PTP network encryption and key management method, device, equipment, medium and product

Abstract

The invention discloses a PTP network encryption and key management method and device, equipment, a medium and a product, and relates to the technical field of network security, and the method comprises the steps: obtaining a key pair distribution request, and generating and distributing an asymmetric public and private key pair to a target node based on the key pair distribution request; deploying the target node in the PTP network, and obtaining a data transmission encryption algorithm and a key request of the target node; the data transmission encryption algorithm and the key request comprise a node digital signature set based on an asymmetric public and private key pair; based on the PTP domain where the target node is located, correspondingly generating a data transmission encryption algorithm and a secret key, and distributing the algorithm and the secret key to the target node; wherein the basic nodes in different PTP domains are distributed with different data transmission encryption algorithms and keys, and the keys comprise a key for data communication and a key for PTP authentication. According to the invention, a comprehensive PTP security solution is provided for a high-security demand scene, and the PTP network security and reliability of the key infrastructure are improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a PTP network encryption and key management method, apparatus, device, medium and product. Background Technology

[0002] The Precision Time Protocol (PTP) is widely used in critical fields requiring high-precision time synchronization, such as financial transactions, power systems, and communication systems. It serves as a crucial technological foundation for ensuring the efficient operation of modern digital society and the security of critical national infrastructure. However, with the increasing threat of cybersecurity, the PTP protocol has long lacked native security mechanisms. Its message transmission is in plaintext, making sensitive infrastructure vulnerable to attacks and posing risks of tampering, replay attacks, and forgery. Although IEEE Std1588-2008 (PTPv2) proposed a security scheme in Annex K, this scheme is only an experimental mechanism, relying on symmetric key encryption (such as HMAC), and cannot achieve node authentication or prevent internal threats, thus limiting its practical application value. Until IEEE 1588-2019 (PTPv2.1), released in 2020, introduced the authentication TLV mechanism, which ensured the integrity and authenticity of PTP messages. However, security limitations still exist: the standard does not specify the key distribution process, relies on pre-shared keys and requires manual configuration, lacks automated key rotation and role authentication mechanisms, and does not provide data encryption schemes, making it difficult to meet the high security requirements of fields such as finance and military.

[0003] In practical applications, such as the "Design of an Encrypted Clock Synchronization System for Echo Simulators Based on PTPv2 Protocol," the paper proposes using the PTPv2 protocol combined with the SM4 algorithm to encrypt timestamps and achieve clock synchronization between echo simulators. However, this scheme lacks a complete key management mechanism, cannot perform key updates and automatic rotation, and cannot guarantee message integrity and authenticity. It also lacks node authentication capability. By only encrypting timestamp information, attackers can still launch attacks through the text content of PTP messages, resulting in low network security. Therefore, a PTP security scheme that combines encryption and key management capabilities is needed to improve the security and reliability of network communication. Summary of the Invention

[0004] The main purpose of this application is to provide a PTP network encryption and key management method, apparatus, device, storage medium and program product, which aims to solve the technical problem that the lack of a sound encryption and key management mechanism in related technologies leads to high security risks in network communication.

[0005] To achieve the above objectives, this application proposes a PTP network encryption and key management method, applied in a network management center, the method comprising: Obtain a key pair allocation request, generate and allocate an asymmetric public-private key pair to the target node based on the key pair allocation request; Deploy the target node in the PTP network and obtain the data transmission encryption algorithm and key request of the target node; the data transmission encryption algorithm and key request include the node digital signature set based on the asymmetric public-private key pair; Based on the PTP domain where the target node is located, a corresponding data transmission encryption algorithm and key are generated and distributed to the target node. Different data transmission encryption algorithms and keys are assigned to the base nodes in different PTP domains. The keys include a key for data communication and a key for PTP authentication.

[0006] In one embodiment, the asymmetric public-private key pair is an elliptic curve cryptography algorithm key pair. The step of generating and distributing the asymmetric public-private key pair to the target node based on a key pair distribution request includes: Randomly generate elliptic curve parameter sets and test their safety until a safe elliptic curve parameter set is obtained. Based on the elliptic curve parameter set, an asymmetric public-private key pair is generated and distributed to the target node.

[0007] In one embodiment, the data transmission encryption algorithm and key request further include the target node's identity identifier, the target node's PTP domain number, and request information; Based on the PTP domain of the target node, the steps for generating the data transmission encryption algorithm and distributing the key to the target node include: The legitimacy of the target node is determined based on the node's digital signature; If the target node is valid, traverse the algorithm key allocation table based on the target node's identity identifier and PTP domain number; If the algorithm key allocation table includes the target node's identity identifier or the target node's PTP domain number, then the data transmission encryption algorithm and key corresponding to the record in the algorithm key allocation table will be distributed. If the target node's identifier and PTP domain number are not included in the algorithm key allocation table, then a data transmission encryption algorithm and key are generated based on the random dynamic allocation algorithm and allocated to the target node. Update the algorithm key allocation table so that it contains the target node's identity identifier, the target node's PTP domain number, and the data transmission encryption algorithm and key of the target node.

