentic. That is, the first connection establishment message is forwarded to the third device only after it is verified that the first connection establishment message is authentic. This solves the problem that the first device cannot confirm the authenticity of the message, thereby improving network security.

[0029] In a possible implementation, establishing a communication connection with a second device based on a first connection establishment message includes: performing security verification on the first connection establishment message using first security information; and establishing a communication connection with the second device if the security verification of the first connection establishment message passes.

[0030] The third device, as the destination node, receives the connection establishment message and uses the first security information to perform security verification on the connection establishment message. After the security verification passes, the third device establishes a communication connection with the second device, thereby further improving network security.

[0031] In one possible implementation, the first security information includes a first verification code and a verification code algorithm; the first security information is used to perform security verification on the first connection establishment message, including: querying in the routing table of the third device based on the identification of the third device to obtain a second verification key; processing the second verification key using the verification code algorithm to obtain a third verification code; and determining that the security verification of the first connection establishment message has passed when the first verification code is consistent with the third verification code.

[0032] If the third verification code is consistent with the first verification code, it indicates that the credential key used by the third device in the process of generating the third verification code is the same as the credential key used by the second device in the process of generating the first verification code, and both are the first credential keys of the third device. This indicates that the first device, the second device, and the third device are in the same trust ring, and the first device, the second device, and the third device are mutually trusted devices, which further indicates that the source node and the destination node of the first connection establishment message are both authentic.

[0033] In a possible implementation, the method also includes: receiving an encrypted session key forwarded by the first device; querying a first credential key of a third device; decrypting the encrypted session key using the first credential key to obtain a third session key, wherein the third session key is used to encrypt and decrypt session data between the third device and the second device.

[0034] Compared with the method of performing identity authentication and key negotiation based on the public-private key pair authentication protocol, which requires at least 1.5RTT, in the embodiment of the present application, the third session key negotiation only costs 0.5RTT, which can reduce the interaction overhead in the session key negotiation process. Further, the second device encrypts the third session key using the first credential key to obtain an encrypted session key, and then the third device decrypts the encrypted session key using the first credential key to obtain the third session key. In the above process, the symmetric key is used to negotiate the session key, which reduces the computational overhead in the session key negotiation process compared with the method of negotiating the session key using the asymmetric key of the public-private key pair.

[0035] In a fourth aspect, the present application provides a device for establishing a connection, the device is configured on a first device, the first device, the second device and the third device are located in the same trust ring, the first device establishes connections with the second device and the third device respectively, the device includes: a first transceiver module and a first processing module, the first transceiver module includes a first receiving module and a first sending module. The first receiving module is used to receive a first connection establishment message sent by the second device, the first connection establishment message includes first security information; the first processing module is used to perform security verification on the first connection establishment message using the first security information; the first sending module is used to send the first connection establishment message to the third device if the security verification of the first connection establishment message passes, the first connection establishment message is used to instruct the third device to establish a communication connection with the second device.

[0036] In one possible implementation, the first security information includes a first verification code and a verification code algorithm, and the first connection establishment message carries an identifier of a third device; the first processing module is used to query the routing table of the first device based on the identifier of the third device to obtain a first verification key; the first verification key is processed using the verification code algorithm to obtain a second verification code; and when the first verification code is consistent with the second verification code, it is determined that the security verification of the first connection establishment message has passed.

[0037] In one possible implementation, the first processing module is used to obtain the first sequence number of the first connection establishment message carried in the first security information when the first verification code is consistent with the second verification code; obtain the second sequence number of the second connection establishment message, and the sending time of the second connection establishment message is earlier than the sending time of the first connection establishment message; and determine that the security verification of the first connection establishment message has passed when the first sequence number and the second sequence number are inconsistent.

[0038] In a possible implementation manner, the first connection establishment message includes a SYN message in a transmission control protocol TCP connection establishment process.

[0039] In one possible implementation, the first receiving module is also used to receive a first link state announcement LSA message sent by a third device before receiving a first connection establishment message sent by the second device, wherein the first LSA message carries a first credential key of the third device; the first processing module includes: a first credential key storage unit, used to save the first credential key in the routing table of the first device as a first verification key of the third device; the first sending module is also used to send the first LSA message to the second device.

[0040] In one possible implementation, the first LSA message sent by the third device is encrypted using a first session key, which is a session key between the first device and the third device; the first LSA message sent to the second device is encrypted using a second session key, which is a session key between the first device and the second device.

[0041] In a possible implementation, the first receiving module is also used to receive an encrypted session key sent by the second device, where the encrypted session key is obtained by encrypting a third session key with the first credential key, and the third session key is used to encrypt and decrypt session data between the third device and the second device; the first sending module is also used to send the encrypted session key to the third device, where the third device uses the first credential key to decrypt the encrypted session key to obtain the third session key.

[0042] In a possible implementation, the first receiving module is used to receive the encrypted session key sent by the second device, and is specifically used to receive the session parameters sent by the second device, wherein the session parameters carry the encrypted session key.

[0043] In a fifth aspect, the present application provides a device for establishing a connection, which is configured on a second device, the second device, the first device and the third device are located in the same trust ring, and the first device establishes connections with the second device and the third device respectively, and the device includes: a second transceiver module, and the second transceiver module includes a second sending module and a second receiving module. The second sending module is used to send a first connection establishment message to the first device, wherein the first connection establishment message includes first security information, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and send the first connection establishment message to the third device after the security verification of the first connection establishment message passes; a second processing module is used to establish a communication connection with the third device based on the first connection establishment message.

[0044] In one possible implementation, the first security information includes a first verification code and a verification code algorithm; the first verification code is obtained by processing a first credential key using the verification code algorithm, wherein the first credential key is the credential key corresponding to the third device, and the first verification code is used to perform security verification on the first connection establishment message.

[0045] In one possible implementation, the device also includes a second receiving module, which is used to receive a first LSA message sent by the first device before sending a first connection establishment message to the first device, wherein the first LSA message sent by the first device is encrypted using a second session key, and the first LSA message carries a first credential key; the second processing module includes a second credential key storage unit, which is used to store the first credential key carried in the first LSA message.

[0046] In one possible implementation, the second processing module includes: a serial number updating unit, which is used to update the first serial number in the first security information after sending a first connection establishment message to the first device, and obtain second security information if no response message forwarded by the first device is received within a preset time period, wherein the response message is a response message generated by the third device for the first connection establishment message; a security information adding unit, which is used to add the second security information to the first connection establishment message to obtain a third connection establishment message; and a second sending module, which is also used to send a third connection establishment message to the first device.

[0047] In one possible implementation, the second processing module includes a session key generation unit, which is used to generate a third session key between the third device, and the third session key is used to encrypt and decrypt session data between the third device and the second device; an encryption unit, which is used to encrypt the third session key using the first credential key to obtain an encrypted session key; and the second sending module, which is also used to forward the encrypted session key to the third device through the first device, wherein the third device decrypts the encrypted session key using the queried first credential key to obtain the third session key.

[0048] In a sixth aspect, the present application provides a device for establishing a connection, which is configured on a third device, the third device, the first device and the second device are located in the same trust ring, the first device establishes connections with the second device and the third device respectively, and the device includes: a third transceiver module, the third transceiver module includes a third sending module and a third receiving module. The third receiving module is used to receive a first connection establishment message sent by the first device, wherein the first connection establishment message includes first security information, the first connection request message is sent by the second device to the first device, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and after the first device passes the security verification of the first connection establishment message, it sends the first connection establishment message to the third device; a third processing module is used to establish a communication connection with the second device based on the first connection establishment message.

[0049] In one possible implementation, the third processing module, when used to establish a communication connection with the second device based on the first connection establishment message, includes: a security verification unit, used to perform security verification on the first connection establishment message using the first security information; and a connection establishment unit, used to establish a communication connection with the second device if the security verification of the first connection establishment message passes.

[0050] In one possible implementation, the first security information includes a first verification code and a verification code algorithm; the security verification unit is specifically used to query in the routing table of the third device based on the identification of the third device to obtain a second verification key; the second verification key is processed using the verification code algorithm to obtain a third verification code; and when the first verification code is consistent with the third verification code, it is determined that the security verification of the first connection establishment message has passed.

[0051] In one possible implementation, the third receiving module is used to receive the encrypted session key forwarded by the first device; the third processing module includes: a credential key query unit, used to query the first credential key of the third device; a decryption unit, used to decrypt the encrypted session key using the first credential key to obtain a third session key, and the third session key is used to encrypt and decrypt session data between the third device and the second device.

[0052] In a possible implementation, the method further includes: a third sending module, configured to send a first LSA message to the first device, wherein the first LSA message carries a first credential key of the third device.

[0053] In the seventh aspect, a device for establishing a connection is provided, comprising a processor, the processor being coupled to a memory, the memory storing at least one program instruction or code, and the at least one program instruction or code being loaded and executed by the processor so that the device implements a method for establishing a connection in any one of the first aspect, the second aspect or the third aspect.

[0054] In an eighth aspect, a storage medium is provided, which may be a computer-readable storage medium, wherein at least one program instruction or code is stored in the storage medium, and when the program instruction or code is loaded and executed by a processor, the computer implements a method for establishing a connection as described in any one of the first aspect, the second aspect, or the third aspect.

[0055] In a ninth aspect, a system for establishing a connection is provided, the system comprising a first device, a second device, and a third device, the first device, the second device, and the third device being located in the same trust ring, the first device being used to execute any one of the connection establishment methods in the first aspect, the second device being used to execute any one of the connection establishment methods in the second aspect, and the third device being used to execute any one of the connection establishment methods in the third aspect.

[0056] In a tenth aspect, another communication device is provided, the device comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals, and when the processor executes the instructions stored in the memory, the processor executes the method in the first aspect or any possible implementation of the first aspect, or executes the method in the second aspect or any possible implementation of the second aspect.

[0057] As an exemplary embodiment, there are one or more processors and one or more memories.

[0058] As an exemplary embodiment, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0059] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips respectively. The embodiments of the present application do not limit the type of memory and the setting method of the memory and the processor.

[0060] In an eleventh aspect, a computer program (product) is provided, the computer program (product) comprising: a computer program code, when the computer program code is executed by a computer, the computer executes the methods in the above aspects.

[0061] In a twelfth aspect, a chip is provided, comprising a processor for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes the methods in the above aspects.

[0062] In the thirteenth aspect, another chip is provided, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the methods in the above aspects.

[0063] The technical effects that can be achieved in any of the fourth to thirteenth aspects mentioned above can refer to the description of the beneficial effects in the first, second or third aspects mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 It is a networking diagram of a heterogeneous network scenario in the related technology;

[0065] Figure 2 This is a schematic diagram of a process of establishing a session connection between a second device and a third device in the related art;

[0066] Figure 3 It is a structural diagram of a related art in which an attacker attacks a third device when a first device forwards data without verification;

[0067] Figure 4 It is a schematic diagram of a process of a first device decrypting and encrypting forwarded data in a related art;

[0068] Figure 5 It is a schematic diagram of an application scenario of a method for establishing a connection provided in an embodiment of the present application;

[0069] Figure 6 It is a flowchart of a method for establishing a connection provided in an embodiment of the present application;

[0070] Figure 7 It is a schematic diagram of a process of distributing a credential key provided in an embodiment of the present application;

[0071] Figure 8 It is a flow chart of a method for session key negotiation provided in an embodiment of the present application;

[0072] Fig. 9 It is a schematic diagram of another process of distributing credential keys provided in an embodiment of the present application;

[0073] Fig.10 It is a flowchart of a method for establishing a TCP connection provided in an embodiment of the present application;

[0074] Fig.11 It is a flowchart of another method for session key negotiation provided in an embodiment of the present application;

[0075] Fig.12 is a schematic diagram of a device structure for establishing a connection provided in an embodiment of the present application;

[0076] Fig.13 is a schematic diagram of another device structure for establishing a connection provided in an embodiment of the present application;

[0077] Fig.14 is a schematic diagram of another device structure for establishing a connection provided in an embodiment of the present application;

[0078] Fig.15 is a structural diagram of a device for establishing a connection provided in an embodiment of the present application;

[0079] Fig.16 is a structural diagram of another device for establishing a connection provided in an embodiment of the present application;

[0080] Fig.17 It is a structural diagram of another device for establishing a connection provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] The terms used in the implementation mode of this application are only used to explain the embodiments of this application, and are not intended to limit this application. The embodiments of this application are described below in conjunction with the accompanying drawings.

