Communication control method, device, equipment and medium

Abstract

The invention provides a communication control method, device, equipment and medium. The method comprises the following steps: determining a first security level of first equipment and a second security level of second equipment; comparing the first security level with the second security level; according to a comparison result, a control strategy message is determined to be sent to the first equipment, the control strategy message is used for indicating communication between the first equipment and the second equipment, and the control strategy message comprises the first safety level and the second safety level under the condition that the level of the first safety level is greater than that of the second safety level. And instructing the first device to update the level of the first security level to be the same as the level of the second security level. The authority and the security level are flexibly changed during equipment communication, an unauthorized behavior during communication between malicious equipment and normal equipment is prevented, the possibility of sensitive information leakage is reduced as much as possible, and the security and the reliability of equipment communication are improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a communication control device, equipment and medium. Background Art

[0002] In the smart financial communication environment, the security level between financial terminals needs to resist external attacks to ensure that data is effectively protected. The interconnection of financial devices requires high security and reliability, because the security levels and functions of different devices vary greatly. Devices with lower security levels usually do not have strong security performance, while devices with higher security levels usually have higher security performance requirements. In the frequent interconnection between devices, devices with higher security levels connecting to devices with lower security levels will face the risk of information leakage. Summary of the invention

[0003] The present invention aims to solve the problem in the prior art that a device with a higher security level faces the risk of information leakage when connecting a device with a lower security level, and proposes a communication control, device, equipment and medium.

[0004] In a first aspect, an embodiment of the present invention provides a communication control method, which is applied to a server, and the method includes:

[0005] determining a first security level for the first device and a second security level for the second device;

[0006] comparing the first security level with the second security level;

[0007] A control strategy message is sent to the first device based on the comparison result, and the control strategy message is used to indicate communication between the first device and the second device. The control strategy message includes instructing the first device to update the level of the first security level to the same level as the second security level when the level of the first security level is greater than the level of the second security level.

[0008] In one embodiment, before determining the first security level of the first device and the second security level of the second device, the method includes:

[0009] Acquire an identification information group sent by the first device, where the identification information group includes first identification information of the first device and second identification information of the second device, where the first identification information is used to determine the first device information, and the second identification information is used to determine the second device information;

[0010] Generate a first level request message based on the first device information, where the first level request message is used to instruct the first device to send a first security level message;

[0011] A second level request message is generated based on the second device information, where the second level request message is used to instruct the second device to send a second security level message.

[0012] In one embodiment, the first device information includes a first PUF value;

[0013] Generating a first request message based on the first device information includes:

[0014] Performing a hash calculation according to the first PUF value to generate a first key;

[0015] determining a first level request and a first random number;

[0016] The first level request and the first random number are encrypted based on the first key to obtain a first level request message.

[0017] In one embodiment, determining, according to the comparison result, that a control strategy message is sent to the first device includes:

[0018] Determine the control strategy based on the comparison results;

[0019] The control policy and the first random number are encrypted based on the first key to obtain a control policy message which is sent to the first device.

[0020] In one embodiment, the second device information includes a second PUF value;

[0021] Generating the second level request message based on the second device information includes:

[0022] Performing a hash calculation according to the second PUF value to generate a second key;

[0023] determining a second level request and a second random number;

[0024] The second level request and the second random number are encrypted based on the second key to obtain a second level request message.

[0025] In one embodiment, determining a first security level of a first device includes:

[0026] In response to receiving the first security level message, comparing the first security level in the first security level message with the first preset level;

[0027] If the level of the first security level is different from the level of the first preset level, updating the level of the first security level to be the same as the level of the second preset level;

[0028] In one embodiment, determining a second security level of the second device includes:

[0029] In response to receiving the second security level message, comparing the second security level in the second security level message with a second preset level;

[0030] In a case where the level of the second security level is different from the level of the second preset level, the level of the second security level is updated to be the same as the level of the second preset level.

