Power line carrier communication PLC method, communication device, communication system, storage medium and program product

Abstract

The present disclosure relates to a power line carrier communication PLC method, communication device, communication system, storage medium and program product, the method can be executed by a central coordinator CCO, the method comprising: receiving an association request sent by a terminal node STA, the association request comprising a first indication and / or a first public key; determining that the STA does not access the PLC network, and determining a shared key according to the first public key and the second private key; an association confirmation is sent to the STA, the association confirmation comprises the second public key, and the association confirmation is used for indicating the STA to determine the shared key according to the second public key and the first private key; and determining that an equipment adding request sent by the main control equipment is received, performing authentication and / or negotiation with the STA according to the shared key to determine an equipment key, the equipment key being used for encrypting transmission of a network key, and the network key being used for encrypting transmission of data. The transmission reliability of the network key can be ensured, and the security of PLC communication is effectively ensured.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to power line carrier communication PLC methods, communication equipment, communication systems, storage media, and program products. Background Technology

[0002] Power line communication (PLC) is a communication technology that transmits data and voice signals over power lines. Data transmission can occur between different appliances connected to the same electricity meter, or it can be transmitted remotely over the power grid. PLCs can be used to connect various smart devices in the home, such as smart sockets, smart light bulbs, and temperature controllers. Summary of the Invention

[0003] This disclosure presents a power line carrier communication PLC method, communication equipment, communication system, storage medium, and program product.

[0004] In a first aspect, embodiments of this disclosure propose a power line carrier communication PLC method, executed by a Central Coordinator (CCO), the method comprising:

[0005] Receive an association request sent by a terminal node (Station, STA), the association request including a first indication and / or a first public key, the first indication being used to indicate whether the STA has been connected to the PLC network;

[0006] If it is determined that the STA is not connected to the PLC network, a shared key is determined based on the first public key and the second private key;

[0007] Send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0008] Upon receiving a device add request from the master control device, the system authenticates and / or negotiates with the STA using the shared key to determine a device key. The device key is used to encrypt the transmission of the network key, and the network key is used to encrypt the transmission of data.

[0009] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0010] Secondly, this disclosure provides a power line carrier communication PLC method, executed by a terminal node STA, the method comprising:

[0011] Send an association request to the central coordinator (CCO). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network. The association request is used to instruct the CCO to determine a shared key based on the first public key and a second private key if it is determined that the STA has not been connected to the PLC network.

[0012] The system receives an association confirmation sent by the CCO, the association confirmation including a second public key, and the association confirmation is used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0013] The device key is determined by authentication and / or negotiation with the CCO based on the shared key, and the device key is used to encrypt the transmission of the network key;

[0014] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0015] Thirdly, embodiments of this disclosure provide a communication device, including:

[0016] The transceiver module is used to receive an association request sent by a terminal node (STA). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network.

[0017] The processing module is used to determine that the STA is not connected to the PLC network, and to determine a shared key based on the first public key and the second private key;

[0018] The transceiver module is further configured to send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0019] The processing module is further configured to determine that a device addition request has been received from the master control device, and to authenticate and / or negotiate with the STA based on the shared key to determine a device key, wherein the device key is used to encrypt the transmission of the network key;

[0020] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0021] Fourthly, embodiments of this disclosure provide a communication device, comprising:

[0022] The transceiver module is used to send an association request to the central coordinator (CCO). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the terminal node (STA) has been connected to the PLC network. The association request is used to instruct the CCO to determine a shared key based on the first public key and a second private key if it is determined that the STA has not been connected to the PLC network.

[0023] The transceiver module is further configured to receive an association confirmation sent by the CCO, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0024] The processing module is used to authenticate and / or negotiate with the CCO based on the shared key to determine a device key, the device key being used to encrypt the transmission of the network key;

[0025] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0026] Fifthly, embodiments of this disclosure provide a communication device, comprising:

[0027] One or more processors;

[0028] The communication device is used to perform the method described in the first aspect or the second aspect.

[0029] In a sixth aspect, embodiments of this disclosure provide a communication system including a terminal node (STA) and a central coordinator (CCO), wherein the CCO is configured to implement the method described in the first aspect, and the STA is configured to implement the method described in the second aspect.

[0030] In a seventh aspect, embodiments of this disclosure provide a storage medium storing instructions that, when executed on a communication device, cause the communication device to perform the communication method described in the first or second aspect.

[0031] Eighthly, embodiments of this disclosure provide a computer program product including a computer program and / or instructions, which, when executed by a communication device, implement the communication method as described in the first or second aspect.

[0032] In this embodiment of the disclosure, the STA can carry its first public key when sending an association request to the CCO, and the CCO can carry its second public key when sending an association confirmation to the STA. This allows the STA and CCO to negotiate a shared key based on the keys carried in the association response and the association request, respectively. Then, they can perform authentication and / or negotiate device keys based on the shared key, thereby ensuring the reliability of network key transmission and effectively ensuring the security of PLC communication. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings required for the description of the embodiments are introduced below. The following drawings are only some embodiments of this disclosure and do not impose specific limitations on the protection scope of this disclosure.

[0034] Figure 1A This is an exemplary schematic diagram of the architecture of a communication system provided according to embodiments of this disclosure.

[0035] Figure 1B This is an exemplary schematic diagram of the architecture of a communication system provided according to embodiments of this disclosure.

[0036] Figure 1C This is an interactive diagram illustrating the connection of a STA device to a CCO according to an embodiment of this disclosure.

[0037] Figure 2A This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0038] Figure 2B This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0039] Figure 3A This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0040] Figure 3B This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0041] Figure 3C This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0042] Figure 3D This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0043] Figure 4A This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0044] Figure 4B This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0045] Figure 4C This is an interactive schematic diagram of a communication method according to an embodiment of the present disclosure.

[0046] Figure 5A This is a schematic diagram of the structure of the central coordinator proposed in an embodiment of this disclosure.

[0047] Figure 5B This is a schematic diagram of the structure of the terminal node proposed in the embodiments of this disclosure.

[0048] Figure 6A This is a schematic diagram of the structure of the communication device proposed in the embodiments of this disclosure.

[0049] Figure 6B This is a schematic diagram of the chip structure proposed in the embodiments of this disclosure. Detailed Implementation

[0050] This disclosure presents a power line carrier communication PLC method, communication equipment, communication system, storage medium, and program product.

[0051] In a first aspect, embodiments of this disclosure propose a power line carrier communication PLC method, executed by a central coordinator (CCO), the method comprising:

[0052] Receive an association request sent by a terminal node (STA), the association request including a first indication and / or a first public key, the first indication being used to indicate whether the STA has been connected to the PLC network;

[0053] If it is determined that the STA is not connected to the PLC network, a shared key is determined based on the first public key and the second private key;

[0054] Send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0055] Upon receiving a device add request from the master control device, the system authenticates and / or negotiates with the STA using the shared key to determine a device key. The device key is used to encrypt the transmission of the network key, and the network key is used to encrypt the transmission of data.

[0056] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0057] In the above embodiments, the STA can carry its generated first public key when sending an association request to the CCO, and the CCO can carry its generated second public key when sending an association confirmation to the STA. This allows the STA and CCO to negotiate a shared key based on the keys carried in the association response and association request, respectively. Then, they can perform authentication and / or negotiate device keys based on the shared key, thereby ensuring the reliability of network key transmission and effectively ensuring the security of PLC communication.

[0058] In conjunction with some embodiments of the first aspect, in some embodiments, authentication with the STA based on the shared key includes:

[0059] An authentication request is sent to the STA, and the authentication request is encrypted using the shared key;

[0060] Receive the authentication response sent by the STA, the authentication response being encrypted using the shared key, and the authentication response including the STA's first authentication certificate;

[0061] Obtain the first certificate; verify the first authentication certificate based on the first certificate.

[0062] In the above embodiments, the CCO can obtain the root certificate through a third-party trusted authority, and then verify the certificate of the STA carried in the authentication response, effectively ensuring that the STA is a trusted device, and further ensuring the reliability of PLC communication.

[0063] In conjunction with some embodiments of the first aspect, in some embodiments, the authentication response further includes a first signature, and the method further includes:

[0064] The first signature is verified based on the public key in the first authentication certificate;

[0065] The first signature is generated by the STA based on the private key in the first authentication certificate.

[0066] In conjunction with some embodiments of the first aspect, in some embodiments, the authentication response further includes a first intermediate certificate, and the verification of the first authentication certificate based on the first root certificate includes:

[0067] The first intermediate certificate is verified based on the first root certificate;

[0068] Once the first intermediate certificate is verified as passed, the first authentication certificate is verified based on the first intermediate certificate.

[0069] In the above embodiments, the reliability of communication can be further ensured by using an intermediate certificate.

[0070] In conjunction with some embodiments of the first aspect, in some embodiments, the authentication response is sent by the STA upon successful verification of the CCO, and the authentication request includes a second authentication certificate of the CCO, the second authentication certificate being used by the terminal device to verify the CCO.

[0071] In the above embodiments, the STA can also verify the CCO to ensure that the CCO is a trusted device, thus guaranteeing the security of data transmission.

[0072] In conjunction with some embodiments of the first aspect, in some embodiments, determining a device key by negotiating with the STA based on the shared key includes:

[0073] The device key is determined based on the shared key using a key derivation algorithm.

[0074] In conjunction with some embodiments of the first aspect, in some embodiments, the method includes:

[0075] A random key is generated based on a random number generation algorithm.

[0076] The network key is generated based on the random key using a key derivation algorithm.

[0077] The network key is sent to the STA, and the network key is encrypted with the device key.

[0078] In conjunction with some embodiments of the first aspect, in some embodiments, the method includes:

[0079] Upon confirming receipt of the association request, a Transmission Entity Identifier (TEI) is assigned to the STA.

[0080] If the binding with the STA fails, the TEI is reclaimed and a disconnection instruction is sent to the STA.

[0081] In the above embodiments, the CCO can achieve more efficient STA management and scheduling by allocating and reclaiming TEIs, ensuring that the CCO can effectively manage its associated STAs.

[0082] In conjunction with some embodiments of the first aspect, in some embodiments, determining that the binding has failed includes at least one of the following:

[0083] It is confirmed that an authentication failure message has been received from the STA, wherein the authentication failure message is sent by the STA when the CCO verification fails;

[0084] The STA verification failed.

