Communication method and related device

Abstract

A communication method and a related device are applied to the technical field of communication. In the application, a first node can broadcast key information, and the key information is associated with a first key. The first node broadcasts the key information associated with the first key, so that the first node can perform security protection on the message sent outwards based on the first key. Other nodes receiving the first message can determine the first secret key according to the secret key information, and if the message needs to be sent to the first node, the message can be safely protected through the first secret key. In some schemes, a first node needs to broadcast information outwards to enable other nodes to perceive itself, and nodes needing to communicate with the first node can obtain keys without establishing connection with the first node, so that the other nodes can obtain the keys without accessing the first node, and the nodes can communicate with the first node without accessing the first node. Therefore, the message sent to the first node can be encrypted by using the first key, and the communication security is remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, in particular to the field of short-range communication technology, such as communication in scenarios such as smart cars, smart homes, smart terminals, and smart manufacturing, and specifically to a communication method and related devices. Background Art

[0002] With the continuous development of communication technology, smart application scenarios such as smart home, smart cockpit, smart driving, smart manufacturing, and smart transportation have emerged. In these scenarios, security is an issue that must be considered during the communication process. Especially for wireless transmission scenarios, two nodes need to first sense the node they need to communicate with in a complex space, and then establish a wireless connection after sensing the other end to achieve data transmission.

[0003] To ensure the transmission and storage security of data between nodes, nodes usually encrypt the transmitted data before storage or transmission. After receiving the data, the receiving node decrypts the ciphertext and restores the plaintext. However, the key used for encryption is usually obtained through key negotiation during the process of the node connecting to another node. However, before the node successfully connects to another node, the message transmitted by the node or another node is still in plain text, which makes the message transmitted between the two nodes before the key is negotiated still have the risk of leakage, affecting the security of the network connection and the data security of the node itself.

[0004] Therefore, how to improve the communication security between nodes is a problem that those skilled in the art are studying. Summary of the invention

[0005] The present application provides a communication method and related devices, which can improve the communication security between nodes.

[0006] In a first aspect, the present application provides a communication method, the method comprising: generating a first message, the first message comprising key information, the key information being associated with a first key. Broadcasting and sending the first message. The first key is used to securely protect at least one second message, the at least one second message being a message related to a first node and transmitted after the first message. The transmission may comprise sending (including forwarding, etc.), or receiving (including monitoring, etc.), etc. Exemplarily, the message related to the first node comprises a message sent by the first node and / or a message received by the first node.

[0007] The communication method may be applied to the first node, for example, executed by a hardware module and / or a software module in the first node.

[0008] In this application, the first node broadcasts the key information associated with the first key, which is equivalent to informing the outside of the clue to obtain the first key. The first node can subsequently perform security protection on the messages sent by the first node based on the first key. Other nodes that receive the first message can determine the first key based on the key information. If these nodes need to send messages to the first node, they can also perform security protection on the messages using the first key.

[0009] Optionally, the first node may be associated with other nodes, and the first message may be used for other nodes to perceive the first node.

[0010] Those skilled in the art should know that in a wireless communication scenario, the first node needs to broadcast information to allow other nodes to perceive itself. Based on the solution provided by the present application, for a node that needs to communicate with the first node, it is not necessary to establish a connection with the first node to obtain the first key through the first key, so that other nodes can use the first key to encrypt messages sent to the first node before they have accessed the first node, which can significantly improve communication security.

[0011] Similarly, for the first node, since the first node will broadcast the key information associated with the first key, the information sent out by the first node can be encrypted by the first key before being sent. The node that successfully obtains the first key can obtain the encrypted information of the first node without establishing an association with the first node, which can improve the security of the information broadcast by the first node.

[0012] In another possible implementation of the first aspect, the first message may also be sent in a multicast manner. For example, the first node sends the first message to nodes in a certain subnet.

[0013] In yet another possible implementation of the first aspect, after broadcasting the first message, the method further includes:

[0014] A third message is received from the second node, the third message being used to request to establish an association with the first node, the third message being protected by the first key and belonging to the at least one second message mentioned above.

[0015] In the above implementation, the first node can establish an association with other nodes (such as the second node), and the association between the two can usually be initiated by the second node. Exemplarily, the second node sends a third message to request an association with the first node, and the third message can be securely protected by the first key, thereby further improving the communication security in the access scenario.

[0016] In another possible implementation of the first aspect, the first key includes an integrity protection (or simply referred to as integrity protection) key, and the third message is security protected by the first key, including: the third message is integrity protected by the integrity protection key. After receiving the third message from the second node, the method further includes: checking the integrity of the third message according to the integrity protection key.

[0017] In the above implementation, security protection may include integrity protection, and integrity protection may prevent the content of the message from being tampered with. Exemplarily, security protection may be implemented by generating a check value, for example, the second node generates a check value based on the first key and all or part of the information in the third message, and the first node may check whether the information has been tampered with based on the first key, the check value, and all or part of the information in the third message, thereby improving security.

[0018] In another possible implementation of the first aspect, the first key includes an encryption key, and the security protection of the third message by the first key includes: encrypting the third message by the encryption key. After receiving the third message from the second node, the method further includes: decrypting the third message based on the encryption key.

[0019] The above method can further prevent the information in the message from being leaked, thereby improving security.

[0020] Optionally, the aforementioned integrity protection key and encryption key may be the same key, or different keys.

[0021] In another possible implementation of the first aspect, the first node includes a key configuration module, the key configuration module is configured with at least one key, and the first node can obtain the first key from the key configuration module. Exemplarily, the key configuration module can obtain the first key from the key configuration module, and then the first node itself determines the key information corresponding to the first key.

[0022] In another possible implementation of the first aspect, at least one key and key information corresponding to the at least one key are configured in the key configuration module. The first node can obtain the key information of the first key from the key configuration module, and carry it in the first message to send to other nodes. When the first key needs to be used, for example, when a plaintext needs to be encrypted or a ciphertext needs to be decrypted, the first key corresponding to the key information of the first key is obtained from the key configuration module.

[0023] In another possible implementation of the first aspect, the first node includes a key configuration module, in which at least one key and key information corresponding to the at least one key are configured, and the first node can obtain the first key and the key information associated with the first key from the key configuration module.

[0024] In summary, keys and / or key information of keys can be centrally managed in the key configuration module, and support on-demand acquisition by the first node, which can further enhance the decoupling of devices in the first node, improve the convenience of management and flexibility during upgrades, and enhance user experience.

[0025] In another possible implementation of the first aspect, the first node includes a key configuration module, and before broadcasting the first message, the method further includes: determining key information through the key configuration module. The key configuration module is configured with at least one key and at least one key corresponding to each information, the first key belongs to the at least one key, and the key information is information corresponding to the first key.

[0026] Exemplarily, the key configuration module stores multiple keys and an identification (or identify, ID) corresponding to each of the multiple keys. The first node can obtain one (or several) keys from the key configuration module as the first key, and use the ID of the first key as the key information of the first key.

[0027] In yet another possible implementation of the first aspect, the security type of the information in the first message belongs to at least one of the following types:

[0028] Information with encryption and integrity protection, encryption without integrity protection, non-encryption with integrity protection, and non-encryption without integrity protection. Among them, information with the security type of encryption with integrity protection is information that has been encrypted and integrity protected, information with the security type of encryption without integrity protection is information that has been encrypted but not integrity protected, information with the security type of non-encryption with integrity protection is information that has not been encrypted but has integrity protected, and information with the security type of non-encryption without integrity protection is information that has not been encrypted and has not been integrity protected.

[0029] In another possible implementation of the first aspect, the information included in the first message may be encrypted or secured by a first key. After receiving the first message, the other nodes may first obtain the first key based on the key information in the first message, thereby obtaining other information in the first message based on the first key.

[0030] In another possible implementation of the first aspect, the first message further includes industry information, where the industry information is used to indicate the industry to which the first node belongs.

[0031] Optionally, the industry information may be protected by using the first key. For example, the industry information may be unencrypted but fully protected information, or the industry information may be encrypted and fully protected information.

[0032] In some scenarios, different industries have different security requirements for wireless access scenarios. In some industries, a lot of information related to the network is required to be kept confidential, such as the public security wireless communication system, the power industry wireless communication system, etc. In the above implementation, by carrying industry information in the first message, the recipient of the first message can determine the security requirements of the industry based on the industry information, thereby determining whether it is necessary to use the first key to protect the transmitted information or determine that the first node uses the first key to protect the transmitted information.

[0033] In another possible implementation of the first aspect, the key information is unencrypted but fully secured information or unencrypted but fully secured information. In other words, the key information may not be encrypted by the first key, so that a node receiving the first message can obtain the first key.

[0034] Optionally, in the case where the key information is unencrypted but integrity protected, the key information is integrity protected by the first key. In this implementation, since integrity protection of the key information does not affect the receiving end's acquisition of the key information content, and the other end can check whether the key information has been tampered with by an attacker, the communication security can be further improved.

[0035] In another possible implementation of the first aspect, the first key includes a first signaling plane key, and the at least one second message is a signaling plane message.

[0036] In this implementation, the first key may include a key for signaling plane encryption, thereby supporting encryption of various types of transmission data with different types of keys, thereby improving user experience.

[0037] In yet another possible implementation of the first aspect, after broadcasting the first message, the method further includes:

[0038] A second key is determined through negotiation with the second node, where the second key is used to securely protect messages between the first node and the second node.

[0039] The second key may be used directly for encryption or integrity protection, or the second key may be used to derive a session key, and the session key may include one or more of an encryption key, an integrity protection key, and an authentication encryption key.

