Secure access method, communication device, chip system, and computer program

Abstract

To provide an apparatus and a method for achieving highly secure authentication and key negotiation in communications between two nodes, such as cockpit domain communications.SOLUTION: In a communication method, a first node communicating with a second node receives, from the second node, a first message including a first ciphertext obtained on the basis of a security parameter and a first key negotiation parameter, decrypts the first ciphertext on the basis of the security parameter, obtains a first key negotiation parameter, determines a first shared key on the basis of the first key negotiation parameter and a key negotiation algorithm, and obtains first identity authentication information used to authenticate the identity of the first node on the basis of the first shared key and a PSK between the first node and the second node.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present application relates to the field of communication technologies and to the field of connected vehicles, in particular to the field of short-range communication technologies, such as cockpit domain communications, in particular to secure access methods and devices. [Background technology]

[0002] Nowadays, with the rapid development of information technology, portable intelligent terminals such as mobile terminals, mobile phones, or tablets have become important personal intelligent tools that are indispensable to people. While people enjoy the convenience brought by information technology, they also face the threat of security vulnerabilities and personal information leakage. Take intelligent vehicles as an example. When vehicle communication is widely applied, wireless communication also brings a series of security risks to vehicles. For example, with the existing short-range communication technology, hackers may invade the in-vehicle information system to obtain vehicle information or even remotely control the vehicle, which poses a very big threat to user privacy and vehicle security.

[0003] To ensure communication security, before two nodes (referred to as a first node and a second node for ease of explanation) communicate with each other, the second node accesses the first node in pairing mode or directly accesses the first node in open mode. When the second node accesses the first node, the second node usually first determines a shared key that both parties use for communication encryption. However, in the existing access process, the confidentiality of the generated shared key is relatively low. For example, when a Bluetooth headset accesses a mobile phone, a link key may be generated by directly tapping the name of the Bluetooth headset on the mobile phone, and then the Bluetooth headset successfully associates with the mobile phone. Then, data can be transmitted and received between the mobile phone as the first node and the Bluetooth headset. This access mode is obviously likely to cause data leakage and threaten user privacy and security. In a communication system, especially an in-vehicle communication system, it is easy for an untrusted node to access the vehicle, in which case the vehicle will endanger the personal safety of the driver and passengers by communicating with an attacker with an untrusted identity.

[0004] Therefore, how to prevent access by untrusted attackers and improve the security of node communication is a technical problem that is being considered by those skilled in the art. Summary of the Invention

[0005] In the embodiments of the present application, a secure access method and apparatus are disclosed that provides a highly secure authentication and key negotiation method to prevent a node from successfully associating with an attacker with an untrusted identity.

[0006] According to a first aspect, an embodiment of the present application discloses a secure access method, the method includes: receiving a first message from a second node, where the first message includes a first ciphertext, the first ciphertext is obtained based on a security parameter and a first key negotiation parameter, the security parameter is a pre-shared key PSK between the first node and the second node, or is a first password, the first password is an agreed access password between the first node and the second node, the PSK between the first node and the second node is a secret value shared between the first node and the second node, and the first password can be regarded as a password used by the second node to access the first node; decrypting the first ciphertext based on the security parameter to obtain a first key negotiation parameter; and determining a first shared key based on the first key negotiation parameter and a key negotiation algorithm.

[0007] In this embodiment of the present application, the second node encrypts the first key negotiation parameter based on the security parameter (the security parameter can be a PSK or a first password) to obtain a first ciphertext. Since the same security parameter is pre-set for the first node or the first node can obtain the same security parameter, the first node can decrypt the first ciphertext to obtain the first key negotiation parameter, and then generate a shared key based on the first key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated and the second node cannot access the first node. Therefore, it is possible to prevent the attacker from using the second node to access the first node, and to prevent the first node from successfully associating with an attacker with an untrusted identity.

[0008] In one possible implementation example of the first aspect, the method further includes obtaining a PSK between the first node and the second node; and obtaining first identity authentication information based on the first shared key and the PSK between the first node and the second node, where the first identity authentication information is used to authenticate the identity of the first node.

[0009] A first identity authentication information is obtained based on the first shared key and the PSK, and the first identity authentication information can be used to authenticate the identity of the first node. In the present application, a method is presented for authenticating the identity of the first node using the first identity information. That is, the second node determines the first shared key and generates verification information based on the first shared key and the PSK. If the verification information is the same as the first identity authentication information, this indicates that the first shared key and the PSK on the first node are the same as those on the second node. In this way, the identity of the first node can be authenticated, and communication between the node and an attacker is prevented, improving the security of the node.

[0010] In another possible implementation example of the first aspect, obtaining a PSK between the first node and the second node includes obtaining a PSK between the first node and the second node based on a first correspondence; or determining a PSK between the first node and the second node based on a first password, a first shared key, a first random number, and a second random number, where the first message further includes the first random number.

[0011] It can be seen that the first node can store the correspondence between the PSK and the second node in the form of a correspondence, and can thus obtain the PSK between the first node and the second node based on the correspondence.

[0012] In one possible design, the PSK is determined based on the first password, the first shared key, the first random number, and the second random number. If the first node is associating with the second node for the first time or if the first node has not obtained the first correspondence, the first node does not have a PSK corresponding to the second node, so a new PSK may be determined.

[0013] In yet another possible implementation example of the first aspect, determining a PSK between the first node and the second node based on the first password, the first shared key, the first random number, and the second random number includes: determining a second shared key based on the first shared key, the first random number, and the second random number; and determining a PSK between the first node and the second node based on the first password, the second shared key, the first random number, and the second random number.

[0014] In yet another possible implementation example of the first aspect, the first ciphertext is obtained based on a hash value of the security parameter and the first key negotiation parameter; and the step of decrypting the first ciphertext based on the first password and obtaining the first key negotiation parameter includes the step of decrypting the first ciphertext based on the hash value of the security parameter and obtaining the first key negotiation parameter.

[0015] In yet another possible implementation example of the first aspect, the first ciphertext is obtained by performing an elliptic curve point addition operation based on a hash value of the security parameters and the first key negotiation parameters; and the step of decrypting the first ciphertext based on the first password and obtaining the first key negotiation parameters includes a step of obtaining the first key negotiation parameters by performing an elliptic curve point subtraction operation based on the hash value of the security parameters and the first ciphertext.

[0016] In yet another possible implementation example of the first aspect, the step of decrypting the first ciphertext based on the security parameters and obtaining the first key negotiation parameters includes: determining a first intermediate key based on a hash value of the security parameters and a first random number; and decrypting the first ciphertext based on the first intermediate key and obtaining the first key negotiation parameters.

[0017] In yet another possible implementation example of the first aspect, obtaining first identity authentication information based on the first shared key and the PSK between the first node and the second node further includes: deriving a first key based on the first shared key, the PSK, the first random number, and the second random number; and generating first identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

[0018] In yet another possible implementation example of the first aspect, the method further includes encrypting the second key negotiation parameters based on the security parameters to obtain a second ciphertext; and sending a second message to the second node, where the second message includes the first identity authentication information and the second ciphertext, and the second ciphertext is used by the second node to determine the first shared key.

[0019] The second key negotiation parameter is used by the second node to determine the shared key. It can be seen that the second key negotiation parameter may be encrypted based on the security parameter, and the second key negotiation parameter can be decrypted to generate the shared key only after the security parameter is cracked. This prevents an attacker from impersonating the second node to access the first node, ensuring the security of the key negotiation process.

[0020] In yet another possible implementation example of the first aspect, the method further includes receiving a third message from the second node, where the third message includes second identity authentication information; and determining that identity authentication of the second node is successful based on the PSK, the first shared key, and the second identity authentication information between the first node and the second node.