[0085] It has been determined that the shared key negotiation failed;

[0086] It has been determined that the device key negotiation failed;

[0087] It has been determined that the network key transmission failed.

[0088] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes:

[0089] If the access failure is detected, a binding failure indication is sent to the main control device.

[0090] In conjunction with some embodiments of the first aspect, in some embodiments, receiving the association request sent by the STA includes:

[0091] It is determined that the association request is encrypted with the network key, and that the STA has been connected to the PLC network;

[0092] Decrypt the associated request using the network key;

[0093] Sending the association confirmation to the STA includes:

[0094] Send an association confirmation encrypted with the network key to the STA.

[0095] In the above embodiments, the STA can encrypt the association request using a network key, which enables the STA to accurately connect to the CCO that assigned it the network key after briefly leaving the PLC network, and prevents it from connecting to other CCOs, thus ensuring that the STA does not arbitrarily associate with other CCOs.

[0096] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes:

[0097] Send a configuration message to the STA, the configuration message being encrypted with the device key; and / or,

[0098] A control message is sent to the STA, and the control message is encrypted using the network key.

[0099] Secondly, this disclosure provides a power line carrier communication PLC method, executed by a terminal node STA, the method comprising:

[0100] Send an association request to the central coordinator (CCO). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network. The association request is used to instruct the CCO to determine a shared key based on the first public key and a second private key if it is determined that the STA has not been connected to the PLC network.

[0101] The system receives an association confirmation sent by the CCO, the association confirmation including a second public key, and the association confirmation is used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0102] The device key is determined by authentication and / or negotiation with the CCO based on the shared key, and the device key is used to encrypt the transmission of the network key;

[0103] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0104] In conjunction with some embodiments of the second aspect, in some embodiments, authentication with the CCO based on the shared key includes:

[0105] Receive the authentication request sent by the CCO, the authentication request being encrypted using the shared key;

[0106] An authentication response is sent to the CCO, the authentication response being encrypted with the shared key, and the authentication response including the STA's first authentication certificate, which is used by the CCO to verify the STA.

[0107] In conjunction with some embodiments of the second aspect, in some embodiments, the authentication request includes a second authentication certificate of the CCO, and sending an authentication response to the CCO includes:

[0108] Obtain a second root certificate;

[0109] Verify the second authentication certificate based on the second root certificate;

[0110] Once the verification of the CCO is confirmed to be successful, the authentication response is sent to the CCO.

[0111] In conjunction with some embodiments of the second aspect, in some embodiments, the authentication request further includes a second intermediate certificate, and the verification of the second authentication certificate based on the second root certificate includes:

[0112] The second intermediate certificate is verified based on the second root certificate;

[0113] Once the second intermediate certificate is verified as passed, the second authentication certificate is verified based on the second intermediate certificate.

[0114] In conjunction with some embodiments of the second aspect, in some embodiments, determining a device key based on the shared key and the CCO includes:

[0115] The device key is determined based on the shared key using a key derivation algorithm.

[0116] In conjunction with some embodiments of the second aspect, in some embodiments, the method includes:

[0117] After determining the device key, it is confirmed that the device has been connected to the PLC network.

[0118] In conjunction with some embodiments of the second aspect, in some embodiments, the method includes:

[0119] The network key sent by the CCO is received. The network key is encrypted with the device key. The network key is generated based on a key derivation algorithm using a random key. The random key is generated based on a random number generation algorithm.

[0120] In conjunction with some embodiments of the second aspect, in some embodiments, the method includes:

[0121] Receive a disconnection indication sent by the CCO, the disconnection indication being used to indicate that the STA has failed to bind with the CCO.

[0122] In conjunction with some embodiments of the second aspect, in some embodiments, sending the association request to the CCO includes:

[0123] Once it is confirmed that the system has been connected to the PLC network, an association request encrypted with the network key is sent to the CCO.

[0124] The receipt of the association confirmation sent by the CCO includes:

[0125] Receive the association confirmation sent by the CCO, which is encrypted with the network key.

[0126] In conjunction with some embodiments of the second aspect, in some embodiments, the method further includes:

[0127] Receive a configuration message sent by the CCO, the configuration message being encrypted using the device key; and / or,

[0128] The system receives control messages sent by the CCO, and these control messages are encrypted using the network key.

[0129] Thirdly, embodiments of this disclosure provide a communication device, including:

[0130] The transceiver module is used to receive an association request sent by a terminal node (STA). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network.

[0131] The processing module is used to determine that the STA is not connected to the PLC network, and to determine a shared key based on the first public key and the second private key;

[0132] The transceiver module is further configured to send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0133] The processing module is further configured to determine that a device addition request has been received from the master control device, and to authenticate and / or negotiate with the STA based on the shared key to determine a device key, wherein the device key is used to encrypt the transmission of the network key;

[0134] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0135] Fourthly, embodiments of this disclosure provide a communication device, comprising:

[0136] The transceiver module is used to send an association request to the central coordinator (CCO). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the terminal node (STA) has been connected to the PLC network. The association request is used to instruct the CCO to determine a shared key based on the first public key and a second private key if it is determined that the STA has not been connected to the PLC network.

[0137] The transceiver module is further configured to receive an association confirmation sent by the CCO, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0138] The processing module is used to authenticate and / or negotiate with the CCO based on the shared key to determine a device key, the device key being used to encrypt the transmission of the network key;

[0139] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0140] Fifthly, embodiments of this disclosure provide a communication device, comprising:

[0141] One or more processors;

[0142] The communication device is used to perform the method described in the first aspect or the second aspect.

[0143] In a sixth aspect, embodiments of this disclosure provide a communication system including a terminal node (STA) and a central coordinator (CCO), wherein the CCO is configured to implement the method described in the first aspect, and the STA is configured to implement the method described in the second aspect.

[0144] In a seventh aspect, embodiments of this disclosure provide a storage medium storing instructions that, when executed on a communication device, cause the communication device to perform the communication method described in the first or second aspect.

[0145] Eighthly, embodiments of this disclosure provide a computer program product including a computer program and / or instructions, which, when executed by a communication device, implement the communication method as described in the first or second aspect.

[0146] It is understood that the aforementioned communication equipment, communication system, storage medium, program product, etc., are all used to execute the methods proposed in the embodiments of this disclosure. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0147] This disclosure is not exhaustive, but merely illustrative of some embodiments, and is not intended to limit the scope of protection of this disclosure. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined, for example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments. In all embodiments of this disclosure, unless otherwise specified or logically conflicting, the terminology and / or descriptions between the embodiments are consistent and can be mutually referenced. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0148] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure.

[0149] In this embodiment of the disclosure, unless otherwise stated, elements expressed in the singular form, such as "a," "an," "the," "the," "the," "the," "the," "the," "this," etc., can mean "one and only one," or "one or more," "at least one," etc. For example, when using articles such as "a," "an," "the," etc. in translation, the noun following the article can be understood as either a singular expression or a plural expression.

[0150] In the embodiments disclosed herein, "multiple" refers to two or more.

[0151] In some embodiments, the terms “at least one of A or B, at least one of A and B”, “one or more”, “a plurality of”, “multiple”, etc., may be used interchangeably.

[0152] In some embodiments, the notation "at least one of A and B", "A and / or B", "A in one case, B in another", "in response to one case A, in response to another case B", etc., may include the following technical solutions depending on the situation: in some embodiments, A (execute A regardless of whether there is a branch B); in some embodiments, B (execute B regardless of whether there is a branch A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, both A and B are executed. The same applies when there are more branches such as A, B, C, etc.

[0153] In some embodiments, the notation "A or B" may include the following technical solutions, depending on the situation: in some embodiments, A (execute A regardless of whether a branch B exists); in some embodiments, B (execute B regardless of whether a branch A exists); in some embodiments, execution is selected from A and B (A and B are selectively executed). The same applies when there are more branches such as A, B, and C.

[0154] The prefixes "first," "second," etc., used in the embodiments of this disclosure are merely for distinguishing different descriptive objects and do not impose restrictions on the position, order, priority, quantity, or content of the descriptive objects. The description of the descriptive objects is found in the claims or the context of the embodiments, and the use of prefixes should not constitute unnecessary restrictions. For example, if the descriptive object is a "field," the ordinal numbers preceding "field" in "first field" and "second field" do not restrict the position or order of the "fields." "First" and "second" do not restrict whether the "fields" they modify are in the same message, nor do they restrict the order of "first field" and "second field." Similarly, if the descriptive object is a "level," the ordinal numbers preceding "level" in "first level" and "second level" do not restrict the priority between "levels." Furthermore, the number of descriptive objects is not limited by ordinal numbers and can be one or more. For example, in "first device," the number of "devices" can be one or more. Furthermore, the objects modified by different prefixes can be the same or different. For example, if the object being described is "device", then "first device" and "second device" can be the same device or different devices, and their types can be the same or different. Similarly, if the object being described is "information", then "first information" and "second information" can be the same information or different information, and their content can be the same or different.

[0155] In some embodiments, “including A,” “containing A,” “for indicating A,” and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0156] In some embodiments, terms such as "time / frequency" and "time-frequency domain" refer to the time domain and / or frequency domain.

[0157] In some embodiments, terms such as “in response to…”, “in response to determining…”, “in the case of…”, “when…”, “when…”, “if…”, etc. can be used interchangeably. These descriptions all refer to the device making a corresponding action under certain objective circumstances. They do not necessarily limit the time, nor do they require the device to make a judgment action when implementing it, nor do they mean that there must be other limitations.

[0158] In some embodiments, the terms “greater than,” “greater than or equal to,” “not less than,” “more than,” “more than or equal to,” “not less than,” “higher than,” “higher than or equal to,” “not lower than,” and “above” can be used interchangeably, as can the terms “less than,” “less than or equal to,” “not greater than,” “less than,” “less than or equal to,” “not more than,” “lower than,” “lower than or equal to,” “not higher than,” and “below”.

[0159] In some embodiments, devices, etc., may be interpreted as physical or virtual, and their names are not limited to those described in the embodiments. Terms such as “device,” “equipment,” “circuit,” “network element,” “network function,” “network device,” “function,” “node,” “unit,” “section,” “system,” “network,” “chip,” “chip system,” “entity,” and “subject” are interchangeable.