[0082] In smart communication scenarios, multiple devices can be included in the same ad hoc network to facilitate communication between devices. In some ad hoc network scenarios, when two devices cannot communicate directly, the first device as an intermediate node is required to undertake the task of data forwarding. For example: heterogeneous network scenarios or network expansion scenarios.

[0083] A heterogeneous network refers to a network that uses different access technologies, or two or more devices that use the same wireless access technology but belong to different wireless operators, and is formed by wireless self-organization. In a heterogeneous network scenario, the second device A needs to communicate with the third device B, but the second device A itself does not support the communication protocol of the third device B. At this time, the first device, which serves as an intermediate node, needs to undertake the task of data forwarding. Figure 1 As shown in the figure, the display screen is connected to the mobile phone via wireless fidelity (Wi-Fi) technology, and the mobile phone and smart watch are connected via Bluetooth. When the smart watch needs to communicate with the display screen, since the smart watch and the display screen cannot be directly connected via Layer 2, they need to rely on Layer 3 routing forwarding capabilities to communicate. Therefore, the smart watch connects to the display screen via the mobile phone across hops, and the mobile phone undertakes the task of forwarding data between the smart watch and the display screen.

[0084] The network extension scenario refers to a scenario where the second device A needs to access a network but is not within the network coverage. For example, a bedroom on the second floor is far from the Wi-Fi router and cannot be covered by Wi-Fi signals. When the sweeping robot runs to the bedroom, the smart speaker in the bedroom connects to the network through power line communication, and the sweeping robot maintains connection with the network through the peer-to-peer (P2P) service with the smart speaker.

[0085] Among them, each device in the self-organizing network acts as a network node, and each network node can be called a hop. The cross-hop connection means that the second device cannot directly establish a communication connection with the third device, and the first device as an intermediate node needs to undertake the data forwarding task to enable the second device to establish a communication connection with the third device. Furthermore, the cross-one-hop connection means that only one device between the second device and the third device needs to undertake the data forwarding task to achieve the communication connection between the second device and the third device. The cross-multi-hop connection means that the second device and the third device need to undertake the data forwarding task through multiple devices in series to achieve the communication connection between the second device and the third device.

[0086] In the above application scenarios, the device-oriented self-organizing network improves the interconnection capability between devices, expands the connection range of devices, saves network deployment costs, and is of great significance. However, in some self-organizing network scenarios, the device that undertakes the data forwarding task is not a router or a switch, but a terminal device, such as: the mobile phone in the above heterogeneous network scenario and the smart speaker in the above extended network scenario. In the scenario where the terminal device undertakes the data forwarding task, on the one hand, the data forwarding service will consume the energy of the terminal device, especially for low-power devices. The activation of the data forwarding function will cause the battery-powered device with limited capacity to fall into a power black hole; on the other hand, the network initially positions the terminal device as a data source. If the device is to undertake the data forwarding task, it is necessary to drive the device to generate data for other devices, which will break the original network security model and bring security risks. Therefore, the first device as an intermediate node usually does not perform routing forwarding without authenticating the second device sending data.

[0087] In the related art, it is usually necessary for the first device as an intermediate node to perform identity authentication with each device on the link in the ad hoc network to establish a secure session connection, and then the second device as the source node initiates a transmission control protocol (TCP) connection establishment request to the third device as the destination node, and based on the data forwarding capability of the first device, completes the cross-hop TCP connection establishment from the second device to the third device, and based on the data forwarding capability of the first device, completes the identity authentication between the second device and the third device, and establishes a secure session connection. For example, Figure 2 As shown, the second device establishes a secure session connection with the third device, mainly including the following steps:

[0088] S110: The first device is connected to the second device via Wi-Fi, and identity authentication and session key negotiation are performed based on a public-private key pair authentication protocol to establish a session connection between the first device and the second device. The first device is connected to the third device via Bluetooth, and identity authentication and session key negotiation are performed based on a public-private key pair authentication protocol to establish a session connection between the first device and the third device.

[0089] Among them, authentication protocols based on public-private key pairs generally include: password authenticated key exchange (PAKE) and transport layer security (TLS).

[0090] The TLS protocol consists of two layers: TLS record protocol and TLS handshake protocol. The handshake protocol is the core part of TLS, which completes end-to-end cryptographic algorithm protocols, identity authentication, and session key negotiation, and is the prerequisite for secure data transmission between the two communicating parties. The process of identity authentication and session key negotiation between the first device and the second device based on the TLS protocol mainly includes: the first device initiates a connection request to the second device, and after the second device receives the connection request, it sends an authentication certificate to the first device, wherein the authentication certificate includes a common key and other authentication information. After the first device verifies that the above authentication certificate is qualified, it generates a random string as a session key, and uses the public key included in the authentication certificate to encrypt the session key. The first device sends the encrypted session key to the second device, and the second device uses the private key corresponding to the public key to decrypt and obtain the session key. Finally, the first device and the second device can use the above session key to encrypt the transmission message before transmitting it.

[0091] It should be noted that the above embodiment is described by taking the first device initiating a connection request to the second device as an example. In actual applications, the second device may also initiate a connection request to the first device. Furthermore, the process of identity authentication and session key negotiation between any two devices based on the public-private key pair authentication protocol is the same as the process of identity authentication and session key negotiation between the first device and the second device described in the above embodiment. For details, please refer to the description in the above embodiment, and will not be described in detail in the embodiments of the present disclosure.

[0092] S120: The second device forwards the SYN message to the third device through the first device.

[0093] S130: The third device forwards a SYN-acknowledgement (ACK) message to the second device through the first device.

[0094] S140. The second device forwards the ACK message to the third device through the first device.

[0095] After the third device receives the ACK message sent by the second device, a TCP connection is established between the second device and the third device.

[0096] When the second device establishes a TCP connection with the third device, the second device initiates a TCP three-way handshake with the third device, such as Figure 2 As shown, after the first device receives the TCP message, it does not need to perform any verification and directly forwards it to the destination node device. For example: after the first device receives the SYN message sent by the second device, or after the first device receives the ACK message sent by the second device, it does not need to perform any verification and directly forwards it to the third device. For another example: after the first device receives the SYN ACK message sent by the third device, it does not need to perform any verification and directly forwards it to the second device. However, if Figure 3 As shown, in actual application, when the first device receives a TCP message with the destination address as the third device, it cannot confirm the authenticity of the sender of the TCP message. An attacker can exploit this vulnerability to send a large number of messages to the first device, which are directly forwarded to the third device through the first device, causing the third device to be attacked by a large number of messages sent by the attacker, bringing network security risks. Furthermore, in the case where the Bluetooth link between the first device and the third device is in a low-power state for a long time, the Bluetooth link maintains a short connection. The first device will trigger the Bluetooth link with the third device only after receiving the TCP message. A large number of attack messages will cause the Bluetooth link between the first device and the third device to be frequently pulled up, thereby increasing the energy consumption of the third device.

[0097] S150: The second device and the third device perform identity authentication and session key negotiation based on a public-private key pair authentication protocol.

[0098] It should be noted that the process of establishing the TCP connection between the second device and the third device, the process of identity authentication and session key negotiation based on the public-private key authentication protocol, and the process of the secure session all involve data or messages that need to be forwarded through the first device as an intermediate node.

[0099] The process of identity authentication and session key negotiation between the second device and the third device based on the public-private key pair authentication protocol is basically the same as the process of identity authentication and session key negotiation between the first device and the second device based on the public-private key pair authentication protocol provided in the above embodiment, and the specific details can be referred to the description in the above embodiment. The difference is that in the process of identity authentication and session key negotiation between the second device and the third device, the message transmitted between the second device and the third device needs to be forwarded through the first device.

[0100] Since the public-private key pair authentication protocol is built on top of the TCP protocol, it mainly serves the application layer. Figure 4 As shown, the data required for identity authentication and session key negotiation between the second device and the third device must be decrypted and encrypted by the application layer of the first device before it can be forwarded. For example: the data sent from the third device to the second device needs to be decrypted by the first device using the first session key between the third device and the first device to obtain the transmission data, and then the transmission data is encrypted using the second session key between the first device and the second device before it can be forwarded to the second device. Similarly, the message sent from the second device to the third device needs to be decoded by the first device using the second session key between the first device and the second device to obtain the transmission data, and then the transmission data is encrypted using the first session key between the third device and the first device before it can be forwarded to the second device.

[0101] The first device as an intermediate node actually only needs to undertake the data forwarding task and does not need to understand the data at the transport layer and above. However, since the secure channel established for transmitting data is link-by-link, the first device has to perform complex operations such as decrypting and then encrypting the message, which will consume a lot of energy.

[0102] In addition, multiple devices perform identity authentication and session key negotiation based on the public-private key pair authentication protocol on the basis of mutual trust formed at the user level. This is a redundant design, resulting in high overhead in the key negotiation process, and the calculation method of the public-private key pair consumes more energy than the calculation method of the symmetric key.

[0103] Among them, the key is a parameter that is input into the algorithm for converting plaintext to ciphertext or ciphertext to plaintext. The process of encoding plaintext into ciphertext using an encryption algorithm is called encryption, and correspondingly, the process of decoding ciphertext into plaintext using a decryption algorithm is called decryption. For example, if each character of a string is cyclically shifted by n bits, then n can be understood as a key, and the cyclic shift can be understood as an encryption algorithm. Using the same encryption algorithm and different keys for the same plaintext will produce different results. For example, if the plaintext is Run, the ciphertext Svo is obtained when the key n is 1; the ciphertext Twp is obtained when the key n is 2.

[0104] According to the similarities and differences between the keys used in the encryption and decryption process, encryption can be divided into symmetric encryption and asymmetric encryption. Symmetric encryption refers to the use of the same key for encryption and decryption, that is, a symmetric key; asymmetric encryption refers to the use of different keys for encryption and decryption. In the asymmetric encryption process, two keys can be obtained at the same time using an asymmetric encryption algorithm, namely a public key and a private key, also known as a public key and a private key. The key that is open to the outside world is called the public key, and the key that is kept secret from the outside world is called the private key. If the public key is used to encrypt plain text, it can only be decrypted using the corresponding private key; if the private key is used to encrypt plain text, it can only be decrypted using the corresponding public key. In general, the public key is used for encryption and the private key is used for decryption.

[0105] A session key is a randomly generated key used for secure communication between two devices. From the perspective of key symmetry, a session key is a symmetric key, which means that the devices use the same session key to encrypt and decrypt data. From the perspective of key repetitiveness, a session key is a one-time key, which means that the session key becomes invalid when the communication ends, and a new session key needs to be negotiated each time a new communication is established.

[0106] The process from the start of communication between two devices to the end of communication can be called a session. Take the session between two devices as an example. At the beginning of the session, the two devices first negotiate a session key. Specifically, the devices can generate a dynamic session key. Then, before each device sends data, it uses the session key to encrypt the data. After each device receives the data, it uses the session key to decrypt the data. When the two devices end communication, the session key becomes invalid.

[0107] In one embodiment of the present application, a schematic diagram of an application scenario of a method for establishing a connection is provided. The method for establishing a connection is mainly applied in an ad hoc network, such as Figure 5 As shown, in this embodiment, the ad hoc network includes three devices, among which the first device and the third device can be directly connected, the first device and the second device are directly connected, and the second device and the third device need to be connected across hops. It should be noted that Figure 5 The self-organizing network in the example is explained with three devices. In actual scenarios, the self-organizing network may include three or more devices. Furthermore, all devices in the self-organizing network can join the self-organizing network at any time, and can also leave the self-organizing network at any time. Furthermore, all devices in the self-organizing network have a mutual trust relationship at the user level. It should be noted that the embodiment of the present application is explained by taking the construction of a self-organizing network by devices as an example. The method for establishing a connection provided in the embodiment of the present application can also be applied to a decentralized network based on trust at the user level, and other networks that perform forwarding with the help of resource-constrained terminals.

