Mesh network system and method based on equipment identity dynamic management

Abstract

The invention relates to a Mesh network system and method based on device identity dynamic management. The method comprises the following steps that a coordinator broadcasts periodic keys to a plurality of nodes regularly; the plurality of nodes receive the periodic key sent by the coordinator; the plurality of nodes burn the fixed key during production, and the plurality of nodes also transmit the fixed key and the periodic key to the terminal; the terminal regularly generates a dynamic key according to the time Data, the MAC address, the fixed key and the periodic key, and transmits the dynamic key to the node along with the information; the node receiving the information sends a Mesh message carrying the dynamic key to the surrounding nodes, the surrounding nodes verify the dynamic key in the Mesh message, and after verification is passed, the Mesh message is forwarded and subjected to data processing; and if the verification is not passed, eliminating the Mesh message. Compared with the prior art, key solidification can be avoided, multi-dimensional verification is realized, the attack risk is reduced, the potential safety hazard is reduced, and the safety is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a Mesh network system and method based on dynamic device identity management. Background Art

[0002] Currently, Bluetooth Mesh uses a layered encryption model: the network layer uses NetKey for device access authentication, and the application layer uses AppKey to achieve end-to-end encryption; messages are forwarded between nodes through flooding broadcasts, relying on a fixed key system to ensure communication security.

[0003] Traditional solutions use a static key system, which is characterized by: 1. Key solidification: NetKey and AppKey remain unchanged throughout the device lifecycle; 2. Single verification dimension: Message authentication relies solely on fixed keys and lacks dynamic parameters such as time and device attributes; 3. Replay attack risk: Attackers can intercept encrypted messages and resend them.

[0004] Traditional solutions using static key systems have some shortcomings. The key remains unchanged for a long time, leading to the risk of brute force cracking, and the threat cannot be quickly isolated after the device is lost or the key is leaked. The existing encryption is not bound to the hardware characteristics of the device and cannot identify illegal devices impersonating legitimate identities. Therefore, it is necessary to solve these problems. Summary of the Invention

[0005] The present invention aims to at least partially address one of the aforementioned technical problems in the prior art. To this end, one objective of the present invention is to provide a Mesh network system and method based on dynamic device identity management that avoids key curing, implements multi-dimensional authentication, reduces the risk of attack, mitigates security risks, and improves security.

[0006] The present invention solves the above technical problems with the following technical solution: A Mesh network method based on dynamic device identity management, comprising the following steps: The coordinator broadcasts a periodic key to multiple nodes at a regular interval; the multiple nodes receive the periodic key sent by the coordinator; The plurality of nodes are all burned with a fixed key during production, and the plurality of nodes also transmit the fixed key and the periodic key to the terminal; The terminal generates a dynamic key according to the time, MAC address, fixed key and periodic key, and transmits the dynamic key to the node along with the information; The node that receives the information sends a Mesh message carrying a dynamic key to the surrounding nodes. The surrounding nodes verify the dynamic key in the Mesh message. If the verification is successful, the Mesh message is forwarded and data is processed; if the verification fails, the Mesh message is eliminated.

[0007] The beneficial effects of the present invention are: using dynamic keys can avoid key solidification, achieve multi-dimensional verification, reduce the risk of attack, reduce security risks, and improve security.

[0008] On the basis of the above technical solution, the present invention can also be improved as follows.

[0009] Furthermore, the node stores the fixed key in its security chip.

[0010] The beneficial effect of adopting the above further solution is that it can prevent the fixed key from being stolen when it is issued, thereby improving security.

[0011] Furthermore, the node verifies the Mesh message by the following steps: The node that receives the Mesh message extracts the time Date and MAC address from the Mesh message, and extracts the fixed key and periodic key stored therein, performs MD5 encryption on the time Date, MAC address, fixed key and periodic key, and obtains the encryption result; when the encryption result is consistent with the dynamic key, the verification is passed; when the encryption result is inconsistent with the dynamic key, the verification fails.

[0012] The beneficial effects of adopting the above further solution are: the Mesh message verification process is simple and the verification efficiency is improved.

[0013] Furthermore, the method further comprises the following steps: When a node receives Mesh messages from other nodes three times in a row and all three Mesh messages fail verification, a warning message is sent to the server.

[0014] The beneficial effect of adopting the above further solution is that it is convenient for maintenance personnel to understand the existing safety risks in a timely manner and facilitate subsequent maintenance.

[0015] Another technical solution of the present invention to solve the above technical problems is as follows: A Mesh network system based on dynamic device identity management, comprising: A coordinator, each of which is connected to a plurality of nodes and is used to broadcast a periodic key to the plurality of nodes at a regular interval; Multiple nodes, multiple nodes are connected to the terminal; multiple nodes are used to receive the periodic key sent by the coordinator; multiple nodes are also used to burn fixed keys during production, and multiple nodes also transmit the fixed key and the periodic key to the terminal; the node that receives the information sends a Mesh message carrying a dynamic key to its surrounding nodes, and the surrounding nodes verify the dynamic key in the Mesh message. After the verification is passed, the Mesh message is forwarded and data is processed; if the verification fails, the Mesh message is eliminated; The terminal is used to receive the fixed key and the periodic key, and is also used to regularly generate a dynamic key according to the time Date, MAC address, fixed key and periodic key, and transmit the dynamic key to the node along with the information.