[0160] In some embodiments, "network" can be interpreted as devices included in a network (e.g., access network devices, core network devices, etc.).

[0161] In some embodiments, the terms "access network device (AN device)," "radio access network device (RAN device)," "base station (BS)," "radio base station," "fixed station," "node," "access point," "transmission point (TP)," "reception point (RP)," "transmission / reception point (TRP)," "panel," "antenna panel," "antenna array," "cell," "macro cell," "small cell," "femto cell," "pico cell," "sector," "cell group," "serving cell," "carrier," "component carrier," and "bandwidth part (BWP)" can be used interchangeably.

[0162] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriberstation, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, and client can be used interchangeably.

[0163] In some embodiments, access network devices, core network devices, or network devices can be replaced by terminals. For example, embodiments of this disclosure can also be applied to structures where communication between access network devices, core network devices, or network devices and terminals is replaced by communication between multiple terminals (e.g., device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, the structure can also be configured such that the terminal has all or part of the functions of the access network device. Furthermore, terms such as "uplink" and "downlink" can be replaced with terms corresponding to communication between terminals (e.g., "sidelink"). For example, uplink channel, downlink channel, etc., can be replaced with sidelink channel, and uplink link, downlink, etc., can be replaced with sidelink link.

[0164] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, core network device, or network device may also be configured to have all or some of the functions of the terminal.

[0165] In some embodiments, the acquisition of data, information, etc., may comply with the laws and regulations of the country where the location is situated.

[0166] In some embodiments, data, information, etc., may be obtained with the user's consent.

[0167] Furthermore, each element, each row, or each column in the table of this disclosure can be implemented as an independent embodiment, and any combination of any element, any row, or any column can also be implemented as an independent embodiment.

[0168] Figure 1A This is a schematic diagram of the architecture of a communication system according to embodiments of this disclosure. Figure 1A As shown, the communication system 100 includes a station (STA) 101 and a central coordinator (CCO) 102.

[0169] In some embodiments, the central coordinator 102 can be used for the terminal node 101 to access the PLC network.

[0170] In some embodiments, terminal node 101 may be provided as a PLC sub-device, or as part of a PLC sub-device. Optionally, the PLC sub-device includes a master control device (such as an MCU) and terminal node 101. Optionally, the master control device may communicate with terminal node 101 via a PLC module serial port, or via shared memory for inter-process communication.

[0171] In some embodiments, the central coordinator 102 may be provided as a PLC gateway, or as part of a PLC gateway. Optionally, the PLC gateway includes a master control device and the central coordinator 102. Optionally, the master control device may communicate with the central coordinator 102 via a PLC module serial port.

[0172] In some embodiments, a user's terminal device, such as a mobile phone, can communicate with the central coordinator 102 or a PLC gateway. Optionally, the user can schedule the central coordinator 102 through the terminal device, for example, instructing the central coordinator 102 to add the terminal node 101 to the PLC network.

[0173] It is understood that the communication system described in this disclosure is for the purpose of more clearly illustrating the technical solutions of this disclosure, and does not constitute a limitation on the technical solutions proposed in this disclosure. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions proposed in this disclosure are also applicable to similar technical problems.

[0174] The following embodiments of this disclosure can be applied to Figure 1AThe communication system 100 shown, or a part thereof, but not limited to it. Figure 1A The entities shown are illustrative; a communication system may include... Figure 1A All or part of the main body, or may include Figure 1A Other entities besides the main body, the number and form of each entity are arbitrary, each entity can be physical or virtual, the connection relationship between the entities is illustrative, the entities can be unconnected or connected, and the connection can be in any way, it can be a direct connection or an indirect connection, it can be a wired connection or a wireless connection.

[0175] The embodiments disclosed herein can be applied to Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G new radio (NR), Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New radio access (NX), Futuregeneration radio access (FX), Global System for Mobile communications (GSM), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), and IEEE 802.20, Ultra-Wideband (UWB), Bluetooth (a registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X) systems, systems utilizing other communication methods, and next-generation systems built upon them, etc. Furthermore, multiple systems can be combined (e.g., a combination of LTE or LTE-A with 5G).

[0176] Figure 1B This is a schematic diagram of the architecture of a communication system according to embodiments of this disclosure. Figure 1B As shown, the communication system 200 includes a PLC gateway 210 and a PLC sub-device 220. The PLC gateway 210 includes a first master control device 211 and a CCO 212, and the PLC sub-device 220 includes a second master control device 221 and a STA 222.

[0177] The PLC gateway 210 can communicate with the terminal device 230 either through the cloud or directly, for example, based on the 3GPP protocol.

[0178] It is worth noting that in some embodiments, the PLC gateway 210 can also communicate with PLC sub-devices other than the PLC sub-device 220. These PLC sub-devices and the PLC sub-device 220 can form a PLC network, and the terminal device 230 can schedule one or more devices in the PLC network.

[0179] Figure 1C This is an exemplary schematic diagram illustrating the interaction between a STA device and a CCO, based on this disclosure. Figure 1C As shown, the process includes the following steps:

[0180] Step S1101: The terminal node STA sends an MMeAssocReq association request to the central coordinator CCO.

[0181] In step S1102, the CCO sends an MMeAssocCnf association confirmation to the STA.

[0182] In some embodiments, after the CCO replies with an MMeAssocCnf association confirmation, the STA device is connected to the PLC network built by the CCO.

[0183] In the above embodiments, the following problems exist: CCO and STA lack authentication, making it impossible to identify the legitimacy of the device; after CCO and STA establish an association request, data is transmitted in plaintext, making the data easily leaked; if STA is connected to a CCO, if the CCO loses power or the signal distance is too far, STA will connect to other CCOs.

[0184] The present disclosure also provides the following embodiments to ensure the security and reliability of communication between STA and CCO in a PLC communication system.

[0185] Figure 2A This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 2A As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0186] Step S2101: The terminal node STA sends an association request to the central coordinator CCO.

[0187] In some embodiments, the association request includes a first instruction and / or a first public key. Optionally, the association request is used to request the CCO to associate with the STA.

[0188] In some embodiments, the STA may pre-generate a first public key and a first private key, which are a key pair. For example, a public key Pub_s and a private key Priv_s.

[0189] In some embodiments, the CCO may pre-generate a second public key and a second private key, which are a key pair. For example, a public key Pub_c and a private key Priv_c.

[0190] Understandably, the first public key and the first private key, as well as the second public key and the second private key, can be used for asymmetric encryption. The public key can be publicly distributed to any device that needs to communicate securely with the key owner. When you want to securely send a message to the key owner, you can use the public key to encrypt the message, and the encrypted message can only be decrypted using the corresponding private key.

[0191] In some embodiments, the STA signs the association request based on a first private key. For example, the association request may include a signature sign_s = SIGN(Pub_s|Ran_s, Priv_s), where Ran_s may be a random number generated by the STA.

[0192] In some embodiments, the association request may include only the first public key. Optionally, the first indication is used to indicate whether the STA is connected to the PLC network. Optionally, the first indication may be determined based on a corresponding flag bit configured on the STA; for example, when the flag bit is 1, the STA can determine that it is connected to the PLC network, and when the flag bit is 0, the STA can determine that it is not connected to the PLC network.

[0193] For example, if the association request is not encrypted, it can be assumed that the STA is not connected to the PLC network. If the association request is encrypted, it can be determined that the STA is connected to the PLC network, and in this case, it is not necessary to indicate the status of whether the STA is connected to the PLC network in the first indication. Optionally, if the CCO can decrypt the association request, it can be determined that the STA is connected to the PLC network corresponding to that CCO. If the CCO cannot decrypt the association request, it can be determined that the STA is connected to the PLC network corresponding to another CCO.

[0194] In some embodiments, the association request is used by the STA to request association with the CCO. Optionally, after the STA associates with the CCO, a shared key can be determined. Optionally, the shared key can be used in the authentication process between the CCO and the STA, and / or, the shared key can also be used to negotiate and determine a device key.

[0195] In some embodiments, the CCO receives an association request sent by the STA. Optionally, in response to the association request, the CCO performs steps S2102 and S2103.

[0196] In some embodiments, before executing step S2102, the CCO verifies the signature based on the first public key. For example, it executes the predefined method Verify(Pub_s,sign_s) based on Pub_s and sign_s to obtain the verification result. Optionally, if the CCO determines that the verification passed, it executes step S2102.

[0197] In some embodiments, the CCO determines that it has received an association request from the STA and assigns a Transport Entity Identifier (TEI) to the STA.

[0198] In step S2102, the CCO determines the shared key.

[0199] In some embodiments, the CCO determines the shared key based on the first public key and the second private key.

[0200] In some embodiments, the CCO determines that the STA is not connected to the PLC network and determines a shared key based on a first public key and a second private key. Optionally, the CCO determines a first indication to indicate that the STA is not connected to the PLC network and determines a shared key based on the first public key and the second private key.

[0201] In some embodiments, the CCO can generate a shared key through Elliptic Curve Diffie-Hellman key exchange (ECHD), for example, shared key shareKey = ECDH(Pub_s, Priv_c).

[0202] As is understandable, ECDH is a key exchange protocol based on elliptic curve cryptography. It allows two communicating parties to negotiate a shared key over an insecure channel, and even if information related to the key exchange is intercepted by a third party, this shared key cannot be calculated. The two parties exchange their public keys and then multiply their private keys by the other party's public key to obtain the shared key. Due to the computational difficulty of elliptic curve discrete logarithms, even if a third party knows both parties' public keys, they cannot calculate the shared key.

[0203] In some embodiments, the CCO may, after determining the shared key, determine the signature sign_c = SIGN(Pub_c, Priv_c).

[0204] In some embodiments, the CCO may perform step S2103 after determining the shared key.

[0205] In step S2103, the CCO sends an association confirmation to the STA.

[0206] In some embodiments, the association confirmation includes a second public key. Optionally, the association confirmation is used to instruct the STA to determine a shared key based on the second public key and the first private key.

[0207] In some embodiments, the association confirmation is used to indicate that the CCO has successfully associated with the STA. Optionally, the CCO determines that it has associated with the STA and sends an association confirmation to the STA.