[0021] The above describes a method for authenticating the identity of a second node. The second identity authentication information is generated by the second node based on the PSK and the first shared key. Therefore, based on the PSK, the first shared key, and the second identity authentication information, it can be determined whether the first shared key and PSK on the second node are the same as those on the first node, so that the identity of the second node can be authenticated.

[0022] In yet another possible implementation example of the first aspect, the first message may also be referred to as an access request message (or an association request message). Furthermore, the second message may also be referred to as a security context request message (or an identity authentication request message). The third message may also be referred to as a security context response message (or an identity authentication response message).

[0023] In yet another possible implementation of the first aspect, the method further includes transmitting a fourth message to the second node, where the fourth message is used to indicate that the access is successful or to indicate that the association is completed. Further, the fourth message may be referred to as an association establishment message (or an access association completion message), or an association completion message, etc.

[0024] According to a second aspect, an embodiment of the present application discloses a secure access method, the method includes: sending a first message to a first node, where the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, where the security parameter is a pre-shared key PSK between the first node and the second node, or a first password, where the first password is an agreed access password between the first node and the second node; receiving a second message from the first node, where the second message includes a second ciphertext, the second ciphertext being obtained by encrypting the second key negotiation parameter based on the security parameter; decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter; determining a first shared key based on the second key negotiation parameter and a key negotiation algorithm; and obtaining a second identity authentication information based on the first shared key and the PSK between the first node and the second node, where the second identity authentication information is used to authenticate the identity of the second node.

[0025] In this embodiment of the present application, the first key negotiation parameter is encrypted based on a security parameter (the security parameter can be a PSK or a first password) and then sent to the first node. Correspondingly, the first node also encrypts the second key negotiation parameter based on the security parameter. Both communication parties may decrypt the ciphertext based on the security parameter and generate a shared key based on the key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated and the second node cannot access the first node. Therefore, the second node can be prevented from accessing the untrusted first node, and the security of the second node is improved.

[0026] In one possible implementation example of the second aspect, prior to the step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, the method further includes a step of obtaining a PSK between the first node and the second node.

[0027] In another possible implementation example of the second aspect, obtaining a PSK between the first node and the second node includes obtaining a PSK between the first node and the second node based on the second correspondence; or determining a PSK between the first node and the second node based on a first password, a first shared key, a first random number, and a second random number, where the first message further includes the first random number, and the first message includes the first random number.

[0028] It can be seen that the correspondence between the PSK and the first node may be stored in the form of a correspondence, so that the PSK between the first node and the second node can be obtained based on the correspondence.

[0029] In one possible design example, the PSK is determined based on the first password, the first shared key, the first random number, and the second random number. If the first node associates with the second node for the first time or if the first node has not obtained the first correspondence, the second node does not have a PSK corresponding to the first node, so a new PSK may be determined in the manner described above.

[0030] In yet another possible implementation example of the second aspect, determining a PSK between the first node and the second node based on the first password, the first shared key, the first random number, and the second random number includes: determining a second shared key based on the first shared key, the first random number, and the second random number; and determining a PSK between the first node and the second node based on the first password, the second shared key, the first random number, and the second random number.

[0031] In yet another possible implementation example of the second aspect, before the step of sending the first message, the method further includes a step of encrypting the first key negotiation parameter based on the security parameter to obtain a first ciphertext.

[0032] In yet another possible implementation example of the second aspect, the step of encrypting the first key negotiation parameter based on the security parameter to obtain the first ciphertext includes a step of encrypting the first key negotiation parameter based on a hash value of the security parameter to obtain the first ciphertext; or a step of obtaining the first ciphertext by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; or a step of determining a first intermediate key based on the hash value of the security parameter and a first random number; and a step of encrypting the first key negotiation parameter based on the first intermediate key to obtain the first ciphertext.

[0033] In yet another possible implementation example of the second aspect, obtaining the second identity authentication information based on the first shared key and the PSK between the first node and the second node further includes deriving a first key based on the first shared key, the PSK, the first random number, and the second random number; and generating the second identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

[0034] In yet another possible implementation example of the second aspect, the second message further includes first identity authentication information; the method further includes determining that identity authentication of the first node is successful based on the PSK, the first shared key, and the first identity authentication information between the first node and the second node.

[0035] The above describes a method for authenticating the identity of a first node. The first identity authentication information is generated by the first node based on the PSK and the first shared key. Therefore, based on the PSK, the first shared key, and the first identity authentication information, it can be determined whether the first shared key and PSK on the first node are the same as those on the second node, so that the identity of the first node can be authenticated. It should be noted that the opportunity to authenticate the identity of the first node may be periodic or aperiodic, or the identity of the first node may be authenticated before some important operation is performed, which is implementation dependent in a particular implementation.

[0036] In yet another possible implementation example of the second aspect, the first message may also be referred to as an access request message (or an association request message). Furthermore, the second message may also be referred to as a security context request message (or an identity authentication request message). The third message may also be referred to as a security context response message (or an identity authentication response message).

[0037] In yet another possible implementation of the second aspect, the method further includes receiving a fourth message from the first node, where the fourth message is used to indicate that the access is successful or to indicate that the association is completed. Further, the fourth message may be referred to as an association establishment message (or an access association completion message) or an association completion message, etc.

[0038] According to a third aspect, an embodiment of the present application discloses a communication device, the communication device including a receiving unit and a processing unit, the communication device being configured to implement the secure access method described in the first aspect or any one of the possible implementations of the first aspect.

[0039] According to a fourth aspect, an embodiment of the present application discloses a communication device, including a transmitting unit, a receiving unit and a processing unit, the communication device being configured to implement the secure access method described in the second aspect or any one of the possible implementations of the second aspect.

[0040] According to a fifth aspect, an embodiment of the present application discloses a communication device including a processor and a communication interface, the processor being configured to invoke a computer program stored in a memory to perform the method described in the first aspect or any one of the possible implementations of the first aspect.

[0041] According to a sixth aspect, an embodiment of the present application discloses a communication device including a processor and a communication interface, the processor being configured to invoke a computer program stored in a memory to implement the first aspect or any one of the possible implementations of the first aspect.

[0042] According to a seventh aspect, an embodiment of the present application further provides a chip system, the chip system including at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, and the at least one processor being configured to invoke a computer program stored in the at least one memory, such that the chip system performs the method described in the first aspect or any one of the possible implementations of the first aspect, or performs the method described in the second aspect or any one of the possible implementations of the second aspect.

[0043] According to an eighth aspect, an embodiment of the present application further provides a communication system including a first node and a second node, the first node including a communication device as described in the third aspect or any one of the possible implementations of the third aspect, or including a communication device as described in the fifth aspect or any one of the possible implementations of the fifth aspect, the second node including a communication device as described in the fourth aspect or any one of the possible implementations of the fourth aspect, or including a communication device as described in the sixth aspect or any one of the possible implementations of the sixth aspect.

[0044] According to a ninth aspect, an embodiment of the present application discloses a computer readable storage medium. The computer readable storage medium stores a computer program. When the computer program runs on a computer, the computer is enabled to perform the method described in the first aspect or any one of the possible implementations of the first aspect, or to perform the method described in the second aspect or any one of the possible implementations of the second aspect.

[0045] According to a tenth aspect, an embodiment of the present application discloses a computer program product, which when run on one or more processors performs the method described in the first aspect or any one of the possible implementations of the first aspect, or performs the method described in the second aspect or any one of the possible implementations of the second aspect.