[0008] In one embodiment, after the steps of generating the data transmission encryption algorithm and distributing the key to the target node based on the target node's PTP domain, the method further includes the following steps: Preset update cycle; When the update cycle arrives, the data transmission encryption algorithm and key for all basic nodes in the algorithm key allocation table are regenerated, and the algorithm key allocation table is updated accordingly. The data transmission encryption algorithm and key for basic nodes in different PTP domains are different. The key includes the key for data communication and the key for PTP authentication. Based on the updated algorithm key allocation table, corresponding data transmission encryption algorithm and key update messages are sent to each basic node of the algorithm key allocation table to enable each basic node to securely update the data transmission encryption algorithm and key; the data transmission encryption algorithm and key update message includes the updated data transmission encryption algorithm and key as well as the network management center digital signature set based on the asymmetric public-private key pair.

[0009] Update the algorithm key allocation table.

[0010] In one embodiment, after the steps of generating the data transmission encryption algorithm and distributing the key to the target node based on the target node's PTP domain, the method further includes the following steps: If a captured base node is detected, the PTP domain where the captured node is located and other base nodes deployed in the PTP domain are determined based on the algorithm key distribution table. The data transmission encryption algorithm and key corresponding to the PTP domain where the captured base node is located are regenerated, and the data transmission encryption algorithm and key update message is sent to other base nodes so that the other base nodes can securely update the data transmission encryption algorithm and key; the data transmission encryption algorithm and key update message includes the updated data transmission encryption algorithm and key and the network management center digital signature set based on the asymmetric public-private key pair; Update the algorithm key allocation table.

[0011] In one embodiment, base nodes in different PTP domains cannot communicate with each other, while base nodes in the same PTP domain can communicate with each other.

[0012] Secondly, to achieve the above objectives, this application further provides a PTP network encryption and key management device, applied in a network management center, the device comprising: The key pair allocation module is used to obtain key pair allocation requests, generate and allocate asymmetric public and private key pairs to the target node based on the key pair allocation requests; The request acquisition module is used to deploy the target node in the PTP network and obtain the data transmission encryption algorithm and key request of the target node; the data transmission encryption algorithm and key request include the node digital signature generated based on the asymmetric public-private key pair; The encryption algorithm and key distribution module is used to generate data transmission encryption algorithms and keys based on the target node's PTP domain and distribute them to the target node; wherein, different encryption algorithms or keys are assigned to nodes in different PTP domains, and the keys include data communication keys and PTP authentication keys.

[0013] Thirdly, to achieve the above objectives, this application further provides a PTP network encryption and key management device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the above-described PTP network encryption and key management method.

[0014] Fourthly, to achieve the above objectives, this application further provides a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the above-described PTP network encryption and key management method.

[0015] Fifthly, to achieve the above objectives, this application further provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the above-described PTP network encryption and key management method.

[0016] One or more technical solutions proposed in this application have at least the following technical effects: This application, through a key distribution mechanism based on asymmetric public-private key pairs (especially elliptic curve cryptography), not only achieves node authentication and data integrity protection but also provides end-to-end data encryption, overcoming the limitations of existing PTP standards that rely on pre-shared keys and lack automated key rotation and role authentication mechanisms. It dynamically allocates different data transmission encryption algorithms and keys according to the PTP domain, supporting automatic key rotation and secure updates without manual configuration, significantly improving the security and efficiency of key management. Simultaneously, through a regionalized key distribution strategy and a rapid response mechanism for captured nodes, it effectively prevents internal threats and node hijacking risks, providing a comprehensive PTP security solution for high-security scenarios and improving the security and reliability of PTP networks for critical infrastructure. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating an embodiment of the PTP network encryption and key management method of this application.

[0020] Figure 2 This is a schematic diagram showing the connection between the network management center and the basic nodes in this application.

[0021] Figure 3 A schematic diagram illustrating the data communication encryption algorithm and key distribution process.

[0022] Figure 4 A schematic diagram illustrating the process of updating communication encryption algorithms and key allocation.

[0023] Figure 5 This is a flowchart illustrating the processing method for captured nodes.

[0024] Figure 6 This is a schematic diagram of the PTP network encryption and key management device of this application.

[0025] Figure 7 This is a schematic diagram of the PTP network encryption and key management device of this application.

[0026] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0027] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0028] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0029] The main solution of this application embodiment is as follows: before the node is deployed to the PTP network, an elliptic curve-based asymmetric key pair is allocated to the node in the network management center; after the node is deployed to the PTP network, the network management center dynamically allocates data transmission encryption algorithms and keys (including communication keys and PTP authentication keys) according to the PTP domain and identity information of the node, and supports the legality and regional management based on digital signatures; through a key update mechanism that is periodically or triggered by events (such as when a node is captured), combined with the dynamic maintenance of the algorithm key allocation table, the automatic rotation and secure distribution of keys are realized.

[0030] Specifically, this application provides a PTP network encryption and key management method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the PTP network encryption and key management method of this application.

[0031] In this embodiment, the PTP network encryption and key management method includes steps S10 to S30: Step S10: Obtain a key pair allocation request, and based on the key pair allocation request, generate and allocate an asymmetric public-private key pair to the target node.