[0108] In the embodiment of the present application, the first device, the second device, and the third device are located in the same trust ring. Application software, websites, and other platforms often require users to log in using their accounts and passwords so that the platforms can keep the user's data. For example, a user logs in to an application using an account and password on a first device, and then records a piece of data in the application; at the same time, after the user logs in to the application using the same account and password on a second device, the above data is also recorded in the application.

[0109] From the above examples, we can understand that the same account can be logged in on different devices. When two or more devices under the same account trust each other, the two or more electronic devices form a trust ring. For example, two mobile phones of the same user, or the mobile phone, tablet computer, and laptop computer of the same user can form a trust ring through mutual trust between devices, or the display screen, mobile phone, and smart watch of the same user can form a trust ring through mutual trust between devices.

[0110] In the embodiment of the present application, devices located in the same trust ring are mutually trusted devices. For example, the first device, the second device and the third device C together constitute a trust ring. For the first device, the second device or the third device can be understood as a trusted device of the first device; for the second device, the first device or the third device can be understood as a trusted device of the second device.

[0111] The user logs in to the user account in the preset application in the first device, logs in to the user account in the preset application in the second device, and logs in to the user account in the preset application in the third device. At this time, the first device, the second device, and the third device are in the same trust loop. Since the above three devices log in to the same user account at the same time, it can be shown that the above three devices form a trusted relationship at the user level. Furthermore, the mutual trust relationship between the first device, the second device, and the third device can be reflected in the preset application. Exemplarily, the devices that are connected or connectable in the preset application of the first device are all trusted devices of the first device. In addition, the user can initiate a cross-hop connection with the third device through the preset application in the second device. The user initiates the cross-hop connection operation, indicating that the user confirms that the trusted relationship between the second device and the third device is established.

[0112] In an embodiment of the present application, a first device establishes a communication connection with a second device, and performs identity authentication and session key negotiation based on a public-private key pair authentication protocol to establish a session connection between the first device and the second device. The session key between the first device and the second device is a second session key, and the second session key is used for encryption and decryption of transmission data between the first device and the second device. A first device establishes a communication connection with a third device, and performs identity authentication and session key negotiation based on a public-private key pair authentication protocol to establish a session connection between the first device and the third device. The session key between the first device and the third device is a first session key, and the first session key is used for encryption and decryption of transmission data between the first device and the second device.

[0113] In the following embodiments, the connection establishment method provided in the embodiments of the present application is also applicable to the scenario of establishing a connection across multiple hops, taking the case of one hop between the second device and the third device as an example. In other words, the data forwarding task can be undertaken by multiple first devices as intermediate nodes between the second device and the third device. In the scenario of establishing a connection across multiple hops, each first device as an intermediate node executes the method for establishing a connection performed by the first device in the embodiment of the present application.

[0114] The present application provides a method for establishing a connection. Figure 6 As shown, the connection establishment method provided in the embodiment of the present application includes but is not limited to S201-S204.

[0115] S201. A first device receives a first connection establishment message sent by a second device, wherein the first connection establishment message includes first security information.

[0116] The first connection establishment message refers to a message sent by the second device to the third device, and the first connection establishment message is used to indicate that a communication connection is established between the third device and the second device. In a possible implementation, the first connection establishment message includes a TCP message, and exemplarily, the first connection establishment message includes a SYN message.

[0117] Since a three-way handshake is required during the TCP connection process, the SYN message is the first message sent in the TCP connection, the SYN ACK message is the response message to the SYN message, and the ACK message is the response to the SYN ACK message. In the same TCP connection process, the SYN message, the SYN ACK message, and the ACK message can be verified for validity by the sequence numbers they carry. Therefore, only the first security information is carried in the SYN message, so that the first device can perform security verification on only the SYN message. When the SYN message security verification passes, the SYN ACK message and the TCP message corresponding to the SYN message can be confirmed as secure messages. In this way, the problem of high security verification calculation overhead caused by verifying each TCP message can be avoided.

[0118] In one implementation of the present application, the first security information includes a first verification code and a verification code algorithm, and the first connection establishment message carries an identifier of a third device, wherein the third device refers to a destination node of the first connection establishment message.

[0119] The above security information SEC_Extention includes the following parameters: security version (Version) information, verification code algorithm information (key information, Key_info), sequence number (authentication squeue, Auth_seq), verification code Auth_code. Among them, the security version information Version is used to indicate the version number currently in use, usually set to zero by default, and occupies 1 byte. The verification code algorithm information Key_info is used to indicate the cryptographic algorithm used to generate the verification code based on the credential key, set to zero by default, and occupies 1 byte. Among them, the sequence number Auth_seq is used to prevent replay attacks, and 1 or 2 bytes are added after each connection is established; the verification code Auth_code refers to the verification code calculated using the verification code algorithm credential key. The verification code is used to verify the authenticity of the destination address and the data integrity, 4 bytes.

[0120] In an embodiment of the present application, devices in the same trust ring automatically generate their own credential keys, each device generates a unique credential key, and distributes the credential key among the trusted devices in the trust ring. Each device in the trust ring can receive the credential key of other devices in the trust ring, and the credential key is used to indicate that there is a mutual trust relationship between the devices in the trust ring. Exemplarily, a third device generates a corresponding first credential key, distributes the first credential key in the trust ring, and each device in the trust ring can receive the first credential key of the third device.

[0121] In one embodiment of the present application, after receiving the first credential key distributed by the third device, the second device saves the first credential key in the routing table of the second device. If the second device wants to establish a communication connection with the third device, the second device queries the routing table stored locally in the second device based on the representation of the third device, obtains the first credential key key1 of the third device from the routing table stored locally in the second device, and the second device processes the first credential key key1 using the verification code algorithm indicated in the security information to generate the first verification code auth_code1, and adds the first verification code auth_code1 to the first security information SEC_Extention 1 of the first connection establishment message. The second device sends a message to the first device.

[0122] A first connection establishment message to which the first security information SEC_Extention 1 is added is sent. After receiving the first connection establishment message, the first device performs security verification on the first connection establishment message by using the first security information.

[0123] Exemplarily, the verification code algorithm may be a hash-based message authentication code (HMAC) algorithm, and accordingly, the first verification code auth_code1=HMAC(Key1, payload).

[0124] In one embodiment of the present application, if a response message forwarded by the first device is not received within a preset time period, the first sequence number in the first security information is updated to obtain second security information, and the response message is a response message generated by the third device for the first connection establishment message; the second security information is added to the first connection establishment message to obtain a third connection establishment message; and the third connection establishment message is sent to the first device.

[0125] The first connection establishment message refers to the connection establishment message currently sent by the second device to the second device, and the third connection establishment message refers to the connection establishment message obtained after the sequence number in the first connection establishment message is updated. In other words, the sequence number carried in the first security information added in the first connection establishment message is different from the sequence number carried in the second security information added in the third connection establishment message.

[0126] In an embodiment of the present application, if the second device fails to receive a response message corresponding to the first connection establishment message within a preset time, the first connection establishment message is retransmitted after a timeout, and the first sequence number auth_seq1 in the first security information is updated during the retransmission process to obtain the second security information. Exemplarily, the first sequence number auth_seq1 is added by 1 to obtain an updated sequence number auth_seq1+1. The connection establishment message with the updated sequence number is used as the third connection establishment message, and the second device sends the third connection establishment message to the first device, so that the first device performs security verification on the third connection establishment message.

[0127] Exemplarily, when the first connection establishment message is a first SYN message, the response message is a SYN ACK message corresponding to the first SYN message.

[0128] S202: The first device performs security verification on the first connection establishment message using the first security information.

[0129] The first security information carries relevant information about the destination node of the first connection establishment message. The first device uses the first security information to verify whether the source node of the first connection establishment message is located in the trust ring. If the source node of the first connection establishment message is located in the trust ring, the first connection establishment message is forwarded to the destination node, that is, the third device. If the source node of the first connection establishment message is not a trusted device in the trust ring, it indicates that the first connection establishment message may be an attack message, and the first connection establishment message is discarded and not forwarded to the third device.

[0130] In one embodiment of the present application, the first connection establishment message is securely verified using the first security information, including: querying in the routing table of the first device based on the identification of the third device to obtain a first verification key; processing the first verification key using a verification code algorithm to obtain a second verification code; and determining that the security verification of the first connection establishment message has passed when the first verification code is consistent with the second verification code.

[0131] In the process of distributing the first credential key of the third device in the trust ring, the first device saves the first credential key of the third device in the routing table of the first device. After the first device receives the first connection establishment message sent by the second device, the first credential key of the third device is queried in the routing table of the first device according to the identifier of the third device carried in the first connection establishment message, and the queried first credential key of the third device is used as the first verification key, which is used to verify whether the second device is in the trust ring.

[0132] If the first connection establishment message does not carry the first security information, it is impossible to verify whether the source of the first connection establishment message is in the trust loop, that is, it is impossible to confirm the security of the source node of the first connection establishment message, and then directly determine that the first connection establishment message fails the security verification.

[0133] The identifier of the third device carried in the first connection establishment message, if the corresponding credential key cannot be queried in the routing table of the first device based on the identifier of the third device, it indicates that the destination address of the first connection establishment message may not be in the trust loop. To ensure network security, the first connection establishment message with a destination address that is not in the trust loop is discarded.

[0134] Based on the identification of the third device, the first credential key of the third device is queried in the routing table of the first device, and the first credential key is used as the first verification key Key1' to verify the security of the first connection establishment message. Specifically, the first security information SEC_Extention1 includes a verification code algorithm, and the first verification key is processed using the verification code algorithm to obtain a second verification code. Exemplarily, when the verification code algorithm is the HMAC algorithm, the second verification code auth_code2 = HMAC (Key1', payload).

[0135] Compare the second verification code auth_code2 with the first verification code auth_code1. If the second verification code auth_code2 is inconsistent with the first verification code auth_code1, it indicates that the credential key used by the second device in the process of generating the first verification code is not the first key credential corresponding to the third device. In other words, the second device does not know the first credential key of the third device. This further indicates that the second device is not in the trust loop established by the first device and the third device, that is, the source node of the first connection establishment message is not clear, and the first connection establishment message may be an attack message. Therefore, the security verification of the first connection establishment message fails. In order to ensure network security, the first connection establishment message is discarded.

[0136] If the second verification code auth_code2 is consistent with the first verification code auth_code1, the credential key used by the second device in the process of generating the first verification code is the same as the credential key used by the first device in the process of generating the second verification code, and both are the first credential keys of the third device. This indicates that the first device, the second device, and the third device are in the same trust loop, and the first device, the second device, and the third device are mutually trusted devices. This further indicates that the source node and the destination node of the first connection establishment message are both real, so the security verification of the first connection establishment message passes.

[0137] In one embodiment of the present application, the third device is a low-power device, and the communication link between the first device and the third device is a low-power link. Exemplarily, the low-power link is a Bluetooth link. Further, the low-power link usually maintains a short connection. In other words, the communication link between the first device and the third device establishes a communication connection through the TCP protocol only when data needs to be transmitted. When data does not need to be transmitted between the first device and the third device, the communication link between the first device and the third device is in a disconnected state.

[0138] In the embodiment of the present application, if the first device fails to pass the security verification of the first connection establishment message, the first device will not pull up the low-power link with the third device. Only if the first device passes the security verification of the first connection establishment message, the first device will pull up the low-power link with the third device. In this way, the low-power link between the first device and the third device can be avoided from being frequently pulled up, resulting in high energy consumption of the third device.