[0031] In a second aspect, an exemplary embodiment of the present invention provides a communication control device, applied to a server, the device comprising:

[0032] A determination module, configured to determine a first security level of a first device and a second security level of a second device;

[0033] A first comparison module, used for comparing the first security level with the second security level;

[0034] A policy module is used to determine a control policy message to be sent to the first device based on the comparison result, the control policy message is used to indicate the communication between the first device and the second device, and the control policy message includes instructing the first device to update the level of the first security level to the same level as the second security level when the level of the first security level is greater than the level of the second security level.

[0035] In one embodiment, before executing the determination module, the process includes:

[0036] An acquisition module, used to acquire an identification information group sent by the first device, the identification information group including first identification information of the first device and second identification information of the second device, the first identification information is used to determine the first device information, and the second identification information is used to determine the second device information;

[0037] A first generating module, configured to generate a first level request message based on the first device information, wherein the first level request message is used to instruct the first device to send a first security level message;

[0038] The second generating module is used to generate a second level request message based on the second device information, where the second level request message is used to instruct the second device to send a second security level message.

[0039] In one embodiment, the first device information includes a first PUF value;

[0040] The first generation module is used to:

[0041] Performing a hash calculation according to the first PUF value to generate a first key;

[0042] determining a first level request and a first random number;

[0043] The first level request and the first random number are encrypted based on the first key to obtain a first level request message.

[0044] In one embodiment, the policy module is used to:

[0045] Determine the control strategy based on the comparison results;

[0046] The control policy and the first random number are encrypted based on the first key to obtain a control policy message which is sent to the first device.

[0047] In one embodiment, the second device information includes a second PUF value;

[0048] The second generation module is used to:

[0049] Performing a hash calculation according to the second PUF value to generate a second key;

[0050] determining a second level request and a second random number;

[0051] The second level request and the second random number are encrypted based on the second key to obtain a second level request message.

[0052] In one embodiment, the determining module is used to:

[0053] In response to receiving the first security level message, comparing the first security level in the first security level message with the first preset level;

[0054] If the level of the first security level is different from the level of the first preset level, updating the level of the first security level to be the same as the level of the second preset level;

[0055] In one embodiment, the determining module is used to:

[0056] In response to receiving the second security level message, comparing the second security level in the second security level message with a second preset level;

[0057] In a case where the level of the second security level is different from the level of the second preset level, the level of the second security level is updated to be the same as the level of the second preset level.

[0058] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor and a memory, wherein the memory stores at least one message, at least one program, a code set or a message set, and the at least one message, at least one program, a code set or a message set is loaded and executed by the processor to implement a communication control method as described in any one of the first aspects.

[0059] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, in which at least one message or at least one program is stored, and the at least one message or at least one program is loaded and executed by a processor to implement a communication control method as described in any one of the first aspects.

[0060] The present invention provides a method, device, equipment and medium for controlling communication of objects, which have the following technical effects:

[0061] The server is used to dynamically adjust the security level of the device, and the control strategy is configured to limit the data range and operation permissions that the device application can access. This allows flexible changes in permissions and security levels when devices communicate, prevents unauthorized behavior when malicious devices communicate with normal devices, minimizes the possibility of sensitive information leakage, and improves the security and reliability of device communications.

[0062] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0064] Figure 1 A schematic diagram of an application scenario provided for an exemplary embodiment of the present invention;

[0065] Figure 2 A first flow chart of a communication control method provided by an exemplary embodiment of the present invention;

[0066] Figure 3 A second flow chart of a communication control method provided by an exemplary embodiment of the present invention;

[0067] Figure 4 A schematic diagram of the configuration of a first level request message and a second level request message provided for an exemplary embodiment of the present invention;

[0068] Figure 5 A module diagram of a communication control device provided by an exemplary embodiment of the present invention;

[0069] Figure 6 A structural diagram of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0070] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0071] The following detailed description is an exemplary description, which is intended to provide further detailed description of the present invention. Unless otherwise specified, all technical terms used in the present invention have the same meaning as those generally understood by those skilled in the art to which the present invention belongs. The terms used in the present invention are only for describing specific embodiments, and are not intended to limit the exemplary embodiments according to the present invention.