[0032] It should be noted that the target node is the node that will be deployed in the PTP network. Before deployment in the PTP network, the target node submits an application for the allocation of asymmetric public-private key pairs. After deployment in the PTP network, the target node submits an application for data transmission encryption algorithms and keys. The asymmetric public-private key pairs are public-private key pairs generated based on asymmetric encryption schemes.

[0033] Specifically, before being deployed to the network, the target node will apply to the network management center for an asymmetric public-private key pair. After the network management center approves the application, it will generate an asymmetric public-private key pair and distribute it to the target node so that the target node can store it securely on its local machine. The network management center will store its own asymmetric public-private key pair, as well as the asymmetric public keys of all the target nodes that have applied for the asymmetric public key pair.

[0034] In one feasible implementation, the asymmetric public-private key pair is an elliptic curve cryptography algorithm key pair, and step S10 includes steps A10~A20: Step A10: Randomly generate elliptic curve parameter sets and check their safety until a safe elliptic curve parameter set is obtained.

[0035] Step A20: Based on the elliptic curve parameter set, generate an asymmetric public-private key pair and distribute it to the target node.

[0036] Specifically, in this embodiment, the asymmetric public-private key pair can be an elliptic curve cryptography public-private key pair generated based on the elliptic curve cryptography (ECC) algorithm. The elliptic curve cryptography public-private key pair is generated at the network management center, including the elliptic curve cryptography public-private key pair used by the network management center itself. Before the target node is deployed to the network, the network management center assigns a pair of elliptic curve cryptography public-private key pairs to the target node.

[0037] For example, the specific generation and allocation process is as follows: randomly generate an elliptic curve and generate its parameters. Check the parameters of the randomly generated elliptic curve. Is it safe? If it is safe, determine the elliptic curve parameters; if it is not safe, regenerate the elliptic curve randomly.

[0038] Parameters for generating elliptic curves Determine if it meets the requirements; if not, regenerate the parameters. If it meets the requirements, then set the elliptic curve parameters... and elliptic curve parameters Combined into an elliptic curve parameter set.

[0039] Generate a public / private key pair based on this parameter set and assign it to the target node.

[0040] Understandably, the network management center stores its own public-private key pair, as well as the public key of the target node that is about to join the PTP network. Ordinary nodes store both their own public-private key pair and the network management center's public key.

[0041] Step S20: Deploy the target node on the PTP network and obtain the data transmission encryption algorithm and key request of the target node.

[0042] Step S30: Based on the PTP domain where the target node is located, generate the corresponding data transmission encryption algorithm and key and distribute them to the target node.

[0043] It should be noted that the data transmission encryption algorithm and key request include a node digital signature generated based on an asymmetric public-private key pair. This is to facilitate the network center's authentication of the node's legitimate identity. Different base nodes in different PTP domains are assigned different data transmission encryption algorithms and keys, including keys for data communication and keys for PTP authentication.

[0044] Additionally, it should be noted that the basic node refers to the node that has been deployed in the PTP domain. The data transmission encryption algorithm is a symmetric encryption algorithm, and the key includes the symmetric encryption key used during data communication (data communication key) and the symmetric encryption key used when calculating the integrity check value of PTP authentication TLV (PTP authentication key).

[0045] For example, ordinary nodes support both asymmetric encryption / decryption algorithms (EEC) and symmetric encryption / decryption algorithms (AES, DES, 3DES, and SM4). When performing data communication encryption and decryption, ordinary nodes can dynamically switch between AES, DES, 3DES, and SM4 algorithms according to the allocation from the network management center. Ordinary nodes store their own ECC public / private key pair, the network management center's ECC public key, the currently used data communication encryption algorithm and key, where the key includes the symmetric encryption scheme key used for data communication and the key used when calculating the integrity check value of PTP authentication TLV.

[0046] It should also be noted that the network management center allocates multiple PTP domains. Basic nodes in different PTP domains are assigned different data transmission encryption algorithms and keys, while basic nodes in the same PTP domain are assigned the same data transmission encryption algorithm and key. Basic nodes in different PTP domains cannot communicate with each other, while basic nodes in the same PTP domain can communicate with each other.

[0047] For example, refer to Figure 2 Ordinary nodes within the same PTP domain can communicate with encrypted data, while ordinary nodes in different PTP domains cannot. The network management center can communicate with all ordinary nodes with encrypted data. Figure 2 As shown, ordinary nodes belonging to PTP domain m cannot communicate encrypted data with ordinary nodes belonging to PTP domains n, i, and j, but ordinary nodes belonging to PTP domain m can communicate encrypted data with each other. It should also be noted that PTP domains emphasize logical isolation; a physical region can have multiple PTP domains, and a PTP domain can span multiple physical regions.

[0048] Specifically, secure data communication using symmetric encryption can be divided into two types: secure data communication between the network management center and ordinary nodes; and secure data communication between ordinary nodes within the same PTP domain. Secure data communication is not possible between ordinary nodes in different PTP domains. Secure data communication is possible between the network management center and ordinary nodes, where ordinary node GNi belongs to PTP domain j. : in: This represents the identity identifier of the network management center. This represents the identity identifier of a regular node i. This indicates a message used for secure data communication transmission. Indicates the time when the current message was sent. Data encryption is performed using the same data communication encryption algorithm and key used by all ordinary nodes within the PTP network domain number j range.