[0016] The beneficial effects of the present invention are: using dynamic keys can avoid key solidification, achieve multi-dimensional verification, reduce the risk of attack, reduce security risks, and improve security.

[0017] Furthermore, the node extracts the time Date and MAC address from the Mesh message, and extracts the fixed key and periodic key stored therein, performs MD5 encryption on the time Date, MAC address, fixed key and periodic key, and obtains the encryption result; when the encryption result is consistent with the dynamic key, the verification is passed; when the encryption result is inconsistent with the dynamic key, the verification fails.

[0018] The beneficial effects of adopting the above further solution are: the Mesh message verification process is simple and the verification efficiency is improved.

[0019] Furthermore, if the node receives Mesh messages from other nodes three times in a row and all three Mesh messages fail to be verified, a warning message is sent to the server.

[0020] The beneficial effect of adopting the above further solution is that it is convenient for maintenance personnel to understand the existing safety risks in a timely manner and facilitate subsequent maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a flow chart of a Mesh network method based on dynamic device identity management of the present invention; Figure 2 This is a module block diagram of a Mesh network system based on dynamic device identity management of the present invention.

[0022] In the accompanying drawings, the components represented by the reference numerals are as follows: 1. Coordinator, 2. Node, 3. Terminal. DETAILED DESCRIPTION

[0023] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0024] like Figure 1 As shown, a Mesh network method based on dynamic device identity management includes the following steps: The coordinator 1 broadcasts a periodic key to multiple nodes 2 at regular intervals; multiple nodes 2 receive the periodic key sent by the coordinator 1; The plurality of nodes 2 are all burned with a fixed key during production, and the plurality of nodes 2 also transmit the fixed key and the periodic key to the terminal 3; The terminal 3 generates a dynamic key according to the time, MAC address, fixed key and periodic key, and transmits the dynamic key to the node 2 along with the information; Node 2 that receives the information sends a Mesh message carrying a dynamic key to its surrounding nodes 2. The surrounding nodes 2 verify the dynamic key in the Mesh message. If the verification is successful, the Mesh message is forwarded and data is processed; if the verification fails, the Mesh message is eliminated.

[0025] When this embodiment is applied specifically, the coordinator 1 is used to send periodic keys at regular intervals, and then the time Date, MAC address, fixed key and periodic key are used to construct a dynamic key, so that the key is in dynamic change, that is, the key is frequently modified to prevent the key from being cracked by brute force. Even after the device is lost or the key is leaked, a new key can be quickly constructed to quickly isolate the risk of key loss; the dynamic key is also bound to the MAC address of the terminal 3, which facilitates the node 2 to quickly identify the terminal 3 and avoid the device impersonating the legitimate identity.

[0026] This embodiment uses dynamic keys to avoid key solidification, achieve multi-dimensional verification, reduce the risk of attack, reduce security risks, and improve security.

[0027] In the above embodiment, the node 2 stores the fixed key in its security chip.

[0028] This embodiment stores the fixed key in its security chip. The fixed key does not appear during the message transmission process, which can prevent the fixed key from being stolen when it is issued, thereby improving security.

[0029] In the above embodiment, node 2 verifies the Mesh message by the following steps: Node 2 that receives the Mesh message extracts the time Date and MAC address from the Mesh message, and extracts the fixed key and periodic key stored therein, performs MD5 encryption on the time Date, MAC address, fixed key and periodic key, and obtains the encryption result; when the encryption result is consistent with the dynamic key, the verification is successful; when the encryption result is inconsistent with the dynamic key, the verification fails.

[0030] The Mesh message verification process of this embodiment is simple, which improves verification efficiency.

[0031] The above embodiment further includes the following steps: When node 2 receives Mesh messages from other nodes 2 three times in a row and all three Mesh messages fail verification, a warning message is sent to the server.

[0032] In this embodiment, when the Mesh message fails to be verified three times, a warning message is sent to the server, so that maintenance personnel can promptly understand the existing security risks and facilitate subsequent maintenance. Example 2:

[0033] like Figure 2 As shown, a Mesh network system based on dynamic device identity management includes: A coordinator 1, wherein the coordinator 1 is connected to a plurality of nodes 2 respectively and is used to broadcast a periodic key to the plurality of nodes 2 at regular intervals; Multiple nodes 2 are connected to a terminal 3; the multiple nodes 2 are used to receive the periodic key sent by the coordinator 1; the multiple nodes 2 are also used to burn a fixed key during production, and the multiple nodes 2 also transmit the fixed key and the periodic key to the terminal 3; the node 2 that receives the information sends a Mesh message carrying a dynamic key to the surrounding nodes 2, and the surrounding nodes 2 verify the dynamic key in the Mesh message. After the verification is passed, the Mesh message is forwarded and data is processed; if the verification fails, the Mesh message is eliminated; Terminal 3 is used to receive the fixed key and the periodic key, and is also used to regularly generate a dynamic key according to the time Date, MAC address, fixed key and periodic key, and transmit the dynamic key to node 2 along with the information.