[0072] Before describing this embodiment, a brief description of the application scenario is given first. Figure 1 , the schematic diagram includes a first device 101, a second device 102 and a server 103. The first device 101 and the second device 102 are respectively connected to the server 103 for communication.

[0073] Among them, the server 103 is used to determine the first security level of the first device and the second security level of the second device; compare the first security level and the second security level; determine a control policy message to be sent to the first device based on the comparison result, and the control policy message is used to indicate the communication between the first device and the second device. The control policy message includes instructing the first device to update the level of the first security level to the same level as the second security level when the level of the first security level is greater than the level of the second security level.

[0074] In one embodiment, the server 103 may be two complete computing engines (processing cores) integrated on a multi-core processor, and may belong to two different single-core processors or two different multi-core processors. A multi-core processor refers to two or more complete computing engines integrated into one processor. Furthermore, the server 103 may also be other computer devices having the same or similar computing devices as the processor. Furthermore, the server 103 may be replaced by a server system, a computing platform or a server cluster including multiple servers.

[0075] The server in this embodiment is preferably a trusted platform, which is a centralized security management system used to ensure the security of connections and operations in a multi-device environment. It coordinates the interaction between devices through authentication and permission allocation, and is an important part of the modern security architecture. On this basis, see Figure 2 An exemplary embodiment of the present invention provides a communication control method, which is applied to a server, and the method includes:

[0076] S201. Determine a first security level of a first device and a second security level of a second device.

[0077] Among them, the security level usually corresponds to the security function and security capability of the device. The first security function refers to the specific functional module or feature provided by the first device to ensure the security of its data and operation, while the first security capability is the overall security attribute of the first device, reflecting its ability and reliability to resist threats.

[0078] In one embodiment, before the first device accesses the network for the first use, the first device needs to send its first device information to the server to configure the first security level. After the server completes the configuration of the first security level according to the first device information, it sends the first security level of the first device back to the first device in the form of a first security level message, and stores the first security level in the database in the form of a first preset level.

[0079] In a specific implementation, the first device also needs to perform encrypted communication during the initial communication with the server. However, since the server has not yet obtained the first PUF value of the first device during the initial communication, the first PUF value cannot be used for encryption. In this embodiment, the initial communication between the first device and the server can be achieved in a preset security space. Specifically, the preset security space needs to meet the following conditions: network isolation, use of a dedicated network link, access control permissions, monitoring, etc., to ensure the communication security between the first device and the server.

[0080] In a specific embodiment, the first security level message can also be obtained by encrypting the first security level in the form of a PKI certificate.

[0081] In a specific implementation, the first device information includes a first security capability and a first security function, and the server configures a first security level according to the first security function and the first security capability.

[0082] In a specific implementation, the first device information further includes first identification information, a first PUF value (Physical Unclonable Function), a first permission, etc. The server will store the first preset level, the first PUF value, the first permission, etc. according to the first identification information of the first device, and the first identification information can be used to index the data stored in each first device.

[0083] In one embodiment, before the second device accesses the network for the first time, the second device needs to send its second device information to the server to configure the second device security level. After the server completes the configuration of the second security level according to the second device information, it sends the second security level of the second device back to the second device in the form of a second security level message, and stores the second security level in the database in the form of a second preset level.

[0084] In a specific embodiment, the second security level message can also be obtained by encrypting the second security level in the form of a PKI certificate.

[0085] In a specific implementation, the second device also needs to perform encrypted communication during the initial communication with the server. However, since the server has not yet obtained the second PUF value of the second device during the initial communication, the second PUF value cannot be used for encryption. In this embodiment, the initial communication between the second device and the server is achieved in a preset security space. Specifically, the preset security space needs to meet the following conditions: network isolation, use of a dedicated network link, access control permissions, monitoring, etc., to ensure the communication security between the second device and the server.