[0139] When the first verification code is consistent with the second verification code, determining that the security verification of the first connection establishment message has passed includes: when the first verification code is consistent with the second verification code, obtaining the first sequence number of the first connection establishment message carried in the first security information; obtaining the second sequence number of the second connection establishment message, the sending time of the second connection establishment message being earlier than the sending time of the first connection establishment message; when the first sequence number and the second sequence number are inconsistent, determining that the security verification of the first connection establishment message has passed.

[0140] In an embodiment of the present application, when the first verification code is consistent with the second verification code, it is determined whether the communication link between the first device and the third device is established. When the communication link between the first device and the third device has been established, the first device directly sends a first connection establishment message to the third device.

[0141] When the communication link between the first device and the third device is not established, the first serial number Auth_seq1 carried in the first security information and the second serial number Auth_seq2 stored locally on the first device are obtained, and the first serial number Auth_seqn1 is compared with the second serial number Auth_seq2. When the first serial number Auth_seq1 is consistent with the second serial number Auth_seq2, it indicates that the first connection establishment message may be an attack message, and it is directly discarded without subsequent processing. If the first serial number Auth_seq1 is consistent with the second serial number Auth_seq2, it indicates that the source node has continuously sent connection establishment messages with the same serial number. In order to avoid the attacker sending a packet that has been received by the destination node to deceive the first device, the connection establishment message with the same serial number is determined as an attack message, and the security verification fails.

[0142] It can be seen from the above embodiment that the second device updates the sequence number in the security information during the timeout retransmission process. In other words, the second device will not continuously send two connection establishment messages with the same sequence number. If the first device receives a connection establishment message with the same sequence number, it means that the connection establishment message sent later is not sent by the second device in the trust loop, but may be an attack message sent by an attacker. At this time, the connection establishment message is discarded.

[0143] When the first sequence number Auth_seq1 is inconsistent with the second sequence number Auth_seq2, it indicates that the first connection establishment message is a timeout retransmission message sent by the second device. At this time, the source of the first connection establishment message is clear and authentic. Therefore, the security verification of the first connection establishment message passes, and the first device establishes a low-power link with the third device and sends the first connection establishment message to the third device through the low-power link.

[0144] S203: When the security verification of the first connection establishment message passes, the first device sends the first connection establishment message to the third device.

[0145] In the embodiment of the present application, when the first verification code is consistent with the second verification code, it is determined whether the communication link between the first device and the third device is established. When the communication link between the first device and the third device has been established, the first device directly sends a first connection establishment message to the third device. When the communication link between the first device and the third device is not established, it is determined whether the first sequence number is consistent with the second sequence number. When the first sequence number is inconsistent with the second sequence number, a communication link between the first device and the third device is established, and a first connection establishment message is sent to the third device through the communication link.

[0146] S204. The second device establishes a communication connection with the third device based on the first connection establishment message.

[0147] In an embodiment of the present application, after receiving the first connection establishment message, the third device generates a connection establishment response message corresponding to the first connection establishment message. The third device forwards the connection establishment response message to the second device through the first device. After the second device receives the connection establishment response message, it generates a connection establishment confirmation message. The second device forwards the connection establishment confirmation message to the third device through the first device. After the third device receives the connection establishment confirmation message forwarded by the first device, the cross-hop connection between the second device and the third device is established.

[0148] Exemplarily, after receiving the SYN message forwarded by the first device, the third device generates a SYNACK message corresponding to the SYN message. The third device forwards the SYN ACK message to the second device through the first device. After the second device receives the SYN ACK message, it generates an ACK message. The second device forwards the ACK message to the third device through the first device. After the third device receives the ACK message forwarded by the first device, the TCP connection between the second device and the third device is established.

[0149] In one embodiment of the present application, after receiving the first connection establishment message, the third device uses the first security information carried in the first connection establishment message to perform security verification on the first connection establishment message; if the security verification of the first connection establishment message passes, a communication connection is established with the second device.

[0150] In an embodiment of the present application, the third device queries its own corresponding first credential key in its own routing table, and uses the first credential key as the second verification key Key1", and uses the second verification key Key1" to verify the security of the first connection establishment message. Specifically, the first security information SEC_Extention1 includes a verification code algorithm, and the second verification key Key1" is processed using the verification code algorithm to obtain a third verification code. Exemplarily, when the verification code algorithm is the HMAC algorithm, the third verification code auth_code3 = HMAC(Key1", payload).

[0151] Exemplarily, the third verification code auth_code3 is compared with the first verification code auth_code1. If the third verification code auth_code3 is inconsistent with the first verification code auth_code1, it indicates that the credential key used by the second device in the process of generating the first verification code is not the first key credential corresponding to the third device. In other words, the second device does not know the first credential key of the third device. This further indicates that the second device is not in the trust loop where the third device is located, that is, the source node of the first connection establishment message is not clear, and the first connection establishment message may be an attack message. Therefore, the security verification of the first connection establishment message fails, and the first connection establishment message is discarded to ensure network security.

[0152] If the third verification code auth_code3 is consistent with the first verification code auth_code1, the credential key used by the third device in the process of generating the second verification code is the same as the credential key used by the second device in the process of generating the first verification code, and both are the first credential keys of the third device. This indicates that the second device and the third device are in the same trust loop, and the second device and the third device are mutually trusted devices. This further indicates that the source node and the destination node of the first connection establishment message are both real, so the security verification of the first connection establishment message passes. When the security verification of the first connection establishment message passes, a communication connection is established with the second device.

[0153] On the basis of the above embodiment, before the second device sends the first connection establishment message to the first device, it is also necessary to distribute the first credential key of the third device in the trust ring. The embodiment of the present application provides a method for distributing the first credential key, such as Figure 7 As shown, the credential key distribution method provided in the embodiment of the present application mainly includes the following steps:

[0154] S301: A secure session connection is established between a first device and a second device; and a secure session connection is established between a first device and a third device.

[0155] The first device establishes a communication connection with the second device, and performs identity authentication and session key negotiation based on a public-private key pair authentication protocol to establish a session connection between the first device and the second device. The session key between the first device and the second device is the second session key sessionkey2, and the second session key is used for encryption and decryption of transmission data between the first device and the second device. The first device establishes a communication connection with the third device, and performs identity authentication and session key negotiation based on a public-private key pair authentication protocol to establish a session connection between the first device and the third device. The session key between the first device and the third device is the first session key sessionkey1, and the first session key is used for encryption and decryption of transmission data between the first device and the second device.

[0156] S302. The first device receives a first LSA message sent by the third device, wherein the first LSA message carries a first credential key.

[0157] In the embodiment of the present application, each device in the trust ring generates its corresponding credential key and distributes the credential key among the devices in the ad hoc network. Exemplarily, the third device generates a 128-bit or 256-bit random number as the first credential key key1 through a random number generator built into the device.

[0158] In one embodiment of the present application, the credential key is filled into the security extension field in the LSA message. Among them, the security extension field mainly includes: the device application layer identifier NetworkID, the device network layer address NodeAddr, and the credential key key. Among them, the device application layer identifier NetworkID and the device network layer address NodeAddr are unique device identifiers and are commonly found in LSA messages. Exemplarily, the device application layer identifier NetworkID is usually represented by an Internet protocol (IP) address, and the device network layer address NodeAddr is usually represented by a media access control (MAC) address.

[0159] In an exemplary embodiment, in the embodiment of the present application, the first LSA message is an LSA message of the third device itself. The security extension fields in the first LSA message are: NetworkID1, NodeAddr1, key1; wherein NetworkID1 is the application layer identifier of the third device, NodeAddr1 is the network layer address of the third device, and key1 is the first credential key of the third device.

[0160] In the embodiment of the present application, the first credential key is carried in the first LSA message. As the first LSA message spreads among the various devices in the ad hoc network, the first credential key is distributed among the various devices in the ad hoc network, so that each device in the same ad hoc network can receive the first credential key of the third device. Since the first credential key is carried in the first LSA message, the credential key does not need to be distributed separately, thereby reducing the resource overhead caused by the distribution process of the credential key.

[0161] In one embodiment of the present application, the first LSA message sent by the third device is encrypted using the first session key. Further, the third device encrypts the first LSA message using the first session key sessionkey1, and then sends the encrypted first LSA message to the first device. In this embodiment, the LSA message is encrypted using the session key before being sent, thereby ensuring the confidentiality of the LSA message.

[0162] S303. The first device sends a first LSA message to the second device, wherein the first LSA message carries a first credential key.

[0163] In an embodiment of the present application, the first device sends the first LSA message of the third device to the second device, so that the second device can receive the first LSA message of the third device, and then the second device can parse the first credential key carried in the first LSA message. In an exemplary embodiment, the first LSA message sent by the first device to the second device can be encrypted using the second session key sessionkey2. In this embodiment, the LSA message is encrypted using the session key before being sent, thereby ensuring the confidentiality of the LSA message.

[0164] The trust ring represents the mutual trust relationship between devices determined by the user. With the help of trust ring management, no authentication is performed between the second device and the third device. The credential key is transmitted through LSA messages between hops, which offloads the distribution of credential keys of trusted devices in the trust ring in the ad hoc network and reduces the overhead of credential key distribution.

[0165] In an embodiment of the present application, after the second device establishes a TCP connection with the third device, in order to ensure the confidentiality of the session between the second device and the third device, the second device and the third device need to negotiate a session key. In an embodiment of the present application, a method for negotiating a session key between the second device and the third device is provided, such as Figure 8 As shown, the method for session key negotiation provided in the embodiment of the present application includes the following steps:

[0166] S401: The second device generates a third session key with a third device.

[0167] The third session key refers to a key used for data transmission between the second device and the third device. The second device generates the third session key by using a random number generator in the second device to generate a 128-bit or 256-bit random number.

[0168] When the second device initiates a secure session request to the third device, the second device generates a random number as a third session key.

[0169] S402: The second device encrypts the third session key using the first credential key to obtain an encrypted session key.

[0170] In the embodiment of the present application, the second device queries the routing table stored in itself, obtains the first credential key key1 of the third device, and uses the first credential key key1 to encrypt the third session key sessionkey3 to obtain an encrypted session key. The encrypted session key is added to the session parameters.

[0171] S403: The second device sends an encrypted session key to the first device.

[0172] S404: The first device sends an encrypted session key to the third device.

[0173] If the second device wants to establish a secure session connection with the third device, the second device needs to forward the third session key to the third device through the first device. Exemplarily, the encrypted session key obtained after encrypting the third session key is added to the session parameters, and the second device forwards the session parameters to the third device through the first device, so that the encrypted session key can be carried in the session parameters for transmission, avoiding the separate transmission of the encrypted session key and reducing the transmission overhead.

[0174] S405. The third device queries the first credential key of the third device.

[0175] In the embodiment of the present application, the third device queries its own corresponding first credential key key1 in its own routing table.

[0176] S406. The third device uses the first credential key to decrypt the encrypted session key to obtain a third session key.

[0177] In the embodiment of the present application, after receiving the session parameters, the third device uses the queried first credential key key1 to decrypt the encrypted session key to obtain a third session key, and saves the third session key in the session parameters. The third device uses the third session key to establish a session connection with the second device.

[0178] In the embodiment of the present application, according to the reliable connection mechanism of TCP, the third device receives the ACK message of the session request message sent by the second device, and the session key negotiation is completed;

[0179] The third device will directly use the third session key sessionkey3 to encrypt the message sent to the second device to ensure the confidentiality of the session.

[0180] Compared with the method of performing identity authentication and key negotiation based on the public-private key pair authentication protocol, which requires at least 1.5RTT, in the embodiment of the present application, the third session key negotiation only costs 0.5RTT, which can reduce the interaction overhead in the session key negotiation process.

[0181] In an embodiment of the present application, the second device uses the first credential key to encrypt the third session key to obtain an encrypted session key, and then the third device uses the first credential key to decrypt the encrypted session key to obtain a third session key. This is the negotiation of session keys using symmetric keys. Compared with the method of negotiating session keys using asymmetric keys of public-private key pairs in related technologies, this reduces the computational overhead in the session key negotiation process.

