Method and device for security authentication encryption in initial stage of communication link establishment, and storage medium

Abstract

The invention discloses a security authentication encryption method and device in the initial stage of communication link establishment and a storage medium. The invention provides an authentication encryption self-adaption method based on prestored and diffused keys, aiming at the problems that end-to-end wireless communication link establishment is limited by narrow bandwidth, conventional encryption preparation cannot be applied mechanically, newly-added planning external equipment is difficult to guarantee after a symmetric key is preset, malicious control is easily caused by abandoning password protection, and the like, and provides the authentication encryption self-adaption method based on the prestored and diffused keys. A key is pre-stored by fully utilizing a key storage space of end equipment, a newly added key is spread and transmitted along with a link establishment process, and two modes of off-line preset loading during opening and automatic on-line interaction after a new communication terminal joins in intercommunication are combined, so that the link establishment efficiency is improved on the premise of no artificial participation and maximum reduction of occupation of a link establishment narrow band. The security of information transmission is greatly improved, so that the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, device and storage medium for security authentication encryption in the initial stage of communication link establishment. Background Art

[0002] End-to-end wireless communication often requires secure transmission (such as authentication, encryption, etc.). However, while increasing the security design of business transmission, the premise of business transmission has been ignored, that is, the security design of link establishment information transmission is lacking. The lack of security protection for the initial communication link establishment link will make it easy for attackers (at the boot stage) to create dangers such as device loss of control and exposure of transmission signaling. In other words, since link establishment information, including communication parameters, security parameters, etc., is transmitted in the channel, whether the link establishment information is transmitted in characters or numbers, there is a risk of exposure, reverse speculation, and malicious control. Summary of the invention

[0003] The present invention provides a method, device and storage medium for secure authentication encryption in the initial stage of communication link establishment, so as to solve the problems in the initial stage of existing end-to-end wireless communication link establishment, that is, communication is limited by narrow bandwidth and conventional encryption preparation cannot be applied, after presetting symmetric keys, it is difficult to protect newly added unplanned equipment, and abandoning password protection can easily lead to malicious control.

[0004] In a first aspect, the present invention provides a method for secure authentication and encryption in the initial stage of communication link establishment, which is applied to a key source, and the method comprises:

[0005] In the activation key loading stage, the key source pre-generates a key for the communication device according to the size of the key storage area of ​​the communication device, wherein the communication device includes the devices in the current intercommunication plan and the devices to be newly intercommunication in the future, and the key includes the keys of each communication device in the current intercommunication plan and the public-private key pairs of the full set of device IDs reserved for the new intercommunication devices in the future and a group of emergency keys shared by the whole network, and loads the full set of public keys, the shared emergency key group, the device's own ID, the device's own private key and the device's own public key signature to the communication device in an offline manner;

[0006] When the pre-generated keys are distributed and there are still new communication devices that need to be activated, the key source will generate a new ID and a pair of public and private keys to cover the public and private keys with the smallest ID number, and load the keys to the activated devices;

[0007] When the emergency key update time has arrived, the key source will generate a new emergency key with a larger version to overwrite the one with the smallest version number in the original emergency key group, and load the key to the activation device;

[0008] When it is necessary to use the signaling channel to transmit link establishment information with the communication peer, it is determined whether the public key corresponding to the communication peer is stored in the key set according to the ID information sent by the communication peer. If so, the key set is queried to obtain the public key corresponding to the communication peer, and the acquisition result is fed back to the communication peer. The obtained public key is used to decrypt the subsequently received link establishment information of the communication peer. If not, the communication peer is triggered to determine whether to transmit its own public key online according to its own bandwidth situation, or directly use the highest version of the emergency key shared by both parties to encrypt the link establishment information.

[0009] For the first narrowband situation, the public key and signature of the communication peer are obtained online, and after the signature verification, the obtained public key is used to decrypt the link establishment information sent by the communication peer. For the second extremely narrowband situation, the highest version of the emergency key shared by both parties is directly used to decrypt the link establishment information sent by the communication peer to establish a secure channel between the communication device and the communication peer.

[0010] Optionally, the complete set of public keys and key sources are generated and stored in the communication device, including: the key source is based on the size of the key storage area of ​​this type of communication device, in addition to generating IDs, public and private keys for all devices in the intercommunication plan, it also pre-generates as many IDs and public and private keys as possible for possible new intercommunication devices in the future; during the device activation key loading phase, the complete set of IDs and public keys generated above are loaded into each communication device of this type.