[0086] In a specific implementation, the second device information includes a second security capability and a second security function, and the server configures the second security level according to the second security function and the second security capability.

[0087] In a specific implementation, the second device information also includes second identification information, second PUF value, second authority, etc. The server stores the second preset level, second PUF value, second authority, etc. according to the second identification information of the second device, and the second device identification information can be used to index each second stored data.

[0088] The following are some common devices in the financial system, their security functions, security capabilities, security levels and permissions:

[0089] RFID Tags:

[0090] Security level: Level 1; Security function: Identify items for asset tracking; Security capability: Basic software integrity protection to prevent common errors, which is basic protection. Only simple identification information can be stored and transmitted, and no data access rights are allowed; Permissions: Only simple identification information can be stored and transmitted, and data of other devices cannot be accessed or complex operations can be performed.

[0091] POS terminal:

[0092] Security level: Level 2; Security functions: Process payment information, read card information, and can process payment transactions; Security capabilities: Autonomous access control, lightweight security isolation environment, controlled protection, can read and transmit card information, but cannot access sensitive data; Permissions: Can process payment transactions, read and transmit card information, but cannot access sensitive data or other complex operations

[0093] Self-service terminal:

[0094] Security level: Level 3; Security functions: Provide self-service, such as deposit, withdrawal, amount inquiry, transfer, password change, etc.; Security capabilities: Complete access control, security policy model of key protection elements, belonging to structured protection. Can handle self-service operations, support simple collaborative operations, but cannot access sensitive data; Permissions: Can handle self-service operations, support simple coordination operations with other financial devices, but cannot access sensitive data.

[0095] Bank Server:

[0096] Security level: Level 4; Security function: Centrally manage the data of connected financial devices, conduct transaction processing and account management; Security function: Reliable trusted base, tamper-proof capability, advanced access control, belonging to security domain protection. It can collect and manage the data of all financial devices, conduct transaction processing and account management, but all operations must be strictly identified and arbitrated; Authority: It can collect and manage the data of all financial devices, conduct transaction processing and account management, but all operations must be strictly reviewed.

[0097] Data Center:

[0098] Security level: Level 5; Security functions: Central data storage and management, advanced data analysis, risk monitoring; Security capabilities: The highest level of security protection, formal verification, and protection against physical attacks. Comprehensive management of all devices, storage and management of all data, with the highest security protection capabilities; Authority: As the center of the financial system, responsible for coordinating all device operations, storage, and management of data, with the highest security protection capabilities.

[0099] In one embodiment, before step S201, see Figure 3 ,include:

[0100] S301. Obtain an identification information group sent by a first device.

[0101] The identification information group includes first identification information of the first device and second identification information of the second device, the first identification information is used to determine the first device information, and the second identification information is used to determine the second device information.

[0102] The first device is generally a requesting device in communication, and the second device is generally a target device in communication. When the first device wants to establish a communication connection with the second device, the first device uploads the identification information group to the server to request the server to configure a corresponding control policy message to control the connection between the first device and the second device.

[0103] S302: Generate a first level request message based on the first device information.

[0104] The first level request message is used to instruct the first device to send a first security level message.

[0105] The server retrieves corresponding first device information and second device information from the database according to the first identification information and the second identification information, respectively, where the first device information includes a first PUF value.

[0106] Specifically, step S302 includes: performing a hash calculation according to the first PUF value to generate a first key; determining a first level request and a first random number; and encrypting the first level request and the first random number based on the first key to obtain a first level request message.

[0107] The first key is obtained based on the AES algorithm. AES (Advanced Encryption Standard) is a symmetric encryption algorithm used to protect the privacy and security of data.