[0182] Furthermore, in an embodiment of the present application, an encrypted session key is added to the session parameters, and the session parameters are usually carried in a session request message. When the first device forwards the session request message, the session request message can be forwarded as soon as it reaches the TCP layer. There is no need for the application layer of the first device to decrypt and encrypt the session request message, which effectively reduces the overhead of the first device in the cross-hop session key negotiation process and saves energy consumption of the first device.

[0183] Based on the above embodiments, the present application embodiment provides a method for distributing credential keys through LSA messages, such as Fig. 9 As shown, the credential key distribution method provided in the embodiment of the present application mainly includes the following steps:

[0184] S501: A first device and a second device are connected via Wi-Fi, and identity authentication and session key negotiation are performed based on a public-private key pair authentication protocol to obtain a second session key between the first device and the second device. A first device and a third device are connected via Bluetooth, and identity authentication and session key negotiation are performed based on a public-private key pair authentication protocol to obtain a first session key between the first device and the third device.

[0185] In an embodiment of the present application, the first device and the second device are connected via Wi-Fi, and identity authentication and session key negotiation are performed based on a public-private key pair authentication protocol to obtain a second session key sessionkey2 between the first device and the second device. The first device and the third device are connected via Bluetooth, and identity authentication and session key negotiation are performed based on a public-private key pair authentication protocol to obtain a first session key sessionkey1 between the first device and the third device.

[0186] The process of identity authentication and session key negotiation between two devices based on the public-private key pair authentication protocol may refer to the description in the above embodiment.

[0187] S502. The third device generates a first credential key and adds the first credential key to the first LSA message; the second device generates a second credential key and adds the second credential key to the second LSA message; the first device generates a third credential key and adds the third credential key to the third LSA message.

[0188] In an embodiment of the present application, each device in the ad hoc network generates its corresponding credential key, and distributes the credential key among the devices in the ad hoc network. Exemplarily, the third device generates a 128-bit or 256-bit random number as the first credential key key1 through the random number generator built into the device; the second device generates a 128-bit or 256-bit random number as the second credential key key2 through the random number generator built into the device; the first device generates a 128-bit or 256-bit random number as the third credential key key3 through the random number generator built into the device.

[0189] In one embodiment of the present application, the credential key is filled into the security extension field in the LSA message. Among them, the security extension field mainly includes: the device application layer identifier NetworkID, the device network layer address NodeAddr, and the credential key key. Exemplarily, the security extension field in the first LSA message is: NetworkID1, NodeAddr1, key1; the security extension field in the second LSA message is: NetworkID2, NodeAddr2, key2; the security extension field in the third LSA message is: NetworkID 3, NodeAddr 3, key3. Among them, NetworkID1 is the application layer identifier of the third device, NodeAddr1 is the network layer address of the third device, and key1 is the first credential key of the third device; Among them, NetworkID2 is the application layer identifier of the second device, NodeAddr2 is the network layer address of the second device, and key2 is the second credential key of the second device. Among them, NetworkID3 is the application layer identifier of the first device, NodeAddr3 is the network layer address of the third device, and key3 is the third credential key of the first device.

[0190] The first LSA message, the second LSA message, and the third LSA message are mutually notified among the first device, the second device, and the third device. Further, in the trust ring formed by the first device, the second device, and the third device, the above LSA messages are mutually notified among the devices in the trust ring. Since the LSA message carries the credential key, with the notification of the LSA message between the trusted devices in the trust ring, the credential key can be distributed among the devices in the trust ring.

[0191] S503: The first device sends a third LSA message to the second device, and the first device sends a third LSA message to the third device.

[0192] In the embodiment of the present application, the third LSA message is the LSA message of the first device itself, and the first device sends its own third LSA message to the second device and the third device respectively. Further, the first device encrypts the third LSA message using the first session key sessionkey1, and then sends the encrypted third LSA message to the third device. After the first device encrypts the third LSA message using the second session key sessionkey2, it sends the encrypted third LSA message to the second device. In the embodiment of the present application, the first device notifies the second device and the third device of the third credential key key3 respectively.

[0193] S504: The first device receives a first LSA message sent by the third device, and the first device receives a second LSA message sent by the second device.

[0194] In the embodiment of the present application, the first LSA message is the LSA message of the third device itself, and the second LSA message is the LSA message of the second device itself. Further, the third device encrypts the first LSA message using the first session key sessionkey1, and then sends the encrypted first LSA message to the first device. The second device encrypts the second LSA message using the second session key sessionkey2, and then sends the encrypted second LSA message to the first device. In the embodiment of the present application, the second device notifies the first device of its own second credential key key2, and the third device notifies the first device of its own first credential key key1.

[0195] S505: The first device forwards the first LSA message to the second device, and the first device forwards the second LSA message to the third device.

[0196] The first device sends the first LSA message of the third device to the second device, so that the second device can receive the first LSA message of the third device, and then the second device can parse out the first credential key carried in the first LSA message. The first device sends the second LSA message of the second device to the third device, so that the third device can receive the second LSA message of the second device, and then the third device can parse out the second credential key carried in the second LSA message. In the embodiment of the present application, the distribution of credential keys between the second device and the third device is realized.

[0197] In an exemplary implementation, the first LSA message sent by the first device to the second device may be encrypted using the second session key sessionkey2, and the second LSA message sent by the first device to the third device may be encrypted using the first session key sessionkey1.

[0198] S506. The first device generates a routing table based on the first LSA message, the second LSA message, and the third LSA message; the second device generates a routing table based on the first LSA message, the second LSA message, and the third LSA message; the third device generates a routing table based on the first LSA message, the second LSA message, and the third LSA message.

[0199] Devices in the trust ring will distribute additional LSA messages of other known trusted devices. Exemplarily, devices in the trust ring query their own trust list and distribute LSA messages of other trusted devices except themselves to neighboring devices, thereby ensuring that each device in the ad hoc network can obtain LSA messages of other devices in the trust ring. After receiving LSA messages from other devices in the trust ring, the device generates a network topology based on the LSA messages of each device, where the network topology includes a routing table and maintains the credential keys of each device in the trust ring.

[0200] In the embodiment of the present application, the trust ring represents the mutual trust relationship between devices determined by the user, which is usually supported by a set of account systems or APPs. With the help of trust ring management, no identity authentication is performed between the second device and the third device, and the credential key is transmitted through the LSA message between hops, which offloads the distribution of authentication messages of the trusted devices in the trust ring in the self-organizing network, thereby reducing the overhead of message distribution.

[0201] After the credential keys are distributed between the devices in the trust ring, the SYN message can be securely verified based on the credential keys. The present application embodiment provides a method for establishing a TCP connection, such as Fig.10 As shown, the method for establishing a TCP connection provided in the embodiment of the present application mainly includes the following steps:

[0202] S601. The second device queries the first credential key of the third device, generates first security information based on the first credential key, and adds the first security information to a SYN message.

[0203] In an embodiment of the present application, each device in the same ad hoc network can maintain a routing table of each device in the ad hoc network. Therefore, the second device can obtain the first credential key key1 of the third device by querying its stored routing table.

[0204] The second device processes the first credential key key1 using the verification code algorithm indicated in the security information, generates a first verification code auth_code1, and adds the first verification code auth_code1 to the first security information SEC_Extention1 of the SYN message. Exemplarily, the verification code algorithm may be an HMAC algorithm, and accordingly, the first verification code auth_code1 = HMAC (Key1, payload).

[0205] S602: The second device sends a SYN message to the first device.

[0206] S603: After receiving the SYN message, the first device performs security verification on the SYN message based on the first security information.

[0207] In an embodiment of the present application, after receiving a SYN message in the routing stack of the first device, based on the identifier of the third device carried in the SYN message, the first credential key of the third device is queried in the routing table of the first device, and the first credential key is used as the first verification key Key1' to verify the security of the SYN message. Specifically, the first security information SEC_Extention1 includes a verification code algorithm, and the first verification key Key1' is processed using the verification code algorithm to obtain the second verification code auth_code2. Exemplarily, when the verification code algorithm is the HMAC algorithm, the second verification code auth_code2 = HMAC (Key1', payload).

[0208] Compare the second verification code auth_code2 with the first verification code auth_code1. If the second verification code auth_code2 is inconsistent with the first verification code auth_code1, it indicates that the credential key used by the second device in the process of generating the first verification code is not the first key credential corresponding to the third device. In other words, the second device does not know the first credential key of the third device. This further indicates that the second device is not in the trust loop established by the first device and the third device, that is, the source node of the first connection establishment message is not clear, and the first connection establishment message may be an attack message. Therefore, the security verification of the first connection establishment message fails. In order to ensure network security, the first connection establishment message is discarded.

[0209] S604: When the security verification of the SYN message passes, a Bluetooth link is established between the first device and the third device.

[0210] In an embodiment of the present application, if the second verification code auth_code2 is consistent with the first verification code auth_code1, the security verification is passed, and it is queried whether the Bluetooth link between the first device and the third device is established. If the Bluetooth link between the first device and the third device is established, the SYN message is directly forwarded to the third device, and step S608 and the steps after S608 are executed.

[0211] When the Bluetooth link between the first device and the third device is not established, obtain the first serial number Auth_seq1 carried in the first security information and the second serial number Auth_seq2 stored locally on the first device, and compare the first serial number Auth_seq1 with the second serial number Auth_seq2. When the first serial number Auth_seq1 is consistent with the second serial number Auth_seq2, it indicates that the first connection establishment message may be an attack message, and is directly discarded without subsequent processing. When the first serial number Auth_seq1 is inconsistent with the second serial number Auth_seq2, it indicates that the first connection establishment message is a timeout retransmission message sent by the second device. At this time, the source of the first connection establishment message is clear and authentic. Therefore, the security verification of the first connection establishment message passes, and the first device pulls up a low-power link with the third device, and sends the first connection establishment message to the third device through the low-power link.

[0212] S605: The second device does not receive a SYN ACK message corresponding to the SYN message within a preset time period, and updates the first sequence number in the first security information to obtain second security information.

[0213] In an embodiment of the present application, if the second device fails to receive the SYN ACK message corresponding to the SYN message within a preset time, the SYN message is retransmitted after a timeout, and the first sequence number auth_seq1 in the first security information is updated during the retransmission process to obtain the second security information. Exemplarily, the first sequence number auth_seq is increased by 1 to obtain an updated sequence number auth_seq+1. The SYN message with the updated sequence number is sent to the first device, so that the first device performs security verification on the third connection establishment message.

[0214] S606: The second device sends a SYN message including second security information to the first device.

[0215] S607: The first device performs security verification on the SYN message based on the second security information.

[0216] In the embodiment of the present application, the process of the first device performing security verification on the SYN message based on the second security information is the same as the process of the first device performing security verification on the SYN message based on the first security information. For details, please refer to the description in the above embodiment.

[0217] S608: After the first device passes the security verification of the SYN message, the first device sends the SYN message to the third device.

[0218] After the first device verifies the SYN message successfully, the first device sends the SYN message to the third device through the Bluetooth link between the first device and the third device.

[0219] S609: The third device performs security verification on the received SYN message.

[0220] The process of the third device performing security verification on the received SYN message is the same as the process of the first device performing security verification on the SYN message based on the security information. For details, please refer to the description in the above embodiment.

[0221] S610: After the third device passes the security verification of the SYN message, it generates a SYN ACK message corresponding to the SYN message.

[0222] S611. The third device forwards the SYN ACK message to the second device through the first device.

[0223] S612: After receiving the SYN ACK message, the second device generates an ACK message corresponding to the SYN ACK message.

[0224] S613: The second device sends an ACK message to the third device through the first device.

[0225] In the embodiment of the present application, after the third device receives the ACK message sent by the second device, the TCP connection between the second device and the third device is established.

[0226] In an embodiment of the present application, since during the TCP connection establishment process, the first device forwards the SYN message after passing security verification, it is ensured that the source and destination of initiating the TCP connection establishment process are real, and effectively prevents forged or replayed messages from inducing the first device to trigger the connection of the low-power link during the forwarding process, thereby consuming the energy of the low-power device.