[0011] Optionally, the method also includes: the key source determines whether there is any surplus in the key storage area outside the key storage area of ​​the communication device occupied by the intercommunication plan; if so, the acquired public key of the communication counterpart is saved in the public key collection of the communication device to reduce the repeated occupation of the initial temporary channel when the link is established next time; otherwise, the acquired public key of the communication counterpart is discarded.

[0012] Optionally, the key source determines whether there is any surplus key storage area outside the key storage area of ​​the communication device occupied by the intercommunication plan, including: determining whether the key storage space of the communication device is greater than a threshold of the storage space occupied by the key in the communication plan, if so, determining that the key storage space is sufficient, otherwise, determining that the key storage space is not sufficient.

[0013] Optionally, the method also includes: obtaining the ID and emergency key version number of the communication peer, and feeding back the communication device's own ID' and emergency key version number to the communication peer; querying from the public key set according to the ID and emergency key version number of the communication peer (the result needs to be informed to the communication peer), and trying to obtain the public key corresponding to the communication peer; using the obtained public key to encrypt the link establishment information and send it to the communication peer; so that the communication peer uses its own private key to decrypt the received encrypted communication parameters and security parameters, and establish a secure channel between the communication device and the communication peer.

[0014] Optionally, based on the ID of the communication peer, query from the public key set and try to obtain the public key corresponding to the communication peer, and based on the emergency key version number of the communication peer, query and obtain the highest version of the emergency key shared by both parties from the emergency key group, and inform the communication peer of the above results.

[0015] In a second aspect, the present invention provides a key source and a communication device for implementing any one of the above methods, wherein the key source comprises:

[0016] Used in the device activation key loading stage, the key source will pre-generate keys for the device of this type to the maximum extent according to the size of the device key storage area (including the full set of device IDs within the current interoperability plan and reserved for future newly added interoperable devices, the full set of public and private key pairs, and a set of emergency keys shared by the entire network), and load the full set of public keys, shared emergency keys, the device's own ID, the device's own private key, and the device's own public key signature to the activated device in an offline manner; when there are still new devices that need to be activated after the pre-generated keys are distributed, the key source will generate a new ID and a pair of public and private keys (to cover the public and private keys with the smallest ID number), and load the key to the activated device in the same way as before; when the emergency key update time has arrived, the key source will generate a new emergency key of a large version (to cover the one with the smallest version number in the original emergency key), and load the key to the activated device in the same way as before;

[0017] In a second aspect, an embodiment of the present invention further provides a communication device for implementing any one of the above methods, the communication device comprising:

[0018] A generating unit, configured to pre-generate a full set of keys for the communication device in an offline manner according to the size of the key storage area of ​​the communication device at the initial stage of establishing a communication link, and send the generated full set of keys to the corresponding communication device;

[0019] The processing unit is used to determine whether the public key corresponding to the communication peer is stored in the key set according to the ID information sent by the communication peer when it is necessary to use the signaling channel to transmit link establishment information with the communication peer. If so, query the key set to obtain the public key corresponding to the communication peer, feed back the acquisition result to the communication peer, and use the acquired public key to decrypt the subsequently received link establishment information of the communication peer. If not, trigger the communication peer to determine whether to transmit its own public key online according to its own bandwidth situation, or directly use the highest version of the emergency key shared by both parties to encrypt the link establishment information.

[0020] Optionally, the key source is also used to determine, based on the size of the key storage area of ​​this type of communication equipment, whether there is any surplus key storage area of ​​the communication equipment occupied by the intercommunication plan; if so, in addition to generating IDs and public and private keys for all devices in the intercommunication plan, as many IDs and public and private keys as possible are pre-generated for possible new intercommunication equipment in the future; during the device activation key loading phase, the complete set of IDs and public keys generated above are loaded into each communication equipment of this type.

[0021] The setting unit is also used to, during the device activation key loading stage, load the IDs and public keys of all devices in the intercommunication plan as well as the IDs and public keys of intercommunication devices that may be added in the future; the processing unit is also used to, during the communication link establishment stage, obtain the public key of the communication peer, and save it in the public key collection of the communication device in a manner that covers the public key that was used least frequently before, so as to reduce the repeated occupation of the initial temporary channel when establishing a link with the same communication peer next time.

[0022] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned methods for security authentication and encryption in the initial stage of communication link establishment.