[0049] Secure data communication is performed between ordinary nodes, where ordinary nodes GNi and GNn both belong to the PTP domain j. : in: This represents the identity identifier of a regular node i. This represents the identifier of a regular node n. This refers to a message transmitted in data communication. Indicates the time when the current message was sent. Data encryption is performed using the same data communication encryption algorithm and key used by all ordinary nodes within the PTP network domain number j range.

[0050] PTP messages are transmitted via message M. PTP messages can use authentication TLV to ensure message integrity and authenticity. The sending end uses its own PTP authentication TLV key to calculate the integrity check value based on the sent message and sends it with the PTP message. The receiving end uses its own PTP authentication TLV key to calculate the integrity check value based on the received message and compares it with the integrity check value in the received PTP message. If they match, it means that the authentication is successful and the message is accepted; if they do not match, it means that the authentication is unsuccessful and the message is discarded.

[0051] In one feasible implementation, the data transmission encryption algorithm and key request also include the target node's identity identifier, the target node's PTP domain number, and request information.

[0052] Step S20 includes steps B10 to B50: Step B10: Determine the legitimacy of the target node based on the node's digital signature.

[0053] Step B20: If the target node is valid, traverse the algorithm key allocation table based on the target node's identity identifier and PTP domain number.

[0054] Step B30: If the algorithm key allocation table includes the target node's identity identifier or the target node's PTP domain number, then the data transmission encryption algorithm and key corresponding to the record in the algorithm key allocation table will be distributed.

[0055] Step B40: If the target node's identifier and PTP domain number are not included in the algorithm key allocation table, then a data transmission encryption algorithm and key are generated based on the random dynamic allocation algorithm and allocated to the target node.

[0056] Step B50: Update the algorithm key allocation table so that the algorithm key allocation table contains the target node's identity identifier, the target node's PTP domain number, and the data transmission encryption algorithm and key of the target node.

[0057] Specifically, the network management center and all ordinary nodes have unique identifiers. After an ordinary node joins the network, it will be initially configured or assigned a PTP network domain number according to the network plan. Both ordinary nodes and the network management center support ECC, AES, DES, 3DES, and SM4 encryption and decryption algorithms. The network management center will maintain an algorithm key allocation table to manage the data communication encryption algorithms and key allocation for ordinary nodes. The algorithm key allocation table records the identifiers, PTP domain numbers, and assigned data communication encryption algorithms and keys of all ordinary nodes that have been deployed in the PTP network and assigned data communication encryption algorithms and keys. The keys include the symmetric encryption key used for data communication and the key used for calculating the integrity check value of PTP authentication TLV.

[0058] The network management center will assign the same data communication encryption algorithm and key to ordinary nodes with the same PTP domain number. The key includes the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of PTP authentication TLV.

[0059] When a regular node requests a data communication encryption algorithm and key (e.g., the target node), the network management center first checks the algorithm key allocation table. If the target node's identifier is already found in the algorithm key allocation table, the network management center directly distributes the corresponding data communication encryption algorithm and key from the algorithm key allocation table. If the target node's identifier is not found, but another regular node with the same PTP domain number as the target node is found, the target node is assigned the same data communication encryption algorithm and key, and the target node is updated in the algorithm key allocation table. If the algorithm key allocation table does not contain an identifier for the algorithm key or its PTP domain number, the network management center generates a data transmission encryption algorithm and key based on a random dynamic allocation algorithm, allocates it to the target node, and updates the target node in the algorithm key allocation table.

[0060] Furthermore, step B40 includes steps B41 to B42: Step B41: If the target node's identity identifier and PTP domain number are not included in the algorithm key allocation table, then generate three random numbers. The first random number is a positive integer whose value does not exceed the number of communication cryptographic algorithms that can be allocated in the network management center. The second random number is determined based on the size of the key pool corresponding to the selected communication cryptographic algorithm. The third random number is determined based on the size of the authentication key pool.

[0061] Step B42: Based on three random numbers, determine the cryptographic algorithm and key for the target node and distribute them to the target node.

[0062] Specifically, in this implementation, the network management center supports a random dynamic allocation algorithm for data communication encryption algorithms and keys. When there is a need for random dynamic allocation, three random numbers are generated. The first random number represents the selected encryption algorithm, and the random number is an integer in the range [1, 4], indicating a random selection from AES, DES, 3DES, and SM4 algorithms. The second random number represents the key number of the corresponding data communication encryption algorithm key pool, and the random number is an integer in the range [1, n], where n is the size of the corresponding encryption algorithm key pool. The key in the key pool can be found based on the key number. The third random number represents the key number of the PTP authentication TLV key pool, and the random number is an integer in the range [1, m], where m is the size of the authentication TLV key pool. The key in the key pool can be found based on the key number. Based on these three random numbers, the data communication encryption algorithm and key are determined and sent to the target node. The key includes the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of PTP authentication TLV, and the information is updated in the algorithm key allocation table.