[0040] In this implementation, the first node and the second node may also negotiate to obtain a second key, and the second key may also be used to replace the first key to encrypt messages between the first node and the second node. Alternatively, the first key and the second key may be used to encrypt different types of data, etc., so as to meet the security requirements in different communication scenarios and improve security.

[0041] In yet another possible implementation of the first aspect, the at least one second message is a message related to the first node, which is transmitted after the first message and before the second key is determined.

[0042] The second key is used to derive a session key, and the session key is used to securely protect at least one fourth message, where the at least one fourth message is a message transmitted by the first node and the second node after determining the second key.

[0043] In this implementation, before the second key is determined, the message related to the first node can be securely protected by the first key, and after the second key is determined, the message transmitted between the first node and the second node is securely protected by the key derived from the second key. In this way, the transmission between the first node and the second node can be protected by the second key obtained by separate negotiation between the two nodes, further improving communication security.

[0044] Optionally, if a new key has not been negotiated between the first node and other nodes (such as the third node), the first node may still use the first key to securely protect messages transmitted between the first node and the third node.

[0045] In yet another possible implementation of the first aspect, the at least one second message includes a message transmitted by the first node and the second node after determining the second key.

[0046] In this implementation manner, after the first node and the second node determine the second key, messages transmitted between the two nodes can still be securely protected using the first key.

[0047] In another possible implementation of the first aspect, at least one second message is a signaling plane message. The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message, and the at least one fifth message is a user plane message, and the at least one fifth message is a message transmitted by the first node and the second node after determining the second key.

[0048] In this implementation, the key derived from the second key is used to encrypt user plane messages, and after the second key is determined, signaling plane messages between the first node and the second node can still be encrypted with the first key.

[0049] In another possible implementation of the first aspect, the key information includes an identifier of the first key. This implementation provides an example of key information, the key information may be an identifier of the key, and the recipient of the first message may also pre-acquire the correspondence between the identifier of the key and the key, so that the first key can be determined based on the identifier.

[0050] In yet another possible implementation of the first aspect, the first key and / or the key information are predefined.

[0051] In another possible implementation of the first aspect, the third message includes a second public key, and the second public key is associated with the first key agreement algorithm and the second private key. Before generating the first message, the method further includes: determining the first private key and the first public key by the first key agreement algorithm, and the key information includes the first public key. After receiving the third message from the second node, the method further includes: determining the first key based on the first private key and the second public key.

[0052] This implementation provides another example of key information, where the key information may include a first public key, which may be used to generate a key. In this case, the key information is not encrypted but may be integrity protected, and the second public key is not encrypted but may be integrity protected, and other information in the third message except the second public key may be encrypted.

[0053] It should be noted that, in this case, after the second node sends the third message to the first node, the first node can determine the first key, and after determining the first key, the message sent by the first node can be encrypted using the first key.

[0054] In yet another possible implementation of the first aspect, the at least one second message includes a broadcast message, such as a broadcast message broadcast by the first node.

[0055] In a second aspect, the present application also provides a communication method, comprising: receiving a first message broadcast from a first node, the first message comprising key information, and determining a first key based on the key information.

[0056] Among them, the first key is used to securely protect at least one second message, and the at least one second message is a message related to the first node transmitted after the first message, and the message related to the first node includes a message from the first node and / or a message sent to the first node.

[0057] The communication method may be applied to the second node, for example, executed by a hardware module and / or a software module in the second node.

[0058] In another possible implementation of the second aspect, the method further includes: sending a third message to the first node, the third message is used to request to establish an association with the first node, the third message is securely protected by the first key, and the third message belongs to at least one second message.

[0059] In another possible implementation of the second aspect, the first key includes an integrity protection key, and before sending the third message to the first node, the method also includes: generating a verification value based on the integrity protection key, the verification value is used to verify the integrity of the third message, and the verification value is carried in the third message.

[0060] In another possible implementation of the second aspect, the first key includes an encryption key, and sending the third message to the first node includes: encrypting the second message based on the encryption key, and sending the encrypted second message to the first node.

[0061] In another possible implementation of the second aspect, the second node includes a key configuration module, and before broadcasting the first message, the method further includes: determining key information through the key configuration module. The key configuration module is configured with at least one key and at least one key corresponding to each information, the first key belongs to the at least one key, and the key information is information corresponding to the first key.

[0062] In another possible implementation of the second aspect, the method further includes: when the key information is unencrypted but intact information, checking the integrity of the key information by using the first key.

[0063] In yet another possible implementation of the second aspect, the first key includes a first signaling plane key, and the at least one second message belongs to a signaling plane message.

[0064] In another possible implementation of the second aspect, after receiving the first message broadcast from the first node, the method further includes: negotiating with the first node to determine a second key, where the second key is used to securely protect messages between the first node and the second node.

[0065] In another possible implementation of the second aspect, at least one second message is a message related to the first node and transmitted after the first message and before the second key is determined. The second key is used to derive a session key, and the session key is used to securely protect at least one fourth message, and the at least one fourth message is a message transmitted by the first node and the second node after the second key is determined.

[0066] In yet another possible implementation of the second aspect, the at least one second message includes a message transmitted by the first node and the second node after determining the second key.

[0067] In another possible implementation of the second aspect, at least one second message belongs to a signaling plane message. The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message, and the at least one fifth message belongs to a user plane message, and the at least one fifth message is a message transmitted by the first node and the second node after determining the second key.

[0068] In yet another possible implementation of the second aspect, the first message further includes industry information, where the industry information is used to indicate the industry to which the first node belongs.

[0069] In yet another possible implementation of the second aspect, the key information includes an identifier of the first key.

[0070] In yet another possible implementation of the second aspect, the first key and / or the key information are predefined.

[0071] In another possible implementation of the second aspect, the key information includes a first public key, and the first public key is associated with a first key agreement algorithm and a first private key. The method further includes: determining a second private key and a second public key through the first key agreement algorithm, wherein the third message includes the second public key; and determining the first key based on the second private key and the first public key.

[0072] In yet another possible implementation of the second aspect, the at least one second message includes a broadcast message.

[0073] In a third aspect, the present application further provides a communication device, the communication device comprising a communication unit and a processing unit. The communication device is used to implement any method of the first aspect; or to implement any method of the second aspect.

[0074] In a fourth aspect, the present application further provides a communication device, the communication device comprising a processor. When the processor calls a computer program or instruction in a memory, any method of the first aspect is implemented, or any method of the second aspect is implemented.

[0075] It should be noted that the processor described in the fourth aspect above can be a processor specifically used to execute these methods (for convenience of distinction, it is called a dedicated processor), or it can be a processor that executes these methods by calling a computer program, such as a general-purpose processor.

[0076] Optionally, the computer program may be stored in a memory. Exemplarily, the memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same device or may be separately provided on different devices. The present application does not limit the type of memory and the configuration of the memory and the processor.

[0077] In a possible implementation manner, the at least one memory is located outside the communication device.

[0078] In yet another possible implementation, the at least one memory is located within the communication device.

[0079] In yet another possible implementation, part of the at least one memory is located inside the communication device, and another part of the memory is located outside the communication device.

[0080] In the present application, the processor and the memory may also be integrated into one device, that is, the processor and the memory may also be integrated together.

[0081] In a fifth aspect, the present application further provides a communication device, comprising a logic circuit and an interface, wherein the logic circuit and the interface are coupled. The interface is used to input data to be processed, and the logic circuit processes the data to be processed according to any method of the first aspect or any method of the second aspect to obtain processed data. The interface is also used to output the processed data.

[0082] In a sixth aspect, the present application also provides a computer-readable storage medium, which is used to store instructions or computer programs; when the instructions or computer programs are executed, any method of the first aspect is implemented, or any method of the second aspect is implemented.

[0083] In a seventh aspect, the present application also provides a computer program product, which, when the instructions or computer program are executed, implements any method of the first aspect, or implements any method of the second aspect.

[0084] In an eighth aspect, the present application further provides a terminal, which includes the communication device of any one of aspects 3 to 5. Further, the terminal can be an intelligent terminal or transportation tool such as a vehicle, a drone, or a robot.

[0085] In a ninth aspect, the present application further provides a communication system, the communication system comprising a first node and / or a second node, wherein the first node is used to implement any method of the first aspect, and the second node is used to implement any method of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] The following is a brief introduction to the drawings required for describing the embodiments.

[0087] Figure 1 It is a schematic diagram of the architecture of a communication system provided by an embodiment of the present application;

[0088] Figure 2It is a flow chart of a communication method provided in an embodiment of the present application;

[0089] Figure 3 It is a schematic diagram of an association process without a security context;

[0090] Figure 4 It is a schematic diagram of an associated process with a security context;

[0091] Figure 5 It is a flowchart of another communication method provided in an embodiment of the present application;

[0092] Figure 6 It is a flowchart of another communication method provided in an embodiment of the present application;

[0093] Figure 7 It is a flowchart of another communication method provided in an embodiment of the present application;

[0094] Figure 8 It is a flowchart of another communication method provided in an embodiment of the present application;

[0095] Fig. 9 is a structural diagram of a communication device provided in an embodiment of the present application;

[0096] Fig.10 It is a structural diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0097] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0098] In this application, a node refers to a device with communication capabilities, including but not limited to one or more of user equipment, network equipment, industrial equipment, etc. Among them, user equipment includes handheld terminals, wearable terminals, transportation tools, vehicle-mounted equipment, sensing equipment, smart home equipment, or leisure and entertainment equipment, etc., handheld terminals include but are not limited to mobile phones, tablets, or laptops, etc., wearable devices include but are not limited to headphones, smart bracelets, smart watches, or smart glasses, etc., transportation tools include but are not limited to vehicles, ships, aircraft, rail transportation (such as subways, high-speed railways, etc.), or logistics robots (such as automated guided vehicles (AGVs), etc.), vehicle-mounted equipment includes but is not limited to domain controllers (DC), screens, microphones, speakers, electronic keys, keyless entry, start system controllers, battery management systems (BMS), battery packs, or batteries, etc., sensing devices include but are not limited to cameras, radars, laser radars, light sensors, temperature sensors, or humidity sensors, etc., smart home equipment includes but is not limited to projectors, smart TVs, smart refrigerators, smart home gateways, or security equipment, etc. Leisure and entertainment equipment such as virtual reality (VR) equipment, mixed reality (MR) equipment, massage chairs, home theaters, game control equipment or 4D theater cabins, etc.