[0227] On the basis of the above embodiment, after the TCP connection is established between the second device and the third device, the second device and the third device need to complete the session key negotiation before a secure session channel can be established. The present application embodiment provides a method for session key negotiation, such as Fig.11 As shown, the session key negotiation method provided in the embodiment of the present application mainly includes the following steps:

[0228] S701. The second device generates a third session key, obtains a first credential key of the third device by querying a routing table; encrypts the third session key using the first credential key to obtain an encrypted session key, and adds the encrypted session key to the session parameters.

[0229] In an embodiment of the present application, when the second device initiates a secure session request to the third device, it will first generate a third session key sessionkey3 and store it in the session parameters. At the same time, it will query the routing table to obtain the first credential key key1 of the third device, and use the first credential key key1 to encrypt the third session key sessionKey3, and send the session parameters to the third device.

[0230] S702: The second device sends session parameters to the third device through the first device.

[0231] S703. After receiving the session parameters, the third device queries its own corresponding first credential key, uses the first credential key to decrypt the encrypted session key to obtain the third session key, and saves the third session key in the session parameters.

[0232] In an embodiment of the present application, the third device will query and obtain the first credential key of the third device in combination with the data source ID, use the first credential key to decrypt the ciphertext of the third session key sessionKey3, obtain the third session key sessionkey3, and save it in the session parameters. According to the reliable connection mechanism of TCP, once the ACK of the session request message is received, the session key negotiation is completed.

[0233] In an embodiment of the present application, the negotiation of the cross-hop session key between the second device and the third device is carried on the basis of a TCP secure connection. Since the trust relationship between the devices has been established, the neighboring devices with the same account securely transmit the session key across hops based on the key, thereby eliminating the authentication and session key negotiation based on the public and private key pairs of the same account, thereby achieving lightweight end-to-end session key negotiation.

[0234] The above describes the method for establishing a connection provided by an embodiment of the present application. Corresponding to the above method, an embodiment of the present application also provides a device for establishing a connection. Fig.12 is a schematic diagram of a structure of a device for establishing a connection provided in an embodiment of the present application, the device is applied to a first device, the first device is the above-mentioned Figures 5 to 11 The first device shown in any of the accompanying drawings. Fig.12 As shown in the following multiple modules, the Fig.12 The connection establishment device 120 shown can perform all or part of the operations performed by the first device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiments of the present application are not limited to this. Fig.12 As shown, the device includes: a first transceiver module 121 including a first receiving module and a first sending module, wherein the first receiving module is used to receive a first connection establishment message sent by the second device, and the first connection establishment message includes first security information; a first processing module 122 is used to perform security verification on the first connection establishment message using the first security information; and the first sending module is used to send the first connection establishment message to the third device if the security verification of the first connection establishment message passes, and the first connection establishment message is used to instruct the third device to establish a communication connection with the second device.

[0235] In one embodiment of the present application, the first security information includes a first verification code and a verification code algorithm, and the first connection establishment message carries an identifier of a third device; the first processing module 122 is used to use the first security information to perform security verification on the first connection establishment message, including: a first verification key acquisition unit, used to query in the routing table of the first device based on the identifier of the third device to obtain the first verification key; a second verification code determination unit, used to process the first verification key using the verification code algorithm to obtain a second verification code; a verification code comparison unit, used to determine that the security verification of the first connection establishment message has passed when the first verification code is consistent with the second verification code.

[0236] In one embodiment of the present application, the first processing module 122 also includes: a first serial number acquisition unit, used to obtain the first serial number of the first connection establishment message carried in the first security information when the first verification code is consistent with the second verification code; a second serial number acquisition unit, used to obtain the second serial number of the second connection establishment message, the sending time of the second connection establishment message is earlier than the sending time of the first connection establishment message; a serial number comparison unit, used to determine that the security verification of the first connection establishment message has passed when the first serial number and the second serial number are inconsistent.

[0237] The first connection establishment message includes a SYN message in the process of establishing a transmission control protocol TCP connection.

[0238] In one embodiment of the present application, the first receiving module is also used to receive a first link state announcement LSA message sent by a third device before receiving a first connection establishment message sent by a second device, wherein the first LSA message carries a first credential key of the third device; the first processing module includes: a first credential key storage unit, used to save the first credential key in the routing table of the first device as a first verification key of the third device; the first sending module is also used to send the first LSA message to the second device.

[0239] In one embodiment of the present application, the first LSA message sent by the third device is encrypted using a first session key, which is a session key between the first device and the third device; the first LSA message sent to the second device is encrypted using a second session key, which is a session key between the first device and the second device.

[0240] In one embodiment of the present application, the first receiving module is also used to receive an encrypted session key sent by the second device, the encrypted session key is obtained by encrypting a third session key with the first credential key, and the third session key is used to encrypt and decrypt session data between the third device and the second device; the first sending module is also used to send the encrypted session key to the third device, and the third device uses the first credential key to decrypt the encrypted session key to obtain the third session key.

[0241] In one embodiment of the present application, the first receiving module is used to receive the encrypted session key sent by the second device, and is specifically used to receive the session parameters sent by the second device, wherein the session parameters carry the encrypted session key.

[0242] The above describes the method for establishing a connection provided by an embodiment of the present application. Corresponding to the above method, an embodiment of the present application also provides a device for establishing a connection. Fig.13is a structural diagram of another device for establishing a connection provided in an embodiment of the present application, the device is applied to a second device, and the second device is the above Figures 5 to 11 The second device shown in any of the accompanying drawings. Fig.13 As shown in the following multiple modules, the Fig.13 The connection establishment device 130 shown can perform all or part of the operations performed by the second device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiments of the present application are not limited to this. Fig.13 As shown, the device includes: a second transceiver module 131 includes a second receiving module and a second sending module, wherein the second sending module is used to send a first connection establishment message to the first device, wherein the first connection establishment message includes first security information, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and send the first connection establishment message to the third device after the security verification of the first connection establishment message passes; a second processing module 132 is used to establish a communication connection with the third device based on the first connection establishment message.

[0243] In one embodiment of the present application, the first security information includes a first verification code and a verification code algorithm; the first verification code is obtained by processing a first credential key using the verification code algorithm, wherein the first credential key is the credential key corresponding to the third device, and the first verification code is used to perform security verification on the first connection establishment message.

[0244] In one embodiment of the present application, the device also includes a second receiving module, which is used to receive a first LSA message sent by the first device before sending a first connection establishment message to the first device, wherein the first LSA message sent by the first device is encrypted using a second session key, and the first LSA message carries a first credential key; the second processing module 132 includes a second credential key storage unit, which is used to store the first credential key carried in the first LSA message.

[0245] In one embodiment of the present application, the second processing module 132 includes: a serial number updating unit, which is used to update the first serial number in the first security information after sending a first connection establishment message to the first device, and obtain second security information if no response message forwarded by the first device is received within a preset time period, and the response message is a response message generated by the third device for the first connection establishment message; a security information adding unit, which is used to add the second security information to the first connection establishment message to obtain a third connection establishment message; and a second sending module, which is also used to send a third connection establishment message to the first device.

[0246] In one embodiment of the present application, the second processing module 132 includes a session key generation unit, which is used to generate a third session key between the third device, and the third session key is used to encrypt and decrypt session data between the third device and the second device; an encryption unit, which is used to encrypt the third session key using the first credential key to obtain an encrypted session key; the second sending module is also used to forward the encrypted session key to the third device through the first device, wherein the third device decrypts the encrypted session key using the queried first credential key to obtain the third session key.

[0247] The above describes the method for establishing a connection provided by an embodiment of the present application. Corresponding to the above method, an embodiment of the present application also provides a device for establishing a connection. Fig.14 is a structural diagram of another device for establishing a connection provided in an embodiment of the present application, the device is applied to a third device, and the third device is the above-mentioned Figures 5 to 11 The third device shown in any of the accompanying drawings. Fig.14 As shown in the following multiple modules, the Fig.14 The connection establishment device 140 shown can perform all or part of the operations performed by the third device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiment of the present application is not limited to this. Fig.14 As shown, the device includes: a third transceiver module 141 includes a third receiving module and a third sending module, wherein the third receiving module is used to receive a first connection establishment message sent by the first device, wherein the first connection establishment message includes first security information, the first connection request message is sent by the second device to the first device, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and after the first device passes the security verification of the first connection establishment message, the first connection establishment message is sent to the third device; a third processing module 142 is used to establish a communication connection with the second device based on the first connection establishment message.

[0248] In one embodiment of the present application, the third processing module 142 is used to establish a communication connection with the second device based on the first connection establishment message, and includes: a security verification unit, used to perform security verification on the first connection establishment message using the first security information; a connection establishment unit, used to establish a communication connection with the second device when the security verification of the first connection establishment message passes.

[0249] In one embodiment of the present application, the first security information includes a first verification code and a verification code algorithm; a security verification unit is specifically used to query in a routing table of the third device based on an identification of the third device to obtain a second verification key; the second verification key is processed using the verification code algorithm to obtain a third verification code; and when the first verification code is consistent with the third verification code, it is determined that the security verification of the first connection establishment message has passed.

[0250] In one embodiment of the present application, the third receiving module is used to receive the encrypted session key forwarded by the first device; the third processing module 142 includes: a credential key query unit, used to query the first credential key of the third device; a decryption unit, used to decrypt the encrypted session key using the first credential key to obtain the third session key, and the third session key is used to encrypt and decrypt session data between the third device and the second device.

[0251] In one embodiment of the present application, it further includes: a third sending module, configured to send a first LSA message to the first device, wherein the first LSA message carries a first credential key of the third device.

[0252] It should be understood that the above Figure 12-14 When the device provided realizes its functions, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0253] The specific hardware structure of the PE device in the above embodiment is as follows: Fig.15 The connection establishment device 1500 shown includes a transceiver 1501, a processor 1502 and a memory 1503. The transceiver 1501, the processor 1502 and the memory 1503 are connected via a bus 1504. The transceiver 1501 is used to receive messages and establish connections, the memory 1503 is used to store instructions or program codes, and the processor 1502 is used to call the instructions or program codes in the memory 1503 so that the PE device executes the relevant processing steps of the PE device (such as PE1 and PE2) in the above method embodiment. In a specific embodiment, the connection establishment device 1500 of the embodiment of the present application may correspond to the first device in each of the above method embodiments, and the processor 1502 in the connection establishment device 1500 reads the instructions or program codes in the memory 1503 so that Fig.15 The connection establishment device 1500 shown is capable of performing all or part of the operations performed by the first device.

[0254] In a specific embodiment, the connection establishment device 1500 of the embodiment of the present application may correspond to the second device in each of the above-mentioned method embodiments, and the processor 1502 in the connection establishment device 1500 reads the instruction or program code in the memory 1503, so that Fig.15 The connection establishment device 1500 shown is capable of performing all or part of the operations performed by the second device.

[0255] In a specific embodiment, the connection establishment device 1500 of the embodiment of the present application may correspond to the third device in each of the above-mentioned method embodiments, and the processor 1502 in the connection establishment device 1500 reads the instruction or program code in the memory 1503, so that Fig.15 The connection establishment device 1500 shown is capable of performing all or part of the operations performed by the third device.

[0256] The device 1500 for establishing the connection may also correspond to the above Figure 12-14 The device shown, for example, Fig.12 The first transceiver module 121 involved in the embodiment is equivalent to the transceiver 1501, and the first processing module 122 is equivalent to the processor 1502. For another example: Fig.13 The second transceiver module 131 involved in is equivalent to the transceiver 1501, and the second processing module 132 is equivalent to the processor 1502. For another example: Fig.14 The third transceiver module 141 involved is equivalent to the transceiver 1501, and the third processing module 142 is equivalent to the processor 1502.

[0257] See also Fig.16 , Fig.16 A schematic diagram of the structure of a device for establishing a connection provided by an exemplary embodiment of the present application is shown. Fig.16 The connection establishment device 1600 shown is used to perform the above Figure 6-Figure 11 The operations involved in the connection establishment method shown in FIG. Fig.16 As shown, the connection establishment device 1600 includes at least one processor 1601 , a memory 1603 , and at least one communication interface 1604 .

