Data communication method and device based on communication chip and storage medium

Abstract

The invention discloses a data communication method and device based on a communication chip, and a storage medium. The method comprises the following steps: each terminal device initiates a first access request to an accessed aggregation security gateway; after receiving the request, the aggregation security gateway establishes an association table according to the identity information in the request; the key center distributes symmetrical key files to each terminal device and the accessed aggregation security gateway; a terminal device to send data generates service data, encrypts the service data by using a secret key in a communication chip and constructs first transmission data, and then sends the first transmission data to an aggregation security gateway. According to the invention, the aggregation security gateway is introduced as a core hub of key management, and the original end-to-end keys which need to be distributed pairwise among all terminals are converted into a key file which only needs to be stored by each terminal and communicates with the aggregation security gateway; lightweight, low-cost and safe deployment of large-scale Internet of Things terminals and mobile devices becomes possible.

Description

Technical Field

[0001] This invention relates to the field of data communication technology, and specifically to a data communication method, device and storage medium based on a communication chip. Background Technology

[0002] With the rapid development of wireless communication technology, communication chips based on independent public IP addresses (such as 4G communication chips) are increasingly widely used in fields such as the Internet of Things (IoT), remote monitoring, and smart terminals. These chips typically support flexible networking methods, such as direct connection mode. In direct connection mode, terminals can directly establish end-to-end communication connections without relying on a central server for data relay, offering advantages such as low latency and simple paths. However, this mode faces significant technical challenges in real-world large-scale networking scenarios.

[0003] As the scale of communication chip-based networks expands and the number of terminals requiring communication increases dramatically, the topology of direct communication becomes extremely complex. Each terminal needs to establish and maintain independent communication links with numerous other terminals within the network, leading to a significant increase in network management overhead and a decrease in communication efficiency. More critically, under existing secure communication mechanisms, symmetric key encryption is typically used between terminals to ensure the confidentiality and integrity of data transmission. This means that each terminal needs to pre-configure or dynamically maintain an independent symmetric key pool for each peer terminal it communicates with. As the number of terminals in the network increases, the number of keys that need to be stored increases exponentially. Due to limitations in cost, power consumption, and size, the built-in storage capacity of communication chips is often relatively limited. When the number of peer terminals reaches a certain threshold, the total data volume of the key pool can easily exceed the chip's storage capacity limit, causing storage overflow. This not only prevents the storage of new keys but may also affect the normal operation of the chip's original programs, or even cause the entire communication function to fail, thus compromising network stability.

[0004] Therefore, under the current technological background, there is an urgent need for a data communication method based on communication chips that can effectively support large-scale networking based on communication chips, while maintaining communication efficiency and security, overcoming the key management bottleneck caused by the limited storage capacity of terminals, and ensuring the scalability and reliability of the network. Summary of the Invention

[0005] Objective: This invention aims to provide a data communication method, device, and storage medium based on a communication chip. It addresses the problem in existing secure communication mechanisms where, when the number of peer terminals reaches a certain threshold, the total data volume of the key pool easily exceeds the chip's storage capacity, causing storage overflow. This invention transfers the chip's storage capacity to an aggregated security gateway, requiring only one key file per terminal, thus resolving the issue of insufficient chip storage. Simultaneously, it performs checksum calculations and verifications on the data header and service data, protecting the reliability and security of data communication.

[0006] Technical solution: This invention provides a data communication method based on a communication chip, the method comprising the following steps:

[0007] (1) Each terminal device initiates an initial access request to the access aggregation security gateway; after receiving the request from each terminal device, the aggregation security gateway establishes an association table based on the identity information in the request;

[0008] (2) The key center distributes symmetric key files to each terminal device and the access aggregation security gateway;

[0009] (3) The terminal device to be sent generates service data and uses the key in the symmetric key file between the terminal and the aggregated security gateway in the communication chip to encrypt the service data and construct the first transmission data; then the first transmission data is sent to the aggregated security gateway.

[0010] (4) After receiving the first transmission data, the aggregated security gateway decrypts and verifies it. If the verification fails, it is discarded directly. If the verification passes, the decrypted data is encrypted using the key in the symmetric key file of the receiving terminal device and the second transmission data is constructed. Then the second transmission data is sent to the receiving terminal device.

[0011] (5) After receiving the second transmission data, the receiving terminal device forwards it to its local communication chip. The communication chip decrypts and verifies the second transmission data. After the verification is successful, it performs business data processing.