[0023] The beneficial effects of the present invention are as follows:

[0024] The present invention aims at the problems that the transmission of link establishment information in the initial stage of end-to-end wireless communication is limited by narrow bandwidth and conventional encryption preparation cannot be applied, it is difficult to ensure that new unplanned equipment is difficult to add after pre-setting symmetric keys, and abandoning password protection can easily lead to malicious control. The present invention analyzes and proposes a communication link establishment security authentication encryption method, which uses a key source in the device activation stage to pre-generate a full set of public keys to the maximum extent based on the size of the key storage area of ​​this type of communication equipment, and combines the two methods of offline pre-setting the full set of public keys at activation and online obtaining the public key of the communication peer after the temporary addition of the new communication peer. Under the premise of minimizing the occupation of the initial temporary channel, the transmission of link establishment information is encrypted. At the same time, in the extremely narrow bandwidth situation where the environment deteriorates and the public key of the new communication peer cannot be obtained online, the emergency key can be automatically enabled to implement symmetric encryption, thereby improving the user experience.

[0025] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0027] Figure 1 It is a flowchart of a method for security authentication and encryption in the initial stage of communication link establishment provided by an embodiment of the present invention;

[0028] Figure 2 It is a flow chart of another method for security authentication and encryption in the initial stage of communication link establishment provided by an embodiment of the present invention in the device activation key loading stage;

[0029] Figure 3 It is a flow chart of another method for security authentication and encryption in the initial stage of communication link establishment provided by an embodiment of the present invention in the communication link establishment stage;

[0030] Figure 4 It is a structural diagram of a device for security authentication and encryption in the initial stage of communication link establishment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and do not limit the present invention.

[0032] The existing end-to-end wireless communication lacks password-based security protection in the initial stage of link establishment, that is, the device identity authentication of the communication peer and the confidentiality of the transmitted information are lacking protection. In the initial stage of communication link establishment, the conventional key exchange method cannot be applied to complete the encryption preparation due to the narrow bandwidth. After the introduction of the preset symmetric key, the burden of key exchange increases and it is difficult to make the newly added unplanned devices interoperable. Especially with the passage of time and the expansion of the scale of the communication peer, the burden will increase exponentially and the efficiency will decrease exponentially. In addition, the current security design of business transmission cannot be directly applied to communication link establishment. Unlike the wide bandwidth after the communication link is established, the bandwidth during communication link establishment is very narrow and cannot support the real-time exchange of conventional symmetric keys. Sometimes, environmental deterioration will further narrow the bandwidth, resulting in the inability to exchange and transmit even asymmetric keys. If the exchange method is abandoned and the preset symmetric key method is used instead, there will be problems in ensuring the freshness of the key. At the same time, the key adjustment of the old device after the new device is added will also become a problem (although the use of the same key for the whole network will not encounter the problem that the key needs to be adjusted for the whole network after the device is added, there are security risks such as "single loss, the whole network is in danger").

[0033] In order to solve the above problems, the embodiment of the present invention provides a method for secure authentication and encryption in the initial stage of communication link establishment, see Figure 1 , applied to a key source, the method comprising:

[0034] S101. In the initial stage of establishing a communication link, the key source pregenerates a full set of keys for the communication device in an offline manner according to the size of the key storage area of ​​the communication device, and sends the generated full set of keys to the corresponding communication device;

[0035] That is, in the embodiment of the present invention, during the device activation key loading stage, the key source pre-generates keys for the type of device to the maximum extent according to the size of the device key storage area (including the full set of device IDs within the current intercommunication plan and reserved for future newly added intercommunication devices, the full set of public and private key pairs, and a group of emergency keys shared by the entire network), and loads the full set of public keys, shared emergency keys, the device's own ID, the device's own private key, and the device's own public key signature to the activation device in an offline manner; when there are still new devices that need to be activated after the pre-generated keys are distributed, the key source will newly generate an ID and a pair of public and private keys (to cover the public and private keys with the smallest ID number), and load the key to the activation device in the same way as before; when the emergency key update time has arrived, the key source will newly generate a large version emergency key (to cover the one with the smallest version number in the original emergency key), and load the key to the activation device in the same way as before;

[0036] Furthermore, the communication device in the embodiment of the present invention includes devices in the current intercommunication plan and devices to be newly intercommunication in the future, wherein the key in the embodiment of the present invention includes the keys of each communication device in the current intercommunication plan and the full set of public and private key pairs of the full set of device IDs reserved for the newly intercommunication devices in the future and a group of emergency keys shared by the whole network, and the full set of public keys, the shared emergency key group, the device's own ID, the device's own private key and the device's own public key signature are loaded to the communication device in an offline manner;

[0037] It should be noted that the embodiment of the present invention is to pre-generate keys in a scenario where, before a conventional secure encryption channel is established, communications lack protection and the bandwidth is too narrow to apply conventional encryption preparations. This enables communication terminals to complete the initial stage of security authentication and encryption preparation requirements with minimal overhead.

[0038] In addition, the key source described in the embodiment of the present invention can be various communication devices, and those skilled in the art can make any settings according to actual needs, and the present invention does not make any specific limitations on this.