[0063] For example, refer to Figure 3 During the network initialization phase or when a target node has just joined the PTP network, the target node requests the network management center to allocate its data communication encryption algorithm and key. The key includes the symmetric encryption key used for data communication and the key used for calculating the integrity check value of the PTP authentication TLV. The target node belongs to the PTP network domain number. The process can be divided into the following steps: The target node sends a request for data communication encryption algorithm and key distribution to the network management center: in: This refers to a regular node requesting data communication encryption algorithms and key distribution. Identity identifier. Represents a regular node To the network management center A request message requesting a data communication encryption algorithm and key allocation. This indicates the ordinary node that initiated the allocation request. The PTP network domain number it belongs to is j. Represents a regular node The request message is digitally signed using its private key based on elliptic curve cryptography (ECC). The time when the current message was sent.

[0064] Network Management Center according to Find ordinary nodes public key Determine digital signature The network management center will check the legitimacy of the node. If the node is legitimate, it means that the ordinary node is a legitimate node in the network, and the following operations will continue. If the node is illegitimate, it means that the ordinary node is an external attacker, and the network management center will mark the node as a malicious node in the network and discard the received data packets.

[0065] Network Management Center After determining the request is valid, the identity identifier of the received ordinary node is used as the basis for further action. and its PTP domain number The network management center queries the data communication encryption algorithm and key allocation table maintained by the network. This table records the identity identifier, PTP domain number, and allocated data communication encryption algorithm and key for all ordinary nodes that have completed their allocation. The key includes the symmetric encryption key used for data communication and the key used for calculating the integrity check value of the PTP authentication TLV. The network management center will allocate the same data communication encryption algorithm and key to ordinary nodes belonging to the same PTP domain number. If the network management center finds that the identity identifier of the ordinary node is already in the allocation table, it will... The data communication encryption algorithm and key are directly distributed to the corresponding record in the allocation table. If the identity identifier of the ordinary node is not found in the allocation table, but another ordinary node with the same PTP domain number is found, the same data communication encryption algorithm and key are assigned to the ordinary node, the allocation table is updated, and the data communication encryption algorithm and key are distributed. If the identity identifier or PTP domain number of the ordinary node is not found in the allocation table, the network management center generates a data communication encryption algorithm and key according to a random dynamic allocation algorithm, updates the allocation table, and distributes the data communication encryption algorithm and key. Configuration distribution: in: This represents the data communication encryption key used by all ordinary nodes within the PTP network domain number j. This indicates the data communication encryption algorithm used by all ordinary nodes within the PTP network domain number j. This represents the PTP authentication TLV key used by all ordinary nodes within the PTP network domain number j. This indicates that the Network Management Center (NMC) uses its private key. Perform digital signatures on messages based on elliptic curve cryptography. Indicates the time when the current message was sent. This indicates that the Network Management Center (NMC) uses ordinary nodes. Public Key Encrypt the message using an elliptic curve cryptography scheme.

[0066] ordinary node Use your own private key After successfully decrypting the message, first use the public key of the Network Management Center (NMC). Determine digital signature The validity of the data packet is determined by whether it was sent by the Network Management Center (NMC) or a regular node. Nodes certified as legitimate by the Network Management Center (NMC) and ordinary nodes Data communication encryption algorithm allocated by the storage network management center Key and key This is used for encryption / decryption and PTP TLV authentication in subsequent data communication; if it is invalid, it means the data packet was forged by a malicious node, and a normal node... The received data packets will be discarded.

[0067] Understandably, this embodiment uses a hybrid approach of asymmetric and symmetric encryption. Asymmetric encryption is used during the symmetric encryption algorithm and key application process for data communication to improve security and authentication. Symmetric encryption is used during data transmission to reduce computational complexity and energy consumption, ensuring network security. Based on the symmetric encryption algorithm and key distribution mechanism for ordinary node data transmission within the PTP domain, the same symmetric encryption algorithm and key are assigned to network nodes within the same PTP domain. The key includes the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of the PTP authentication TLV, reducing computational and key management complexity. Different data communication encryption algorithms or keys are assigned to network nodes in different PTP domains, preventing communication between nodes in different PTP domains due to incorrect data decryption. This isolates the security of network nodes in different PTP domains. If the network encryption communication of one PTP domain is compromised, it does not affect the network communication security of other PTP domains, thus improving the overall network security. The mechanism dynamically and randomly allocates and manages symmetric encryption algorithms and keys for data transmission. Based on the PTP domain, the allocation algorithm dynamically and randomly selects, generates, and distributes symmetric encryption algorithms and keys for data communication. The keys include the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of PTP authentication TLV, thereby improving network security.

[0068] Furthermore, in this embodiment, step C10~C30 are included after step S30: Step C10: Preset update cycle.

[0069] Step C20: When the update cycle arrives, regenerate the data transmission encryption algorithms and keys for all basic nodes in the algorithm key allocation table, and update the algorithm key allocation table accordingly. Note that the data transmission encryption algorithms and keys for basic nodes in different PTP domains are different; the keys include keys for data communication and keys for PTP authentication.