[0208] In some embodiments, if the CCO determines that the association with the STA is unsuccessful, it does not send an association confirmation to the STA; that is, the association confirmation is used to indicate that the CCO and the STA are successfully associated.

[0209] In some embodiments, the associated acknowledgment includes a signature determined by the CCO. For example, the associated acknowledgment includes the signature sign_c = SIGN(Pub_c, Priv_c).

[0210] In some embodiments, the STA receives an association confirmation sent by the CCO. Optionally, in response to the association confirmation, the STA executes step S2104. Optionally, in response to the association confirmation, the STA verifies the signature sign_c in the association confirmation based on the second public key. For example, it executes the predefined method Verify(Pub_s,sign_s) based on Pub_s and sign_s to obtain the verification result. Optionally, if the STA determines that the verification passed, it executes step S2104.

[0211] Step S2104, STA determines the shared key.

[0212] In some embodiments, the STA determines the shared key based on the second public key and the first private key.

[0213] In some embodiments, the STA can generate a shared key using ECDH. For example, the shared key shareKey = ECDH(Pub_c, Priv_s).

[0214] It is understandable that the shared key generated by the STA and CCO, such as a shared key generated through ECDH, can decrypt encrypted data sent by the other party. Therefore, the shared keys generated by the STA and CCO respectively can be considered as the same key, and are collectively referred to as the shared key.

[0215] In step S2105, the master control device sends a device addition request to the CCO.

[0216] It is understandable that the master control device is the master control device corresponding to the CCO, such as the master control device of the PLC gateway, and the CCO is part of the PLC gateway.

[0217] In some embodiments, the terminal device sends an instruction to the master control device to add a device in response to a user's operation, and the master control device sends an add device request to the CCO in response to the instruction.

[0218] In some embodiments, the Add Device Request is used to instruct the CCO to send an authentication request to the STA.

[0219] In some embodiments, the CCO performs step S2106 in response to a device addition request.

[0220] In step S2106, the CCO sends an authentication request to the STA.

[0221] In some embodiments, the device addition request may include, for example, the STA's TEI, MAC address, or node identifier. The CCO can send an authentication request to the corresponding STA based on the STA's TEI, MAC address, or node identifier.

[0222] In some embodiments, the CCO sends an authentication request to the STA based on a shared key. Optionally, the authentication request is encrypted using the shared key.

[0223] In some embodiments, the STA receives an authentication request sent by the CCO based on the shared key. Optionally, the authentication request is obtained by decryption using the shared key. For example, the STA executes decrypt(mseReg, shareKey) to obtain mseReg.

[0224] In some embodiments, the authentication request includes a second authentication certificate of the CCO. For example, the authentication request is msgReq = encrypt(DC_c, shareKey), where DC_c represents the second authentication certificate.

[0225] Understandably, a CCO's second certification can be issued by a trusted third-party organization.

[0226] In some embodiments, when the CCO sends an authentication request to the STA, the authentication request may further include a second signature. Optionally, the CCO may generate a second signature based on the private key in the second authentication certificate, for example, a signature of sign = signature(DC_c, Priv_c). Optionally, when using an intermediate certificate, such as a second intermediate certificate, the CCO may generate a second signature based on the private key in the second authentication certificate and / or the intermediate certificate, for example, a signature of sign = signature(DC_c|intermediate certificate, Priv_c), where Priv_c represents the private key in the second authentication certificate DC_c.

[0227] In some embodiments, the method further includes: the STA verifying the second signature based on the public key in the second authentication certificate; wherein the second signature is generated by the CCO based on the private key in the second authentication certificate.

[0228] In some embodiments, if the authentication request includes a second authentication certificate, the STA responds to the authentication request by obtaining the second root certificate; the STA then verifies the second authentication certificate based on the second root certificate. Optionally, before verifying the second authentication certificate, the STA verifies the signature using the public key in the second authentication certificate, for example by executing `validate(DC_c_pub,Dc_c,sign)`, where `DC_c_pub` represents the public key in the second authentication certificate, and `sign` represents the signature information.

[0229] For example, STA can obtain a second root certificate from a third-party trusted institution.

[0230] In some embodiments, the authentication request may also include a second intermediate certificate.

[0231] In some embodiments, the STA can verify the second intermediate certificate based on the second root certificate, and if the second intermediate certificate passes verification, it can then verify the second authentication certificate based on the second intermediate certificate. Optionally, the STA can use the public key of the second authentication certificate to verify the signature, and then use the second root certificate to verify the second intermediate certificate, for example, by executing `validate(DC_pub, DC_c|intermediate certificate, sign)`.

[0232] Understandably, once the STA verifies the second certification certificate, it can confirm that the CCO verification has passed.

[0233] In some embodiments, if the STA verifies the CCO, step S2107 is executed. Optionally, if the STA verifies the second intermediate authentication certificate, step S2107 is executed.

[0234] In step S2107, the STA sends an authentication response to the CCO.

[0235] In some embodiments, the STA sends an authentication response to the CCO based on a shared key. Optionally, the authentication response is encrypted using the shared key.

[0236] In some embodiments, the CCO receives the authentication response sent by the STA based on the shared key. Optionally, the authentication response is obtained by decryption using the shared key. For example, the CCO executes decrypt(mseResp, shareKey) to obtain mseResp.

[0237] In some embodiments, the authentication response includes the STA's first authentication certificate. For example, the authentication response is msgResp = encrypt(DC_s, shareKey), where DC_s represents the second authentication certificate.

[0238] Understandably, STA's first certification can be issued by a trusted third-party organization.

[0239] In some embodiments, when the STA sends an authentication response to the CCO, the authentication response may further include a first signature. Optionally, the CCO may generate the first signature based on the private key in the first authentication certificate. Optionally, when using an intermediate certificate, such as a first intermediate certificate, the STA may generate the first signature based on the private key in the first authentication certificate and / or a second intermediate certificate.

[0240] In some embodiments, the authentication response further includes a first signature, and the method further includes: the CCO verifying the first signature based on the public key in the first authentication certificate; wherein the first signature is generated by the STA based on the private key in the first authentication certificate.

[0241] In some embodiments, if the authentication request includes a first authentication certificate, the CCO responds to the authentication response by obtaining the first root certificate; the CCO then verifies the first authentication certificate based on the first root certificate. Optionally, before verifying the first authentication certificate, the CCO verifies the signature using the public key in the first authentication certificate, for example by executing `validate(DC_s_pub,Dc_s,sign)`, where `DC_s_pub` represents the public key in the first authentication certificate, and `sign` represents the signature information.

[0242] For example, a CCO can obtain the first root certificate from a third-party trusted institution.

[0243] In some embodiments, the authentication response may also include a first intermediate certificate.

[0244] In some embodiments, the CCO can verify the first intermediate certificate based on the first root certificate, and if the first intermediate certificate passes verification, verify the first authentication certificate based on the first intermediate certificate. Optionally, the CCO uses the public key of the first authentication certificate to verify the signature, and after the signature passes verification, verifies the first intermediate certificate using the first root certificate, for example, by executing `validate(DC_s_pub, DC_s|intermediate certificate, sign)`.

[0245] Understandably, once the CCO verifies the first certification certificate, the verification of the STA can be considered successful.

[0246] In some embodiments, verification of the STA by the CCO is necessary, while verification of the CCO by the STA is optional. Optionally, the second authentication certificate or the second intermediate certificate in the request message sent by the CCO to the STA in step S2106 is optional, while the first authentication certificate and / or the first intermediate certificate in the response message sent by the STA to the CCO in step S2107 is mandatory.

[0247] In some embodiments, if the CCO verifies the STA and passes the verification, step S2108 is executed. Optionally, if the CCO verifies the first authentication certificate and passes the verification, step S2108 is executed.

[0248] In step S2108, CCO and STA determine the device key based on the shared key using a key derivation algorithm.

[0249] In some embodiments, the CCO and STA obtain the device key devKey based on shared key negotiation. For example, the device key devKey = KDF(shareKey, salt), where KDF represents the key derivation algorithm and salt represents a randomly generated data fragment.

[0250] In some embodiments, the CCO executes steps S2109 to S2111 in response to a successful negotiation of the device key with the STA.

[0251] In some embodiments, the STA determines that it is accessing the PLC network in response to successfully negotiating the device key with the CCO, or sets a first indication to indicate that the STA is accessing the PLC network. Optionally, the flag bit corresponding to the first indication is set to 1.

[0252] Step S2109: CCO generates a random key based on a random number generation algorithm.

[0253] In some embodiments, the random key can be represented as randomKey = DRBG(), where DRBG is a random number generation algorithm.

[0254] In some embodiments, the CCO performs step S2110 in response to generating a random key.

[0255] In step S2110, the CCO generates a network key based on the key derivation algorithm and the random key.

[0256] In some embodiments, the network key can be represented as netKey = KDF(randomKey, timestamp, salt), where timestamp is a timestamp.

[0257] In some embodiments, the CCO determines the generated network key and performs step S2111.

[0258] In step S2111, the CCO sends the network key to the STA.

[0259] In some embodiments, the network key is used to encrypt data transmission. Optionally, the network key is used to encrypt data transmission between the CCO and the STA. For example, when the CCO sends a control message to the STA, the network key can be used to encrypt the control message; or, when the STA sends node data to the CCO, the network key can also be used to encrypt the node data.

[0260] In some embodiments, the CCO sends a network key to the STA based on the device key. Optionally, the CCO encrypts the network key based on the device key.

[0261] In some embodiments, the STA receives the network key sent by the CCO based on the device key. Optionally, the STA decrypts the network key based on the device key to obtain the network key.

[0262] In some embodiments, the CCO determines that the STA binding has failed, reclaims the STA's TEI, and sends a disconnect indication to the STA. Optionally, in response to the disconnect indication, the STA sets the flag corresponding to the first indication to 0.

[0263] In some embodiments, the CCO determines that the binding has failed, including at least one of the following: determining that an authentication failure message has been received from the STA, the authentication failure message being sent when the STA fails to verify the CCO; determining that the verification of the STA has failed; determining that the shared key negotiation has failed; determining that the device key negotiation has failed; or determining that the network key transmission has failed.

[0264] In some embodiments, if the CCO determines that STA binding has failed, it may also send a binding failure message to the master control device. Optionally, in response to the binding failure message, the master control device may further send a corresponding device binding failure indication to the user's terminal device. Optionally, the terminal device may display the binding failure message in response to the user interface.