[0012] Furthermore, the initial access request includes the terminal device's identity identifier (Did), network access identifier (Rid), internal network IP address, and external network IP address.

[0013] Furthermore, the association table records the one-to-one correspondence between the identity identifier Did, the network access identifier Rid, the internal network IP, and the external network IP.

[0014] Furthermore, each terminal device and the aggregated security gateway are pre-configured with the same verification and comparison method, which is to calculate the checksum using a hash algorithm;

[0015] The hash algorithm is a hash function based on a linear feedback shift register obtained by selecting an irreducible polynomial and inputting random numbers, or a traditional hash algorithm, including one of MD4, MD5, SHA2, SHA3, RIPEMD, and MASH-1 algorithms.

[0016] Furthermore, encrypting the business data and constructing the first transmission data refers to:

[0017] 1) The terminal device to be sent selects the first encryption key k1 from the key file in the communication chip, and records the key index idx-k1 of the first encryption key k1 in the key file. The first encryption key k1 is used to encrypt the service data mes to obtain the service ciphertext MES.

[0018] 2) Generate the first data header corresponding to the business ciphertext MES. The first data header includes the receiver's external IP address and key index idx-k1. Then, calculate the checksum of the receiver's external IP address, key index idx-k1, and business data mes to obtain the first checksum.

[0019] 3) The terminal device to be sent finally combines the first data header, the first checksum and the service ciphertext MES to obtain the first transmitted data.

[0020] Furthermore, the process of decrypting and verifying the first transmitted data after receiving it means that:

[0021] A1: After receiving the first transmitted data, the aggregated security gateway obtains the first decryption key k1' from the key file corresponding to the terminal device to be sent, based on the key index idx-k1 in the first data header of the first transmitted data. The first decryption key k1' is then used to decrypt the service ciphertext MES in the first transmitted data to obtain the service data mes'.

[0022] A2: The aggregated security gateway calculates the checksum of the receiver's external IP address, key index idx-k1, and service data mes' in the first data header of the first transmitted data to obtain a second checksum; it compares the calculated second checksum with the first checksum in the first transmitted data to see if they are consistent. If they are consistent, the checksum passes; if they are inconsistent, the checksum fails.

[0023] Furthermore, the step of encrypting the decrypted data using the key in the symmetric key file of the receiving terminal device and constructing the second transmission data refers to:

[0024] B1: The aggregated security gateway selects the second encryption key k2 from the key file symmetrical to the receiving terminal device, records the key index idx-k2 of the second encryption key k2 in the key file, and uses the second encryption key k2 to encrypt the business data mes' to obtain the business ciphertext MES';

[0025] B2: The aggregated security gateway generates a second data header corresponding to the business ciphertext MES'. The second data header includes the recipient's external IP address and key index idx-k2. Then, a checksum is calculated on the recipient's external IP address, key index idx-k2, and business data mes' to obtain a third checksum.

[0026] B3: The aggregation security gateway finally combines the second data header, the third checksum, and the business ciphertext MES' to obtain the second transmission data.

[0027] Furthermore, the decryption and verification of the second transmitted data refers to:

[0028] C1: The receiving terminal device obtains the second decryption key k2' from its local key file according to the key index idx-k2 in the second data header of the second transmitted data in its communication chip, and uses the second decryption key k2' to decrypt the service ciphertext MES' in the second transmitted data to obtain the service data mes'';

[0029] C2: The receiving terminal device calculates the checksum of the receiver's external IP address, key index idx-k2, and service data mes'' in the second data header of the second transmitted data to obtain the fourth checksum; it compares the calculated fourth checksum with the third checksum in the second transmitted data to see if they are consistent. If they are consistent, the checksum passes; if they are inconsistent, the checksum fails.

[0030] The present invention also includes a computer device comprising at least a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement a data communication method based on a communication chip as described in any of the preceding claims.

[0031] The present invention also includes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data communication method based on a communication chip as described in any of the preceding claims.