[0108] In this embodiment, firstly, the first key is generated based on the first PUF value, which can ensure that the first key is unique and bound to the first device, thus ensuring the uniqueness and security of communication from the source; secondly, the first PUF value, as the physical identifier of the first device, cannot be directly exposed, and the hash calculation can prevent the first PUF value from being directly exposed, thus enhancing security. Furthermore, the introduction of randomness makes the authentication mechanism more secure and reliable, and even if part of the communication data is intercepted, it cannot be attacked by speculation or reorganization.

[0109] In one embodiment, see Figure 4 After receiving the first level request message, the first device decrypts the first level request message according to the first PUF value to obtain the first level request and the first random number. The first device determines the first security level according to the first level request. Then, a hash calculation is performed according to the first PUF value to generate a first key, and the first security level and the first random number are encrypted based on the first key to obtain the first security level message.

[0110] S303: Generate a second level request message based on the second device information.

[0111] The second level request message is used to instruct the second device to send a second security level message.

[0112] Specifically, step S303 includes: performing a hash calculation according to the second PUF value to generate a second key; determining a second level request and a second random number; and encrypting the second level request and the second random number based on the second key to obtain a second level request message.

[0113] The second key is obtained based on the AES algorithm. AES (Advanced Encryption Standard) is a symmetric encryption algorithm used to protect the privacy and security of data.

[0114] In this embodiment, firstly, the second key is generated based on the second PUF value, which can ensure that the second key is unique and bound to the second device, thus ensuring the uniqueness and security of the communication from the source; secondly, the second PUF value, as the physical identifier of the second device, cannot be directly exposed, and the hash calculation can prevent the second PUF value from being directly exposed, thus enhancing security. Furthermore, the introduction of randomness makes the authentication mechanism more secure and reliable, and even if part of the communication data is intercepted, it cannot be attacked by speculation or reorganization.

[0115] In one embodiment, see Figure 4 After receiving the second level request message, the second device decrypts the second level request message according to its own second PUF value to obtain the second level request and the second random number. The second device determines the second security level according to the second level request. Then, a hash calculation is performed according to the second PUF value to generate a second key, and the second security level and the second random number are encrypted based on the second key to obtain a second security level message.

[0116] Furthermore, all communication contents between the second device and the server can be encrypted through the above steps.

[0117] Based on the above embodiment, determining the first security level of the first device in step S201 includes:

[0118] In response to receiving the first security level message, the first security level in the first security level message is compared with the first preset level. If the level of the first security level is different from the level of the first preset level, the level of the first security level is updated to be the same as the level of the second preset level.

[0119] Specifically, the server compares the first security level with the first preset level stored in the database. The purpose is that, since the first device may be connected to devices of other security levels during use, in order to connect the first device with devices of other security levels, the first device may adjust its first security level. The first preset level stored in the database is the security level of the first device itself. This measure can avoid the security level of the first device from constantly changing during the communication process. For example, the first preset level of the first device is level two, and during use, the first device may adjust the first security level to level one in order to communicate with a device with level one. If the control strategy is configured according to the first security level as level one, the first device will not be able to communicate with a device with level two, which reduces the flexibility of the first device and makes it difficult to achieve the function of the first device.

[0120] Based on the above embodiment, determining the second security level of the second device in step S201 includes:

[0121] In response to receiving a second security level message, the second security level in the second security level message is compared with the second preset level; if the level of the second security level is different from the level of the second preset level, the level of the second security level is updated to be the same as the level of the second preset level.

[0122] Specifically, the server will compare the second security level with the second preset level stored in the database. The purpose is that, since the second device may experience connection with devices of other security levels during use, in order to connect the second device with devices of other security levels, the second device may adjust its second security level. The second preset level stored in the database is the security level of the second device itself. This measure can avoid the security level of the second device from constantly changing during the communication process. For example, the second preset level of the second device is level two, and during use, the second device may adjust the second security level to level one in order to communicate with devices with level one. If the control strategy is configured according to the second security level as level one, then other devices with level one will easily request connection with the second device, posing a security risk.

[0123] S202: Compare the first security level and the second security level.