[0265] For example, if the STA fails to authenticate with the CCO in step S2106, it can send an authentication failure message to the CCO. In response to the authentication failure message, the CCO can skip step S2107 to step S2111 and reclaim the TEI allocated to the STA.

[0266] In some embodiments, "acquire," "get," "obtain," "receive," "transmit," "bidirectional transmission," and "send and / or receive" can be used interchangeably and can be interpreted as receiving from other entities, acquiring from protocols, acquiring from higher layers, obtaining through self-processing, or autonomous implementation. Protocols include, for example, at least one of the 3GPP protocol, Wi-Fi protocol, and audio and / or video protocols.

[0267] In some embodiments, terms such as “send,” “transmit,” “report,” “distribute,” “transfer,” “bidirectional transmission,” “send and / or receive” can be used interchangeably.

[0268] In some embodiments, terms such as "certain," "preset," "default," "set," "indicated," "a certain," "any," and "first" can be used interchangeably. "Certain A," "preset A," "default A," "set A," "indicated A," "a certain A," "any A," and "first A" can be interpreted as A pre-defined in a protocol or the like, or as A obtained through setting, configuration, or instruction, or as specific A, a certain A, any A, or first A, but are not limited thereto.

[0269] In some embodiments, the determination or judgment can be made by a value represented by 1 bit (0 or 1), or by a true or false value (boolean), or by a comparison of numerical values ​​(e.g., a comparison with a predetermined value), but is not limited thereto.

[0270] In some embodiments, "not expecting to receive" can be interpreted as not receiving on time domain resources and / or frequency domain resources, or as not performing subsequent processing on the data and / or instructions after receiving them; "not expecting to send" can be interpreted as not sending, or as sending but not expecting the receiver to respond to the sent content.

[0271] The communication method involved in the embodiments of this disclosure may include at least one of steps S2101 to S2111. For example, step S2102 may be implemented as an independent embodiment, step S2104 may be implemented as an independent embodiment, steps S2101 to S2104 may be implemented as independent embodiments, steps S2105 to S2107 may be implemented as independent embodiments, and steps S2108 to S2110 may be implemented as independent embodiments, but are not limited thereto.

[0272] In some embodiments, steps S2101 and S2103 to S2111 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0273] In some embodiments, steps S2101 to S2103 and steps S2105 to S2111 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0274] In some embodiments, steps S2101 to S2106 and steps S2108 to S2111 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0275] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0276] Figure 2B This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 2B As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0277] Step S2201: The terminal node STA sends an association request to the central coordinator CCO based on the network key.

[0278] In some embodiments, the STA sends an association request to the CCO, the association request being encrypted with a network key.

[0279] In some embodiments, the STA determines that it has access to the PLC network and sends an association request encrypted with a network key to the CCO.

[0280] In some embodiments, if the STA determines that it has accessed the PLC network and has received the network key sent by the CCO, it can encrypt the association request according to the network key and send it to the corresponding CCO.

[0281] For example, refer to Figure 2A The process involves the STA completing the association process with the CCO (as in steps S2101 to S2104) and obtaining the shared key, completing the authentication process with the CCO (as in steps S2105 to S2108) and obtaining the device key, and successfully receiving the network key sent by the CCO. If the STA briefly disconnects from the PLC network, the STA can resend the association request to the CCO to re-associate. At this time, the STA can use the network key to encrypt the association request so that only the CCO, who uniquely possesses the network key, can receive the association request.

[0282] In some embodiments, if the STA is not connected to the PLC network and / or has not received the network key sent by the CCO, it can send an unencrypted association request to the CCO, referring to the optional implementation in step S2101.

[0283] In some embodiments, the CCO receives an association request sent by the STA based on a network key. Optionally, the CCO determines that the association request is encrypted with the network key, thus confirming that the STA has accessed the PLC network. Optionally, the CCO decrypts the association request based on the network key. Optionally, after decrypting the association request, the CCO executes step S2102. Optionally, after decrypting the association request, the CCO determines that it is associated with the STA and executes step S2102.

[0284] In some embodiments, the association request includes a first public key. Optionally, the CCO, in response to the association request, determines a shared key.

[0285] In some embodiments, the optional implementation of the CCO determining the shared key can be found in [reference needed]. Figure 2A Optional implementation methods of step S2102 and Figure 2A The related content will not be elaborated here.

[0286] In step S2202, the CCO sends an association confirmation to the STA based on the network key.

[0287] In some embodiments, the association response is used to indicate that the CCO has successfully associated with the STA.

[0288] In some embodiments, the CCO determines that the association request is encrypted with a network key and sends an association confirmation encrypted with the network key to the STA.

[0289] In some embodiments, the STA receives an association confirmation encrypted with a network key sent by the CCO. Optionally, the STA decrypts the association confirmation using the network key to obtain the corresponding information.

[0290] In some embodiments, the association confirmation includes a second public key. Optionally, the STA determines a shared key in response to the association confirmation.

[0291] In some embodiments, the optional implementation of how the STA determines the shared key can be found in [reference needed]. Figure 2A Optional implementation methods of step S2104 and Figure 2A The related content will not be elaborated here.

[0292] In step S2203, the CCO sends a configuration message to the STA based on the device key.

[0293] In some embodiments, the CCO sends a configuration message to the STA, which is encrypted with a device key. In response to configuration information sent by the master device, the CCO encrypts the configuration message with the device key and sends it to the STA.

[0294] In some embodiments, the master control device receives a configuration message for the STA sent by the terminal device, and in response to the configuration message sent by the terminal device, the master control device sends a configuration message to the CCO.

[0295] In some embodiments, the configuration message is used to configure the STA. Optionally, the configuration message may include, for example, configuration fields and configuration parameters. Optionally, the STA configures the parameter values ​​corresponding to the configuration fields as the corresponding configuration parameters based on the configuration message.

[0296] In some embodiments, the STA receives a configuration message encrypted with a device key sent by the CCO. Optionally, the STA decrypts the configuration message using the device key to obtain information such as configuration fields and configuration parameters.

[0297] In step S2204, the CCO sends a control message to the STA based on the network key.

[0298] In some embodiments, the CCO sends a control message to the STA, which is encrypted using a network key. In response to control information sent by the master device, the CCO encrypts the control message using the network key and sends it to the STA.

[0299] In some embodiments, the master control device receives a control message for the STA sent by the terminal device, and in response to the control message sent by the terminal device, the master control device sends a control message to the CCO.

[0300] In some embodiments, the control message is used to control the STA. Optionally, the control message may include, for example, a controlled object and control parameters. Optionally, the STA adjusts the state corresponding to the controlled object to the corresponding control parameters based on the control message.

[0301] In some embodiments, the STA receives control messages encrypted with a network key sent by the CCO. Optionally, the STA decrypts the control messages using the network key to obtain information such as the controlled object and control parameters.

[0302] The communication method involved in the embodiments of this disclosure may include at least one of steps S2201 to S2204. For example, step S2201 may be implemented as a standalone embodiment, step S2202 may be implemented as a standalone embodiment, step S2203 may be implemented as a standalone embodiment, and step S2204 may be implemented as a standalone embodiment, but is not limited thereto.

[0303] In some embodiments, steps S2203 and S2204 may be performed in an alternate order or simultaneously.

[0304] In some embodiments, steps S2202 to S2204 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0305] In some embodiments, steps S2201 and S2203 to S2204 are optional, and one or more of these steps may be omitted or substituted in different embodiments.

[0306] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0307] Figure 3A This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 3A As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0308] Step S3101: STA sends an association request to CCO.

[0309] In step S3102, the CCO determines that the STA is not connected to the PLC network and determines the shared key based on the first public key and the second private key.

[0310] In step S3103, the CCO sends an association confirmation to the STA.

[0311] In step S3104, the CCO and STA authenticate and / or negotiate to determine the device key based on the shared key.

[0312] In some embodiments, the association request includes a first indication and / or a first public key, wherein the first indication is used to indicate whether the STA has been connected to the PLC network.

[0313] In some embodiments, the association confirmation includes a second public key, which is used to instruct the STA to determine the shared key based on the second public key and the first private key.

[0314] In some embodiments, the device key is used to encrypt the transmission of the network key, and the network key is used to encrypt the transmission of data.

[0315] In some embodiments, the first public key and the first private key are a key pair generated by STA, and the second public key and the second private key are a key pair generated by CCO.

[0316] In some embodiments, the CCO authenticates with the STA based on a shared key, including:

[0317] The CCO sends an authentication request to the STA, which is encrypted using a shared key.

[0318] The CCO receives the authentication response sent by the STA. The authentication response is encrypted with a shared key and includes the STA's first authentication certificate.

[0319] The CCO obtains the first root certificate and verifies the first authentication certificate based on the first root certificate.

[0320] In some embodiments, the authentication response further includes a first signature, and the method further includes:

[0321] The CCO verifies the first signature based on the public key in the first authentication certificate; wherein the first signature is generated by the STA based on the private key in the first authentication certificate.

[0322] In some embodiments, the authentication response further includes a first intermediate certificate, and verifies the first authentication certificate against the first root certificate, including:

[0323] The CCO verifies the first intermediate certificate based on the first root certificate;

[0324] The CCO determines that the first intermediate certificate has passed verification and then verifies the first authentication certificate based on the first intermediate certificate.

[0325] In some embodiments, the authentication response is sent by the STA if the CCO verification is successful. The authentication request includes a second authentication certificate of the CCO, which is used by the terminal device to verify the CCO.

[0326] In some embodiments, determining a device key by negotiating with the STA based on a shared key includes:

[0327] CCO is based on a key derivation algorithm to determine the device key based on the shared key.

[0328] In some embodiments, the method includes:

[0329] CCO generates random keys based on a random number generation algorithm;

[0330] CCO is based on a key derivation algorithm that generates network keys from random keys.

[0331] The CCO sends a network key to the STA, which is encrypted using the device key.

[0332] In some embodiments, the method includes:

[0333] The CCO determines that it has received the association request and assigns a Transport Entity Identifier (TEI) to the STA.

[0334] The CCO determines that the binding with the STA has failed, reclaims the TEI, and sends a disconnect instruction to the STA.