[0032] The beneficial effects of this invention are as follows: By introducing an aggregated security gateway as the core hub for key management, this invention transforms the end-to-end key distribution that originally required pairwise distribution among all terminals into a system where each terminal only needs to store a single key file that communicates with the aggregated security gateway. The total number of key files is reduced from quadratic to linear, equivalent to the number of terminals. This fundamentally avoids the enormous challenge to storage capacity posed by storing massive amounts of keys on terminal chips, making lightweight, low-cost, and secure deployment of large-scale IoT terminals and mobile devices possible. Simultaneously, the calculation and verification of checksums for data headers and business data effectively protects the security and integrity of data headers and business data, preventing them from being tampered with and protecting the reliability and security of data communication. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the data communication system based on the communication chip of the present invention;

[0034] Figure 2 This is a schematic diagram of the data communication method based on a communication chip according to the present invention. Detailed Implementation

[0035] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0036] As described in the background section, the scale of existing communication chip-based networks is constantly expanding. Each terminal device needs to establish and maintain independent communication links with numerous other terminal devices within the network, leading to a significant increase in network management overhead and a decrease in communication efficiency. More importantly, under existing secure communication mechanisms, symmetric key encryption is typically used between terminal devices to ensure the confidentiality and integrity of data transmission. When the number of peer terminal devices reaches a certain threshold, the total data volume of the key pool can easily exceed the chip's storage capacity limit, causing storage overflow. This not only prevents the storage of new keys but may also affect the normal operation of the chip's original programs, even causing the entire communication function to fail and compromising network stability. Therefore, under the current technological background, there is an urgent need for a data communication method based on communication chips that can effectively support large-scale communication chip-based networks, overcome the key management bottleneck caused by the limited storage capacity of terminal devices while maintaining communication efficiency and security, and ensure network scalability and reliability.

[0037] In view of this, the present invention proposes a data communication method based on a communication chip, wherein the participants in the method include various terminal devices, routers, key centers, and aggregated security gateways, such as... Figure 1As shown, each terminal device is connected to the aggregated security gateway via a router. In this network structure, the terminal devices cannot discover each other on the Internet and therefore cannot directly establish a connection for communication. The aggregated security gateway manages all terminal devices. Based on the identity identifier (Did) or the network access identifier (Rid), the aggregated gateway can obtain the external IP address of the peer, decrypt the data, encrypt it using the peer's key, and send it to the peer.

[0038] Therefore, data communication methods based on communication chips, such as Figure 2 As shown, it includes the following steps:

[0039] (1) Each terminal device initiates an initial access request to the access aggregation security gateway; after receiving the request from each terminal device, the aggregation security gateway establishes an association table based on the identity information in the request; the initial access request includes the terminal device's identity identifier Did, network access identifier Rid, internal network IP and external network IP, and may also include the terminal device's identity information such as the mask; the external network IP is the public network IP of the router, and the internal network IP is assigned to the multiple access terminal devices in order to distinguish the multiple access terminal devices since multiple terminal devices are accessed to the same router at the same time.

[0040] Based on this, the aggregated security gateway, as a network element device that manages all terminal devices, will learn the identity information such as internal and external network IPs of each terminal device in this step, and associate the correspondence between these identity information. Based on this correspondence, an association table is established. That is to say, the association table records the one-to-one correspondence between the identity identifier Did, the network access identifier Rid, the internal network IP and the external network IP of each terminal device.

[0041] (2) The key center distributes symmetrical key files to each terminal device and the access aggregation security gateway. Since each terminal device forwards data through the aggregation security gateway, each terminal device only needs to be configured with a key file symmetrical to the aggregation security gateway. The aggregation security gateway is the network element with the most key files, and the number of key files is comparable to the number of terminal devices accessing the aggregation security gateway. Each terminal device only needs to be configured with one key file, which solves the problem mentioned in the background technology that the key volume is too large and the chip storage capacity is insufficient to support it in the direct end-to-end communication scenario.

[0042] Meanwhile, all terminal devices and aggregated security gateways are pre-set with the same verification and comparison method, which is to calculate the checksum using a hash algorithm. The hash algorithm is a hash function based on a linear feedback shift register obtained by selecting an irreducible polynomial and inputting random numbers, or a traditional hash algorithm, including one of the following algorithms: MD4, MD5, SHA2, SHA3, RIPEMD, and MASH-1.

[0043] (3) The terminal device to be sent generates service data and uses the key in the symmetric key file of the terminal and the aggregated security gateway in the communication chip to encrypt the service data and construct the first transmission data; then the first transmission data is sent to the aggregated security gateway; at this time, the service data generated by the terminal device is quantum encrypted and the transmission data is constructed in the communication chip (using the key shared by the terminal and the aggregated security gateway), which specifically means:

[0044] 1) The terminal device to be sent selects the first encryption key k1 from the key file in the communication chip and records the key index idx-k1 of the first encryption key k1 in the key file. The first encryption key k1 is used to encrypt the service data mes to obtain the service ciphertext MES. The encryption method is one-time pad.