[0039] Specifically, each communication terminal in the embodiment of the present invention needs to complete key loading at the key source before it is activated and used. The present invention is that the key source is based on the size of the key storage area of ​​this type of communication equipment. In addition to generating IDs and public and private keys for all devices in the intercommunication plan, it also pre-generates as many IDs and public and private keys as possible for possible new intercommunication devices in the future; in the device activation key loading stage, the above-generated complete set of IDs and public keys are loaded to each of this type of communication equipment, and in subsequent use, the required public key is retrieved from the key storage area, so as to finally use the public key to establish a secure channel between the communication device and the communication counterpart, thereby maximizing the communication security between the ends.

[0040] S102, when it is necessary to use the signaling channel to transmit link establishment information with the communication peer, determine whether the public key corresponding to the communication peer is stored in the key set according to the ID information sent by the communication peer, if so, execute S103, otherwise, execute S104;

[0041] Specifically, the embodiment of the present invention is that before the signaling channel is used to transmit the link establishment information with the communication peer, it is determined whether the public key corresponding to the communication peer exists in the public key collection through the ID transmitted by the peer, if so, S103 is executed, otherwise, S104 is executed;

[0042] S103, querying the public key set (the result needs to be notified to the communication peer), trying to obtain the public key corresponding to the communication peer, and using the obtained public key to decrypt the link establishment information subsequently sent by the communication peer;

[0043] S104, triggering the communication peer to determine whether to transmit its own public key online according to its own bandwidth situation, or directly use the highest version of the emergency key shared by both parties to encrypt the link establishment information;

[0044] Specifically, the embodiment of the present invention notifies the communication peer of the judgment result that the public key does not exist, and the communication peer decides whether to first transmit its own public key online (narrowband situation) or directly use the emergency key of the highest version shared by both parties to encrypt subsequent outbound link establishment information (extremely narrowband situation) according to its own bandwidth situation;

[0045] S105, judging whether the corresponding public key sent by the communication peer is received online based on the bandwidth situation of the communication peer, if it exists, executing S106, otherwise, executing S107;

[0046] S106. In the case of narrowband, the public key and signature of the communication peer are obtained online, and after the signature verification is completed, the link establishment information sent by the communication peer is decrypted using the obtained public key;

[0047] S107: For an extremely narrow band situation, directly use the emergency key of the highest version shared by both parties to decrypt the link establishment information sent by the communication peer, so as to establish a secure channel between the communication device and the communication peer.

[0048] That is to say, the method described in the embodiment of the present invention is aimed at the problems that the transmission of link establishment information in the initial stage of end-to-end wireless communication is limited by narrow bandwidth and conventional encryption preparation cannot be applied, it is difficult to ensure that new unplanned equipment is difficult to add after pre-setting symmetric keys, and abandoning password protection can easily lead to malicious control. A communication link establishment security authentication encryption method is analyzed and proposed. By using the key source in the device activation stage to pre-generate a full set of public keys based on the size of the key storage area of ​​this type of communication device to the maximum extent, and combining the two methods of offline pre-setting the full set of public keys at the time of activation and online obtaining the public key of the communication peer after the temporary addition of the new communication peer, the transmission of link establishment information is encrypted under the premise of minimizing the occupation of the initial temporary channel. At the same time, in the extremely narrow bandwidth situation where the environment deteriorates and the public key of the new communication peer cannot be obtained online, the emergency key can be automatically enabled to implement symmetric encryption, thereby improving the user experience.

[0049] Since the initial stage of communication link establishment is limited by narrow bandwidth, it is impossible to apply conventional key exchange methods to complete encryption preparations, and after the introduction of preset symmetric keys, the burden of key exchange increases and it is difficult to enable newly added unplanned devices to communicate with each other. Especially as time goes by and the scale of communication peers expands, the burden will increase exponentially and the efficiency will decrease exponentially. Therefore, the present invention combines the two methods of offline presetting the full set of public keys at the time of activation and online obtaining the public key of the communication peer after the new communication peer temporarily joins, which greatly improves the security of information transmission while minimizing the occupation of the initial temporary channel.

[0050] In addition, although the above burden can be alleviated by presetting symmetric keys, as time goes by and the scale of communication peers expands, the burden of periodic key replacement increases. Newly added unplanned devices need to adjust the keys at all original planned communication devices to achieve intercommunication, and the pressure of manual security increases. Therefore, the preset method is only applicable to the situation where all communication plans have been clarified and all communication peer keys are available during the activation phase. It is not applicable to scenarios where there is a need to adjust the communication plan later. In this regard, the present invention provides an online public key exchange method, that is, a method of obtaining the unplanned peer public key through online interaction and covering the previously least frequently used public key, so as to establish a communication link security channel between the communication device and the newly added unplanned communication peer without manual participation.