[0335] In some embodiments, determining that binding has failed includes at least one of the following:

[0336] The CCO confirms that it has received an authentication failure message from the STA. The authentication failure message is sent by the STA when its verification of the CCO fails.

[0337] The STA verification failed.

[0338] The shared key negotiation failed;

[0339] Device key negotiation failed;

[0340] The network key transmission failed.

[0341] In some embodiments, the method further includes:

[0342] The CCO determines that the connection has failed and sends a binding failure indication to the master control device.

[0343] In some embodiments, receiving an association request sent by the STA includes:

[0344] The CCO confirms that the association request is encrypted with a network key, thus verifying that the STA has connected to the PLC network.

[0345] The CCO decrypts the association request based on the network key pair;

[0346] Send association confirmation to STA, including:

[0347] The CCO sends an association confirmation encrypted with the network key to the STA.

[0348] In some embodiments, the method further includes:

[0349] The CCO sends a configuration message to the STA, which is encrypted with the device key; and / or,

[0350] The CCO sends control messages to the STA, which are encrypted using a network key.

[0351] In some embodiments, the method includes:

[0352] After the STA determines the device key, it confirms that it has been connected to the PLC network.

[0353] In some embodiments, the method includes:

[0354] The STA receives the network key sent by the CCO. The network key is encrypted with the device key. The network key is generated based on the key derivation algorithm and the random key is generated based on the random number generation algorithm.

[0355] In some embodiments, the STA determines that it has accessed the PLC network and sends an association request encrypted with the network key to the CCO; the STA receives an association confirmation encrypted with the network key from the CCO.

[0356] In some embodiments, the STA authenticates with the CCO based on a shared key, including:

[0357] The STA receives authentication requests sent by the CCO, and the authentication requests are encrypted using a shared key;

[0358] The STA sends an authentication response to the CCO. The authentication response is encrypted with a shared key and includes the STA's first authentication certificate, which is used by the CCO to verify the STA.

[0359] In some embodiments, the authentication request includes a second authentication certificate of the CCO, and the STA sends an authentication response to the CCO, including:

[0360] STA obtains a second root certificate;

[0361] STA verifies the second certification certificate based on the second certificate;

[0362] Once the STA confirms that the CCO verification has passed, it sends an authentication response to the CCO.

[0363] In some embodiments, the authentication request further includes a second signature, the method comprising:

[0364] The STA verifies the second signature based on the public key in the second authentication certificate; wherein the second signature is generated by the CCO based on the private key in the second authentication certificate.

[0365] In some embodiments, the authentication request further includes a second intermediate certificate, and the STA verifies the second authentication certificate against the second root certificate, including:

[0366] STA verifies the second intermediate certificate based on the second root certificate;

[0367] STA confirms that the second intermediate certificate has passed verification and then verifies the second certification certificate based on the second intermediate certificate.

[0368] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0369] Figure 3B This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 3B As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0370] Step S3201: The terminal node STA sends an association request to the central coordinator CCO.

[0371] In step S3202, the CCO determines the shared key.

[0372] In step S3203, the CCO sends an association confirmation to the STA.

[0373] Step S3204, STA determines the shared key.

[0374] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0375] Figure 3C This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 3C As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0376] Step S3301: CCO sends an authentication request to STA.

[0377] In step S3302, the STA sends an authentication response to the CCO.

[0378] In some embodiments, the authentication request includes a first intermediate certificate, a first authentication certificate, and a first signature.

[0379] Step S3303: CCO obtains the first root certificate.

[0380] In step S3304, the CCO verifies the first signature.

[0381] Step S3305: CCO verifies the first intermediate certificate based on the first root certificate.

[0382] Step S3306: The CCO verifies the first authentication certificate based on the first intermediate certificate.

[0383] In step S3307, CCO and STA determine the device key based on the shared key using a key derivation algorithm.

[0384] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0385] Figure 3D This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 3D As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0386] Step S3401: STA sends an association request to CCO.

[0387] In step S3402, CCO assigns TEI to STA.

[0388] In step S3403, the CCO determines that the STA binding has failed and reclaims the TEI of the STA.

[0389] In step S3404, CCO sends a disconnect instruction to STA.

[0390] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0391] Figure 4A This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 4A As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0392] Step S4101: CCO generates a key pair, a public key Pub_c and a private key Priv_c.

[0393] In step S4102, STA generates a key pair, a public key Pub_s and a private key Priv_s.

[0394] Optionally, STA signs the data using a private key, sign_s = SIGN(Pub_s|Ran_s,Priv_s).

[0395] In step S4103, the STA sends an association request MMeAssocReq to the CCO, carrying Pub_s.

[0396] Optionally, the association request may also include the sign_s and auth=0 flags, where the auth flag indicates whether the device has been connected.

[0397] In step S4104, after receiving the association request from the STA, the CCO generates a shared key.

[0398] Optionally, the CCO uses Pub_s to verify the signature, Verify(Pub_s, Pub_s, sign_s), to ensure the authenticity and integrity of the data. Optionally, a shared key is generated via ECDH, shareKey = ECDH(Pub_s, Priv_c). Optionally, the signature required to verify the data is calculated, sign_c = SIGN(Pub_c, Priv_c).

[0399] In step S4105, the CCO returns the associated confirmation MMeAssocCnf, carrying Pub_c.

[0400] Optionally, the associated confirmation also includes a signature, sign_c.

[0401] Step S4106: After receiving the association confirmation frame, the STA generates a shared key.

[0402] Optionally, the STA uses Pub_c to verify the signature, Verify(Pub_c, Pub_c|Ran_c, sign_c), to ensure the authenticity and integrity of the data. Optionally, the STA generates a shared key via ECDH, shareKey = ECDH(Pub_c, Priv_s).

[0403] In step S4107, the User selects the device to be added on the application interface and sends a device addition request to the gateway.

[0404] In step S4108, the gateway master device sends a device addition request to the CCO.

[0405] In step S4109, the CCO sends an authentication request to the STA, and the data sent is encrypted using the shareKey: msgReq = encrypt(DC_c, shareKey).

[0406] Optionally, DC_c represents the CCO's authentication certificate, issued by a trusted third-party authority. Alternatively, in addition to the DC_c certificate, an intermediate certificate can be added to the encrypted data.

[0407] Optionally, the CCO can sign DC_c using the private key Priv_c corresponding to DC_c, such as sign = signature(DC_c, Priv_c) or, if an intermediate certificate is available, sign = signature(DC_c|intermediate certificate, Priv_c). The data sent is encrypted using shareKey, for example, the authentication request is msgReg = encrypt(DC_c, sign, shareKey).

[0408] In step S4110, the STA receives the authentication request, decrypts the data using the shared key shareKey (decrypt(msgReq,shareKey)), and verifies DC_c.

[0409] Optionally, STA obtains the RootCA root certificate from a third-party trusted authority and verifies DC_c. Optionally, if an intermediate certificate exists, the root certificate needs to be used to verify the intermediate certificate, and the intermediate certificate needs to verify DC_c.

[0410] In some embodiments, the STA can use the public key in the DC_c certificate to verify the signature, for example, validate(DC_c_pub,Dc_c,sign) or, if there is an intermediate certificate, validate(Dc_pub,DC_c|intermediate certificate,sign), which can be used to prove that the certificate comes from the CCO.

[0411] Step S4111: STA sends an authentication response.

[0412] In some embodiments, after step S4110 verifies DC_c, an authentication response is returned. The authentication response message is msgResp = encrypt(DC_s, shareKey), where DC_s represents the STA's authentication certificate, issued by a third-party trusted authority. Optionally, in addition to the DC_s certificate, an intermediate certificate can also be added to the encrypted data.

[0413] In some embodiments, when the STA returns an authentication response, it can sign DC_s using the private key Priv_s corresponding to DC_s, for example, sign = signature(DC_s, Priv_s), or if there is an intermediate certificate, it can be sign = sigpature(DC_s, intermediate certificate, Priv_s). The authentication response can be represented as msgResp = encrypt(DC_s, sign, shareKey).

[0414] In step S4112, the CCO receives the authentication response, decrypts the data using the shared key shareKey (decrypt(msgResp,shareKey), and verifies DC_s.

[0415] Optionally, the CCO obtains the RootCA root certificate from a third-party trusted authority and verifies DC_s. Optionally, if an intermediate certificate exists, the root certificate needs to be used to verify the intermediate certificate, and the intermediate certificate verifies DC_s.

[0416] Alternatively, the CCO can also use the public key in the DC_s certificate to validate the signature, for example, validate(DC_s_pub, DC_s, sign), or, if an intermediate certificate is available, validate(DC_s_pub, DC_s|intermediate certificate, sign).

[0417] In step S4113, CCO and STA negotiate devKey based on shareKey, devKey = KDF(shareKey, salt).

[0418] Optionally, at this point, the STA has successfully connected, and the STA needs to set the auth flag to 1.

[0419] Step S4114: CCO generates netKey, randomKey = DRBG(), netKey = KDF(randomKey, timestamp, salt).

[0420] In step S4115, the CCO transmits the netKey to the STA via encrypted devKey.

[0421] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0422] Figure 4B This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 4B As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0423] Step S4201: CCO negotiates the shareKey with STA.

[0424] In step S4202, the User instructs the CCO to add a device.

[0425] In step S4203, the gateway master device sends a device addition request to the CCO.

[0426] In step S4204, the CCO sends an authentication request to the STA.

[0427] In step S4205, if the STA fails to authenticate the CCO, it returns an authentication failure response.

[0428] In step S4206, CCO sends an MMeLeaveInd message to STA.

[0429] In step S4207, the CCO reclaims the TEI allocated during the association request.

[0430] In step S4208, the CCO returns a binding failure response to the master device.

[0431] In step S4209, the gateway master device returns a STA device binding failure to the user.

[0432] In step S4210, the User side displays a device binding failure message on the user interface.

[0433] Optionally, the specific reason for failure can be displayed. Optionally, the reason for failure includes at least one of the following: CCO authentication STA failure, STA authentication CCO failure, devKey negotiation failure, netKey sending failure.

[0434] In step S4211, if the STA successfully authenticates the CCO, it returns an authentication response.

[0435] In step S4212, if CCO authentication STA fails, send an MMeLeaveInd message and reclaim the TEI allocated during the association request.