[0124] The server will determine whether a communication connection between the first device and the second device can be arranged according to the comparison result of the first security level and the second security level.

[0125] S203: Determine a control strategy message according to the comparison result and send it to the first device.

[0126] Among them, the control strategy message is different according to the result of the comparison.

[0127] For example, when the comparison result indicates that the first security level is lower than the second security level, the control policy message will instruct the first device to prohibit communication with the second device. The purpose of this measure is to avoid the first device with a low security level from requesting communication with the second device with a high security level. A high security level usually means that its security requirements and security capabilities will be higher. When a device with a low security level requests to connect with a device with a high security level, there is a security risk that the data of the device with a higher security level will be leaked through the device with a lower security level.

[0128] When the comparison result indicates that the first security level is equal to the second security level, the control policy message will instruct the first device to directly communicate with the second device. When the security levels of the two devices are the same, the security requirements and security capabilities of the two devices are the same, and the connection at this time is not prone to the security risk of data leakage.

[0129] When the comparison result indicates that the level of the first security level is equal to the level of the second security level, the control policy message will instruct the first device to update the level of the first security level to the same level as the second security level. Through this setting, the first device with a higher security level can request to communicate with the second device with a lower security level.

[0130] In addition, the communication policy in the communication policy message is configured in the form of an access token, which includes the second device identifier of the second device and the authority of the first device relative to the second device, including data access authority and operation authority. The access token is generated according to the second security level and second authority of the second device. The access token can be generated and stored in the database according to the second security level of the second device when the second device initially accesses the network, and is determined when the corresponding communication policy needs to be generated.

[0131] An access token is a digital credential used for authentication and authorization. It is used to authorize a device to perform specific operations or access specific resources. It plays a dual role in verifying identity and controlling permissions in a security system. It usually contains identification information (identification information of the requesting device and identification information of the target device), permissions, validity period, issuer, other metadata (such as signature, algorithm, etc.), and other information.

[0132] Based on the above content, it can be known that the first device is a device for requesting a communication connection, and the second device is the connected device. The purpose of setting the device identifier of the second device in the access token is to make the access token valid only for the second device, thereby preventing the first device from initiating a false connection to establish a connection with other devices, causing security risks.

[0133] For example, a POS (security level 2) communicates with an RFID tag (security level 1).

[0134] POS machines can process payment transactions, read and transmit card information, and have autonomous access control and basic anti-penetration capabilities. RFID tags can only store and transmit simple identification information and have basic software integrity protection.

[0135] After downgrading the security level of the POS machine to level one, the data access rights of the POS machine can only read and transmit the identification information of the RFID tag, and cannot access other data; the operation rights of the POS machine can only perform operations related to the identification information, such as reading tag information, and cannot process payment transactions or other complex operations.

[0136] In one embodiment, the communication control policy sent to the first device is encrypted in step S203, specifically including:

[0137] The control strategy is determined according to the comparison result. The control strategy and the first random number are encrypted based on the first key, and the control strategy message is obtained and sent to the first device. The first key is generated according to the first PUF value.

[0138] In one embodiment, after step S203, the method further includes:

[0139] The heartbeat packets of the first device and the second device are monitored.

[0140] When the first device and the second device are disconnected, the first device or the second device actively connects to the server, and the server updates the first security level with the first preset level of the first device;

[0141] Or, when the first device and the second device are disconnected, the first device or the second device actively connects to the server, and the server updates the second security level with the second preset level of the second device;.

[0142] In one embodiment, after step S203, the method further includes: connecting the audit device to the server, and regularly collecting the connection behavior data of the device through the server, including connection frequency, connection time, and connection mode, while monitoring the registry data and important files of the connected device.

[0143] In this embodiment, the server is used to dynamically adjust the security level of the device, and the security level control policy is configured to limit the data range and operation permissions that the device application can access, so as to achieve flexible changes in permissions and security levels when devices communicate, prevent unauthorized behavior when malicious devices communicate with normal devices, minimize the possibility of sensitive information leakage, and improve the security and reliability of device communications.