[0070] Step C30: Based on the updated algorithm key allocation table, send data transmission encryption algorithm and key update messages to each basic node of the algorithm key allocation table, so that each basic node can securely update the data transmission encryption algorithm and key; the data transmission encryption algorithm and key update message includes the updated data transmission encryption algorithm and key, as well as the network management center digital signature set based on the asymmetric public-private key pair.

[0071] Specifically, the network management center can periodically update the symmetric encryption algorithm and key for data transmission to improve network security.

[0072] For example, refer to Figure 4 To improve network communication security, the Network Management Center (NMC) periodically updates the data communication encryption algorithms and keys for all legitimate ordinary nodes in the network at fixed intervals. The keys include the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of the PTP authentication TLV. The steps are as follows: The Network Management Center (NMC) maintains a timer. At fixed intervals, the NMC sends data communication encryption algorithm and key update messages to all legitimate ordinary nodes. Belongs to the PTP domain The network management center generates updated data communication encryption algorithms and keys according to the PTP domain-based random dynamic allocation algorithm. The keys include the symmetric encryption key used for data communication and the key used for calculating the integrity check value of the PTP authentication TLV. All ordinary nodes with the same PTP network domain number are assigned the same data communication encryption algorithm and key, and the allocation table is updated accordingly. This update message is then sent out. in: This represents the identity identifier of a regular node i. This represents the new encryption key used for data communication by all ordinary nodes within the PTP network domain number j. This indicates a new encryption algorithm for data communication used by all ordinary nodes within the PTP network domain number j. This represents the new authentication TLV key used by all ordinary nodes within the PTP network domain number j. This indicates that the Network Management Center (NMC) uses its private key. Perform digital signatures on messages based on elliptic curve cryptography. Indicates the time when the current message was sent.

[0073] This indicates that the Network Management Center (NMC) uses ordinary nodes. Public Key Encrypt the message using an elliptic curve cryptography scheme.

[0074] ordinary node After receiving the data communication encryption algorithm and key update information, use its private key. To decrypt the message, first verify the network administrator's digital signature. Authentication is performed. If authentication is successful and the data is confirmed to have been sent by the network management center, the new data communication encryption algorithm is stored. Key and key It is used for subsequent data communication encryption and decryption and PTP TLV authentication; if authentication fails, the data packet is discarded, and the encryption algorithm and key used for data communication remain unchanged.

[0075] Furthermore, in this embodiment, step D10~C30 are included after step S30: Step D10: If a captured basic node is detected, then based on the algorithm key allocation table, determine the PTP domain where the captured node is located and other basic nodes deployed in the PTP domain.

[0076] Step D20: Regenerate the data transmission encryption algorithm and key corresponding to the PTP domain where the captured base node resides, and send the data transmission encryption algorithm and key update message to other base nodes deployed in the PTP domain where the captured base node resides, so that the other base nodes can securely update their data transmission encryption algorithms and keys. The data transmission encryption algorithm and key update message includes the updated data transmission encryption algorithm and key, as well as a network management center digital signature set up based on an asymmetric public-private key pair.

[0077] Step D30: Update the algorithm key allocation table.

[0078] Specifically, when a network node is captured, the network management center can update the symmetric encryption algorithm and key for data transmission in real time based on the PTP network domain number. The key includes the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of PTP authentication TLV, ensuring network security. At the same time, the update scope is controlled within the PTP domain to which the network node belongs, reducing network traffic.

[0079] For example, refer to Figure 5 When the network management center detects that a regular node has been captured, in order to ensure network communication security, the network management center will initiate data communication encryption algorithm and key updates for all non-captured regular nodes belonging to the same PTP network domain number, based on the PTP network domain number of the captured regular node. The keys include the symmetric encryption key used for data communication and the key used for calculating the integrity verification value of PTP authentication TLV. The specific process is as follows: When the Network Management Center (NMC) detects that a regular node has been captured, it queries the data communication encryption algorithm and key distribution table of the regular node. The regular node belongs to the PTP domain. It belongs to the PTP domain. Other uncaptured ordinary nodes are represented as The system sends data communication encryption algorithm and key update messages to all uncaptured ordinary nodes belonging to the same PTP network domain number. The keys include the symmetric encryption key used for data communication and the key used for calculating the integrity check value of the PTP authentication TLV. The updated data communication encryption algorithm and key are generated according to a random dynamic allocation algorithm, updated in the allocation table, and the update message is then sent out. in: This represents the identity identifier of an ordinary node i that has not been captured. This represents the new encryption key used for data communication by all uncaptured ordinary nodes within the PTP network domain number j. This indicates a new encryption algorithm for data communication used by all uncaptured ordinary nodes within the PTP network domain number j. This represents the new authentication TLV key used by all uncaptured ordinary nodes within the PTP network domain number j range. This indicates that the Network Management Center (NMC) uses its private key. Perform digital signatures on messages based on elliptic curve cryptography. Indicates the time when the current message was sent. This indicates that the Network Management Center (NMC) uses ordinary nodes. Public Key Encrypt the message using an elliptic curve cryptography scheme.