[0099] Network equipment includes but is not limited to routers, switches, or base stations, etc. Industrial equipment such as industrial robots or robotic arms, etc.

[0100] The nodes in the embodiments of the present application can be applied to various scenarios such as smart cars, smart homes, smart terminals, smart manufacturing, or smart exhibition halls. In some application scenarios or some network types, devices with similar communication capabilities may not be called nodes, but for the convenience of description, in the embodiments of the present application, devices with communication capabilities are collectively referred to as nodes.

[0101] It should be understood that the communication method, communication device, communication system or node of the embodiment of the present application is applicable to a variety of networks, such as a wired communication network, a wireless communication network, or a network including a combination of wired communication and wireless communication. For example, the wireless communication network includes a network connected by the following communication technologies: Sparklink (or Nearlink) 802.11b / g, Bluetooth (Blue Tooth), Zigbee), Radio Frequency Identification (RFID), Ultra-Wideband (UWB) technology, or a wireless short-range communication system, or a long-range connection technology including a communication technology based on long term evolution (Long Term Evolution), a fifth generation mobile communication technology (5th generation mobile networks or 5th generation wireless systems, 5th-Generation, referred to as 5G or 5G technology), a global system for mobile communications (Global System for Mobile Communications, GSM), a general packet radio service (General Packet Radio Service, GPRS), a universal mobile telecommunications system (Universal Mobile Telecommunications System, UMTS) and other wireless access type technologies. For example, the wired communication network includes a network connected by the following communication technologies: one or more of fiber optic connection technology, vehicle-mounted wired communication technology, controller area network (CAN), local interconnect network bus (LIN), CAN flexible data-rate (CAN FD), or vehicle-mounted Ethernet.

[0102] The following describes an architecture and business scenario of a communication system that can be applied to an embodiment of the present application. It should be noted that the system architecture and business scenario described in this application are intended to more clearly illustrate the technical solution of this application and do not constitute a limitation on the technical solution provided by this application. It should be understood that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution provided by this application is also applicable to similar technical problems.

[0103] See also Figure 1 , Figure 1It is a schematic diagram of the architecture of a communication system provided in an embodiment of the present application. The communication system 10 may include a first node 101 and may further include a second node 102.

[0104] The first node 101 has communication capability, where the communication capability may include wireless communication capability, wired communication capability (eg, wired communication interface), etc., wireless communication technology such as short-range wireless communication technology, etc. Similarly, the second node 102 also has communication capability.

[0105] In the case where the communication system includes a first node and a second node, the first node 101 and the second node 102 may establish a connection (eg, Figure 1 The two are connected with a solid line), and the communication connection here includes a direct connection, a connection through an intermediate node (such as a control node), etc. Figure 1 In the illustrated solution, the connection between the first node 101 and the second node 102 may be wired, wireless, or a combination thereof. It should be understood that since the network model includes multiple layers, the connection here may include connections between peer entities of some layers in the nodes, such as access layer connections.

[0106] As a possible implementation, the first node 101 may have management capabilities and can be accessed by other nodes, such as the second node 102. In other words, the first node 101 can establish an association with the second node 102. The management capability here means that the first node can have the ability to allocate resources, control the data transmission and reception mode (such as encoding / decoding mode, modulation mode, etc.). Exemplarily, the first node can send data scheduling information to the second node 102, and the second node 102 can send data according to the data scheduling information sent by the first node 101.

[0107] The method provided in the embodiments of the present application is introduced exemplarily below.

[0108] See also Figure 2 , Figure 2 is a flow chart of a communication method provided in an embodiment of the present application. Optionally, the method may be based on Figure 1 The communication system shown in FIG. Figure 2 The communication method shown may include one or more steps from step S201 to step S204. It should be understood that for the convenience of description, the order of S201 to S204 is described here, and it is not intended to limit the execution to the above order. The embodiment of the present application does not limit the execution order, execution time, execution number, etc. of the above one or more steps. S201 to step S204 are as follows:

[0109] Step S201: a first node broadcasts a first message.

[0110] Among them, the first message may include key information, which is associated with the first key, including but not limited to one or more of the identification of the first key (including ID, number, etc.), the key generation parameters of the first key, or the management node ID corresponding to the first key.

[0111] For ease of understanding, two possible implementations of key information are introduced below:

[0112] In implementation mode 1, the key information includes an identifier of the first key. There is a corresponding relationship between the identifier of the first key and the first key, and the key corresponding to the identifier can be determined by the identifier of the first key. Please refer to Table 1, which shows a schematic diagram of a possible corresponding relationship between a key and a key ID, wherein key E1 can be determined by id1, and similarly, key E2 can be determined by id2, and the rest of the cases are similar.

[0113] Table 1

[0114]

[0115]

[0116] Optionally, the corresponding relationship shown in Table 1 may be pre-set or pre-defined in the first node. As a possible implementation, the corresponding relationship shown in Table 1 may be pre-written into a key configuration module (described below).

[0117] Implementation method 2, the key information includes the public key of the key negotiation algorithm (i.e., the key negotiation parameter used to determine the key), which is called the first public key for easy distinction. Exemplarily, two nodes can determine the key by exchanging public keys. At this time, the first node first broadcasts its own public key through the first message. The receiving end of the first message (taking the second node as an example) can determine the first key based on the key negotiation algorithm according to the first public key and its own private key. Correspondingly, the second node also generates a second public key and provides it to the first node. The first node can determine the first key based on the second public key and its own private key. The first keys determined by the two are consistent.

[0118] In some possible implementations, the first key or key information may be determined from a key configuration module. The key configuration module is configured with at least one key and / or key information corresponding to at least one key. The key configuration module may be a module built into the first node, or the key configuration module may be connected to the first node through an external interface of the first node. In the latter case, the key configuration module may belong to an external module of the first node. For example, the key configuration module may be an encryption card.

[0119] The first node can obtain the first key and / or the key information corresponding to the first key from the key configuration module. Exemplarily, the key configuration module can contain one or more keys, and the first node can obtain one (or several) as the first key from the key configuration module. The first node obtains the key information of the first key based on the first key and carries it in the first message to send. In another exemplary embodiment, the key configuration module is configured with at least one key and key information corresponding to at least one key. Before sending the first message, the first node obtains the key information of the first key (such as the aforementioned id1) through the key configuration module, and carries it in the first message to send it to other nodes. When the first key is needed, for example, when a plaintext needs to be encrypted or a ciphertext needs to be decrypted, the first key corresponding to the key information of the first key is obtained from the key configuration module. In another exemplary embodiment, the key configuration information is configured with at least one key and key information corresponding to at least one key, the first node can obtain the first key and the key information associated with the first key, carry the key information of the first key in the first message, and the first key is used to subsequently implement one or more operations such as encryption, decryption, integrity protection, and integrity verification. It can be seen that, when the key configuration module includes the first key and the key information of the first key, the first key and the key information of the first key may be obtained by the first node at the same time, or at different times.

[0120] In some possible implementations, the first message may also include other information in addition to the key information. Optionally, the first message may also include one or more of the industry information, the communication domain information where the first node is located, the identifier of the first node, or the indication information of the key negotiation algorithm used in the first node (or the communication domain where the first node is located). Among them, the industry information is used to indicate the industry to which the first node belongs. For example, the industry includes but is not limited to the security industry, the power industry, or the smart terminal industry. The information of the communication domain includes but is not limited to one or more of the identifier of the communication domain, the time synchronization method used by the communication domain, or the frequency domain resources of the communication domain. The identifier of the first node includes but is not limited to one or more of the device identifier of the first node, the L2 layer ID of the first node, the network address of the second node, etc. The indication information of the key negotiation algorithm is used to indicate the key negotiation algorithm.

[0121] In some possible implementations, the information of the first message belongs to one or more security types, and the security type refers to the degree of security requirements of the information. Exemplarily, the security type of the information in the first message belongs to at least one of the following types: encrypted with complete security, encrypted without complete security, unencrypted with complete security, and unencrypted without complete security. Among them, the information with the security type of encrypted with complete security is information that is encrypted and integrity protected, the information with the security type of encrypted without complete security is information that is encrypted but not integrity protected, the information with the security type of unencrypted with complete security is information that is not encrypted but integrity protected, and the information with the security type of unencrypted without complete security is information that is not encrypted and not integrity protected. Exemplarily, the key information belongs to information that is not encrypted with complete security or information that is not encrypted with complete security. In other words, the key information may not be encrypted by the first key, so that the node receiving the first message can obtain the first key.

[0122] Optionally, the information contained in the first message can be encrypted or fully protected by a first key. After receiving the first message, other nodes can first obtain the first key based on the key information in the first message, and then obtain other information in the first message based on the first key. In other words, the information in the first message can already be protected by the first key. Taking the key information as an example, when the key information is unencrypted but fully protected information, the key information is integrity protected by the first key. In this implementation, since the key information is fully protected, it will not affect the receiving end's acquisition of the key information content, and it can enable the other end to check whether the key information has been tampered with by an attacker.