[0046] According to an eleventh aspect, an embodiment of the present application discloses a terminal. The terminal may be an intelligent cockpit product or a vehicle, etc., and the terminal includes a first node and / or a second node. The second node (e.g., one or more of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, a passive entry passive start system controller, and a user equipment UE) includes the device described in the third aspect or any one of the possible implementation examples of the third aspect. The first node (e.g., a base station or a cockpit domain controller CDC of a vehicle) includes the communication device described in the fourth aspect or any one of the possible implementation examples of the fourth aspect.

[0047] Alternatively, the vehicles may be replaced with intelligent terminals or transportation vehicles such as unmanned aerial vehicles or robots. [Brief description of the drawings]

[0048] The accompanying drawings used in the embodiments of the present application are described below.

[0049] [Figure 1] FIG. 2 is a schematic diagram of a key negotiation algorithm.

[0050] [Figure 2(a)] FIG. 2 is a schematic diagram of a usage scenario of the key negotiation algorithm. [Figure 2(b)] FIG. 2 is a schematic diagram of a usage scenario of the key negotiation algorithm. [Figure 2(c)] FIG. 2 is a schematic diagram of a usage scenario of the key negotiation algorithm.

[0051] [Diagram 3] 1 is a schematic flow chart of a communication system according to an embodiment of the present application;

[0052] [Figure 4] FIG. 2 is a schematic diagram of a communication scenario according to an embodiment of the present application;

[0053] [Diagram 5] 1 is a schematic flowchart of a communication method according to an embodiment of the present application;

[0054] [Figure 6] 3 is a schematic flow chart for determining a shared key according to an embodiment of the present application;

[0055] [Figure 7] 4 is a schematic flowchart of another communication method according to an embodiment of the present application;

[0056] [Figure 8A]4 is a schematic flowchart of yet another communication method according to an embodiment of the present application; [Figure 8B] 4 is a schematic flowchart of yet another communication method according to an embodiment of the present application;

[0057] [Figure 9A] FIG. 2 is a schematic diagram of an operation scenario of a communication method according to an embodiment of the present application; [Figure 9B] FIG. 2 is a schematic diagram of an operation scenario of a communication method according to an embodiment of the present application; [Figure 9C] FIG. 2 is a schematic diagram of an operation scenario of a communication method according to an embodiment of the present application; [Figure 9D] FIG. 2 is a schematic diagram of an operation scenario of a communication method according to an embodiment of the present application; [Figure 9E] FIG. 2 is a schematic diagram of an operation scenario of a communication method according to an embodiment of the present application;

[0058] [Figure 10] 1 is a schematic diagram of the structure of a communication device according to an embodiment of the present application;

[0059] [Figure 11] 1 is a schematic diagram of the structure of another communication device according to an embodiment of the present application;

[0060] [Figure 12] 13 is a schematic diagram of the structure of yet another communication device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0061] Hereinafter, the embodiments of the present application will be described with reference to the accompanying drawings in the embodiments of the present application. Please note that the terms "example" or "for example" are used in the present application to indicate an example, instance, or example. Any embodiment or design manner described in the present application as "example" or "for example" should not be construed as preferred or advantageous over other embodiments or design manners. Indeed, the use of terms such as "example" or "for example" is intended to present relative concepts in a concrete manner.

[0062] In the present application, the term "at least one" refers to one or more, and the term "multiple" refers to two or more. The term "at least one of the following items" or similar expressions refers to any combination of these items, including any combination of one item or multiple items. For example, at least one item of a, b, and c may refer to a, b, c, (a and b), (a and c), (b and c), or (a, b, and c), where a, b, and c may be singular or plural. The term "and / or" describes the association relationship between related objects, and represents that three relationships may exist. For example, A and / or B may represent three cases: only A is present, both A and B are present, and only B is present, where A and B may be singular or plural. The symbol " / " generally represents an "or" relationship between related objects.

[0063] Furthermore, unless otherwise specified, ordinal numbers such as "first" and "second" used in the embodiments of the present application are used to distinguish between multiple objects, and are not intended to limit the order, chronological order, priority, or importance of the multiple objects. For example, first information and second information are used only to distinguish between different information, and do not indicate that the two types of information are different in content, priority, transmission order, or importance, etc.

[0064] First, technical terms used in the embodiments of the present application will be explained below.

[0065] 1. Node

[0066] A node is an electronic device or a component (e.g., a chip or integrated circuit) within an electronic device that can process, transmit, and receive data. An electronic device may include a terminal device or a network side device. For example, a node may be a cockpit domain device or a module within a cockpit domain device (e.g., one or more of modules such as a cockpit domain controller (CDC), a camera, a screen, a microphone, a speaker, an electronic key, and a passive entry passive start system controller). In a specific implementation process, the node may alternatively be a data relay device, such as a base station, a router, a repeater, a bridge, or a switch; or may be a terminal device, such as various types of user equipment (UE), a mobile phone, a tablet computer (pad), a desktop computer, an earphone, and a stereo; or may further include a machine intelligent device, such as a self-driving device, a transportation safety device, a smart home device (e.g., one or more of an audio-visual device, a security device, a smart lighting device, and an environmental monitoring device), a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a machine type communication (MTC) device, an industrial control device, a remote medical device, a smart grid device, or a smart city device; or may further include a wearable device (e.g., a smart watch, a smart band, or a pedometer), etc.

[0067] In some technical scenarios, devices with similar data transmission and reception capabilities may not be called nodes, however, for ease of description, electronic devices with data transmission and reception capabilities are collectively referred to as nodes in the embodiments of this application.

[0068] 2. Security algorithms (encryption algorithms)

[0069] (1) Hash algorithm

[0070] A hash algorithm is also called a hash function or hash algorithm. A hash algorithm can output a part of data (e.g., a string, a number, or a file) as a hash value (a hash value can also be called a hash value or a digest value) of a preset length (e.g., 80 bits or 128 bits), and it is very difficult to find the inverse law. Common hash algorithms mainly include secure hash algorithm 1 (SHA-1) and message digest (MD) algorithms (e.g., MD2, MD4, or MD5), etc.

[0071] (2) Encryption algorithm

[0072] Encryption algorithms are used to protect the confidentiality of data and are usually represented as encrypting plaintext to obtain ciphertext. Encryption algorithms may include cryptographic operations (e.g., elliptic point addition or exclusive-or), and may also include various mathematical functions with relatively high security. Common encryption algorithms include exclusive-or, data encryption standard (DES), triple data encryption algorithm (3DES), advanced encryption standard (AES), RSA encryption algorithm, and data structure analysis (DSA) algorithm.

[0073] (3) Key derivation algorithm

[0074] A key derivation algorithm is used to derive (derive or derive) one or more secret values ​​from a secret value. This is also called a key derivation algorithm. For example, a new secret value DK derived from a secret value Key may be expressed as follows: DK=KDF(Key). Common key derivation algorithms include password-based key derivation function (PBKDF) and scrypt algorithm, etc. PBKDF algorithms further include the first generation PBKDF1 and the second generation PBKDF2. In the key derivation process of some KDF algorithms, a hash algorithm is used to perform a hash transformation on the input secret value. Therefore, the algorithm identifier may be further used to indicate the hash algorithm received and used as an input of the KDF function.

[0075] It should be noted that KDFs may be applied not only to the process of obtaining secret values ​​by derivation, but also to aspects such as the generation of authentication and identity information.

[0076] Of course, an authentication algorithm (authentication function, AUF, or AUTH function) may also be used to generate authentication information and identity information. The authentication algorithm is used to obtain authentication information based on input parameters.