[0080] Uncaptured ordinary nodes After receiving the data communication encryption algorithm and key update information, use its private key. To decrypt the message, first check the digital signature of the network management center. Authentication is performed. If authentication is successful, it is confirmed that the data was sent by the network management center, and the new data communication encryption algorithm is stored. Key and key It is used for subsequent data communication encryption and decryption and PTP TLV authentication; if authentication fails, the data packet is discarded, and the data communication encryption algorithm and key remain unchanged.

[0081] In summary, this embodiment effectively solves the problems of the PTP protocol's lack of native security mechanisms, vulnerability to tampering, replay, and forgery attacks by allocating elliptic curve-based asymmetric public-private key pairs to target nodes before deployment and dynamically allocating symmetric encryption algorithms and keys (including communication keys and PTP authentication keys) based on PTP domain numbers and identities after deployment. It also overcomes the limitations of the PTPv2 Annex K experimental scheme, which relies on symmetric key encryption and cannot achieve node authentication and internal threat prevention, as well as the shortcomings of the PTPv2.1 authentication TLV mechanism, such as its lack of standardized key distribution, automated rotation, and data encryption. Compared to existing schemes such as those combining SM4 algorithm to encrypt timestamps, this method introduces a complete key management mechanism, supporting periodic or event-triggered (e.g., node capture) automated rotation and secure distribution, ensuring message integrity, authenticity, and node authentication. Furthermore, it achieves regionalized management through PTP domain isolation, preventing illegal communication between different domains. This significantly improves the security and reliability of PTP networks in critical fields such as finance, power, and communications, while reducing computational complexity and network communication overhead.

[0082] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the PTP network encryption and key management method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0083] This application also provides a PTP network encryption and key management device, please refer to... Figure 6 The PTP network encryption and key management device includes: The key pair allocation module 10 is used to obtain key pair allocation requests, generate and allocate asymmetric public and private key pairs to the target node based on the key pair allocation requests; The request acquisition module 20 is used to deploy the target node in the PTP network and obtain the data transmission encryption algorithm and key request of the target node; the data transmission encryption algorithm and key request include the node digital signature set based on the asymmetric public-private key pair; The encryption algorithm and key distribution module 30 is used to generate data transmission encryption algorithms and keys based on the PTP domain of the target node and distribute them to the target node; wherein, different encryption algorithms or keys are assigned to nodes in different PTP domains, and the keys include data communication keys and PTP authentication keys.

[0084] The PTP network encryption and key management device provided in this application, employing the PTP network encryption and key management method described in the above embodiments, can solve the technical problem of related technologies lacking a sound encryption and key management mechanism, resulting in high security risks in network communication. Compared with related technologies, the beneficial effects of the PTP network encryption and key management device provided in this application are the same as those of the PTP network encryption and key management method provided in the above embodiments, and other technical features in the PTP network encryption and key management device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0085] This application provides a PTP network encryption and key management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the PTP network encryption and key management method in the above embodiments.

[0086] The following is for reference. Figure 7 This document illustrates a structural diagram of a PTP network encryption and key management device suitable for implementing embodiments of this application. The PTP network encryption and key management device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The PTP network encryption and key management device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0087] like Figure 7As shown, the PTP network encryption and key management device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the PTP network encryption and key management device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the PTP network encryption and key management device to communicate wirelessly or wiredly with other devices to exchange data. Although PTP network encryption and key management devices with various systems are shown in the figure, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0088] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0089] The PTP network encryption and key management device provided in this application, employing the PTP network encryption and key management method described in the above embodiments, can solve the technical problem of related technologies lacking a sound encryption and key management mechanism, resulting in high security risks in network communication. Compared with related technologies, the beneficial effects of the PTP network encryption and key management device provided in this application are the same as those of the PTP network encryption and key management method provided in the above embodiments, and other technical features in this PTP network encryption and key management device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0090] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0091] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0092] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the PTP network encryption and key management methods in the above embodiments.

[0093] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0094] The aforementioned computer-readable storage medium may be included in a PTP network encryption and key management device; or it may exist independently and not be assembled into a PTP network encryption and key management device.

[0095] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the PTP network encryption and key management device, the PTP network encryption and key management device: obtains a key pair allocation request; generates and allocates an asymmetric public-private key pair to the target node based on the encryption algorithm and key allocation module key pair allocation request; deploys the encryption algorithm and key allocation module target node in the PTP network; obtains the data transmission encryption algorithm and key request of the encryption algorithm and key allocation module target node; the data transmission encryption algorithm and key request of the encryption algorithm and key allocation module includes a node digital signature set based on the asymmetric public-private key pair of the encryption algorithm and key allocation module; generates a data transmission encryption algorithm and key based on the PTP domain of the encryption algorithm and key allocation module target node and allocates it to the encryption algorithm and key allocation module target node; wherein, different data transmission encryption algorithms and keys are allocated to the basic nodes in different PTP domains, and the encryption algorithm and key allocation module keys include data communication keys and PTP authentication keys.

[0096] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0097] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0098] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0099] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described PTP network encryption and key management method. This addresses the technical problem of related technologies lacking a robust encryption and key management mechanism, leading to high security risks in network communication. Compared to related technologies, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the PTP network encryption and key management method provided in the above embodiments, and will not be elaborated upon here.

[0100] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the PTP network encryption and key management method as described above.