[0123] Optionally, the first message broadcasts the first message, which may be received by other nodes (such as the second node) or may not be received by other nodes (such as the second node). Figure 2 (Using both solid lines with arrows and dashed lines with arrows to represent the same).

[0124] In some possible implementations, the first key is used to securely protect at least one second message, where the at least one second message is a message related to the first node and transmitted after the first message. Exemplarily, the message related to the first node includes a message sent by the first node and / or a message received by the first node. It should be understood that securely protecting at least one second message includes encrypting part or all of the information (or the entire message) in the second message.

[0125] Optionally, the first message may also be sent in a multicast manner. For example, the first node sends the first message to nodes in a certain subnet.

[0126] Optionally, Figure 2The method shown may further include step S202. The optional in this article may be understood as that the step may be executed or may not be executed. Step S202 is specifically as follows:

[0127] Step S202 (optional): the first node broadcasts and sends the sixth message.

[0128] The sixth message is protected by the first key, for example, encrypted and / or integrity protected by the first key. Optionally, the encryption includes authenticated encryption.

[0129] Optionally, the sixth message is securely protected by the first key includes: part or all of the information in the sixth message is securely protected by the first key.

[0130] As a possible implementation, the same key may be used for encryption or integrity protection, or different keys may be used. Taking the use of different keys for encryption and integrity protection as an example, the first key may include an encryption key and an integrity protection key, and the sixth message is encrypted using the encryption key and integrity protected using the integrity protection key.

[0131] In a possible implementation, integrity protection is implemented by generating a verification value. For example, the first node generates a verification value based on the first key (or integrity protection key) and part or all of the information in the sixth message, and the verification value can be carried in the sixth message. The receiving end of the sixth message can verify part or all of the information in the aforementioned sixth message based on the verification value and the first key (or integrity protection key).

[0132] As a possible example, a communication system includes a first node and a second node that can access the first node. Before the first node and the second node establish a connection, the first node needs to broadcast first, and the broadcast information includes a system message. The system message can be used for the second node to initiate access to the first node. Exemplarily, the system information can include Group0, Group1, Group2, Group3, Group4 and Group5, which are used to carry different information respectively. Exemplarily, Group0 can carry the following information: the sending period of the system message, the number of continuous superframes that the system may use in a sending period, the offset of the system message in a sending period, etc. Group1 is used to carry the domain name of the communication domain, Group2 is used to carry the synchronization mode of the communication domain or information about time synchronization, frequency domain synchronization, etc. Group3 and Group4 can also carry information, and the types of information they carry are not listed one by one here. In the present application, the first message can be Group5, and other information can also be carried in Group5, see the above. The order in which the first node sends system messages may be, for example, first sending Group0, then Group5, and then sending one or more of Group1, Group2, Gruop3 or Group4, etc. The sixth message in step S202 may be one or more of Group1, Group2, Gruop3 or Group4, etc.

[0133] It is understandable that Group0 may not be protected by the first key security, while one or more of Group1, Group2, Group3 or Group4 etc. may be protected by the first key security (eg, encrypted and / or fully secured).

[0134] Optionally, in some cases, the second node may receive the first message from the first node. Figure 2 The communication method shown may further include step S203 and / or step S204.

[0135] Step S203: The second node determines the first key according to the key information.

[0136] As a possible implementation, when the key information is an identifier of the first key, the second node can determine the first key according to the identifier of the first key. Exemplarily, the second node pre-configures (or pre-defines) the correspondence between the identifier of the first key and the first key (as shown in Table 1), and the second node can determine the first key corresponding to the identifier of the first key according to the identifier of the first key. For example, determine the corresponding key E1 according to id1.

[0137] Optionally, a key configuration module may also be provided in the second node. The second node may determine the first key corresponding to the key information from the key configuration module through the key information. For example, the corresponding relationship shown in Table 1 is saved by the key configuration module, the second node provides the key information to the key configuration module, and the key configuration module returns the first key corresponding to the key information.

[0138] As a possible implementation, the first message includes a first public key (i.e., key information), which is determined by the first node through a first key agreement algorithm and a first private key. At this time, the second node can determine the second private key and the second public key based on the first key agreement algorithm, and determine the first key based on the second private key and the first public key. Further, the second node determines the second public key based on the second private key, and the second public key can be sent to the first node (described below).

[0139] Step S204: the second node sends a third message to the first node. Correspondingly, the first node receives the third message from the second node.

[0140] The third message is securely protected by the first key, for example, encrypted and / or integrity protected by the first key. Optionally, the encryption includes authenticated encryption. It should be noted that the third message is securely protected by the first key including: part or all of the information in the sixth message is securely protected by the first key.

[0141] As a possible implementation, encryption or integrity protection may use the same key, or different keys.

[0142] Exemplarily, the first key includes an integrity protection key, and the third message is securely protected by the first key, including: the third message is integrity protected by the integrity protection key. After receiving the third message from the second node, the first node checks the integrity of the third message according to the integrity protection key. Optionally, integrity protection is implemented by generating a verification value. For example, the second node generates a verification value based on the first key (or integrity protection key) and part or all of the information in the third message, and the verification value can be carried in the third message. The first node can verify part or all of the information in the aforementioned sixth message based on the verification value and the first key (or integrity protection key).

[0143] In another exemplary embodiment, the third message may include an encryption key. The third message is protected by the first key, including: the third message is encrypted by the encryption key. At this time, the first node can decrypt the third message based on the encryption key.

[0144] Optionally, the integrity protection key and the encryption key may be the same key, or different keys.

[0145] In some possible implementations, after the third message, more messages may be transmitted between the first node and the second node. These messages may be encrypted using the first key, or may be encrypted using the newly determined second key, or may be partially encrypted using the first key, and partially encrypted using the newly determined second key.

[0146] In some possible implementations, the first node and the second node may negotiate to obtain a second key. The second key may be used to securely protect information transmitted between the first node and the second node. The second key may be directly used for encryption and / or integrity protection, or the second key may be used to derive a session key, and the session key may include one or more of an encryption key, an integrity protection key, and an authentication encryption key.

[0147] Optionally, the second key can also be used to replace the first key to encrypt messages between the first node and the second node, or the first key and the second key can be used to encrypt different types of data, etc., so as to meet the security requirements in different communication scenarios. The following are several exemplary designs for the use of the first key and the second key:

[0148] Design 1, before the second key is determined through negotiation, the first key is used for security protection, and after the second key is determined, the second key is used for security protection. Specifically, the first key is used to securely protect at least one second message, where the at least one second message may be a message related to the first node and transmitted before the second key is determined. The second message is transmitted after the first message. The second key is used to derive a session key, which is used to securely protect at least one fourth message. The at least one fourth message is a message transmitted by the first node and the second node after the second key is determined.

[0149] Furthermore, if the first node and other nodes (such as the third node) have not yet negotiated a new key, the first key can still be used to securely protect messages transmitted between the first node and the third node.

[0150] Design 2: After negotiating the second key, the first node and the second node can still use the first key to securely protect information transmitted between them. In one possible scenario, the first key has a corresponding activation time, so even though the first node and the second node determine the second key, before the second key is activated, the first node and the second node use the first key to securely protect information transmitted between them.

[0151] Design 3, at least one second message belongs to a signaling plane message. The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message. Among them, at least one fifth message belongs to a user plane message, and at least one fifth message is a message transmitted by the first node and the second node after determining the second key. In other words, the key derived from the second key is used to encrypt the user plane message, and after determining the second key, the signaling plane message between the first node and the second node can still be encrypted with the first key.

[0152] In Design 3, the user plane refers to the communication process (or protocol) responsible for transmitting and processing user data flows, and can also be called the data plane. The signaling plane refers to the communication process (or protocol) responsible for transmitting and processing system coordination signaling, and can also be called the management plane (or the access layer information of the management plane can be called management frames), the control plane, etc.

[0153] It should be understood that the above three designs are merely examples and are not intended to limit the embodiments of the present application.

[0154] In some possible implementations, the first node and the second node may establish a communication connection (such as an access layer connection) to transmit other data between the first node and the second node, such as user plane data and signaling, through the communication connection.

[0155] exist Figure 2 In the embodiment shown, the first node broadcasts key information associated with the first key, which is equivalent to informing the outside of the clue to obtain the first key. The first node can subsequently perform security protection on messages sent out by the first node based on the first key. Other nodes that receive the first message can determine the first key based on the key information. If these nodes need to send messages to the first node, they can also perform security protection on the messages using the first key.

[0156] In a wireless communication scenario, the first node needs to broadcast information to allow other nodes to perceive itself. Based on the solution provided by the present application, for a node that needs to communicate with the first node, it is not necessary to establish a connection with the first node to obtain the first key through the first key, so that other nodes can use the first key to encrypt messages sent to the first node before they have accessed the first node, which can significantly improve communication security.

[0157] Similarly, for the first node, since the first node will broadcast the key information associated with the first key, the information sent out by the first node can be encrypted by the first key before being sent. The node that successfully obtains the first key can obtain the encrypted information of the first node without establishing an association with the first node, which can improve the security of the information broadcast by the first node.

[0158] Taking an exemplary wireless system as an example, the first node needs to broadcast the communication domain system information broadcast (SIB) to allow other nodes to perceive itself. Based on the solution provided by the present application, the first node can encrypt the sensitive information in the SIB by carrying the key information of the first key in the SIB. Moreover, the establishment request message during the connection establishment process, the message during the authentication process, the message during the security verification process, and the message during the key negotiation process can also be encrypted based on the first key, so that the first node and the second node can achieve secure communication before they have negotiated a consistent point-to-point new key, which significantly improves the communication security.