[0045] 2) Generate the first data header corresponding to the business ciphertext MES. The first data header includes the receiver's external IP address and key index idx-k1. Then, calculate the checksum of the receiver's external IP address, key index idx-k1, and business data mes to obtain the first checksum.

[0046] 3) The terminal device to be sent combines the first data header, the first checksum and the business ciphertext MES to obtain the first transmission data, and then sends the first transmission data to the aggregated security gateway.

[0047] (4) After receiving the first transmitted data, the aggregated security gateway decrypts and verifies it, specifically:

[0048] A1: After receiving the first transmitted data, the aggregated security gateway obtains the first decryption key k1' from the key file corresponding to the terminal device to be sent, based on the key index idx-k1 in the first data header of the first transmitted data. The first decryption key k1' is then used to decrypt the service ciphertext MES in the first transmitted data to obtain the service data mes'.

[0049] A2: The aggregated security gateway calculates the checksum of the receiver's external IP address, key index idx-k1, and service data mes' in the first data header of the first transmitted data to obtain a second checksum; it compares the calculated second checksum with the first checksum in the first transmitted data to see if they are consistent. If they are consistent, the checksum passes; if they are inconsistent, the checksum fails.

[0050] If the verification fails, the transmitted data is discarded. If the verification passes, the decrypted data is encrypted using the key in the symmetric key file of the receiving terminal device, and a second transmission data is constructed. Specifically:

[0051] B1: The aggregated security gateway selects the second encryption key k2 from the key file symmetrical to the receiving terminal device, records the key index idx-k2 of the second encryption key k2 in the key file, and uses the second encryption key k2 to encrypt the business data mes' to obtain the business ciphertext MES';

[0052] B2: The aggregated security gateway generates a second data header corresponding to the business ciphertext MES'. The second data header includes the recipient's external IP address and key index idx-k2. Then, a checksum is calculated on the recipient's external IP address, key index idx-k2, and business data mes' to obtain a third checksum.

[0053] B3: The aggregation security gateway finally combines the second data header, the third checksum, and the business ciphertext MES' to obtain the second transmission data, and then sends the second transmission data to the receiving terminal device.

[0054] (5) After receiving the second transmitted data, the receiving terminal device forwards it to its local communication chip, which decrypts and verifies the second transmitted data, specifically:

[0055] C1: The receiving terminal device obtains the second decryption key k2' from its local key file according to the key index idx-k2 in the second data header of the second transmitted data in its communication chip, and uses the second decryption key k2' to decrypt the service ciphertext MES' in the second transmitted data to obtain the service data mes'';

[0056] C2: The receiving terminal device calculates the checksum of the receiver's external IP address, key index idx-k2, and service data mes'' in the second data header of the second transmitted data to obtain the fourth checksum; it compares whether the calculated fourth checksum is consistent with the third checksum in the second transmitted data. If they are consistent, the checksum passes and the service data processing is executed; if they are inconsistent, the checksum fails.

[0057] This invention introduces an aggregated security gateway as the core hub for key management. This transforms the original end-to-end key distribution among all terminals into a system where each terminal only needs to store a single key file that communicates with the aggregated security gateway. The total number of key files is reduced from quadratic to linear, equivalent to the number of terminals. This fundamentally avoids the enormous storage capacity challenge posed by storing massive amounts of keys on terminal chips, making lightweight, low-cost, and secure deployment of large-scale IoT terminals and mobile devices possible. Simultaneously, the calculation and verification of checksums for data headers and business data effectively protects the security and integrity of these data headers and business data, preventing tampering and ensuring the reliability and security of data communication.

[0058] This invention also provides a computer device, which includes at least a processor and a memory. The memory stores a computer program, and the processor executes the computer program stored in the memory to implement the steps in the data communication method based on a communication chip according to this invention.

[0059] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the data communication method based on a communication chip according to this invention.

Claims

1. A data communication method based on a communication chip, characterized in that, The method includes the following steps: (1) Each terminal device initiates an initial access request to the access aggregation security gateway; after receiving the request from each terminal device, the aggregation security gateway establishes an association table based on the identity information in the request; (2) The key center distributes symmetric key files to each terminal device and the access aggregation security gateway; (3) The terminal device to be sent generates service data and uses the key in the symmetric key file between the terminal and the aggregated security gateway in the communication chip to encrypt the service data and construct the first transmission data; then the first transmission data is sent to the aggregated security gateway. (4) After receiving the first transmission data, the aggregated security gateway decrypts and verifies it. If the verification fails, it is discarded directly. If the verification passes, the decrypted data is encrypted using the key in the symmetric key file of the receiving terminal device and the second transmission data is constructed. Then the second transmission data is sent to the receiving terminal device. (5) After receiving the second transmitted data, the receiving terminal device forwards it to its local communication chip. The communication chip decrypts and verifies the second transmitted data. After the verification is successful, it performs business data processing.