[0436] Optionally, if the negotiation of devKey and / or netKey fails, the CCO should also send an MMeLeaveInd message and reclaim the TEI allocated during the association request.

[0437] It is understood that, in any case, if the CCO sends an MMeLeaveInd message to the STA, steps S4207 to S4210 can be executed. This embodiment of the disclosure does not limit the order of execution of the steps.

[0438] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0439] Figure 4C This is an interactive schematic diagram illustrating a communication method according to an embodiment of this disclosure. For example... Figure 4C As shown, the embodiments of this disclosure relate to a communication method, which includes:

[0440] In step S4301, the connected STA device sends an association request, where auth=1 and the MMeAssocReq message is encrypted using netKey.

[0441] In step S4302, the CCO uses the netKey to decrypt the encrypted MMeAssocReq message.

[0442] In step S4303, the CCO uses the netKey to encrypt the associated confirmation MMeAssocCnf message and returns it to the STA.

[0443] In step S4304, the STA uses netKey to decrypt the encrypted MMeAssocCnf message.

[0444] In step S4305, the CCO encrypts configuration messages using the devKey.

[0445] In this scenario, the User-side device responds to the user configuring the STA device on the application interface, sends a configuration device instruction to the master control device, the master control device responds to the configuration device instruction and sends a configuration device request to the CCO, and the CCO responds to the configuration device request by encrypting the configuration messages sent to the STA using devKey.

[0446] Step S4306: CCO uses netKey to encrypt control messages.

[0447] In this scenario, the User-side device responds to the user controlling the STA device on the application interface, the User-side device sends a control device instruction to the master control device, the master control device responds to the control device instruction and sends a control device request to the CCO, and the CCO responds to the control device request by encrypting the control messages sent to the STA using a netKey.

[0448] Understandably, encrypting the auth with the netkey ensures that the STA can only connect to the CCO network that correctly provides it with the netkey, preventing it from connecting to other CCO networks.

[0449] In some embodiments, the steps and their optional implementations in other embodiments described before or after this embodiment, as well as other related parts in the specification, can be referred to, and will not be repeated here.

[0450] This disclosure also proposes an apparatus (also referred to as a communication device, etc.) for implementing any of the above methods. For example, an apparatus is proposed that includes units or modules for implementing the steps performed by the terminal in any of the above methods. Furthermore, another apparatus is proposed that includes units or modules for implementing the steps performed by a network device (e.g., an access network device, a core network functional node, a core network device, etc.) in any of the above methods.

[0451] It should be understood that the division of units or modules in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, the units or modules in the device can be implemented by a processor calling software: for example, the device includes a processor connected to a memory containing instructions. The processor calls the instructions stored in the memory to implement any of the above methods or to implement the functions of the units or modules in the above device. The processor can be, for example, a general-purpose processor, such as a Central Processing Unit (CPU) or a microprocessor, and the memory can be internal or external to the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits. The functionality of some or all of the units or modules can be achieved through the design of these hardware circuits, which can be understood as one or more processors. For example, in one implementation, the hardware circuit is an application-specific integrated circuit (ASIC). The functionality of some or all of the units or modules is achieved through the design of the logical relationships between the components within the circuit. In another implementation, the hardware circuit can be implemented using a programmable logic device (PLD). Taking a field-programmable gate array (FPGA) as an example, it can include a large number of logic gates. The connection relationships between the logic gates are configured through configuration files, thereby achieving the functionality of some or all of the units or modules. All units or modules of the above device can be implemented entirely through processor-called software, entirely through hardware circuits, or partially through processor-called software with the remaining parts implemented through hardware circuits.

[0452] In this embodiment, the processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction read and execute capabilities, such as a Central Processing Unit (CPU), a microprocessor, a graphics processing unit (GPU) (which can be understood as a microprocessor), or a digital signal processor (DSP). In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. The logical relationships of the aforementioned hardware circuits are fixed or reconfigurable. For example, the processor is a hardware circuit implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units or modules. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as a Neural Network Processing Unit (NPU), a Tensor Processing Unit (TPU), or a Deep Learning Processing Unit (DPU).

[0453] Figure 5A This is a schematic diagram of the structure of the Central Coordinator (CCO) according to an embodiment of this disclosure. The Central Coordinator 5100 is used to perform any of the above methods. In some embodiments, such as Figure 5A As shown, the central coordinator 5100 may include at least one of the following: a transceiver module 5101, a processing module 5102, etc.

[0454] In some embodiments, the transceiver module 5101 described above is used to receive an association request sent by a terminal node STA. The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network.

[0455] Processing module 5102 is used to determine that the STA is not connected to the PLC network, and to determine a shared key based on the first public key and the second private key;

[0456] The transceiver module 5101 is further configured to send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0457] The processing module 5102 is further configured to determine that a device addition request has been received from the master control device, and to authenticate and / or negotiate with the STA based on the shared key to determine a device key, wherein the device key is used to encrypt the transmission of the network key;

[0458] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0459] Optionally, the transceiver module is used to perform at least one of the communication steps (such as sending and / or receiving) performed by the central coordinator in any of the above methods (but not limited to these), which will not be elaborated here. Optionally, the processing module is used to perform at least one of the other steps performed by the central coordinator in any of the above methods, which will not be elaborated here.

[0460] Figure 5B This is a schematic diagram of the structure of a terminal node according to an embodiment of this disclosure. The terminal node 5100 is used to execute any of the above methods. In some embodiments, such as... Figure 5B As shown, the terminal node 5100 may include at least one of the following: a transceiver module 5101, a processing module 5102, etc.

[0461] In some embodiments, the transceiver module 5101 described above is used to receive an association request sent by a terminal node STA. The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network.

[0462] Processing module 5102 is used to determine that the STA is not connected to the PLC network, and to determine a shared key based on the first public key and the second private key;

[0463] The transceiver module 5101 is further configured to send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key;

[0464] The processing module 5102 is further configured to determine that a device addition request has been received from the master control device, and to authenticate and / or negotiate with the STA based on the shared key to determine a device key, wherein the device key is used to encrypt the transmission of the network key;

[0465] Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

[0466] Optionally, the transceiver module is used to perform at least one of the communication steps (such as sending and / or receiving) performed by the terminal node in any of the above methods (but not limited to these), which will not be elaborated here. Optionally, the processing module is used to perform at least one of the other steps performed by the terminal node in any of the above methods, which will not be elaborated here.

[0467] In some embodiments, the transceiver module may include a transmitting module and / or a receiving module, which may be separate or integrated. Optionally, the transceiver module may be interchangeable with a transceiver.

[0468] In some embodiments, the processing module may be a single module or may include multiple sub-modules. Optionally, the multiple sub-modules may each perform all or part of the steps required by the processing module.

[0469] In some embodiments, the processing module can be replaced by the processor, and the transceiver module can be replaced by the transceiver.

[0470] Figure 6A This is a schematic diagram of the structure of the communication device 6100 proposed in this embodiment. The communication device 6100 can be a network device (e.g., a terminal node, central coordinator, PLC gateway, PLC sub-device, etc.), a terminal device (e.g., user equipment, etc.), a chip, chip system, or processor that supports the network device in implementing any of the above methods, or a chip, chip system, or processor that supports the terminal in implementing any of the above methods. The communication device 6100 can be used to implement the methods described in the above method embodiments; for details, please refer to the descriptions in the above method embodiments.

[0471] like Figure 6A As shown, the communication device 6100 is used to execute any of the above methods. In some embodiments, the communication device 6100 includes one or more processors 6101. The processor 6101 may be a general-purpose processor or a special-purpose processor, such as a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control communication devices (e.g., base stations, baseband chips, terminal devices, terminal device chips, DUs or CUs, etc.), execute programs, and process program data. Optionally, the communication device 6100 is used to execute any of the above methods. Optionally, one or more processors 6101 are used to invoke instructions to cause the communication device 6100 to execute any of the above methods.

[0472] In some embodiments, the communication device 6100 further includes one or more transceivers 6102. When the communication device 6100 includes one or more transceivers 6102, the transceiver 6102 performs at least one of the communication steps such as sending and / or receiving in the above-described method, and the processor 6101 performs at least one of the other steps. In optional embodiments, the transceiver may include a receiver and / or a transmitter, which may be separate or integrated. Optionally, the terms transceiver, transceiver unit, transceiver, transceiver circuit, interface circuit, interface, etc., can be used interchangeably; the terms transmitter, transmitting unit, transmitter, transmitting circuit, etc., can be used interchangeably; the terms receiver, receiving unit, receiver, receiving circuit, etc., can be used interchangeably.

[0473] In some embodiments, the communication device 6100 further includes one or more memories 6103 for storing data and / or instructions. Optionally, one or more processors 6101 are used to invoke instructions stored in the memory 6103 to cause the communication device 6100 to perform any of the above methods. Optionally, all or part of the memory 6103 may also be located outside the communication device 6100. In an optional embodiment, the communication device 6100 may include one or more interface circuits 6104. Optionally, the interface circuit 6104 is connected to the memory 6103 and can be used to receive data and / or instructions from the memory 6103 or other devices, and can be used to send data and / or instructions to the memory 6103 or other devices. For example, the interface circuit 6104 can read data and / or instructions stored in the memory 6103 and send the data and / or instructions to the processor 6101.

[0474] The communication device 6100 described in the above embodiments may be a network device or a terminal, but the scope of the communication device 6100 described in this disclosure is not limited thereto, and the structure of the communication device 6100 may vary. Figure 6A The limitations. The communication device may be a standalone device or part of a larger device. For example, the communication device may be: (1) a standalone integrated circuit IC, or chip, or chip system or subsystem; (2) a collection of one or more ICs, optionally including storage components for storing data, programs and / or instructions; (3) an ASIC, such as a modem; (4) a module that can be embedded in other devices; (5) a receiver, terminal device, smart terminal device, cellular phone, wireless device, handheld device, mobile unit, vehicle device, network device, cloud device, artificial intelligence device, etc.; (6) others, etc.

[0475] Figure 6BThis is a schematic diagram of the structure of chip 6200 according to an embodiment of this disclosure. For cases where the communication device 6100 can be a chip or a chip system, please refer to... Figure 6B The diagram shown is a schematic representation of the structure of chip 6200, but it is not limited to this.