[0077] (4) Key Negotiation Algorithm

[0078] Key negotiation is the process in which both communicating parties exchange some parameters and obtain a key through negotiation. The algorithm used in key negotiation is called the key negotiation algorithm or key exchange algorithm. Common key negotiation algorithms include the Diffie-Hellman key exchange (DH) algorithm, the Elliptic Curve Cryptosystems (ECC)-based DH (ECDH) algorithm, the Chinese encryption algorithms (such as SM1, SM2, SM3, and SM4), and the Oakley algorithm.

[0079] Note that the key negotiation algorithm may also be considered as a key negotiation protocol: for both communicating parties, the key negotiation algorithm specifies the rules for key generation and exchange, and how to use the keys for encryption depends on other algorithms.

[0080] 3.DH Algorithm

[0081] The DH algorithm may allow two parties over an insecure channel to create a key that can be used to encrypt subsequent communications.

[0082] 1 is a schematic diagram of the DH algorithm according to one embodiment of the present application. A first node and a second node obtain a determined prime number p and a random number g. The steps of exchanging keys between two nodes using the DH algorithm are as follows:

[0083] Step 1: The second node determines a random number a.

[0084] Step 2: The second node generates a first calculated value A, where A=g a mod p.

[0085] Step 3: The second node sends the first calculated value A to the first node.

[0086] Step 4: The first node determines a random number b.

[0087] Step 5: The first node obtains a second calculated value B by calculation, where B=g b mod p.

[0088] Step 6: The first node determines a key s, where s=A b mod p.

[0089] Step 7: The first node sends the second calculated value B to the second node.

[0090] Step 8: The second node determines a key s, where s=B a mod p.

[0091] s=A b mod p=(g a mod p) b mod p=g ab mod p=(g b mod p) a mod p=B amod p, the key s calculated by the first node and the second node is the same. The key s is not directly transmitted in the message. Therefore, the attacker cannot directly obtain this key. The key s obtained through negotiation can be calculated only after the attacker obtains a or b by brute-force cracking. In this case, the formula for the attacker to obtain a computationally by brute-force cracking based on A, g, and p is a=log gA mod p. Since there is no fast calculation algorithm for logarithm arithmetic and the values ​​of the prime number p and the random number g are usually relatively large, it is difficult for an attacker to obtain a by performing logarithm arithmetic and modulus arithmetic based on A, the prime number p, and the random number g. Therefore, the key K obtained using the DH algorithm is secure.

[0092] 4. Elliptic Curve Algorithms

[0093] Elliptic curve algorithms are security algorithms that are implemented based on the mathematical theory of elliptic curves. Usually, the curve equation of an elliptic curve that people talk about is a binary cubic equation. There are several forms of this equation. The most commonly used general equation is as follows:

number

[0094] From the curve equation and the image, it is easy to see that the elliptic curve is symmetric about the x-axis.

number

[0095] (1) Point addition (elliptic curve addition)

[0096] 2(a), 2(b) and 2(c) are schematic diagrams of possible point addition operations according to the present application. Referring to FIG. 2(a), the addition operation on an elliptic curve can be expressed in the following manner: Mark points P and Q on the curve (herein, the elliptic curve with a=0 and b=7, i.e., y 2 =x 3 +7 as an example); draw a line through points P and Q and intersect the curve at a third point -R; and continue to draw a point R that is symmetrical to point -R with respect to the x-axis. Point R is the point obtained by adding P and Q, and is represented by P+Q=R.

[0097] Note that since elliptic curves are symmetric with respect to the x-axis, R is the symmetric point with respect to point-R, and since point-R is on the elliptic curve, point-R is also definitely on the elliptic curve, i.e., the point obtained by adding P and Q is on the elliptic curve.

[0098] Referring to Fig. 2(b), when P=Q, a tangent line of the elliptic curve is drawn using point P as the tangent point. The tangent line intersects with the elliptic curve at another point represented by point -R. Similarly, a point R is drawn that is symmetrical to point -R with respect to the x-axis. Point R is obtained by adding P and P, and is represented by P+P=2P=R.

[0099] (2) Point subtraction (elliptic curve subtraction)

[0100] Referring to FIG. 2(c), since RP=R+(-P), solving (RP) is an addition operation between points R and -P. Point -P is a point symmetrical to point P. Hence, a line is drawn through points R and -P. Since the elliptic curve is symmetrical with respect to the x-axis, it can be seen that this line is tangent to the elliptic curve at point -P. Thus, point P is drawn that is symmetrical to point -P with respect to the x-axis, and point P is the point obtained by adding points R and -P.

[0101] (3) Point multiplication

[0102] When adding a point on an elliptic curve n times in succession, the result obtained is the result of adding a point P n times, denoted by nP. The number of additions, n, is an integer and is sometimes called a scalar. A point multiplication operation on an elliptic curve is sometimes called a scalar multiplication operation. When the operation involves multiple scalars, the operation is sometimes called a multi-scalar multiplication operation.

[0103] It should be noted that the point multiplication algorithm may have different definitions in different operation scenarios, and the implementation depends on the specifically defined operation law of the point multiplication algorithm. Here, we present a possible calculation scheme of the elliptic curve point multiplication algorithm.

[0104] (4)ECDH key exchange

[0105] Elliptic curve algorithms require a cyclic subgroup of an elliptic curve defined in a finite field. The required parameters are: a prime number p used to describe the size of the finite field, parameters a and b of the elliptic curve equation, a base point G used to generate the cyclic subgroup, the order n of the subgroup, and a cofactor h of the subgroup (h=N / n, where N is the order of the elliptic curve group). In general, six parameters (p, a, b, G, n, h) combine to define the elliptic curve used by an elliptic curve algorithm.

[0106] The ECDH algorithm is mainly implemented based on the following equation K=k×G, where K and G are points on the elliptic curve Ep(a,b), n is the order of G (nG=O∞, where O∞ means infinity), and k is an integer smaller than n. In K=kG, for a given k and G, it is easy to calculate K according to the addition law (for example, accumulation using the addition operation of points). However, on the contrary, for a given K and G, it is very difficult to obtain k. In the practical use of the elliptic curve algorithm, in principle, p is very large and n is also very large. Therefore, it is a mathematical problem to calculate n points one by one and compare it with K.

[0107] In the key exchange process, assume that both parties in the key exchange are Alice and Bob, and that both parties share the curve parameters (elliptic curve E, order N, base point G). The stages of the exchange may be as follows:

[0108] Step 1: Alice generates a random integer a and calculates a first value A=a×G.

[0109] Step 2: Bob generates a random integer b and calculates a second value B=b×G.

[0110] Step 3: Alice forwards A to Bob. The forwarding of A may be public. Specifically, an attacker can obtain A and G, but it is difficult for the attacker to compute a based on A and G.

[0111] Step 4: Bob forwards B to Alice. Similarly, the forwarding of B may be public. Specifically, an attacker can obtain B and G, but it is difficult for the attacker to compute a based on B and G.

[0112] Step 5: Bob receives A forwarded by Alice and calculates Q = b × A = ab × G.

[0113] Step 6: Alice receives B forwarded by Bob and calculates Q′=a×B=ab×G.

[0114] Both Alice and Bob obtain Q=b×A=b×(a×G)=(b×a)×G=(a×b)×G=a×(b×G)=a×B=Q′ (commutative and associative laws), i.e., both obtain the same key Q. Since the key Q is not directly transmitted, it is difficult for an attacker to calculate Q based on the obtained A, B, and G. Therefore, the key Q obtained by the exchange using the ECDH algorithm is secure.

[0115] 5. Fresh parameters

[0116] A fresh parameter is a parameter in the field of information security, and is used to generate keys and authentication parameters, etc., and may also be called fresh or fresh parameters. The fresh parameter may include at least one of a number once (NONCE), a count value, a serial number, and a sequence number, etc. Usually, fresh parameters generated at different times are different. It will be understood that the specific value of the fresh parameter changes every time the fresh parameter is generated, and the fresh parameter (or authentication parameter, etc.) used to generate a key this time is different from the fresh parameter (or authentication parameter, etc.) used to generate a key last time, so that the security of the generated key can be improved.