[0101] The computer program product provided in this application can solve the technical problem that the lack of a sound encryption and key management mechanism in related technologies leads to high security risks in network communication. Compared with related technologies, the beneficial effects of the computer program product provided in this application are the same as those of the PTP network encryption and key management method provided in the above embodiments, and will not be repeated here.

[0102] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A PTP network encryption and key management method, characterized in that, Applied to network management centers, the method includes: Obtain a key pair allocation request, and based on the key pair allocation request, generate and allocate an asymmetric public-private key pair to the target node; The target node is deployed in the PTP network, and the data transmission encryption algorithm and key request of the target node are obtained; the data transmission encryption algorithm and key request include a node digital signature generated based on the asymmetric public-private key pair; Based on the PTP domain in which the target node is located, a corresponding data transmission encryption algorithm and key are generated and distributed to the target node; wherein, different data transmission encryption algorithms and keys are assigned to the base nodes in different PTP domains, and the keys include data communication keys and PTP authentication keys.

2. The PTP network encryption and key management method as described in claim 1, characterized in that, The asymmetric public-private key pair is an elliptic curve cryptography algorithm key pair; The step of generating and allocating an asymmetric public-private key pair to the target node based on the key pair allocation request includes: Randomly generate elliptic curve parameter sets and test their safety until a safe elliptic curve parameter set is obtained. Based on the elliptic curve parameter set, the asymmetric public-private key pair is generated and distributed to the target node.

3. The PTP network encryption and key management method as described in claim 1, characterized in that, The data transmission encryption algorithm and key request also include the target node's identity identifier, the target node's PTP domain number, and request information; The step of generating a data transmission encryption algorithm and distributing a key to the target node based on the PTP domain where the target node is located includes: The legitimacy of the target node is determined based on the node's digital signature; If the target node is legitimate, the algorithm key allocation table is traversed based on the target node's identity identifier and the target node's PTP domain number; If the algorithm key allocation table includes the identity identifier of the target node or the PTP domain number of the target node, then the data transmission encryption algorithm and key corresponding to the record in the algorithm key allocation table will be distributed. If the algorithm key allocation table does not include the identity identifier and PTP domain number of the target node, then a data transmission encryption algorithm and key are generated based on the random dynamic allocation algorithm and allocated to the target node; The algorithm key allocation table is updated to include the target node's identity identifier, the target node's PTP domain number, and the target node's data transmission encryption algorithm and key.

4. The PTP network encryption and key management method as described in claim 3, characterized in that, After the step of generating a data transmission encryption algorithm and distributing a key to the target node based on the PTP domain where the target node is located, the method further includes the following step: Preset update cycle; When the update cycle arrives, the data transmission encryption algorithms and keys of all basic nodes in the algorithm key allocation table are regenerated, and the algorithm key allocation table is updated accordingly. The data transmission encryption algorithms and keys of basic nodes in different PTP domains are different, and the keys include data communication keys and PTP authentication keys. Based on the updated algorithm key allocation table, corresponding data transmission encryption algorithm and key update messages are sent to each basic node of the algorithm key allocation table, so that each basic node can securely update the data transmission encryption algorithm and key; the data transmission encryption algorithm and key update message includes the updated data transmission encryption algorithm and key and the network management center digital signature set based on the asymmetric public-private key pair.

5. The PTP network encryption and key management method as described in claim 3, characterized in that, After the step of generating a data transmission encryption algorithm and distributing a key to the target node based on the PTP domain of the target node, the method further includes the following step: If a captured base node is detected, the PTP domain where the captured node is located and other base nodes deployed in the PTP domain where the captured base node is located are determined based on the algorithm key allocation table. The data transmission encryption algorithm and key corresponding to the PTP domain where the captured base node is located are regenerated, and the data transmission encryption algorithm and key update message is sent to other base nodes deployed in the PTP domain where the captured base node is located, so that the other base nodes can securely update the data transmission encryption algorithm and key; the data transmission encryption algorithm and key update message includes the updated data transmission encryption algorithm and key and the network management center digital signature set based on the asymmetric public-private key pair; Update the key allocation table for the algorithm.

6. The method according to any one of claims 1-5, characterized in that, Basic nodes in different PTP domains cannot communicate with each other, while basic nodes in the same PTP domain can communicate with each other.

7. A PTP network encryption and key management device, characterized in that, The device, used in a network management center, includes: The key pair allocation module is used to obtain key pair allocation requests, generate and allocate asymmetric public-private key pairs to the target node based on the key pair allocation requests; The request acquisition module is used to deploy the target node in the PTP network and acquire the data transmission encryption algorithm and key request of the target node; the data transmission encryption algorithm and key request includes a node digital signature generated based on the asymmetric public-private key pair; An encryption algorithm and key distribution module is used to generate a data transmission encryption algorithm and key based on the PTP domain of the target node and distribute them to the target node; wherein, nodes in different PTP domains are assigned different encryption algorithms or keys, and the keys include data communication keys and PTP authentication keys.

8. A PTP network encryption and key management device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network encryption and key management method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the PTP network encryption and key management method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the PTP network encryption and key management method as described in any one of claims 1 to 6.

Images