[0034] When this embodiment is applied specifically, the coordinator 1 is used to send periodic keys at regular intervals, and then the time Date, MAC address, fixed key and periodic key are used to construct a dynamic key, so that the key is in dynamic change, that is, the key is frequently modified to prevent the key from being cracked by brute force. Even after the device is lost or the key is leaked, a new key can be quickly constructed to quickly isolate the risk of key loss; the dynamic key is also bound to the MAC address of the terminal 3, which facilitates the node 2 to quickly identify the terminal 3 and avoid the device impersonating the legitimate identity.

[0035] This embodiment uses dynamic keys to avoid key solidification, achieve multi-dimensional verification, reduce the risk of attack, reduce security risks, and improve security.

[0036] In the above embodiment, the node 2 extracts the time Date and MAC address from the Mesh message, and extracts the fixed key and periodic key stored therein, performs MD5 encryption on the time Date, MAC address, fixed key and periodic key, and obtains the encryption result; when the encryption result is consistent with the dynamic key, the verification is successful; when the encryption result is inconsistent with the dynamic key, the verification fails.

[0037] The Mesh message verification process of this embodiment is simple, which improves verification efficiency.

[0038] In the above embodiment, if the node 2 receives Mesh messages from other nodes 2 three times in a row and all three Mesh messages fail to be verified, a warning message is sent to the server.

[0039] In this embodiment, when the Mesh message fails to be verified three times, a warning message is sent to the server, so that maintenance personnel can promptly understand the existing security risks and facilitate subsequent maintenance.

[0040] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A Mesh network method based on dynamic device identity management, characterized in that: The following steps are involved: The coordinator broadcasts the periodic key to multiple nodes at regular intervals; The plurality of nodes receive the periodic key sent by the coordinator; The plurality of nodes are all burned with a fixed key during production, and the plurality of nodes also transmit the fixed key and the periodic key to the terminal; The terminal generates a dynamic key according to the time, MAC address, fixed key and periodic key, and transmits the dynamic key to the node along with the information; The node that receives the information sends a Mesh message carrying a dynamic key to the surrounding nodes. The surrounding nodes verify the dynamic key in the Mesh message. If the verification is successful, the Mesh message is forwarded and data is processed; if the verification fails, the Mesh message is eliminated.

2. The Mesh network method based on dynamic device identity management according to claim 1, characterized in that: The node stores a fixed key in its secure chip.

3. The Mesh network method based on dynamic device identity management according to claim 1, characterized in that: The node verifies the Mesh message by the following steps: The node that receives the Mesh message extracts the time Date and MAC address from the Mesh message, and extracts the fixed key and periodic key stored therein, performs MD5 encryption on the time Date, MAC address, fixed key and periodic key, and obtains the encryption result; when the encryption result is consistent with the dynamic key, the verification is passed; when the encryption result is inconsistent with the dynamic key, the verification fails.

4. The Mesh network method based on dynamic device identity management according to claim 1, characterized in that: The following steps are also included: When a node receives Mesh messages from other nodes three times in a row and all three Mesh messages fail verification, a warning message is sent to the server.

5. A Mesh network system based on dynamic device identity management, characterized in that: include: A coordinator, each of which is connected to a plurality of nodes and is used to broadcast a periodic key to the plurality of nodes at a regular interval; Multiple nodes, multiple nodes are connected to the terminal; The plurality of nodes are used to receive the periodic key sent by the coordinator; The plurality of nodes are further configured to burn fixed keys during production, and transmit fixed keys and periodic keys to terminals. The node receiving the information sends a Mesh message carrying a dynamic key to the surrounding nodes, and the surrounding nodes verify the dynamic key in the Mesh message. If the verification is successful, the Mesh message is forwarded and data is processed. If the verification fails, the Mesh message is eliminated. The terminal is used to receive the fixed key and the periodic key, and is also used to regularly generate a dynamic key according to the time Date, MAC address, fixed key and periodic key, and transmit the dynamic key to the node along with the information.

6. The Mesh network system based on dynamic device identity management according to claim 5, characterized in that: The node extracts the time Date and MAC address from the Mesh message, and extracts the fixed key and periodic key stored therein, performs MD5 encryption on the time Date, MAC address, fixed key and periodic key, and obtains the encryption result; when the encryption result is consistent with the dynamic key, the verification is passed; when the encryption result is inconsistent with the dynamic key, the verification fails.

7. The Mesh network system based on dynamic device identity management according to claim 5, characterized in that: If the node receives Mesh messages from other nodes three times in a row and all three Mesh messages fail to be verified, a warning message is sent to the server.

Images