[0051] The present invention realizes device identity authentication through the prefabrication and online signature verification of public keys. For the identity authentication of planned and unplanned communication terminals with preset public keys, zero-overhead device identity authentication is realized based on public key preset. Compared with the conventional independent identity authentication and confidentiality protection that consume double consumption of (communication or storage) resources respectively, the present invention consumes only a single storage resource for the communication link establishment security authentication encryption of planned and unplanned communication terminals with preset public keys.

[0052] Similar to the consumption of (communication or storage) resources encountered in the device identity authentication in the above problem, the confidentiality protection of the preset symmetric key, as the usage time increases, is also consumed by periodic key replacement compared to the confidentiality protection of the preset public key. A communication device with sufficient storage space that pre-sets a large number of symmetric keys will also be exhausted as the usage time increases. If channel resources are not occupied in time to obtain new keys, confidentiality protection will be damaged due to the lack of fresh keys. If channel resources are occupied to obtain new symmetric keys, not only new mechanisms but also new equipment must be introduced, which greatly increases the system cost.

[0053] In this regard, the present invention not only uses preset public keys to provide encryption for link establishment information, but also generates new symmetric emergency keys used in extremely narrowband situations through key sources at regular intervals according to preset periods, and the newly opened devices outside the plan carry them when loading the keys. The new version of the emergency key is propagated to the communication devices that did not have the new version of the emergency key before this period through subsequent link establishment and intercommunication, so as to clean up and overwrite the oldest version of the emergency key. Similarly, when the communication device of the present invention receives a public key sent by a new communication peer online that it does not have, based on the interaction frequency between the ends, the storage of the new communication peer public key is completed without increasing the key storage space by overwriting the public key of the communication peer with the lowest interaction frequency, etc. Those skilled in the art can make settings according to actual needs, and the present invention does not make specific limitations on this.

[0054] Specifically, the embodiment of the present invention determines whether the key storage space of the communication device is greater than the threshold value of the storage space occupied by the key in the communication plan. If so, it is determined that the key storage space is abundant, and the public key of the communication counterpart outside the plan that may be added in the future can be pre-generated and stored. Otherwise, it is determined that the key storage space is not abundant, and the public key of the communication counterpart that is not pre-stored can only be obtained online and overwritten and stored in the subsequent link establishment and intercommunication, and the public key of the communication counterpart that is used for a long time is finally determined and stored according to the interaction frequency between the ends.

[0055] In specific implementation, the embodiment of the present invention evaluates the occupation of the key storage area of ​​the communication device of this type by the intercommunication plan through the key source, and determines whether there is any surplus in the key storage area. If so, it pre-generates as many public keys of unplanned communication devices as possible and adds them to the public key collection to reduce the occupation of the initial temporary channel when the new equipment and the old equipment establish a communication link in the future.

[0056] That is, when determining the size of the key storage area of ​​this type of communication device, a storage space threshold that maintains storage space and processing efficiency can be set to reduce resource consumption while maintaining processing efficiency.

[0057] The following will be combined Figure 2-Figure 3 The method described in the embodiment of the present invention is explained and illustrated in detail by a specific example:

[0058] The embodiment of the present invention provides a method for security authentication and encryption in the initial stage of communication link establishment, which is used to solve the problems that the existing link establishment information transmission is limited by narrow bandwidth and cannot be applied to conventional encryption methods, it is difficult to ensure that unplanned equipment is difficult to add after pre-setting symmetric keys, and abandoning password protection can easily lead to malicious control.

[0059] Specifically, an embodiment of the present invention provides a method for security authentication and encryption in the initial stage of communication link establishment, which includes two sub-methods, namely, the first sub-method is used in the device activation key loading stage; the second sub-method is used in the communication link establishment stage.

[0060] See also Figure 2In the key loading stage of device activation, the key source generates keys for the model to the maximum extent possible (including a full set of device IDs, a full set of public and private key pairs, and an emergency key group) for communication terminals that have not generated keys, based on the size of the key storage area reported by the communication terminal. The communication terminal receives and stores the generated keys (including its own ID, its own private key, a full set of public keys, and an emergency key group) offline. For communication terminals whose key storage area is larger than the space required for keys in the communication plan, after activation, this type of communication terminal no longer occupies the link establishment channel to transmit public keys, and does not affect the original startup link establishment process; for communication terminals whose key storage area is not larger than the space required for keys in the communication plan, after activation, only after receiving the identity identification number (ie, ID) sent by a new member outside the public key set, will it occupy the link establishment channel to transmit the public key, slightly reducing the startup link establishment efficiency.