[0117] A NONCE is a random value that is used only once (or never repeated).

[0118] 6. Password

[0119] A password may be understood as a password that is set or predefined by a node for accessing another node, or as a secret value agreed upon between two nodes. Optionally, the password may be in the form of a string including one or more of numbers, letters, and symbols, and may be entered using a keyboard, voice, or biometric information, etc. For example, in a scenario where a mobile phone terminal accesses a router that supports the Wireless Fidelity (Wi-Fi) protocol, the mobile phone terminal may access the router using a "Wi-Fi password", and the "Wi-Fi password" may be understood as the password of the router.

[0120] Optionally, a password may be used in the following scenario (assuming a second node requests access to a first node):

[0121] Scenario 1: The first node may predetermine or pre-set a first password, and a user of the second node may enter the first password on the second node. Specifically, the second node may receive the first password entered by the user and request access to the first node based on the first password. For example, a vehicle owner may set a first password for the vehicle using an administrator interface. When a new smartphone of the vehicle owner needs to access the vehicle, the vehicle owner may enter the first password on the new smartphone, and the smartphone may request access to the vehicle based on the entered password.

[0122] Scenario 2: The first node predetermines or pre-sets a first password. Similarly, the first password for accessing the first node is also pre-set in the second node. When the second node needs to access the first node, the second node can do so using the pre-set first password. For example, when assembling a vehicle, a vehicle factory may set a first password in the CDC of the vehicle, and set the first password of the CDC in the radar of the vehicle. In this way, when the radar accesses the CDC of the vehicle, it can access the CDC using the first password of the CDC.

[0123] Scenario 3: A third party device (such as a network-side device, a certification center, or an authentication server trusted by the first node) may assign an agreed-upon value to the first node and the second node, where the agreed-upon value may be used by the second node to access the first node. Thus, the agreed-upon value may be regarded as an access password for the first node.

[0124] It will be understood that the above description of the algorithm is merely used to briefly explain the implementation principle, and does not limit the implementation to use the same parameters during use. There may be other improvements and modifications in the specific implementation process of the algorithm. The algorithm mentioned in this application may be the algorithm obtained after improvements and modifications. For example, ECC may be incorporated into the DSA algorithm, and the combination is called the ECDSA algorithm.

[0125] Furthermore, it should be noted that "authentication", "verification" and "verification" referred to in the embodiments of the present application may refer to the meaning of confirming authenticity and validity. The term "access" referred to in the embodiments of the present application refers to a process in which a first node establishes a connection to a second node. In some specific technical scenarios, "access" may also be described as association.

[0126] The following describes the system architecture and service scenarios in the embodiments of the present application. It should be noted that the system architecture and service scenarios described in the present application are intended to more clearly describe the technical solutions in the present application, and do not constitute limitations on the technical solutions provided in the present application. With the evolution of system architecture and the emergence of new service scenarios, those skilled in the art will understand that the technical solutions provided in the present application can also be applied to similar technical problems.

[0127] 3 is a schematic diagram of a possible communication system according to an embodiment of the present application. The communication system includes a first node 301 and a second node 302. The second node 302 may request association with the first node 301. After successful association, the first node 301 can communicate with the second node 302. The communication link between the first node 301 and the second node 302 may include various types of connection media, including a wired link (e.g., optical fiber), a wireless link, or a combination of a wired link and a wireless link, etc. For example, the short-range connection technology may include 802.11b / g, Bluetooth, ZigBee, radio frequency identification (RFID) technology, ultra wideband (UWB) technology, or a wireless short-range communication system (e.g., an in-vehicle wireless short-range communication system), etc. As another example, long-range connectivity technologies may include radio access technologies such as Long Term Evolution (Long Term Evolution) based communication technologies, 5th generation mobile networks or 5th generation wireless systems (5th-Generation, 5G or 5G technology for short), global system for mobile communications (GSM), general packet radio service (GPRS), universal mobile telecommunications system (UMTS), and the like.

[0128] Of course, other wireless communication technologies may be used to support communication between the first node and the second node. For example, in some particular implementation scenarios, the first node may also be referred to as a node G, a control node, or an access point, and the second node may also be referred to as a node T or a terminal. A communication link from node G to node T may be referred to as link G, and a communication link from node T to node G may be referred to as link T.

[0129] The first node 301 and the second node 302 may be the same type of device or different types of devices. For example, FIG. 4 is a schematic diagram of a possible communication scenario. A vehicle cockpit domain controller (CDC) 401 is a control center in the vehicle's intelligent cockpit device and may be regarded as the first node 401. A smartphone 402 is a device with data transmission and reception capabilities and may be regarded as the second node 402.

[0130] The CDC 401 may be accessed through Bluetooth. The smartphone 402 supports Bluetooth functionality. Thus, the smartphone 402 may request access to the CDC 401. Bluetooth technology typically uses digital pairing or just work modes for connection. Thus, in digital pairing mode, the identifier of the CDC 401 is tapped directly on the smartphone 402, and the pairing number is confirmed by the CDC 401, so that the CDC 401 can be connected through Bluetooth. In this case, if an attacker connects to the CDC 401 using the identity of the smartphone 402, the CDC 401 cannot identify the attacker, and the attacker succeeds in accessing the CDC 401, thus threatening the privacy and security of the vehicle. In this specification, only the access scenario through Bluetooth is used as an example. A specific access scenario may further include access made using another communication technology. Similarly, in some other scenarios, when accessing a node using a conventional method, communication security is affected because it is usually difficult to prevent an attacker with an unknown identity from accessing the node.

[0131] Therefore, to improve security, an embodiment of the present application provides a secure access method as shown in FIG.

[0132] 5 is a schematic flow chart of a secure access method according to an embodiment of the present application. Moreover, the method may be implemented based on the architecture shown in FIG 3. The method includes at least the following steps:

[0133] Step S501: A second node sends a first message to a first node, the first message including a first ciphertext, the first ciphertext being obtained based on a first key negotiation parameter and a security parameter.

[0134] Specifically, the key negotiation parameters are parameters determined in the key negotiation process. For ease of explanation, in the embodiments of the present application, the key negotiation parameters sent by the second node to the first node are called first key negotiation parameters.

[0135] For example, a first node and a second node perform key negotiation based on the DH algorithm and use a relatively large prime number p and a random number g as the public key. The second node determines a calculated value A based on its own private key (a) and public key (p and g). The prime number p, the random number g, the private key a, and the calculated value A may all be considered as parameters generated in the key negotiation process. Because the calculated value A is determined by the second node and then sent to the first node, the calculated value A may be considered as a first key negotiation parameter.

[0136] In another example, the first node and the second node perform key negotiation based on the ECDH algorithm. Assuming that the determined elliptic curve is Ep and the base point is G, the second node obtains a calculated value A (e.g., A=a×G) based on its own private key a and the base point G, and sends the calculated value A to the first node. In this case, the calculated value A may be regarded as the first key negotiation parameter.

[0137] The security parameter is a parameter shared between the first node and the second node, for example, a shared key between the first node and the second node (including a pre-shared key or a symmetric encryption key, etc.), a first password, a pre-configured parameter between the first node and the second node, or a parameter predetermined in a communication protocol.

[0138] A pre-shared key (PSK) is a secret value shared between a first node and a second node. The second node may obtain the PSK shared with the first node in a manner such as predetermined, pre-configured, or generated through mutual negotiation, and the second node may use the PSK to encrypt messages.