[0258] Processor 1601 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing units (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, processor 1601 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present application. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0259] Optionally, the connection establishment device 1600 further includes a bus. The bus is used to transmit information between the components of the connection establishment device 1600. The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.16 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus. Fig.16 In addition to bus connection, the components of the device 1600 in which the connection is established may also be connected in other ways. The embodiment of the present application does not limit the connection method of the components.

[0260] The memory 1603 is, for example, a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1603 is, for example, independent and connected to the processor 1601 via a bus. The memory 1603 can also be integrated with the processor 1601.

[0261] The communication interface 1604 uses any transceiver-like device to communicate with other devices or communication networks, and the communication network can be Ethernet, a radio access network (RAN) or a wireless local area network (WLAN), etc. The communication interface 1604 may include a wired communication interface and may also include a wireless communication interface. Specifically, the communication interface 1604 may be an Ethernet interface, a fast Ethernet (FE) interface, a gigabit Ethernet (GE) interface, an asynchronous transfer mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface or a combination thereof. The Ethernet interface may be an optical interface, an electrical interface or a combination thereof. In an embodiment of the present application, the communication interface 1604 may be used to connect the established device 1600 to communicate with other devices.

[0262] In a specific implementation, as an embodiment, the processor 1601 may include one or more CPUs, such as Fig.16 0 and CPU1 shown in FIG. Each of these processors may be a single-CPU processor or a multi-CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0263] In a specific implementation, as an embodiment, the connection establishment device 1600 may include multiple processors, such as Fig.16 1 and 1605. Each of these processors may be a single-CPU or a multi-CPU. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0264] In a specific implementation, as an embodiment, the device 1600 for establishing a connection may also include an output device and an input device. The output device communicates with the processor 1601 and may display information in a variety of ways. For example, the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 1601 and may receive user input in a variety of ways. For example, the input device may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0265] In some embodiments, the memory 1603 is used to store the program code 1602 for executing the solution of the present application, and the processor 1601 can execute the program code 1602 stored in the memory 1603. That is, the device 1600 for establishing the connection can implement the message processing method provided by the method embodiment through the processor 1601 and the program code 1602 in the memory 1603. The program code 1602 may include one or more software modules. Optionally, the processor 1601 itself may also store the program code or instruction for executing the solution of the present application.

[0266] In a specific embodiment, the connection establishment device 1600 of the embodiment of the present application may correspond to the first device in each of the above-mentioned method embodiments, and the processor 1601 in the connection establishment device 1600 reads the program code 1602 in the memory 1603 or the program code or instruction stored in the processor 1601 itself, so that Fig.16 The connection establishment device 1600 shown is capable of performing all or part of the operations performed by the first device.

[0267] In a specific embodiment, the connection establishment device 1600 of the embodiment of the present application may correspond to the second device in each of the above-mentioned method embodiments, and the processor 1601 in the connection establishment device 1600 reads the program code 1602 in the memory 1603 or the program code or instruction stored in the processor 1601 itself, so that Fig.16 The device 1600 shown in which the connection is established can perform all or part of the operations performed by the second device.

[0268] In a specific embodiment, the connection establishment device 1600 of the embodiment of the present application may correspond to the third device in each of the above-mentioned method embodiments, and the processor 1601 in the connection establishment device 1600 reads the program code 1602 in the memory 1603 or the program code or instruction stored in the processor 1601 itself, so that Fig.16 The connection establishment device 1600 shown is capable of performing all or part of the operations performed by the third device.

[0269] The device 1600 for establishing the connection may also correspond to the above Figure 12-14 The device shown, Figure 12-14 Each functional module in the apparatus shown is implemented using software of the connection establishment device 1600. In other words, Fig.12 The functional modules included in the apparatus shown are generated after the processor 1601 of the device 1600 for establishing the connection reads the program code 1602 stored in the memory 1603. For example, Fig.12 The first transceiver module involved in the communication interface 1604 is equivalent to the communication interface 1604, and the first processing module 122 is equivalent to the processor 1601 and / or the processor 1605. For another example, Fig.13 The second receiving module 131 involved in the embodiment is equivalent to the communication interface 1604, and the second processing module 132 is equivalent to the processor 1601 and / or the processor 1605. For another example, Fig.14 The third receiving module 141 involved is equivalent to the communication interface 1604, and the third processing module 142 is equivalent to the processor 1601 and / or the processor 1605.

[0270] in, Figure 6-Figure 11 Each step of the method for establishing the connection shown is completed by an integrated logic circuit of hardware or software instructions in the processor of the device 1600 for establishing the connection. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0271] See also Fig.17 , Fig.17 A schematic diagram of the structure of a device 1700 for establishing a connection provided by another exemplary embodiment of the present application is shown; Fig.17 The connection establishment device 1700 shown is used to perform the above Figure 6-Figure 11 All or part of the operations involved in the method for establishing a connection shown. The device 1700 for establishing a connection is, for example, a switch, a router, etc. The device 1700 for establishing a connection can be implemented by a general bus architecture.

[0272] like Fig.17 As shown, the device 1700 for establishing a connection includes: a main control board 1710 and an interface board 1730 .

[0273] The main control board is also called the main processing unit (MPU) or route processor card. The main control board 1710 is used to control and manage various components in the device 1700 for establishing a connection, including route calculation, device management, device maintenance, and protocol processing functions. The main control board 1710 includes: a central processing unit 1711 and a memory 1712.

[0274] The interface board 1730 is also called a line processing unit (LPU), a line card or a service board. The interface board 1730 is used to provide various service interfaces and implement data packet forwarding. Service interfaces include but are not limited to Ethernet interfaces, POS (packet over SONET / SDH) interfaces, etc., and Ethernet interfaces are, for example, flexible Ethernet clients (FlexE Clients). The interface board 1730 includes: a central processor 1731, a network processor 1732, a forwarding table entry memory 1734 and a physical interface card (PIC) 1733.

[0275] The central processor 1731 on the interface board 1730 is used to control and manage the interface board 1730 and communicate with the central processor 1711 on the main control board 1710 .

[0276] The network processor 1732 is used to implement the message sending process. The network processor 1732 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented by an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Specifically, the network processor 1732 is used to forward the received message based on the forwarding table stored in the forwarding table entry memory 1734. If the destination address of the message is the address of the device 1700 with the established connection, the message is sent to the CPU (such as the central processor 1731) for processing; if the destination address of the message is not the address of the device 1700 with the established connection, the next hop and the outgoing interface corresponding to the destination address are found from the forwarding table according to the destination address, and the message is forwarded to the outgoing interface corresponding to the destination address. Among them, the processing of the uplink message may include: processing of the message input interface, forwarding table search; the processing of the downlink message may include: forwarding table search, etc. In some embodiments, the central processor may also perform the function of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, so that the forwarding chip is not required in the interface board.

[0277] The physical interface card 1733 is used to implement the connection function of the physical layer, and the original traffic enters the interface board 1730 from it, and the processed message is sent from the physical interface card 1733. The physical interface card 1733 is also called a daughter card, which can be installed on the interface board 1730 and is responsible for converting the optical signal into a message and forwarding the message to the network processor 1732 for processing after checking the legitimacy of the message. In some embodiments, the central processor 1731 can also perform the functions of the network processor 1732, such as implementing software forwarding based on a general-purpose CPU, so that the network processor 1732 is not required in the physical interface card 1733.

[0278] Optionally, the device 1700 for connection establishment includes a plurality of interface boards, for example, the device 1700 for connection establishment further includes an interface board 1740, and the interface board 1740 includes: a central processor 1741, a network processor 1742, a forwarding table entry memory 1744, and a physical interface card 1743. The functions and implementation methods of the components in the interface board 1740 are the same or similar to those of the interface board 1730, and are not described in detail herein.

[0279] Optionally, the device 1700 to which the connection is established further includes a switching fabric board 1720. The switching fabric board 1720 may also be referred to as a switch fabric unit (SFU). When the device has multiple interface boards, the switching fabric board 1720 is used to complete data exchange between the interface boards. For example, the interface board 1730 and the interface board 1740 may communicate via the switching fabric board 1720.

[0280] The main control board 1710 is coupled to the interface board. For example, the main control board 1710, the interface board 1730, the interface board 1740, and the switching network board 1720 are connected to the system backplane through the system bus to achieve intercommunication. In a possible implementation, an inter-process communication (IPC) channel is established between the main control board 1710 and the interface board 1730 and the interface board 1740, and the main control board 1710 and the interface board 1730 and the interface board 1740 communicate through the IPC channel.

[0281] Logically, the device 1700 for establishing a connection includes a control plane and a forwarding plane. The control plane includes a main control board 1710 and a central processing unit 1711. The forwarding plane includes various components for performing forwarding, such as a forwarding table entry memory 1734, a physical interface card 1733, and a network processor 1732. The control plane performs functions such as a router, generating a forwarding table, processing signaling and protocol messages, and configuring and maintaining the status of the device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the network processor 1732 forwards the message received by the physical interface card 1733 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane can be stored in the forwarding table entry memory 1734. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device.

[0282] It is worth noting that there may be one or more main control boards, and when there are multiple boards, they may include a primary main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. In a centralized forwarding architecture, the device may not need a switching network board, and the interface board is responsible for processing the service data of the entire system. In a distributed forwarding architecture, the device can have at least one switching network board, which realizes data exchange between multiple interface boards and provides large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of the distributed architecture device are greater than those of the centralized architecture device. Optionally, the device may have only one board, that is, no switching board, and the functions of the interface board and the main control board are integrated on the board. In this case, the central processor on the interface board and the central processor on the main control board can be combined into one central processor on the board to perform the functions of the two. This type of device has low data exchange and processing capabilities (for example, low-end switches or routers). The specific architecture to be used depends on the specific networking deployment scenario, and no limitation is made here.

[0283] In a specific embodiment, the device 1700 for establishing the connection corresponds to the above Fig.12 In some embodiments, Fig.12 The first transceiver module 121 in the illustrated apparatus for establishing a connection is equivalent to the physical interface card 1733 in the device 1700 for establishing a connection or the physical interface card 1743 in the device 1700 for establishing a connection. Fig.12 The first processing module 122 in the illustrated apparatus for establishing a connection is equivalent to at least one of the central processor 1711 , the network processor 1732 , and the network processor 1742 in the device 1700 for establishing a connection.

[0284] In some embodiments, the connection establishment device 1700 also corresponds to the above Fig.13 Any of the devices shown above for establishing a connection with a second device. In some embodiments, Fig.13 The second transceiver module 131 in the apparatus for establishing a connection shown is equivalent to the physical interface card 1733 in the device 1700 for establishing a connection or the physical interface card 1743 in the device 1700 for establishing a connection. Fig.13 The second processing module 132 in the illustrated connection establishment apparatus is equivalent to at least one of the central processor 1711 , the network processor 1732 , and the network processor 1742 in the connection establishment device 1700 .

[0285] In some embodiments, the connection establishment device 1700 also corresponds to the above Fig.14 Any of the devices shown in the figure is applied to establish a connection with a third device. In some embodiments, Fig.14 The third transceiver module 141 in the illustrated apparatus for establishing a connection is equivalent to the physical interface card 1733 in the device 1700 for establishing a connection or the physical interface card 1743 in the device 1700 for establishing a connection. Fig.14 The third processing module 142 in the illustrated connection establishment apparatus is equivalent to at least one of the central processor 1711, the network processor 1732 and the network processor 1742 in the connection establishment device 1700.

[0286] Among them, at least one of the central processor 1711, the network processor 1732 and the network processor 1742 refers to any one of the central processor 1711, the network processor 1732 and the network processor 1742, or any combination of multiple thereof.