[0159] The above scheme mentions access layer connection. Two signaling processes for establishing access layer connection are introduced below. Optionally, the process of establishing access layer connection can also be called access process and association process. Specifically, association refers to the process in which two nodes obtain consistent communication keys and establish a connection. The following is an introduction to the process of terminal node accessing the management node as an example, where the management node can be regarded as the first node, and correspondingly, the terminal node can be regarded as the second node.

[0160] See also Figure 3 , Figure 3 It is a schematic diagram of an association process without a security context, which includes authentication and security context processes. For ease of distinction, the messages (or information) exchanged during the association process are represented as T1-T5. Before this association process, there was no security context in the terminal node and the management node, and no session key was negotiated, so there was no security context. When associating, the terminal node sends message T1 (which can be regarded as the third message mentioned above). Message T1 contains the terminal node ID, the first key negotiation parameter, and the third fresh parameter. Among them, message T1 can be securely protected by the first key. For the method of obtaining the first key, see Figure 2 The embodiment shown.

[0161] The management node determines the second key negotiation parameter and the fourth fresh parameter, and determines the first key according to the first key negotiation parameter and the second key negotiation parameter. Further, the management node may determine the first key based on the first key (such as the key K KE ), the third fresh parameter and the fourth fresh parameter determine the second key (such as key Kgt). The management node provides the second key negotiation parameter and the fourth fresh parameter to the terminal node through message T2, and the optional message T2 carries authentication information (i.e., the first authentication information) for verifying the key, identity, or message integrity. Optionally, the message T2 can be securely protected by the first key, or by a session key derived from the second key.

[0162] The terminal node obtains the second key in the same way. Furthermore, the terminal node also derives a session key based on the second key, which is used to securely protect the subsequent messages (or some messages are still securely protected using the first key). In this way, the terminal node and the management node negotiate to obtain a consistent second key. The terminal node can further generate a second authentication information, and send it to the management node in a message T3. The management node verifies the second authentication information, and if the verification is successful, the management node sends a message T4 to the terminal node to complete the association. The optional terminal node responds with a message T5, indicating that the association is complete. Similarly, one or more of the messages T3, T4, or T5 can be securely protected by the first key, or by a session key derived from the second key, or partly by the first key and the other part by a session key derived from the second key.

[0163] It should be understood that in the specific implementation process, the association process may exchange more messages, or the message may carry more or fewer parameters. For example, the third fresh parameter and the fourth fresh parameter may not be carried, and the second key may be obtained according to the first key and the counter when the second key is obtained. For another example, the first authentication information or the second authentication information may not be carried. For another example, the message T1 may optionally carry one or more of the security capabilities of the terminal node (used to indicate the security algorithm supported by the terminal node), the indication information of the key negotiation algorithm, etc. For another example, the message T2 may also carry the length of the authentication information, the length of the session key, the ID of the second key (or the ID of the first key), and the indication information of the security algorithm. For another example, the message T4 may also carry one or more of the temporary ID assigned by the terminal node to the management node, the validity period of the second key, the validity period of the first key, etc. In the case where the terminal node belongs to a communication group, the management node may also carry one or more of the group key of the communication group, the ID of the group key, the group security algorithm, the validity period of the group key, etc. in the message T4.

[0164] The aforementioned security context refers to a set of information including parameters related to communication security, such as one or more of a key, a freshness parameter, a key negotiation parameter, information about a security algorithm, an identity of a terminal, etc. The information about a security algorithm includes one or more of indication information of a security algorithm, a version of a security algorithm, etc.

[0165] Exemplarily, a security context may include one or more of the following information: a fixed ID of a terminal node, a temporary ID of a terminal node, a shared key (for example, expressed as Kgt), a validity period of a shared key, an identifier of a shared key (for example, Kgt ID), indication information of a key agreement algorithm, indication information of an encryption algorithm of a signaling plane, indication information of an integrity protection algorithm of a signaling plane, an encryption key of a signaling plane, an integrity protection key of a signaling plane, indication information of an encryption algorithm of a user plane, indication information of an integrity protection algorithm of a user plane, indication information of an authentication encryption algorithm of a user plane, an encryption key of a user plane, an integrity protection key of a user plane, an authentication encryption key of a user plane, a key deduction counter counter, COUNTERg, a global frame number (GFN), a group key (for example, expressed as GK), an identifier of a GK (GK ID), a group algorithm (Galgorithm), an validity period of a group key (GK expiration), and a group global frame number (groupglobal frame number, GGFN).

[0166] See also Figure 4 , Figure 4 It is a schematic diagram of an association process with a security context. For ease of distinction, the messages (or information) are represented as T6-T8 below. Before the association process, the management node obtains the security context of the terminal node. The content of the association context can be found above. In the association process, the terminal node sends a message T6 (which can be regarded as the third message mentioned above) to the management node, carrying the identity of the terminal node (optionally a temporary identity or a fixed identity), and optionally carrying a Kgt ID. Optionally, the message T6 can be securely protected by a first key, or by using a key in the security context for security protection.

[0167] The management node obtains the shared integrity protection key with the terminal node according to the identity of the terminal node, and checks the integrity of the associated message according to the integrity protection key. When the management node successfully checks the integrity of message T6, it sends message T7, and an association is established between the management node and the terminal node. Message T7 can be securely protected by the first key, or by using the key in the security context. Optionally, when the management node successfully checks the integrity of message T6, the management node can also assign a temporary ID to the terminal node. At this time, the temporary ID assigned by the management node to the terminal node can be carried in message T7.

[0168] It is understandable that the integrity protection key may be included in the security context, and the aforementioned "checking the integrity of message T6 according to the integrity protection key" may also be replaced by "checking the integrity of message T6 according to the security context". Further, the security context may include indication information of the integrity protection algorithm and the integrity protection key, and the management node may check the integrity of message T6 by using the integrity protection key and the specified integrity protection algorithm. Optionally, the integrity protection key here may be the integrity protection algorithm of the signaling plane.

[0169] Further, the management node uses the integrity protection algorithm of the signaling plane and the signaling plane integrity protection key Ks.int to perform integrity protection on message T7. Optionally, when the signaling plane encryption protection is enabled, the management node may also use the encryption algorithm of the signaling plane and the encryption key Ks.enc of the signaling plane to perform encryption protection on message T7.

[0170] Optionally, the terminal node responds with message T8, indicating that the association is complete. In some scenarios, if message T7 is encrypted, the terminal node decrypts message T7. If message T7 is integrity protected, the terminal node verifies the integrity of message T7. If the integrity verification passes, the association is complete and the terminal node can send message T8 to the management node. Optionally, message T8 can be securely protected by the first key, or by using a key in the security context.

[0171] Figure 2 The embodiment shown provides a variety of possible solutions. Figure 5 , Figure 6 , Figure 7 , Figure 8 ,or Fig. 9 Some possible designs are exemplarily described. It should be understood that Figure 5 , Figure 6 , Figure 7 , Figure 8 ,or Fig. 9 The logic, terminology, etc. in the illustrated embodiment can refer to the above. In addition, in some diagrams of this application, the information indicated by the message is schematically described in the accompanying drawings, but this does not limit the information carried by the message. In the specific implementation process, the message can carry one or more pieces of information in the brackets below.

[0172] See also Figure 5 , Figure 5 5 is a flow chart of another communication method provided in an embodiment of the present application. The communication method may include step S501 and step S502, which are as follows:

[0173] Step S501: a first node broadcasts and sends a first message.

[0174] The first message may include key information, which is associated with the first key. The first message may further include industry information, etc. For detailed description, see the above.

[0175] Optionally, the first message is used for other nodes to access the first node. For example, after receiving the first message, other nodes can perceive the first node and obtain the first key based on the key information, so as to use the first key corresponding to the key information to securely access the first node.

[0176] Optionally, before the first message, the first node may also broadcast a seventh message, and the seventh message may include the identifier of the first node and information about the communication domain where the first node is located.

[0177] Optionally, before sending the first message, the first node may have sent other information. Exemplarily, the first node may send a system message Group0 and then send the first message (such as Group5).

[0178] Step S502: The first node broadcasts and sends a sixth message. The sixth message is protected by the first key.

[0179] See step S202. It should be noted that the sixth information may be one message or multiple messages, for example, the sixth message may be one or more system messages, such as one or more of Group1, Group2, Group3 or Group4, etc., and the related description is as mentioned above.

[0180] exist Figure 5 In the illustrated embodiment, the first node broadcasts key information associated with the first key, and performs security protection on other messages broadcasted outward based on the first key, so as to improve the security of the broadcast communication of the first node.

[0181] See also Figure 6 , Figure 6 It is a flowchart of another communication method provided by an embodiment of the present application. The communication method may include some or all of the steps in step S601-step S607. It should be understood that the following is only an exemplary description using the step sequence of S601-S607 as an example. During the specific implementation process, the timing of executing some steps may be changed, and some steps may be executed multiple times. Steps S601-step S607 are as follows. Specifically as follows:

[0182] Step S601: a first node broadcasts and sends a first message.

[0183] The first message may include key information, and the key information is associated with the first key. It is understandable that the second node may receive the first message from the first node.

[0184] Step S602: The second node obtains the first key according to the key information.

[0185] Step S603: The second node sends an association request to the first node.

[0186] The association request may be securely protected by the first key. Accordingly, the first node receives the association request from the second node. The association request may be the aforementioned third message, or Figure 3 The message T1 shown or Figure 4 Message T6 is shown. In the embodiment of the present application, the name of the message is only an example.

[0187] Step S604: the first node sends an association response to the second node.

[0188] The association response can be protected by the first key. Accordingly, the second node receives the association response from the first node. Exemplarily, the association response message can be Figure 3 Message T2 is shown.

[0189] Step S605: The first node and the second node perform authentication request and response.