[0061] At this time, the methods are respectively applied to the key source, the communication device and the communication counterpart.

[0062] For the key source, the steps performed include:

[0063] a) Determine that the key of this type of communication terminal has not been generated, and generate keys for this model to the maximum extent possible according to the size of the received key storage area (including a full set of device IDs, a full set of public and private key pairs (and public key signatures) and a set of shared emergency keys);

[0064] b) Bind the number to the smallest device ID (hereinafter referred to as "ID"), select a private key corresponding to the ID, and send it together with a full set of public keys and a unique set of emergency keys to the numbered device (the emergency key replacement timer starts at this time);

[0065] c) Determine that the key of this type of communication terminal has been generated and the ID has not been used up, bind the number with the smallest value among the IDs that have not been issued, select the private key, full set of public keys and emergency keys corresponding to the ID and issue them to the numbered device;

[0066] d) If the key of this type of communication terminal has been generated but the ID has been used up, a new ID and a pair of public and private keys are generated, the device number is bound to the newly generated ID, and the "pre-stored key" is issued in the same way as before;

[0067] e) (When the emergency key replacement time arrives) a new emergency key (with a version number greater than all the version numbers in the generated set of emergency keys) is generated, and then the one with the smallest version number in the original emergency key is overwritten to form a new set of emergency keys.

[0068] The operations performed on the communication peer include:

[0069] a) Report the model, serial number and key storage area size;

[0070] b) Receive and store the ID, private key, full set of public keys (and own public key signature) and emergency key.

[0071] See also Figure 3 , which refers to all interactions between the communication terminal and the communication peer, including communication link establishment. At this time, the method is applied to the communication device and the communication peer respectively (taking the communication peer as the initiator as an example, the roles and steps can be exchanged when the communication device is the initiator). For the communication peer, the operation steps performed include:

[0072] a) Send your own ID (including emergency key version);

[0073] b) Obtain the peer search result. If the peer has its own public key, all subsequent outgoing information will be encrypted with its own private key before being sent out. If the peer does not have its own public key, decide whether to first pass its own public key to the peer (in the case of narrow bandwidth) or directly use the shared version of the emergency key to encrypt the subsequent outgoing information (in the case of extremely narrow bandwidth);

[0074] c) Obtain the peer ID', search for the peer public key in the "pre-stored key", and search for the emergency key with the highest version shared by both parties, encrypt the result (together with the public key in the case of narrowband) and send it to the peer;

[0075] d) Decrypt and obtain the plaintext (if the public key is included, complete the public key storage), and determine the subsequent decryption method based on the response;

[0076] e) Complete communication link establishment;

[0077] f) If the previous situation is extremely narrow bandwidth and the public key is not possessed by both parties, the public key exchange is performed at this time;

[0078] g) If one party has a higher version of the emergency key, the higher version of the emergency key will be pushed;

[0079] h) Negotiation and exchange of regular user information encryption keys;

[0080] i) Enable the user information encryption key to symmetrically encrypt subsequent messages (stop using the link building information encryption).

[0081] For communication equipment, the steps performed include:

[0082] a) Obtain the peer ID, search for the peer public key in the "pre-stored keys", and search for the emergency key with the highest version shared by both parties;

[0083] b) Send the search result together with its own ID' to the peer;

[0084] c) Determine the decryption method and decrypt (including the public key and the storage of the public key), select according to the search result of the other end, if the other end has its own public key, then all the subsequent outgoing information will be encrypted with its own private key before being sent out, if the other end does not have its own public key, then decide whether to first pass its own public key to the other end (in the case of narrow bandwidth), or directly use the shared version of the emergency key to encrypt the next outgoing information (in the case of extremely narrow bandwidth), and finally encrypt the response (in the case of narrow bandwidth together with the public key) and send it to the other end;

[0085] d) Complete communication link establishment;

[0086] e) If the previous situation is extremely narrow bandwidth and the public key is not possessed by both parties, the public key exchange is performed at this time;

[0087] f) If one party has a higher version of the emergency key, the higher version of the emergency key will be pushed;

[0088] g) Negotiation and exchange of regular user information encryption keys;

[0089] h) Enable the user information encryption key to symmetrically encrypt subsequent messages (stop using the link building information encryption).