[0139] The first password may be understood as an access password agreed between the first node and the second node, or as a password preset or predefined by the first node to allow the second node to access the first node, or as a secret value agreed between the first node and the second node. Furthermore, for a related explanation of the first password, please refer to the explanation in the explanation section of technical terms. Here, the details will not be described again.

[0140] In the following, the pre-shared key PSK is used as an example to show four implementation methods for obtaining the first ciphertext based on the security parameter and the first key negotiation parameter.

[0141] Implementation method 1: The second node performs a point addition operation based on the PSK and the first key negotiation parameters to obtain a first ciphertext. Furthermore, the first node may first perform a hash operation on the PSK, and then perform a point addition operation based on the hash value of the PSK and the first key negotiation algorithm to obtain a first ciphertext. For example, the first ciphertext C1 may be expressed by the following formula:

number

[0142] A point addition operation may be performed on a point on the elliptic curve. However, in a specific implementation process, if the first key negotiation parameter is not a point on the elliptic curve, the first key negotiation parameter may first be mapped to a point on the elliptic curve, and then a point addition operation is performed. Other parameters, such as PSK and hash(PSK), may be similarly mapped. A possible calculation method is given in this application. That is, the second node may use hash(PSK) as the horizontal coordinate (if hash(PSK) exceeds the domain, a modulus operation may be performed on hash(PSK)), obtain a mapping point R(hash(PSK),y1) on the elliptic curve, and perform an elliptic curve point addition operation based on the point R and KEt to obtain a point S(x2,y2). The second node may use the horizontal coordinate x2 or the vertical coordinate y2 of the point S as C1. Correspondingly, if one x-value corresponds to multiple y-values, the conditions that the y-values ​​must satisfy can be pre-agreed upon (e.g. the one y-value with the largest absolute value is selected) so that the corresponding point is determined.

[0143] Optionally, if the key negotiation algorithm directly used by the first node and the second node is an ECDH algorithm, the first ciphertext may be obtained using the method of implementation example 1. Of course, if the key negotiation algorithm is not an ECDH algorithm, the key negotiation parameters may alternatively be mapped to a point on an elliptic curve, so that the first ciphertext is obtained using a point addition operation.

[0144] Method 2: The second node performs a multiplication operation based on the PSK and the first key negotiation parameter to obtain a first ciphertext C1. For example, the first ciphertext C1 can be expressed by the following formula:

number

[0145] Optionally, when the key negotiation algorithm directly used by the first node and the second node is a DH algorithm, the first ciphertext may be obtained using the method of implementation example 2. Of course, even if the key negotiation algorithm is not a DH algorithm, a multiplication operation may be performed to obtain the first ciphertext.

[0146] Implementation method 3: The second node encrypts the first key negotiation parameters using an encryption algorithm based on the PSK or the hash value of the PSK to obtain a first ciphertext. For example, the obtained first ciphertext C1 satisfies the following formula: C1=Enc(hash(PSK),KEt). Here, Enc is an encryption algorithm, and specifically may be one of the following: SM4 algorithm, ZUC algorithm, AES algorithm, etc., or a combination thereof.

[0147] Implementation method 4: The second node may derive a key based on the PSK (for ease of explanation, this key is called a first intermediate key), and encrypt the first key negotiation parameter based on the first intermediate key to obtain a first ciphertext. For example, the first intermediate key K1 satisfies the following formula: K1=KDF(Hash(PSK), NONCEd), where KDF is a derivation algorithm used to derive the first intermediate key, and NONCEd is a fresh parameter (an optional parameter and used here as an example only) used to derive the first intermediate key. The first ciphertext C1 obtained by the second node satisfies C1=Enc(K1, KEt).

[0148] It should be noted that in order to more clearly describe the present solution, implementation method 4 describes how to obtain the first ciphertext by performing multiple steps. In actual processing, the first ciphertext may alternatively be obtained by performing one step. The first intermediate key K1 is just an intermediate result, that is, the scheme for determining the first ciphertext C1 satisfies C1=Enc(KDF(Hash(PSK),NONCEd),KEt).

[0149] It will be understood that the PSK may be replaced with a first password, a pre-set parameter between the first node and the second node, or a parameter predefined in a communication protocol, etc. Details will not be described again here. In one possible design example, if the second node has a PSK between the second node and the first node, the second node obtains the first ciphertext based on the PSK and the first key negotiation parameter. If the second node does not have a PSK between the second node and the first node, the second node obtains the first ciphertext based on the first password and the first key negotiation parameter.

[0150] Optionally, the first message may further include a fresh parameter. For ease of description, in each embodiment of the present application, the fresh parameter included in the first message is called a first fresh parameter. The fresh parameter includes at least one of a random number, a count value, and a serial number, etc.

[0151] Optionally, the first node may broadcast a message. In response, the second node may receive the message broadcasted by the first node. The second node transmits first information to the first node based on the message broadcasted by the first node. Further optionally, the message broadcasted by the first node may carry an indication of a key negotiation algorithm supported by the first node (or referred to as a key negotiation algorithm capability of the first node).

[0152] Further optionally, the second node may determine one of the key negotiation algorithms supported by the first node as the algorithm to be used in the key negotiation with the first node, in which case the first message may further carry an identifier of the key negotiation algorithm selected by the second node.

[0153] The second node transmits a first message to the first node, and in response, the first node receives the first message from the second node.

[0154] Please note that the first message may also be called an access request message (or access request information), or may be called an association request message (or may be called association request information in a specific scenario). In each embodiment of the present application, the name of the message or information is not limited, and only the content of the message is described and expressed as an example. The name of the message may be randomly replaced.

[0155] Step S502: The first node decrypts the first ciphertext based on the security parameter to obtain a first key negotiation parameter.

[0156] Specifically, the first ciphertext is obtained based on the security parameter and the first key negotiation parameter, and the security parameter is a parameter that can be obtained by both the first node and the second node. Therefore, the first node can decrypt the first ciphertext based on the security parameter and obtain the first key negotiation parameter.

[0157] Corresponding to the above implementation example in which the second node obtains the first ciphertext, the present application provides several implementation examples in which the first ciphertext is decrypted as follows.

[0158] Implementation Example 1: The first node performs an elliptic point subtraction operation based on the first ciphertext and the PSK (or the hash value of the PSK) to obtain the first key negotiation parameter. For example, the first key negotiation parameter KEt is expressed by the following formula:

number

[0159] Implementation Example 2: The first node performs a division operation based on the first ciphertext and the PSK (or the hash value of the PSK) to obtain the first key negotiation parameter. For example, the first key negotiation parameter KEt is calculated using the following formula:

number

[0160] Implementation Example 3: The first node decrypts the first ciphertext by using an encryption algorithm and using the PSK or a hash value of the PSK as input to the encryption algorithm. For example, the first key negotiation parameter KEt satisfies the following formula: KEt=Dec(hash(PSK),C1), where Dec is the decryption algorithm corresponding to the encryption algorithm Enc (the encryption algorithm and the decryption algorithm may be the same algorithm in general, or may be computational procedures with different algorithms in particular, and different names are used here for ease of explanation).

[0161] Implementation Example 4: The first node derives a first intermediate key based on the PSK, decrypts the first ciphertext based on the first intermediate key, and obtains a first key negotiation parameter. For example, the first intermediate key K1 satisfies the following formula: K1=KDF(Hash(PSK), NONCEd), where KDF is a derivation algorithm used to derive the first intermediate key, and NONCEd is a fresh parameter used to derive the first intermediate key. The obtained first key negotiation parameter KEt satisfies the following formula: KEt=Dec(K1, C1).