[0190] Optionally, messages exchanged between the authentication request and the response are securely protected by a first key.

[0191] Step S606: The first node and the second node negotiate to determine the second key.

[0192] Optionally, messages exchanged during the negotiation of the second key may also be securely protected by the first key.

[0193] Step S607: The first node and the second node use the second key to perform secure data transmission.

[0194] Taking the first node as an example, the first node can derive a session key based on the second key, and use the session key to encrypt or decrypt data transmitted between the first node and the second node. Similarly, the second node also derives a session key based on the second key, and uses the session key to decrypt or encrypt data transmitted between the first node and the second node.

[0195] Consider a possible situation, if the first node does not provide the key information of the first key to the second node, the message (or information) transmitted between the first node and the second node cannot be encrypted by the key before the first node accesses the first node, for example, the association request cannot be encrypted or integrity protected. This will cause the information transmitted before access, or the information transmitted before the second key is negotiated, to be monitored by the attacker, affecting security.

[0196] In an embodiment of the present application, the first node can provide the second node with a clue to obtain the first key, namely, the key information. Based on the clue, the second node can find the first key that can communicate securely with the first node, and based on the first key, implement security protection for messages (or information) related to the first node that need to be transmitted before accessing the first node, thereby improving communication security.

[0197] See also Figure 7 , Figure 7 : is a flowchart of another communication method provided by an embodiment of the present application. The communication method may include some or all of the steps in step S701-step S708. It should be understood that the following is only an exemplary description using the step sequence of S701-S708 as an example. During the specific implementation process, the timing of executing some steps may be changed, and some steps may be executed multiple times. Steps S701-step S708 are as follows:

[0198] Step S701: a first node broadcasts a first message to a second node.

[0199] The first message may include key information, and the key information is associated with the first key. It is understandable that the second node may receive the first message from the first node.

[0200] Step S702: The communication device in the second node sends a key request to the encryption card.

[0201] The key request may carry the key information obtained from the first message.

[0202] Step S703: The encryption card in the second node returns the first key.

[0203] Exemplarily, the encryption card may store the key and key information corresponding to the key. Based on the key information carried in the key request, the encryption card may query the key corresponding to the key information, ie, the first key, and return it to the communication device in the second node.

[0204] Step S704: the second node sends an association request to the first node.

[0205] The association request may be securely protected by the first key. Accordingly, the first node receives the association request from the second node. The association request may be the aforementioned third message, or Figure 3 The message T1 shown or Figure 4 Message T6 is shown. In the embodiment of the present application, the name of the message is only an example.

[0206] Step S705: The first node sends an association response to the second node.

[0207] The association response can be protected by the first key. Accordingly, the second node receives the association response from the first node. Exemplarily, the association response message can be Figure 3 Message T2 is shown.

[0208] Step S706: The first node and the second node perform authentication request and response.

[0209] Optionally, messages exchanged between the authentication request and the response are securely protected by a first key.

[0210] Step S707: The first node and the second node negotiate to determine the second key.

[0211] Optionally, messages exchanged during the negotiation of the second key may also be securely protected by the first key.

[0212] Step S708: The first node and the second node use the second key to securely transmit data.

[0213] Taking the first node as an example, the first node can derive a session key based on the second key, and use the session key to encrypt or decrypt data transmitted between the first node and the second node. Similarly, the second node also derives a session key based on the second key, and uses the session key to decrypt or encrypt data transmitted between the first node and the second node.

[0214] exist Figure 7 In the embodiment shown, the encryption card is used to uniformly manage the keys. Thus, the same key and key information of the key are set in the first node and the second node, so that the messages (or information) transmitted between the two nodes can be securely protected, thereby improving the security of communication.

[0215] See also Figure 8 , Figure 8 1 is a flow chart of another communication method provided by an embodiment of the present application. The communication method may include some or all of the steps in step S801-step S809. It should be understood that the following is only described exemplarily by taking the step sequence of S801-S809 as an example. During the specific implementation process, the timing of executing some steps may be changed, and some steps may be executed multiple times. Steps S801-step S809 are as follows:

[0216] Step S801: a first node broadcasts a first message to a second node.

[0217] The first message may include key information, and the key information is associated with the first key. It is understandable that the second node may receive the first message from the first node.

[0218] Step S802: The communication device in the second node sends a key request to the encryption card.

[0219] The key request may carry the key information obtained from the first message.

[0220] Step S803: The encryption card in the second node returns the first key.

[0221] Exemplarily, the encryption card may store the key and key information corresponding to the key. Based on the key information carried in the key request, the encryption card may query the key corresponding to the key information, ie, the first key, and return it to the communication device in the second node.

[0222] Step S804: the second node sends an association request to the first node.

[0223] The association request may be securely protected by the first key. Accordingly, the first node receives the association request from the second node. The association request may be the aforementioned third message, or Figure 3 The message T1 shown or Figure 4 Message T6 is shown. In the embodiment of the present application, the name of the message is only an example.

[0224] Step S805: The first node sends an association response to the second node.

[0225] The association response can be protected by the first key. Accordingly, the second node receives the association response from the first node. Exemplarily, the association response message can be Figure 3 Message T2 is shown.

[0226] Step S806: The first node and the second node perform authentication request and response.

[0227] Optionally, messages exchanged between the authentication request and the response are securely protected by a first key.

[0228] Step S807: The first node and the second node negotiate to determine the second key.

[0229] Optionally, messages exchanged during the negotiation of the second key may also be securely protected by the first key.

[0230] Step S808: The first node and the second node implement secure data transmission on the signaling plane through the first key.

[0231] Step S809: The first node and the second node implement secure transmission of user plane data through the second key.

[0232] exist Figure 8In the illustrated embodiment, after the second key is obtained through negotiation, the message (or information) on the signaling plane is securely protected by the first key, and the message (or information) on the user plane is securely protected by the second key (for example, a session key derived based on the second key). In this way, the communication security between the first node and the second node can be guaranteed before and after the first node and the second node obtain the second key through negotiation. After the second key is negotiated, multiple sets of keys can support encryption of various types of transmission data with different types of keys, thereby improving user experience.

[0233] The method of the embodiment of the present application is described in detail above, and the device of the embodiment of the present application is provided below.

[0234] It should be understood that the division of units in the device provided in the embodiments of the present application is only a division of logical functions, and in actual implementation, it can be fully or partially integrated into one physical entity, or it can be physically separated. In addition, the units in the device can be implemented in the form of a processor calling software; for example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or realize the functions of each unit of the device, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory inside the device or a memory outside the device. Alternatively, the units in the device can be implemented in the form of hardware circuits, and the functions of some or all of the units can be realized by designing the hardware circuits, and the hardware circuits can be understood as one or more processors; for example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC), and the functions of some or all of the above units are realized by designing the logical relationship of the components in the circuit; for another example, in another implementation, the hardware circuit can be realized by a programmable logic device (PLD), taking a field programmable gate array (FPGA) as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to realize the functions of some or all of the above units. All units of the above devices can be realized in the form of a processor calling software, or in the form of hardware circuits, or in part by a processor calling software, and the rest by hardware circuits.

[0235] In the embodiment of the present application, the processor is a circuit with the ability to process signals. In one implementation, the processor can be a circuit with the ability to read and run instructions, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP); in another implementation, the processor can implement certain functions through the logical relationship of a hardware circuit, and the logical relationship of the hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by a processor as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document to implement the hardware circuit configuration can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. In addition, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0236] It can be seen that each unit in the above device can be one or more processors (or processing circuits) configured to implement the above method, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0237] In addition, all or part of the units in the above device can be integrated together, or can be implemented independently. In one implementation, these units are integrated together and implemented in the form of a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of each unit of the device. The type of the at least one processor may be different, for example, including a CPU and an FPGA, a CPU and an artificial intelligence processor, a CPU and a GPU, etc.

[0238] Several possible arrangements are listed below.

[0239] See also Fig. 9 , Fig. 9is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. Optionally, the communication device 90 may be an independent device, such as a node. Alternatively, the communication device 90 may also be a device in an independent device (such as a node), such as a chip or an integrated circuit. The communication device 90 is used to implement the aforementioned communication method, such as Figure 2 , Figure 5 , Figure 6 , Figure 7 ,or Figure 8 In the embodiments shown, any one or more of the communication methods shown in the embodiments. Further, in some scenarios, the communication device is also used to implement the following Figure 3 or Figure 4 The association process shown.

[0240] like Fig. 9 As shown, the communication device 90 includes a communication unit 901 and a processing unit 902. The communication unit 901 is used to implement one or more operations such as sending, receiving, monitoring, transmitting, establishing a connection, and responding, and further includes other operations for implementing the communication method. The processing unit 902 is used to implement one or more operations of processing, calculating, determining, generating, updating, encrypting, decrypting, etc., and further includes other operations for implementing the communication method.

[0241] In one possible design, the communication device 90 includes a communication unit 901 and a processing unit 902, and the communication device 90 is used to implement the method on the first node side in the aforementioned communication method.

[0242] In a possible implementation, the processing unit 902 is configured to generate a first message, where the first message includes key information, and the key information is associated with the first key;

[0243] The communication unit 901 is used to broadcast and send a first message. The first key is used to securely protect at least one second message, and the at least one second message is a message related to the first node and transmitted after the first message. Exemplarily, the message related to the first node includes a message sent by the first node and / or a message received by the first node.

[0244] Transmission may include sending or receiving.

[0245] In another possible implementation, the communication unit 901 is further configured to receive a third message from the second node, the third message being used to request to establish an association with the first node. The third message is securely protected by the first key and belongs to the at least one second message mentioned above.