[0287] Based on the above Fig.15 , Fig.16 and Fig.17 The device shown in the embodiment of the present application further provides a communication system, the communication system comprising: a first device, a second device and a third device. Optionally, the first device is Fig.15 The connection shown is established by the device 1500 or Fig.16 The connection shown is established by the device 1600 or Fig.17 The connection established by the device 1700 is shown, and the second device is Fig.15 The connection shown is established by the device 1500 or Fig.16 The connection shown is established by the device 1600 or Fig.17 The connection established by the device 1700 shown in FIG. Fig.15 The connection shown is established by the device 1500 or Fig.16 The connection shown is established by the device 1600 or Fig.17 The connection shown is established by device 1700.

[0288] The methods performed by the first device, the second device, and the third device can be referred to above. Figure 6-Figure 11 The relevant description of the illustrated embodiment will not be repeated here.

[0289] It should be understood that the above processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0290] Further, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0291] The memory may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct memory bus random access memory (DR RAM).

[0292] A computer-readable storage medium is also provided, wherein the storage medium stores at least one program instruction or code, which, when loaded and executed by a processor, enables the computer to implement the above Figure 6-Figure 11 Any connection establishment method.

[0293] The present application provides a computer program. When the computer program is executed by a computer, a processor or a computer can be enabled to execute the corresponding steps and / or processes in the above method embodiments.

[0294] A chip is provided, comprising a processor, for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes the methods in the above aspects.

[0295] Another chip is provided, comprising: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, the processor is used to execute the code in the memory, and when the code is executed, the processor is used to execute the methods in the above aspects.

[0296] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk), etc.

[0297] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above are only specific implementation methods of the present application and are not used to limit the protection scope of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.

[0298] Those of ordinary skill in the art will appreciate that, in conjunction with the various method steps and modules described in the embodiments disclosed herein, they can be implemented in software, hardware, firmware, or any combination thereof. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0299] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0300] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. As an example, the method of the embodiment of the present application can be described in the context of a machine executable instruction, and the machine executable instruction is such as included in the program module executed in the device on the real or virtual processor of the target. Generally speaking, a program module includes a routine, a program, a library, an object, a class, a component, a data structure, etc., which performs a specific task or realizes a specific abstract data structure. In various embodiments, the function of the program module can be merged or divided between the described program modules. The machine executable instruction for the program module can be executed in a local or distributed device. In a distributed device, the program module can be located in both a local and a remote storage medium.

[0301] The computer program code for realizing the method for the embodiment of the present application can be written in one or more programming languages. These computer program codes can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by a computer or other programmable data processing device, causes the function / operation specified in the flow chart and / or block diagram to be implemented. The program code can be executed completely on a computer, partially on a computer, as an independent software package, partially on a computer and partially on a remote computer or completely on a remote computer or server.

[0302] In the context of the embodiments of the present application, computer program codes or related data may be carried by any appropriate carrier to enable a device, apparatus or processor to perform the various processes and operations described above. Examples of carriers include signals, computer readable media, and the like.

[0303] Examples of signals may include electrical, optical, radio, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, etc.

[0304] A machine-readable medium may be any tangible medium that contains or stores a program for or related to an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of machine-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0305] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0306] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0307] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0308] In addition, each functional module in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0309] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0310] In this application, the terms "first", "second", etc. are used to distinguish between identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limitation on quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the various examples, a first device may be referred to as a second device, and similarly, a second device may be referred to as a first device. Both the first edge network and device and the second device may be edge devices, and in some cases, may be separate and different edge devices.

[0311] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0312] The term "at least one" in this application means one or more, and the term "multiple" in this application means two or more, for example, multiple second messages means two or more second messages. The terms "system" and "network" are often used interchangeably herein.

[0313] It should be understood that the terms used in the description of various examples herein are only for describing specific examples and are not intended to be limiting. As used in the description of various examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0314] It should also be understood that the term “comprise” (also known as “includes,” “including,” “comprises” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0315] It should also be understood that the terms "if" and "if" may be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrases "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted to mean "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0316] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0317] It should also be understood that the references to "one embodiment", "an embodiment", or "a possible implementation" throughout the specification mean that specific features, structures, or characteristics related to the embodiment or implementation are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment", or "a possible implementation" throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

Claims

1. A method for establishing a connection, characterized in that: The method is applied to a first device, the first device, the second device and the third device are located in the same trust ring, and the first device establishes connections with the second device and the third device respectively, and the method includes: receiving a first connection establishment message sent by the second device, where the first connection establishment message includes first security information; Performing security verification on the first connection establishment message using the first security information; In a case where the security verification of the first connection establishment message passes, the first connection establishment message is sent to the third device, where the first connection establishment message is used to instruct the third device to establish a communication connection with the second device.

2. The method according to claim 1, characterized in that The first security information includes a first verification code and a verification code algorithm, and the first connection establishment message carries an identifier of the third device; The using the first security information to perform security verification on the first connection establishment message includes: Based on the identifier of the third device, query in the routing table of the first device to obtain a first verification key; Processing the first verification key using the verification code algorithm to obtain a second verification code; When the first verification code is consistent with the second verification code, it is determined that the security verification of the first connection establishment message passes.

3. The method according to claim 2, characterized in that The determining that the first connection establishment message passes security verification when the first verification code is consistent with the second verification code includes: When the first verification code is consistent with the second verification code, obtaining a first sequence number of the first connection establishment message carried in the first security information; Obtaining a second sequence number of a second connection establishment message, where the sending time of the second connection establishment message is earlier than the sending time of the first connection establishment message; When the first sequence number and the second sequence number are inconsistent, it is determined that the security verification of the first connection establishment message passes.

4. The method according to any one of claims 1 to 3, characterized in that The first connection establishment message includes a synchronization sequence number SYN message in the process of establishing a transmission control protocol TCP connection.

5. The method according to any one of claims 1 to 4, characterized in that Before receiving the first connection establishment message sent by the second device, the method further includes: Receive a first link state advertisement LSA message sent by the third device, wherein the first LSA message carries a first credential key of the third device; storing the first credential key in a routing table of the first device as a first verification key of the third device; Send the first LSA message to the second device.

6. The method according to claim 5, characterized in that The first LSA message sent by the third device is encrypted using a first session key, where the first session key is a session key between the first device and the third device; The first LSA message sent to the second device is encrypted using a second session key, where the second session key is a session key between the first device and the second device.

7. The method according to claim 5, characterized in that The method further comprises: receiving an encrypted session key sent by the second device, where the encrypted session key is obtained by encrypting a third session key with the first credential key, and the third session key is used for encrypting and decrypting session data between the third device and the second device; The encrypted session key is sent to the third device, so that the third device decrypts the encrypted session key using the first credential key to obtain a third session key.

8. The method according to claim 7, characterized in that The receiving the encrypted session key sent by the second device includes: Receive a session parameter sent by the second device, wherein the session parameter carries the encrypted session key.

9. A method for establishing a connection, characterized in that: The method is applied to a second device, the second device, the first device, and the third device are located in the same trust ring, and the first device establishes connections with the second device and the third device respectively, and the method includes: Sending a first connection establishment message to the first device, wherein the first connection establishment message includes first security information, and the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and send the first connection establishment message to the third device after the security verification of the first connection establishment message passes; Establish a communication connection with the third device based on the first connection establishment message.

10. The method according to claim 9, characterized in that The first security information includes a first verification code and a verification code algorithm; The first verification code is obtained by processing a first credential key using the verification code algorithm, wherein the first credential key is the credential key corresponding to the third device, and the first verification code is used to perform security verification on the first connection establishment message.

11. The method according to claim 10, characterized in that Before sending the first connection establishment message to the first device, the method further includes: receiving a first LSA message sent by the first device, wherein the first LSA message sent by the first device is encrypted using a second session key, and the first LSA message carries the first credential key; The first credential key carried in the first LSA message is stored.

12. The method according to any one of claims 9 to 11, characterized in that: After sending the first connection establishment message to the first device, the method further includes: If no response message forwarded by the first device is received within a preset time period, the first sequence number in the first security information is updated to obtain second security information, wherein the response message is a response message generated by the third device in response to the first connection establishment message; Adding the second security information to the first connection establishment message to obtain a third connection establishment message; Send the third connection establishment message to the first device.

13. The method according to claim 11, characterized in that The method further comprises: generating a third session key between the third device and the second device, wherein the third session key is used for encrypting and decrypting session data between the third device and the second device; Encrypting the third session key using the first credential key to obtain an encrypted session key; The encrypted session key is forwarded to the third device through the first device, wherein the third device decrypts the encrypted session key using the queried first credential key to obtain a third session key.

14. A method for establishing a connection, characterized in that: The method is applied to a third device, the third device, the first device, and the second device are located in the same trust ring, and the first device establishes connections with the second device and the third device respectively, and the method includes: receiving a first connection establishment message sent by the first device, wherein the first connection establishment message includes first security information, the first connection request message is sent by the second device to the first device, the first security information is used to instruct the first device to perform security verification on the first connection establishment message, and after the first device passes the security verification on the first connection establishment message, sending the first connection establishment message to the third device; Establish a communication connection with the second device based on the first connection establishment message.

15. The method according to claim 14, characterized in that The establishing a communication connection with the second device based on the first connection establishment message includes: Performing security verification on the first connection establishment message using the first security information; When the security verification of the first connection establishment message passes, a communication connection is established with the second device.

16. The method according to claim 15, characterized in that The first security information includes a first verification code and a verification code algorithm; The using the first security information to perform security verification on the first connection establishment message includes: Based on the identifier of the third device, query the routing table of the third device to obtain a second verification key; Processing the second verification key using the verification code algorithm to obtain a third verification code; When the first verification code is consistent with the third verification code, it is determined that the security verification of the first connection establishment message passes.

17. The method according to any one of claims 14 to 16, characterized in that: The method further comprises: receiving an encrypted session key forwarded by the first device; querying a first credential key of the third device; The encrypted session key is decrypted using the first credential key to obtain the third session key, where the third session key is used for encryption and decryption of session data between the third device and the second device.

18. A device for establishing a connection, characterized in that: The apparatus is configured on a first device, the first device, the second device and the third device are located in the same trust ring, the first device establishes connections with the second device and the third device respectively, and the apparatus includes: A first transceiver module, configured to perform a receiving or sending related operation performed by the first device in the connection establishment method according to any one of claims 1 to 8; The first processing module is used to perform other operations other than the receiving or sending related operations performed by the first device in the connection establishment method described in any one of claims 1 to 8.

19. A device for establishing a connection, characterized in that: The apparatus is configured on a second device, the second device, the first device and the third device are located in the same trust ring, the first device establishes connections with the second device and the third device respectively, and the apparatus includes: A second transceiver module, configured to perform a receiving or sending related operation performed by the second device in the connection establishment method according to any one of claims 9 to 13; The second processing module is used to perform other operations other than the receiving or sending related operations performed by the second device in the connection establishment method described in any one of claims 9 to 13.

20. A device for establishing a connection, characterized in that: The apparatus is configured on a third device, the third device, the first device and the second device are located in the same trust ring, the first device establishes connections with the second device and the third device respectively, and the apparatus includes: A third transceiver module, configured to perform a receiving or sending related operation performed by the third device in the connection establishment method according to any one of claims 14 to 17; The third processing module is used to perform other operations other than the receiving or sending related operations performed by the third device in the connection establishment method described in any one of claims 14-17.

21. A device for establishing a connection, characterized in that The device includes: a processor, the processor is coupled to a memory, the memory stores at least one program instruction or code, and the at least one program instruction or code is loaded and executed by the processor so that the device implements the method for establishing a connection described in any one of claims 1-17.

22. A system for establishing a connection, characterized in that: The system includes a first device, a second device and a third device, wherein the first device, the second device and the third device are located in the same trust ring, the first device is used to execute the connection establishment method described in any one of claims 1-8, the second device is used to execute the connection establishment method described in any one of claims 9-13, and the third device is used to execute the connection establishment method described in any one of claims 14-17.

23. A storage medium, characterized in that: The storage medium stores at least one program instruction or code, and when the program instruction or code is loaded and executed by the processor, the computer implements the method for establishing a connection as described in any one of claims 1-17.

Images