[0162] Step S503: The first node determines a first shared key based on the first key negotiation parameter and the key negotiation algorithm.

[0163] Specifically, the key negotiation algorithm may be a key negotiation algorithm pre-agreed between the first node and the second node, or the second node may convey an identifier of the key negotiation algorithm in the first message to indicate the key negotiation algorithm to be used.

[0164] This application presents several ways to determine the first shared key based on the first key negotiation parameters and the key negotiation algorithm.

[0165] Scheme 1: The first node may determine a secret key of the first node, and may determine an exchange key based on the key negotiation algorithm, the first key negotiation parameter, and the secret key of the first node. The exchange key may be used as the first shared key.

[0166] 6 is a schematic flow chart for determining an exchange key (first shared key) according to an embodiment of the present application. Referring to sub-diagram (a) of FIG. 6, a process for determining an exchange key based on a DH algorithm is described. The first node may input a first key negotiation parameter KEt into the DH algorithm. The first node may determine a random number b (used as the secret key of the first node) according to the procedure of the DH algorithm, and determine an exchange key K based on the random number b and the first key negotiation parameter. KE may be determined.

[0167] Referring to sub-diagram (b) of FIG. 6, the first node may input the first key negotiation parameter KEt to the ECDH algorithm. The first node may determine a random number b (used as the first node's private key) according to the procedure of the ECDH algorithm, and derive an exchange key K based on the random number b and the elliptic curve. KE Determine.

[0168] It will be appreciated that in some specific design examples, the key negotiation algorithm may be encapsulated in a computational procedure where the input is the first key negotiation parameter and the output is the first shared key. Of course, in some other possible design examples, the steps of determining the secret key and computing the exchange key may be performed in different computational procedures.

[0169] Scheme 2: The first node may determine a secret key of the first node, and determine an exchange key based on the key negotiation algorithm, the first key negotiation parameter, and the private key of the first node. The first node determines a first shared key based on the exchange key and the freshness parameter.

[0170] For example, the first node exchanges key K KE Determine the exchange key K KE For example, the first shared key Kgt may be determined based on the following formula: Kgt=KDF(K KE , NONCEt, NONCEg), where NONCEt is a first fresh parameter (optional parameter) and NONCEg is a second fresh parameter (optional parameter).

[0171] The first shared key obtained in method 2 (hereinafter referred to as the first shared key Kgt) is the exchange key K KE Please note that for ease of explanation, the first shared key Kgt is described as the second shared key in the claims, since the exchanged key is used as the first shared key in the solution described in Scheme 1. It will be understood that the terms "first" and "second" in this application are intended only to distinguish between parameters, and are not intended to limit the names of specific parameters.

[0172] Optionally, the secure access method shown in Figure 5 includes one or more of steps S504 to S509. Steps S504 to S509 are specifically as follows:

[0173] Step S504: The first node obtains a pre-shared key (PSK) between the first node and the second node.

[0174] Specifically, the PSK is a secret value shared between the first node and the second node. Below, we present two possible cases in which the first node obtains the PSK between the first node and the second node.

[0175] Case 1: A correspondence relationship between the PSK and the identity of the second node exists on the first node. In other words, on the first node, the PSK between the first node and the second node may correspond to the identity of the second node. The first node may obtain the corresponding PSK based on the identity and the correspondence relationship of the second node.

[0176] The identity of the second node may be an ID, a media access control (MAC) address, a domain name, a domain address, or another user-defined identity of the second node, also referred to as the device identity of the second node. Furthermore, the second node may add the identity of the second node to the first message, so that the first node can obtain the identity of the second node. Optionally, the correspondence between the PSK and the identity of the second node may be a correspondence pre-configured or pre-defined on the first node, or may be a correspondence stored after the first node and the second node generate the PSK through negotiation. The correspondence may be in one or more forms of a correspondence set, a data table, a database, and the like. This application is not limited thereto. Table 1 is a possible set of correspondence between the PSK and the identity of the second node shown in one embodiment of this application. The correspondence set includes a plurality of second node identities, corresponding PSKs, and PSK types. For example, for a second node with an identity of "ID1", the first node may determine that the PSK corresponding to the second node is "PSK1" based on the temporary ID "ID1.1". Furthermore, the type of "PSK1" is preset. Table 1. Complete set of correspondences between PSK and second node identity [Table 1]

[0177] It should be noted here that if the correspondence is preset, the PSK preset on the first node is the same as the PSK preset on the second node; or if the correspondence is stored after the PSK is generated, the method and parameters for the first node to generate the PSK are also the same as the method and parameters for the second node to generate the PSK. In one possible design example, if the correspondence between the PSK and the identity of the second node exists on the first node, this may indicate that the second node has previously accessed the first node, or that the first node has preset the PSK between the first node and the second node. Therefore, the first node can obtain the PSK based on the correspondence.

[0178] It should be noted that if the first node obtains the PSK in the manner of case 1, step S504 may alternatively be performed before step S502, and the PSK may be used to decrypt the first ciphertext. The order of performing other steps in this application may also be changed without affecting the implementation of the solution.

[0179] Case 2: The first node generates a PSK between the first node and the second node. Specifically, the parameters for generating the PSK include a first password, a first shared key (specifically, an exchange key K KE The PSK may include one or more of: a first fresh parameter, a second fresh parameter, an identity of the first node, and an identity of the second node, etc. In the following, several cases are given for the parameters for generating the PSK.

[0180] Case 1: The first node determines a random number, and uses the random number as the PSK between the first node and the second node.

[0181] Case 2: The first message includes a first fresh parameter, and the first node generates a PSK based on the first fresh parameter and the fresh parameter determined by the first node. For example, the generated PSK is

number

[0182] Case 3: The first node generates a PSK based on a first password. For example, the generated PSK satisfies PSK=KDF(pw, IDg, IDt, NONCEt, NONCEg, Kgt), where pw is the first password, IDg is the identity of the first node, IDt is the identity of the second node, NONCEt is the first fresh parameter, and NONCEg is the second fresh parameter. IDt, IDg, NONCEt, NONCEg, and Kgt are optional parameters, and Kgt is the aforementioned exchange key K. KE Note that it may be replaced by:

[0183] Furthermore, the first shared key Kgt is the exchange key K KE If the PSK generated by the first node is derived based on

number

[0184] For details about these parameters, please refer to the above explanation, and we will not explain them in detail again here.

[0185] In one possible design example, after generating the PSK between the first node and the second node, the first node may store the correspondence between the PSK and the identity of the second node.

[0186] Step S505: The first node obtains first identity authentication information based on the first shared key and / or the PSK.

[0187] Specifically, the first identity authentication information is used to authenticate the identity of the first node. For example, the first node may transmit the first identity authentication information to another node (e.g., the second node), and the other node may determine the identity of the first node based on the first identity authentication information.

[0188] This application provides the following three implementation examples for obtaining first identity authentication information.

[0189] Implementation Example 1: A first node determines a first identity credential based on a pre-shared key PSK. Optionally, the optional parameters involved in the generation of the first identity credential further include a first shared key (which is K KE The message may include one or more of: a first message, a second message in which the first identity information is placed (described below), an identifier of a key negotiation algorithm supported by the first node (or referred to as a key negotiation algorithm function of the first node), and an identifier of a key negotiation algorithm supported by the second node (or referred to as a key negotiation algorithm function of the second node). The aforementioned message may be the entire message or some parameters in the message. For example, the entire first message may be used as the parameter, or the first fresh parameter in the first message may be used as the parameter.