[0476] Chip 6200 includes one or more processors 6201. Chip 6200 is used to perform any of the methods described above.

[0477] In some embodiments, chip 6200 further includes one or more interface circuits 6202. Optionally, terms such as interface circuit, interface, and transceiver pin can be used interchangeably. In some embodiments, chip 6200 further includes one or more memories 6203 for storing data and / or instructions. Optionally, all or part of the memories 6203 may be located outside of chip 6200. Optionally, interface circuit 6202 is connected to memory 6203, and interface circuit 6202 can be used to receive data and / or instructions from memory 6203 or other devices, and interface circuit 6202 can be used to send data and / or instructions to memory 6203 or other devices. For example, interface circuit 6202 can read data and / or instructions stored in memory 6203 and send the data and / or instructions to processor 6201.

[0478] In some embodiments, the interface circuit 6202 performs at least one of the communication steps, such as sending and / or receiving, in the above-described method. For example, the interface circuit 6202 performing the communication steps, such as sending and / or receiving, in the above-described method means that the interface circuit 6202 performs data and / or instruction interaction between the processor 6201, the chip 6200, the memory 6203, or the transceiver device. In some embodiments, the processor 6201 performs at least one of the other steps.

[0479] The modules and / or devices described in the various embodiments, such as virtual devices, physical devices, and chips, can be combined or separated arbitrarily as needed. Optionally, some or all steps can also be performed collaboratively by multiple modules and / or devices, which is not limited here.

[0480] This disclosure also proposes a storage medium storing instructions that, when executed on a communication device, cause the communication device to perform any of the above methods. Optionally, the storage medium is an electronic storage medium. Optionally, the storage medium is a computer-readable storage medium, but not limited thereto; it may also be a storage medium readable by other devices. Optionally, the storage medium may be a non-transitory storage medium, but not limited thereto; it may also be a temporary storage medium.

[0481] This disclosure also proposes a program product, including a program and / or instructions, which, when executed by a communication device, cause the communication device to perform any of the above methods. Optionally, the program product is a computer program product. Optionally, the program product is stored on the storage medium.

[0482] This disclosure also proposes a computer program that, when run on a computer, causes the computer to perform any of the above methods.

Claims

1. A power line carrier communication PLC method, characterized in that, The method, executed by the Central Coordinator (CCO), includes: Receive an association request sent by a terminal node (STA), the association request including a first indication and / or a first public key, the first indication being used to indicate whether the STA has been connected to the PLC network; If it is determined that the STA is not connected to the PLC network, a shared key is determined based on the first public key and the second private key; Send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key; Upon receiving a device add request from the master control device, the system authenticates and / or negotiates with the STA using the shared key to determine a device key. The device key is used to encrypt the transmission of the network key, and the network key is used to encrypt the transmission of data. Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

2. The method according to claim 1, characterized in that, Authentication with the STA based on the shared key includes: An authentication request is sent to the STA, and the authentication request is encrypted using the shared key; Receive the authentication response sent by the STA, the authentication response being encrypted using the shared key, and the authentication response including the STA's first authentication certificate; Obtain the first certificate; The first authentication certificate is verified based on the first root certificate.

3. The method according to claim 2, characterized in that, The authentication response also includes a first signature, and the method further includes: The first signature is verified based on the public key in the first authentication certificate; The first signature is generated by the STA based on the private key in the first authentication certificate.

4. The method according to claim 2, characterized in that, The authentication response further includes a first intermediate certificate, and the verification of the first authentication certificate based on the first root certificate includes: The first intermediate certificate is verified based on the first root certificate; Once the first intermediate certificate is verified as passed, the first authentication certificate is verified based on the first intermediate certificate.

5. The method according to claim 2, characterized in that, The authentication response is sent by the STA if the CCO verification is successful. The authentication request includes a second authentication certificate of the CCO, which is used by the terminal device to verify the CCO.

6. The method according to claim 1, characterized in that, The device key is determined by negotiating with the STA based on the shared key, including: The device key is determined based on the shared key using a key derivation algorithm.

7. The method according to claim 1, characterized in that, The method includes: A random key is generated based on a random number generation algorithm. The network key is generated based on the random key using a key derivation algorithm. The network key is sent to the STA, and the network key is encrypted with the device key.

8. The method according to claim 1, characterized in that, The method includes: Upon confirming receipt of the association request, a Transmission Entity Identifier (TEI) is assigned to the STA. If the binding with the STA fails, the TEI is reclaimed and a disconnection instruction is sent to the STA.

9. The method according to claim 8, characterized in that, The determination of binding failure includes at least one of the following: It is confirmed that an authentication failure message has been received from the STA, wherein the authentication failure message is sent by the STA when the CCO verification fails; The STA verification failed. It has been determined that the shared key negotiation failed; It has been determined that the device key negotiation failed; It has been determined that the network key transmission failed.

10. The method according to claim 8, characterized in that, The method further includes: If the access failure is detected, a binding failure indication is sent to the main control device.

11. The method according to claim 1, characterized in that, The process of receiving the association request sent by the STA includes: It is determined that the association request is encrypted with the network key, and that the STA has been connected to the PLC network; Decrypt the associated request using the network key; Sending the association confirmation to the STA includes: Send an association confirmation encrypted with the network key to the STA.

12. The method according to claim 11, characterized in that, The method further includes: Send a configuration message to the STA, the configuration message being encrypted with the device key; and / or, A control message is sent to the STA, and the control message is encrypted using the network key.

13. A power line carrier communication PLC method, characterized in that, The method, executed by the terminal node STA, includes: Send an association request to the central coordinator (CCO). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network. The association request is used to instruct the CCO to determine a shared key based on the first public key and a second private key if it is determined that the STA has not been connected to the PLC network. The system receives an association confirmation sent by the CCO, the association confirmation including a second public key, and the association confirmation is used to instruct the STA to determine the shared key based on the second public key and the first private key; The device key is determined by authentication and / or negotiation with the CCO based on the shared key, and the device key is used to encrypt the transmission of the network key; Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

14. The method according to claim 13, characterized in that, Authentication with the CCO based on the shared key includes: Receive the authentication request sent by the CCO, the authentication request being encrypted using the shared key; An authentication response is sent to the CCO, the authentication response being encrypted with the shared key, and the authentication response including the STA's first authentication certificate, which is used by the CCO to verify the STA.

15. The method according to claim 14, characterized in that, The authentication request includes the CCO's second authentication certificate, and an authentication response is sent to the CCO, including: Obtain a second root certificate; Verify the second authentication certificate based on the second root certificate; Once the verification of the CCO is confirmed to be successful, the authentication response is sent to the CCO.

16. The method according to claim 15, characterized in that, The authentication request also includes a second signature, and the method includes: The second signature is verified using the public key in the second authentication certificate; The second signature is generated by the CCO based on the private key in the second authentication certificate.

17. The method according to claim 15, characterized in that, The authentication request also includes a second intermediate certificate, and the verification of the second authentication certificate based on the second root certificate includes: The second intermediate certificate is verified based on the second root certificate; Once the second intermediate certificate is verified as passed, the second authentication certificate is verified based on the second intermediate certificate.

18. The method according to claim 13, characterized in that, The device key is determined through negotiation with the CCO based on the shared key, including: The device key is determined based on the shared key using a key derivation algorithm.

19. The method according to claim 13, characterized in that, The method includes: After determining the device key, it is confirmed that the device has been connected to the PLC network.

20. The method according to claim 13, characterized in that, The method includes: The network key sent by the CCO is received. The network key is encrypted with the device key. The network key is generated based on a key derivation algorithm using a random key. The random key is generated based on a random number generation algorithm.

21. The method according to claim 13, characterized in that, The method includes: Receive a disconnection indication sent by the CCO, the disconnection indication being used to indicate that the STA has failed to bind with the CCO.

22. The method according to claim 13, characterized in that, Sending the association request to the CCO includes: Once it is confirmed that the system has been connected to the PLC network, an association request encrypted with the network key is sent to the CCO. The receipt of the association confirmation sent by the CCO includes: Receive the association confirmation sent by the CCO, which is encrypted with the network key.

23. The method according to claim 22, characterized in that, The method further includes: Receive a configuration message sent by the CCO, the configuration message being encrypted using the device key; and / or, The system receives control messages sent by the CCO, and these control messages are encrypted using the network key.

24. A communication device, characterized in that, include: The transceiver module is used to receive an association request sent by a terminal node (STA). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the STA has been connected to the PLC network. The processing module is used to determine that the STA is not connected to the PLC network, and to determine a shared key based on the first public key and the second private key; The transceiver module is further configured to send an association confirmation to the STA, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key; The processing module is further configured to determine that a device addition request has been received from the master control device, and to authenticate and / or negotiate with the STA based on the shared key to determine a device key, wherein the device key is used to encrypt the transmission of the network key; Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

25. A communication device, characterized in that, include: The transceiver module is used to send an association request to the central coordinator (CCO). The association request includes a first indication and / or a first public key. The first indication is used to indicate whether the terminal node (STA) has been connected to the PLC network. The association request is used to instruct the CCO to determine a shared key based on the first public key and a second private key if it is determined that the STA has not been connected to the PLC network. The transceiver module is further configured to receive an association confirmation sent by the CCO, the association confirmation including a second public key, the association confirmation being used to instruct the STA to determine the shared key based on the second public key and the first private key; The processing module is used to authenticate and / or negotiate with the CCO based on the shared key to determine a device key, the device key being used to encrypt the transmission of the network key; Wherein, the first public key and the first private key are a key pair generated by the STA, and the second public key and the second private key are a key pair generated by the CCO.

26. A communication device, characterized in that, include: One or more processors; The communication device is used to perform the method of any one of claims 1-12 or any one of claims 13-23.

27. A communication system, characterized in that, It includes a terminal node (STA) and a central coordinator (CCO), the CCO being configured to implement the method of any one of claims 1-12, and the STA being configured to implement the method of any one of claims 13-23.

28. A storage medium storing instructions, characterized in that, When the instructions are executed on the communication device, the communication device performs the method as claimed in any one of claims 1-12 or any one of claims 13-23.

29. A computer program product comprising a computer program and / or instructions, characterized in that, When the computer program and / or the instructions are executed by the communication device, they implement the communication method as described in any one of claims 1-12 or any one of claims 13-23.

Images