[0246] In another possible implementation, the first key includes an integrity protection key, and the third message is security protected by the first key, including: the third message is integrity protected by the integrity protection key, and the processing unit 902 is also used to check the integrity of the third message according to the integrity protection key.

[0247] In another possible implementation, the first key includes an encryption key, and the security protection of the third message by using the first key includes: the third message is encrypted by using the encryption key, and the processing unit 902 is further used to decrypt the third message based on the encryption key.

[0248] In another possible implementation, the first node includes a key configuration module. The processing unit 902 is further configured to determine the key information through the key configuration module.

[0249] In another possible implementation, the security type of the information in the first message belongs to at least one of the following types: encryption with full security, encryption without full security, non-encryption with full security, and non-encryption without full security.

[0250] In another possible implementation of the first aspect, the information included in the first message may be encrypted or secured by a first key. After receiving the first message, the other nodes may first obtain the first key based on the key information in the first message, thereby obtaining other information in the first message based on the first key.

[0251] In another possible implementation of the first aspect, the key information is unencrypted but fully secured information or unencrypted but fully secured information.

[0252] In another possible implementation of the first aspect, the first key includes a first signaling plane key, and the at least one second message is a signaling plane message.

[0253] In another possible implementation of the first aspect, the processing unit 902 and the communication unit 901 are further configured to negotiate with the second node to determine a second key, where the second key is used to securely protect messages between the first node and the second node.

[0254] The second key may be used directly for encryption or integrity protection, or the second key may be used to derive a session key, and the session key may include one or more of an encryption key, an integrity protection key, and an authentication encryption key.

[0255] In another possible implementation of the first aspect, at least one second message is a message related to the first node and transmitted after the first message and before the second key is determined. The second key is used to derive a session key, and the session key is used to securely protect at least one fourth message, and the at least one fourth message is a message transmitted by the first node and the second node after the second key is determined.

[0256] In yet another possible implementation of the first aspect, the at least one second message includes a message transmitted by the first node and the second node after determining the second key.

[0257] In another possible implementation of the first aspect, at least one second message is a signaling plane message. The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message, and the at least one fifth message is a user plane message, and the at least one fifth message is a message transmitted by the first node and the second node after determining the second key.

[0258] In another possible implementation of the first aspect, the first message further includes industry information, where the industry information is used to indicate the industry to which the first node belongs.

[0259] Optionally, the industry information may be securely protected using a first key.

[0260] In yet another possible implementation of the first aspect, the key information includes an identifier of the first key.

[0261] In yet another possible implementation of the first aspect, the first key and / or the key information are predefined.

[0262] In another possible implementation of the first aspect, the third message includes a second public key, where the second public key is associated with the first key agreement algorithm and the second private key. The processing unit 902 is further configured to:

[0263] Determine a first private key and a first public key by using a first key agreement algorithm, wherein the key information includes the first public key;

[0264] A first key is determined based on the first private key and the second public key.

[0265] In yet another possible implementation of the first aspect, the at least one second message includes a broadcast message, such as a broadcast message broadcast by the first node.

[0266] In another possible design, the communication device 90 includes a communication unit 901 and a processing unit 902, and the communication device 90 is used to implement the method on the second node side in the aforementioned communication method.

[0267] In a possible implementation, the communication unit 901 is configured to receive a first message broadcast from a first node, where the first message includes key information;

[0268] The processing unit 902 is used to determine the first key according to the key information. The first key is used to securely protect at least one second message, the at least one second message is a message related to the first node transmitted after the first message, and the message related to the first node includes a message from the first node and / or a message sent to the first node.

[0269] In another possible implementation, the communication unit 901 is further used to send a third message to the first node, where the third message is used to request to establish an association with the first node, the third message is securely protected by the first key, and the third message belongs to at least one second message.

[0270] In another possible implementation, the first key includes an integrity protection key. The processing unit 902 is further configured to generate a check value according to the integrity protection key, the check value is used to check the integrity of the third message, and the check value is carried in the third message.

[0271] In another possible implementation, the first key includes an encryption key. The processing unit 902 is further configured to encrypt the second message based on the encryption key. The communication unit 901 is further configured to send the encrypted second message to the first node.

[0272] In another possible implementation, the second node includes a key configuration module. The processing unit 902 is further configured to determine the key information through the key configuration module.

[0273] In yet another possible implementation, the processing unit 902 is further configured to, when the key information is unencrypted but intact information, check the integrity of the key information by using the first key.

[0274] In yet another possible implementation, the first key includes a first signaling plane key, and the at least one second message belongs to a signaling plane message.

[0275] In yet another possible implementation, the communication unit 901 and the processing unit 902 are further configured to negotiate with the first node to determine a second key, where the second key is used to securely protect messages between the first node and the second node.

[0276] In another possible implementation, at least one second message is a message related to the first node, transmitted after the first message and before the second key is determined; the second key is used to derive a session key, and the session key is used to securely protect at least one fourth message, and at least one fourth message is a message transmitted by the first node and the second node after the second key is determined.

[0277] In yet another possible implementation, the at least one second message includes a message transmitted by the first node and the second node after determining the second key.

[0278] In yet another possible implementation, at least one second message belongs to a signaling plane message;

[0279] The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message, and the at least one fifth message is a user plane message, and the at least one fifth message is a message transmitted by the first node and the second node after determining the second key.

[0280] In yet another possible implementation, the first message further includes industry information, where the industry information is used to indicate the industry to which the first node belongs.

[0281] In yet another possible implementation, the key information includes an identifier of the first key.

[0282] In yet another possible implementation, the first key and / or the key information are predefined.

[0283] In another possible implementation, the key information includes a first public key, and the first public key is associated with the first key agreement algorithm and the first private key. The processing unit 902 is further configured to:

[0284] Determine a second private key and a second public key by using a first key agreement algorithm, wherein the third message includes the second public key;

[0285] A first key is determined based on the second private key and the first public key.

[0286] In yet another possible implementation, the at least one second message includes a broadcast message.

[0287] See also Fig.10 , Fig.10 1 is a schematic diagram of the structure of another communication device provided in an embodiment of the present application. The communication device 100 may be an independent device, such as a node, or a device contained in an independent device, such as a chip, a software module, or an integrated circuit. The communication device 100 may include at least one processor 1001 and a communication interface 1002. Optionally, at least one memory 1003 may also be included. Further optionally, a connection line 1004 may also be included, wherein the processor 1001, the communication interface 1002 and / or the memory 1003 are connected via the connection line 1004, and / or communicate with each other via the connection line 1004 to transmit control signals and / or data signals. Exemplarily, the connection line may include a bus.

[0288] in:

[0289] The processor 1001 is a module for performing arithmetic operations and / or logical operations, and may specifically include one or more of the following modules: a filter, a modem, a power amplifier, a low noise amplifier (LNA), a baseband processor, a radio frequency processor, a radio frequency circuit, a central processing unit (CPU), an application processor (AP), a microcontroller unit (MCU), an electronic control unit (ECU), a graphics processing unit (GPU), a microprocessor (MPU), an application specific integrated circuit (ASIC), an image signal processor (ISP), a digital signal processor (DSP), a field programmable gate array (FPGA), a complex programmable logic device (CPLD), or a coprocessor, etc.

[0290] The communication interface 1002 may be used to provide information input or output for the at least one processor, or to receive externally transmitted signals and / or to transmit externally transmitted signals.

[0291] For example, communication interface 1002 may include interface circuitry.

[0292] For example, the communication interface 1002 may include a wired link interface such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, general wireless transmission, vehicle-mounted short-range communication technology, and other short-range wireless communication technologies, etc.) interface.

[0293] Optionally, the communication interface 1002 may further include a radio frequency transmitter, an antenna, etc. When the communication interface 1002 includes an antenna, the number of antennas may be one or more.

[0294] As a possible design, if the communication device 100 is an independent device, the communication interface 1002 may include a receiver and a transmitter. The receiver and the transmitter may be the same component or different components. When the receiver and the transmitter are the same component, the component may be referred to as a transceiver.

[0295] As another possible design, if the communication device 100 is a chip or a circuit, the communication interface 1002 may include an input interface and an output interface, and the input interface and the output interface may be the same interface, or may be different interfaces.

[0296] Optionally, the functions of the communication interface 1002 may be implemented by a transceiver circuit or a dedicated transceiver chip.

[0297] The memory 1003 is used to provide a storage space, in which data such as an operating system and a computer program can be stored. The memory 1003 can be a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), or a portable read only memory (CD-ROM), etc., or a combination of multiple thereof.

[0298] The functions and actions of the modules or units in the communication device 100 listed above are only exemplary.

[0299] Each functional unit in the communication device 100 can be used to implement the aforementioned communication method, for example Figure 2 , Figure 5 , Figure 6 , Figure 7 ,or Figure 8 The communication method shown.

[0300] Optionally, the processor 1001 may be a processor specifically used to execute the aforementioned method (for convenience of distinction, referred to as a dedicated processor), or may be a processor that executes the aforementioned method by calling a computer program (for convenience of distinction, referred to as a dedicated processor). Optionally, the at least one processor may include both a dedicated processor and a general-purpose processor.

[0301] Optionally, in the case where the communication device 100 includes at least one memory 1003 , if the processor 1001 implements the aforementioned communication method by calling a computer program, the computer program may be stored in the memory 1003 .

[0302] The present application also provides a chip, which includes a logic circuit and a communication interface. The communication interface is used to receive a signal or send a signal; the logic circuit is used to receive a signal or send a signal through the communication interface. The chip is used to implement the aforementioned communication method, for example Figure 2 , Figure 5 , Figure 6 , Figure 7 ,or Figure 8 The communication method shown.