2. The data communication method based on a communication chip according to claim 1, characterized in that: The initial access request includes the terminal device's identity ID (Did), network access ID (Rid), internal network IP address, and external network IP address.

3. The data communication method based on a communication chip according to claim 2, characterized in that: The association table records the one-to-one correspondence between the identity identifier Did, the network access identifier Rid, the internal network IP, and the external network IP.

4. The data communication method based on a communication chip according to claim 1, characterized in that: Each terminal device and the aggregated security gateway are pre-set with the same verification and comparison method, which is to calculate the checksum using a hash algorithm. The hash algorithm is a hash function based on a linear feedback shift register obtained by selecting an irreducible polynomial and inputting random numbers, or a traditional hash algorithm, including one of MD4, MD5, SHA2, SHA3, RIPEMD, and MASH-1 algorithms.

5. The data communication method based on a communication chip according to claim 1, characterized in that: The process of encrypting business data and constructing the first transmission data refers to: 1) The terminal device to be sent selects the first encryption key k1 from the key file in the communication chip, and records the key index idx-k1 of the first encryption key k1 in the key file. The first encryption key k1 is used to encrypt the service data mes to obtain the service ciphertext MES. 2) Generate the first data header corresponding to the business encrypted text MES. The first data header includes the receiver's external IP address and key index idx-k1. Then, calculate the checksum of the receiver's external IP address, key index idx-k1 and business data mes to obtain the first checksum. 3) The terminal device to be sent finally combines the first data header, the first checksum and the service ciphertext MES to obtain the first transmitted data.

6. The data communication method based on a communication chip according to claim 5, characterized in that: After receiving the first transmitted data, the aggregated security gateway performs decryption and verification, which means: A1: After receiving the first transmitted data, the aggregated security gateway obtains the first decryption key k1' from the key file corresponding to the terminal device to be sent, based on the key index idx-k1 in the first data header of the first transmitted data. The first decryption key k1' is used to decrypt the service ciphertext MES in the first transmitted data to obtain the service data mes'. A2: The aggregated security gateway calculates the checksum of the receiver's external IP address, key index idx-k1, and service data mes' in the first data header of the first transmitted data to obtain a second checksum; it compares the calculated second checksum with the first checksum in the first transmitted data to see if they are consistent. If they are consistent, the checksum passes. If they do not match, the verification fails.

7. A data communication method based on a communication chip according to claim 6, characterized in that: The step of encrypting the decrypted data using the key in the symmetric key file of the receiving terminal device and constructing the second transmission data refers to: B1: The aggregated security gateway selects the second encryption key k2 from the key file symmetrical to the receiving terminal device, records the key index idx-k2 of the second encryption key k2 in the key file, and uses the second encryption key k2 to encrypt the business data mes' to obtain the business ciphertext MES'; B2: The aggregated security gateway generates a second data header corresponding to the business ciphertext MES'. The second data header includes the recipient's external IP address and key index idx-k2. Then, a checksum is calculated on the recipient's external IP address, key index idx-k2, and business data mes' to obtain a third checksum. B3: The aggregation security gateway finally combines the second data header, the third checksum, and the business ciphertext MES' to obtain the second transmission data.

8. The data communication method based on a communication chip according to claim 7, characterized in that: The process of decrypting and verifying the second transmitted data refers to: C1: The receiving terminal device obtains the second decryption key k2' from its local key file according to the key index idx-k2 in the second data header of the second transmitted data in its communication chip, and uses the second decryption key k2' to decrypt the service ciphertext MES' in the second transmitted data to obtain the service data mes''; C2: The receiving terminal device calculates the checksum of the receiver's external IP address, key index idx-k2, and service data mes'' in the second data header of the second transmitted data to obtain the fourth checksum; compares whether the calculated fourth checksum is consistent with the third checksum in the second transmitted data. If they are consistent, the checksum passes. If they do not match, the verification fails.

9. A computer device, characterized in that: The computer device includes at least a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the data communication method based on a communication chip as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the data communication method based on a communication chip as described in any one of claims 1-8.

Images