[0144] An exemplary embodiment of the present invention provides a communication control device, which is applied to a server, see Figure 5 , the device comprises:

[0145] A determination module 51, configured to determine a first security level of a first device and a second security level of a second device;

[0146] A first comparison module 52, used for comparing the first security level with the second security level;

[0147] The policy module 53 is used to determine a control policy message to be sent to the first device based on the comparison result, the control policy message is used to indicate the communication between the first device and the second device, and the control policy message includes instructing the first device to update the level of the first security level to the same level as the second security level when the level of the first security level is greater than the level of the second security level.

[0148] In one embodiment, before executing the determination module 51, the following steps are included:

[0149] An acquisition module, used to acquire an identification information group sent by the first device, the identification information group including first identification information of the first device and second identification information of the second device, the first identification information is used to determine the first device information, and the second identification information is used to determine the second device information;

[0150] A first generating module, configured to generate a first level request message based on the first device information, wherein the first level request message is used to instruct the first device to send a first security level message;

[0151] The second generating module is used to generate a second level request message based on the second device information, where the second level request message is used to instruct the second device to send a second security level message.

[0152] In one embodiment, the first device information includes a first PUF value;

[0153] The first generation module is used to:

[0154] Performing a hash calculation according to the first PUF value to generate a first key;

[0155] determining a first level request and a first random number;

[0156] The first level request and the first random number are encrypted based on the first key to obtain a first level request message.

[0157] In one embodiment, the policy module is used to:

[0158] Determine the control strategy based on the comparison results;

[0159] The control policy and the first random number are encrypted based on the first key to obtain a control policy message which is sent to the first device.

[0160] In one embodiment, the second device information includes a second PUF value;

[0161] The second generation module is used to:

[0162] Performing a hash calculation according to the second PUF value to generate a second key;

[0163] determining a second level request and a second random number;

[0164] The second level request and the second random number are encrypted based on the second key to obtain a second level request message.

[0165] In one embodiment, the determination module 51 is used to:

[0166] In response to receiving the first security level message, comparing the first security level in the first security level message with the first preset level;

[0167] If the level of the first security level is different from the level of the first preset level, updating the level of the first security level to be the same as the level of the second preset level;

[0168] In one embodiment, the determination module 51 is used to:

[0169] In response to receiving the second security level message, comparing the second security level in the second security level message with a second preset level;

[0170] In a case where the level of the second security level is different from the level of the second preset level, the level of the second security level is updated to be the same as the level of the second preset level.

[0171] The system and method embodiments in the embodiments of the present invention are based on the same inventive concept.

[0172] An exemplary embodiment of the present invention further provides an electronic device, see Figure 6The electronic device 600 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 610 (the processor 610 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic battery FPGA), a memory 630 for storing data, and one or more storage media 620 (such as one or more mass storage devices) for storing application programs 623 or data 622. Among them, the memory 630 and the storage medium 620 can be short-term storage or permanent storage. The storage medium 620 stores at least one message, at least one program, code set or message set, and the at least one message, at least one program, code set or message set is loaded and executed by the processor to implement the above method.

[0173] Furthermore, the CPU 610 may be configured to communicate with the storage medium 620 and execute a series of message operations in the storage medium 620 on the electronic device 600. The electronic device 600 may also include one or more power supplies 660, one or more wired or wireless network interfaces 60, one or more input and output interfaces 640, and / or one or more operating systems 621, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0174] The input / output interface 640 may be used to receive or send data via a network. The specific example of the network may include a wireless network provided by a communication provider of the electronic device 600. In one example, the input / output interface 640 includes a network adapter (Network Interface Controller, NIC), which may be connected to other network devices via a base station so as to communicate with the Internet. In one example, the input / output interface 640 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0175] It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components as shown, or with Figure 6 Different configurations are shown.