[0090] In summary, the method described in the embodiment of the present invention is a security authentication encryption method based on public key cryptography (supplemented by symmetric encryption), that is, the public key is used to complete the decryption of the link establishment information while completing the authentication of the identity of the communication counterpart; and the present invention mixes the two public key transmission methods of offline preset and online interaction, while minimizing the occupation of the link establishment channel, it also supports online automatic acquisition of the public key from the newly added unplanned communication counterpart, and supports the function of automatically changing the public key cryptography to symmetric encryption under special extremely narrow band conditions; and after the communication link is completed and the bandwidth is widened, it supports the automatic online sharing and transmission of high-version emergency keys, so as to spread the high-version emergency keys newly generated by the key source to the entire network.

[0091] In general, in view of the current situation that the transmission of link establishment information in the initial stage of end-to-end wireless communication is limited by narrow bandwidth and cannot be applied to conventional encryption preparation, it is difficult to ensure that new unplanned equipment is difficult to add after pre-setting symmetric keys, and abandoning password protection is easy to lead to malicious control, a communication link establishment security authentication encryption method based on public key cryptography is proposed. It has been verified by the implementation examples that this method has the advantages of not requiring manual regular key protection, not doubling manual consumption due to scale expansion and new unplanned equipment, and being able to adapt to extremely narrowband link establishment encryption after environmental deterioration. At the same time, due to the introduction of an adaptive mechanism, this method can also automatically pre-store public keys for possible new unplanned equipment when the storage space of the communication equipment is large. When the pre-stored public keys cannot meet the scale expansion, the key source can automatically continue to generate new public keys to complete the activation of the new equipment. At the same time, the new public key can also be automatically spread to the communication peer end that communicates with it through an online method together with the regularly updated emergency key, reducing the cost of manual protection. Finally, this method can also complete the storage of new public keys by overwriting the public key of the lowest interaction frequency communication peer in the public key set without increasing storage space, thereby maximizing the use of space to save subsequent chain establishment time and eliminating the repeated occupation of channels by new public keys.

[0092] Accordingly, an embodiment of the present invention provides a device for implementing any of the above methods, see Figure 4 The device includes: a generating unit, which is used to trigger a key source to pre-generate a full set of keys for the communication device in an offline manner according to the size of a key storage area of ​​the communication device in the initial stage of communication link establishment, and send the generated full set of keys to the corresponding communication device; a processing unit, which is used to determine whether the public key corresponding to the communication peer is stored in the full set of keys according to the ID information sent by the communication peer when the communication device needs to use a signaling channel to transmit link establishment information with the communication peer, if so, query the key set to obtain the public key corresponding to the communication peer, feed back the acquisition result to the communication peer, and use the obtained public key to decrypt the subsequent received link establishment information of the communication peer, if not, trigger the communication peer to determine whether to transmit its own public key online according to its own bandwidth situation, or directly use the highest version of the emergency key shared by both parties to encrypt the link establishment information.

[0093] Furthermore, the generation unit described in the embodiment of the present invention is also used to trigger the key source according to the size of the key storage area of ​​the communication device of this type, in addition to generating the ID and public and private keys of all devices in the intercommunication plan, it also pre-generates as many IDs and public and private keys as possible for the intercommunication devices that may be added in the future; in the device activation key loading stage, the above-generated ID set and public key set are loaded to each communication device of this type. The processing unit is also used to overwrite the public key of the lowest interaction frequency communication peer in the public key set with the newly obtained public key to achieve the update of the public key set, and overwrite the lowest version emergency key with the newly obtained high version emergency key to achieve the update of the emergency key group.

[0094] That is to say, the embodiment of the present invention provides an adaptive method of security authentication encryption based on public key cryptography for the initial stage of communication link establishment; by combining the offline pre-setting of the full set of public keys at the time of activation and the online acquisition of public keys when new ones are added, and combining multiple complementary methods such as public key cryptography and symmetric encryption, it adapts to the security authentication encryption of narrowband and ultra-narrowband communication link establishment, and minimizes the occupancy of the initial temporary channel; and automatically completes the evaluation and local coverage storage after receiving the new public key and the high-version emergency key, while completing the full network diffusion of the newly generated key from the key source, reducing the repeated occupancy of the initial temporary channel by the transmission of the new public key; the present invention balances the contradiction between storage space and channel resources, maximizes the use of space, and adaptively completes the enhancement of communication link establishment security.

[0095] At the same time, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, any of the above methods for secure authentication and encryption in the initial stage of communication link establishment is implemented. The relevant contents of the device embodiment and storage medium embodiment of the present invention can be understood by referring to the method embodiment of the present invention, and will not be discussed in detail here.

[0096] Although the preferred embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, and thus, the scope of the present invention should not be limited to the above embodiments.