[0303] The embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the instructions are executed on at least one processor (or communication device), the aforementioned communication method is implemented, for example Figure 2 , Figure 5 , Figure 6 , Figure 7 ,or Figure 8 The communication method shown.

[0304] The present application also provides a computer program product, which includes computer instructions, and the computer instructions are used to implement the aforementioned communication method, for example Figure 2 , Figure 5 , Figure 6 , Figure 7 ,or Figure 8 The communication method shown.

[0305] The embodiment of the present application further provides a terminal, which includes the aforementioned communication device 90 and / or communication device 100.

[0306] As a possible implementation, the terminal includes a terminal node, wherein the terminal may be an intelligent terminal or a means of transportation such as a vehicle, a drone, or a robot.

[0307] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0308] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items.

[0309] For example, at least one of a, b, or c can be represented by: a, b, c, (a and b), (a and c), (b and c), or (a and b and c), where a, b, c can be single or multiple. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can be represented by: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0310] Furthermore, unless otherwise specified, the ordinal numbers such as "first" and "second" used in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects. For example, the first node and the second node are only for the convenience of describing fresh parameters in different implementations, and do not indicate differences in their execution operations, importance, structure, etc.

[0311] In the above embodiments, the term "when..." can be interpreted as meaning "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent substitution, improvement, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

[0312] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

Claims

1. A communication method, characterized in that: The method is applied to a first node, and the method comprises: generating a first message, wherein the first message includes key information, and the key information is associated with a first key; Broadcasting sends the first message; Among them, the first key is used to securely protect at least one second message, and the at least one second message is a message related to the first node and transmitted after the first message. The message related to the first node includes a message sent by the first node and / or a message received by the first node.

2. The method according to claim 1, characterized in that After broadcasting the first message, the method further includes: A third message is received from a second node, the third message being used to request to establish an association with the first node, the third message being securely protected by the first key, and the third message belonging to the at least one second message.

3. The method according to claim 2, characterized in that The first key includes an integrity protection key, and the third message is security-protected by the first key, including: the third message is integrity-protected by the integrity protection key, After receiving the third message from the second node, the method further includes: The integrity of the third message is checked according to the integrity protection key.

4. The method according to claim 2 or 3, characterized in that: The first key includes an encryption key, and the third message is securely protected by the first key, comprising: encrypting the third message by the encryption key, After receiving the third message from the second node, the method further includes: The third message is decrypted based on the encryption key.

5. The method according to any one of claims 1 to 4, characterized in that: The first node includes a key configuration module. Before broadcasting the first message, the method further includes: Determine the key information through the key configuration module; The key configuration module is configured with at least one key and information corresponding to the at least one key, the first key belongs to the at least one key, and the key information is information corresponding to the first key.

6. The method according to any one of claims 1 to 5, characterized in that: The security type of the information in the first message belongs to at least one of the following types: Information with encryption and integrity protection, encryption without integrity protection, non-encryption with integrity protection, and non-encryption without integrity protection. Among them, information with the security type of encryption with integrity protection is information that has been encrypted and integrity protected, information with the security type of encryption without integrity protection is information that has been encrypted but not integrity protected, information with the security type of non-encryption with integrity protection is information that has not been encrypted but has integrity protected, and information with the security type of non-encryption without integrity protection is information that has not been encrypted and has not been integrity protected.

7. The method according to claim 6, characterized in that The key information is either unencrypted but fully protected information or unencrypted but fully protected information. In the case where the key information is unencrypted but integrity protected information, the key information is integrity protected by the first key.

8. The method according to any one of claims 1 to 7, characterized in that: The first key includes a first signaling plane key, and the at least one second message is a signaling plane message.

9. The method according to any one of claims 1 to 7, characterized in that: After broadcasting the first message, the method further includes: A second key is determined by negotiation with the second node, where the second key is used to securely protect messages between the first node and the second node.

10. The method according to claim 9, characterized in that The at least one second message is a message related to the first node and transmitted after the first message and before the second key is determined; The second key is used to derive a session key, and the session key is used to securely protect at least one fourth message, where the at least one fourth message is a message transmitted by the first node and the second node after determining the second key.

11. The method according to claim 9, characterized in that The at least one second message comprises a message transmitted by the first node and the second node after determining the second key.

12. The method according to claim 9, characterized in that The at least one second message belongs to a signaling plane message; The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message, and the at least one fifth message is a user plane message, and the at least one fifth message is a message transmitted by the first node and the second node after determining the second key.

13. The method according to any one of claims 1 to 12, characterized in that: The first message further includes industry information, where the industry information is used to indicate the industry to which the first node belongs.

14. The method according to any one of claims 1 to 13, characterized in that: The key information includes an identifier of the first key.

15. The method according to any one of claims 1 to 9, characterized in that: The first key and / or the key information are predefined.

16. The method according to claim 2 or 3, characterized in that: The third message includes a second public key, the second public key being associated with the first key agreement algorithm and the second private key; Before generating the first message, the method further includes: Determine a first private key and a first public key by using the first key agreement algorithm, wherein the key information includes the first public key; After receiving the third message from the second node, the method further includes: The first key is determined based on the first private key and the second public key.

17. The method according to any one of claims 1 to 16, characterized in that: The at least one second message comprises a broadcast message.

18. A communication method, characterized in that: Applied to the second node, the method comprises: Receiving a first message broadcasted from a first node, wherein the first message includes key information; Determine a first key according to the key information; Among them, the first key is used to securely protect at least one second message, and the at least one second message is a message related to the first node and transmitted after the first message. The message related to the first node includes a message from the first node and / or a message sent to the first node.

19. The method according to claim 18, characterized in that The method further comprises: A third message is sent to the first node, where the third message is used to request to establish an association with the first node, the third message is securely protected by the first key, and the third message belongs to the at least one second message.

20. The method according to claim 19, characterized in that The first key includes an integrity protection key, and before sending the third message to the first node, the method further includes: A check value is generated according to the integrity protection key, where the check value is used to check the integrity of the third message, and the check value is carried in the third message.

21. The method according to claim 19 or 20, characterized in that The first key includes an encryption key, and the sending a third message to the first node includes: encrypting the second message based on the encryption key; The encrypted second message is sent to the first node.

22. The method according to any one of claims 18 to 21, characterized in that: The second node includes a key configuration module. Before broadcasting the first message, the method further includes: Determine the key information through the key configuration module; The key configuration module is configured with at least one key and information corresponding to the at least one key, the first key belongs to the at least one key, and the key information is information corresponding to the first key.

23. The method according to any one of claims 18 to 22, characterized in that: The method further comprises: In the case that the key information is unencrypted but intact information, the integrity of the key information is checked by using the first key.

24. The method according to any one of claims 18 to 23, characterized in that: The first key includes a first signaling plane key, and the at least one second message belongs to a signaling plane message.

25. The method according to any one of claims 18 to 24, characterized in that: After receiving the first message broadcast from the first node, the method further includes: A second key is determined by negotiation with the first node, where the second key is used to securely protect messages between the first node and the second node.

26. The method according to claim 25, characterized in that The at least one second message is a message related to the first node and transmitted after the first message and before the second key is determined; The second key is used to derive a session key, and the session key is used to securely protect at least one fourth message, where the at least one fourth message is a message transmitted by the first node and the second node after determining the second key.

27. The method according to claim 25, characterized in that The at least one second message comprises a message transmitted by the first node and the second node after determining the second key.

28. The method according to claim 25, characterized in that The at least one second message belongs to a signaling plane message; The second key is used to derive a session key, and the session key is used to securely protect at least one fifth message, and the at least one fifth message is a user plane message, and the at least one fifth message is a message transmitted by the first node and the second node after determining the second key.

29. The method according to any one of claims 18 to 28, characterized in that: The first message further includes industry information, where the industry information is used to indicate the industry to which the first node belongs.

30. The method according to any one of claims 18 to 29, characterized in that: The key information includes an identifier of the first key.

31. The method according to any one of claims 18 to 30, characterized in that: The first key and / or the key information are predefined.

32. The method according to claim 19 or 20, characterized in that The key information includes a first public key, and the first public key is associated with a first key agreement algorithm and a first private key; the method further includes: Determine a second private key and a second public key by using the first key agreement algorithm, wherein the third message includes the second public key; The first key is determined based on the second private key and the first public key.

33. The method according to any one of claims 18 to 32, characterized in that: The at least one second message comprises a broadcast message.

34. A communication device, characterized in that: The communication device comprises a communication unit and a processing unit, and the communication device is used to implement the method according to any one of claims 1-17.

35. A communication device, characterized in that: The communication device comprises a communication unit and a processing unit, and the communication device is used to implement the method described in any one of claims 18-33.

36. A communication device, characterized in that: The communication device includes a processor and a communication interface; When the processor calls the computer program or instruction in the memory, the method according to any one of claims 1 to 17 is executed, or the method according to any one of claims 18 to 33 is executed.

37. A chip, characterized in that: The chip includes a processor and a communication interface; The processor is used to implement the method according to any one of claims 1 to 17, or to implement the method according to any one of claims 18 to 33.

38. A communication system, characterized in that: The communication system comprises a first node and a second node, The first node comprises the communication device as claimed in claim 34; The second node comprises the communication device of claim 35.

39. A terminal, characterized in that: The terminal includes the communication device as claimed in claim 34, or includes the communication device as claimed in claim 35, or includes the communication device as claimed in claim 36, or includes the chip as claimed in claim 37, or includes the communication system as claimed in claim 38.

40. A computer-readable storage medium, characterized in that The computer readable storage medium is used to store instructions or computer programs; When the instructions or the computer program are executed, the method according to any one of claims 1 to 17 is implemented, or the method according to any one of claims 18 to 33 is implemented.

Images