[0176] An embodiment of the present invention also provides a computer-readable storage medium, which can be set in a server to store at least one message, at least one program, a code set or a message set related to a method in an implementation method embodiment. The at least one message, the at least one program, the code set or the message set is loaded and executed by the processor to implement the above method.

[0177] Optionally, in this embodiment, the storage medium may be located in a network server among multiple network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0178] It is known from common technical knowledge that the present invention can be implemented by other embodiments that do not deviate from its spirit or essential features. Therefore, the embodiments of the above invention are only illustrative in all respects and are not exclusive. All changes within the scope of the present invention or within the scope equivalent to the present invention are included in the present invention.

[0179] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program messages. These computer program messages can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the message generated by the processor of the computer or other programmable data processing device is used to implement the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0181] These computer program messages can also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to work in a specific manner, so that the messages stored in the computer readable memory produce an article of manufacture including a message device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0182] These computer program messages can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the messages executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0183] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A communication control method, characterized in that: Applied to a server, the method comprises: determining a first security level for the first device and a second security level for the second device; comparing the first security level and the second security level; A control policy message is sent to the first device based on the comparison result, wherein the control policy message is used to indicate communication between the first device and the second device, and the control policy message includes instructing the first device to update the level of the first security level to the same level as the second security level when the level of the first security level is greater than the level of the second security level.

2. The communication control method according to claim 1, characterized in that: Before determining the first security level of the first device and the second security level of the second device, the method includes: Acquire an identification information group sent by the first device, the identification information group including first identification information of the first device and second identification information of the second device, the first identification information is used to determine the first device information, and the second identification information is used to determine the second device information; generating a first level request message based on the first device information, where the first level request message is used to instruct the first device to send a first security level message; A second level request message is generated based on the second device information, where the second level request message is used to instruct the second device to send a second security level message.

3. The communication control method according to claim 2, characterized in that: The first device information includes a first PUF value; The generating a first request message based on the first device information includes: Performing a hash calculation according to the first PUF value to generate a first key; determining a first level request and a first random number; The first level request and the first random number are encrypted based on the first key to obtain the first level request message.

4. The communication control method according to claim 3, characterized in that: The step of determining a control strategy message according to the comparison result and sending it to the first device includes: Determine the control strategy based on the comparison results; The control policy and the first random number are encrypted based on the first key to obtain the control policy message which is sent to the first device.

5. The communication control method according to claim 2, characterized in that: The second device information includes a second PUF value; The generating the second level request message based on the second device information comprises: Performing a hash calculation according to the second PUF value to generate a second key; determining a second level request and a second random number; The second level request and the second random number are encrypted based on the second key to obtain the second level request message.

6. The communication control method according to claim 2, characterized in that: The determining a first security level of the first device includes: In response to receiving the first security level message, comparing the first security level in the first security level message with a first preset level; In a case where the level of the first security level is different from the level of the first preset level, the level of the first security level is updated to be the same as the level of the second preset level.

7. The communication control method according to claim 2, characterized in that: The determining the second security level of the second device includes: In response to receiving the second security level message, comparing the second security level in the second security level message with the second preset level; In a case where the level of the second security level is different from the level of the second preset level, the level of the second security level is updated to be the same as the level of the second preset level.

8. A communication control device, characterized in that: Applied to a server, the device comprises: A determination module, configured to determine a first security level of a first device and a second security level of a second device; A first comparison module, used for comparing the first security level with the second security level; A policy module is used to determine a control policy message to be sent to the first device based on the comparison result, the control policy message is used to indicate the communication between the first device and the second device, and the control policy message includes instructing the first device to update the level of the first security level to the same level as the second security level when the level of the first security level is greater than the level of the second security level.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one message, at least one program, a code set or a message set, and the at least one message, at least one program, a code set or a message set is loaded and executed by the processor to implement the communication control method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one message or at least one program, and the at least one message or at least one program is loaded and executed by the processor to implement the communication control method according to any one of claims 1 to 7.

Images