Claims

1. A method for secure authentication and encryption in the initial stage of communication link establishment, characterized in that: The method comprises: In the initial stage of establishing a communication link, the key source pre-generates a full set of keys for the communication device in an offline manner according to the size of the key storage area of ​​the communication device, and sends the generated full set of keys to the corresponding communication device; When the communication device needs to use the signaling channel to transmit link establishment information with the communication peer, it is determined whether the public key corresponding to the communication peer is stored in the key set according to the ID information sent by the communication peer. If so, it is queried in the key set to obtain the public key corresponding to the communication peer, and the acquisition result is fed back to the communication peer. The obtained public key is used to decrypt the subsequently received link establishment information of the communication peer. If not, it is triggered to determine whether to transmit its own public key online according to its own bandwidth situation, or to directly use the highest version of the emergency key shared by both parties to encrypt the link establishment information.

2. The method according to claim 1, characterized in that In the initial stage of establishing a communication link, the key source pre-generates a full set of keys for the communication device in an offline manner according to the size of the key storage area of ​​the communication device, and sends the generated full set of keys to the corresponding communication device, including: In the activation key loading stage, the key source pre-generates a maximum number of keys for the communication device in an offline manner according to the upper limit of the key storage area of ​​the communication device, wherein the communication device includes the devices in the current intercommunication plan and the devices to be newly intercommunication in the future, and the keys include the keys of each communication device in the current intercommunication plan and the full set of public and private key pairs of the full set of device IDs reserved for the new intercommunication devices in the future and a set of emergency keys shared by the whole network; The full set of public keys, the shared emergency key group, the device's own ID, the device's own private key and the device's own public key signature are sent to the communication device.

3. The method according to claim 1, characterized in that The method further comprises: When the pre-generated keys are distributed and there are still new communication devices that need to be activated, the key source will generate a new ID and a pair of public and private keys to cover the public and private keys with the smallest ID number in the key set, and trigger the newly activated communication device to load the newly generated key.

4. The method according to claim 1, characterized in that: The method further comprises: When the preset emergency key update time is reached, the key source will generate a new emergency key to cover the key with the smallest version number in the original emergency key group, and trigger the activation device to load the newly generated key.

5. The method according to claim 3 or 4, characterized in that: The online transmission of the own public key includes: The key source determines whether there is surplus storage space in the key storage area of ​​the communication device occupied by the intercommunication plan. If so, the acquired public key of the communication counterpart is saved in the public key collection of the communication device to reduce the repeated occupation of the initial temporary channel when the link is established next time. Otherwise, the acquired public key of the communication counterpart is discarded.

6. The method according to claim 5, characterized in that The determining whether the key storage area of ​​the communication device occupied by the intercommunication plan has surplus storage space includes: It is determined whether the key storage space of the communication device is greater than a threshold value of the storage space occupied by the key in the communication plan; if so, it is determined that the key storage space is abundant; otherwise, it is determined that the key storage space is not abundant.

7. The method according to claim 5, characterized in that The method further comprises: Obtaining the ID and the emergency key version number of the communication peer, and feeding back the ID' and the emergency key version number of the communication device itself to the communication peer; According to the ID and the emergency key version number of the communication peer, query and obtain the public key corresponding to the communication peer from the full key set; The link establishment information is encrypted using the acquired public key and then sent to the communication peer, so that the communication peer uses its own private key to decrypt the received encrypted communication parameters and security parameters, and establishes a secure channel between the communication device and the communication peer.

8. The method according to claim 7, characterized in that Obtaining the ID and emergency key version number of the communication peer, including: According to the ID of the communication peer, query from the key set to obtain the public key corresponding to the communication peer, and according to the emergency key version number of the communication peer, query from the emergency key group to obtain the emergency key with the highest version shared by both parties.

9. A communication device for implementing the method according to any one of claims 1 to 8, characterized in that: The communication device comprises: A generating unit, configured to trigger a key source to pre-generate a full set of keys for the communication device in an offline manner according to the size of a key storage area of ​​the communication device at the initial stage of establishing a communication link, and send the generated full set of keys to the corresponding communication device; The processing unit is used to determine whether the public key corresponding to the communication peer is stored in the key set according to the ID information sent by the communication peer when the communication device needs to use the signaling channel to transmit link establishment information with the communication peer. If so, query the key set to obtain the public key corresponding to the communication peer, feed back the acquisition result to the communication peer, and use the acquired public key to decrypt the subsequently received link establishment information of the communication peer. If not, trigger the communication peer to determine whether to transmit its own public key online according to its own bandwidth situation, or directly use the highest version of the emergency key shared by both parties to encrypt the link establishment information.

10. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method for security authentication and encryption in the initial stage of communication link establishment as described in any one of claims 1 to 8.

Images