[0190] For example, in one possible design example, the first identity authentication information AUTHg satisfies AUTHg=KDF(PSK, first message, some parameters in the second message). Here, the second message may be a message in which the first identity authentication information is placed (described later). In this way, another node (e.g., the second node) may verify whether the PSK stored on the other node is the same as the PSK on the first node based on the first identity authentication information (if the PSK is the same as the PSK on the first node, this indicates that the identity of the first node is trustworthy), and may further verify whether some parameters in the first message and the second message have been tampered with. In other words, the first identity authentication information can not only authenticate the identity of the first node, but also protect the integrity of the first message and the second message. In another example, in another possible design example, the first identity authentication information AUTHg satisfies AUTHg=AUF(PSK, KDF). KE , first message, second fresh parameters). For details of these parameters, see the above description.

[0191] Implementation example 2: The PSK in implementation example 1 is the exchange key K KE Or it may be replaced with the first shared key Kgt.

[0192] Implementation Example 3: The first node determines a first key (also called an identity authentication key) based on the first shared key and / or the PSK, and generates a first identity authentication information based on the first key. It will be understood that in generating the first identity authentication information, neither the PSK nor the first shared key is directly used, but the first key obtained based on the PSK and / or the first shared key is used. In this way, the security of the PSK and the first shared key can be protected, and the security of the PSK and the first shared key can be improved.

[0193] Optionally, the first identity authentication information AUTHg generated by the first node satisfies AUTHg=KDF(Kauth, first message, some parameters in the second message). For the meaning of these parameters, please refer to the above definitions.

[0194] Further optionally, the following design example may be available for the first node to determine the first key (Kauth) based on the first shared key and / or PSK.

[0195] Design Example 1: The first key Kauth determined by the first node is

number

[0196] Design Example 2: The first key Kauth determined by the first node is

number

number

[0197] Design Example 3: K of Design Examples 1 and 2 KE But, K KEIn addition, the method of determining the first key Kauth may be replaced by the method of determining the first key Kauth based on the following:

number

[0198] Please see above for definitions of these parameters.

[0199] Similarly, the first node may also derive encryption and integrity protection keys using the methods shown in design examples 1 to 3.

[0200] For example, the encryption key Kenc determined by the first node is

number

[0201] In another example, the integrity protection key Kmac determined by the first node is

number

[0202] Step S506: The first node sends a second message to the second node. The second message includes a second ciphertext, and the second ciphertext is obtained based on the second key negotiation parameter and the security parameter. Optionally, the second message may further include the first identity authentication information.

[0203] Specifically, for ease of explanation, the key negotiation parameters sent by the first node to the second node are referred to as second key negotiation parameters.

[0204] The second key negotiation parameters are typically determined by the first node based on the first node's private key.

[0205] The security parameter is a parameter shared between the first node and the second node, such as a shared key between the first node and the second node (including a pre-shared key or a symmetric encryption key, etc.), a password agreed upon between the first node and the second node, a pre-configured parameter between the first node and the second node, or a parameter predefined in a communication protocol. For details, please refer to the detailed description of S501. Here, the details will not be described again.

[0206] Using PSK as an example, the following provides four implementation methods for the first node to obtain the second ciphertext based on the security parameter and the second key negotiation parameter.

[0207] Method 1: The first node performs a dot addition operation based on the PSK (or a hash value of the PSK) and the second key negotiation parameters to obtain a second ciphertext C2. For example, the second ciphertext C2 can be expressed by the following formula:

number

[0208] Method 2: The first node performs a multiplication operation based on the PSK (or a hash value of the PSK) and the second key negotiation parameter to obtain a second ciphertext C2. For example, the second ciphertext C2 can be calculated using the following formula:

number

[0209] Implementation method 3: The first node encrypts the second key negotiation parameters using an encryption algorithm based on the PSK (or the hash value of the PSK) to obtain a second ciphertext. For example, the obtained second ciphertext C2 satisfies the following formula: C2=Enc(hash(PSK),KEg). Here, Enc is an encryption algorithm, and specifically may be one or more of the SM4 algorithm, the ZUC algorithm, the AES algorithm, etc.

[0210] Implementation method 4: The first node may derive a first intermediate key based on the PSK or a hash value of the PSK, and use the first intermediate key to encrypt the second key negotiation parameters. For example, the first intermediate key K1 satisfies the following formula: K1=KDF(Hash(PSK), NONCEd), where KDF is a derivation algorithm used to derive the key, and NONCEd is a fresh parameter used to derive the first intermediate key (this is an optional parameter and is used here as an example only; if NONCEd is a random number determined by the second node, NONCEd may be sent to the first node using a message). The second ciphertext C2 obtained by the first node satisfies C2=Enc(K1, KEg).

[0211] It will be understood that the PSK may be replaced with a first password, a pre-configured parameter between the first node and the second node, or a parameter predefined in a communication protocol, etc. Details will not be described again here.

[0212] In one possible design, if the first node has a PSK between the first node and the second node, the first node derives the second ciphertext based on the PSK and the first key negotiation parameters. If the first node does not have a PSK between the first node and the second node, the first node derives the second ciphertext based on the first password and the second key negotiation parameters.

[0213] In one possible design example, according to the protocol specification, if a second node obtains a first ciphertext in a certain manner, the first node also obtains a second ciphertext in a corresponding manner, facilitating encryption and decryption.

[0214] Optionally, the second message may further include a fresh parameter determined by the second node. For ease of explanation, in each embodiment of the present application, the fresh parameter included in the second message is called a second fresh parameter. The fresh parameter includes at least one of a random number, a count value, and a serial number, etc.

[0215] In addition, optionally, the second message may further include a message authentication code (MAC), which is a message authentication code generated based on an integrity protection algorithm and is used to protect the integrity of the second message.

[0216] The first node sends a second message to the second node. In response, the second node receives the second message from the first node. It should be noted that in a specific implementation process, the second message may also be referred to as an authentication request message, a security context request message, or an identity authentication request message, or may be referred to as authentication request information, security context request information, or identity authentication request information.

[0217] Step S507: The second node decrypts the second ciphertext based on the security parameter to obtain a second key negotiation parameter.

[0218] Specifically, the second ciphertext is obtained based on the security parameter and the first key negotiation parameter, so that the second node can decrypt the second ciphertext based on the security parameter to obtain the second key negotiation parameter.

[0219] Corresponding to the above implementation example in which the first node obtains the second ciphertext, the present application provides several implementation examples in which the second ciphertext is decrypted as follows.

[0220] Implementation Example 1: The second node performs a point subtraction operation based on the second ciphertext and the PSK (or a hash value of the PSK) to obtain a second key negotiation parameter.

[0221] Implementation Example 2: The second node performs a division operation based on the second ciphertext and the PSK (or a hash value of the PSK) to obtain a second key negotiation parameter.

[0222] Implementation Example 3: The second node decrypts the second ciphertext by using the encryption algorithm and the PSK or a hash value of the PSK as input to the decryption algorithm. For example, the first key negotiation parameter KEt satisfies the following formula: KEg=Dec(hash(PSK),C2), where Dec is the decryption algorithm corresponding to the encryption algorithm Enc.

[0223] Implementation Example 4: The second node may derive a first intermediate key based on the PSK and use the first intermediate key to decrypt the second ciphertext. For example, the first intermediate key K1 satisfies the following formula: K1=KDF(Hash(PSK), NONCEd), where KDF is a derivation algorithm used to derive the first intermediate key, and NONCEd is a fresh parameter used to derive the first intermediate key. For example, the first key negotiation parameter KEt satisfies the following formula: KEt=Enc(K1, C2).

[0224] It should be noted that for the above implementation example, reference can be made to the detailed description of the decryption method at the first node in step S502.

[0225] Step S508: The second node determines the first shared key based on the second key negotiation parameter and the key negotiation algorithm.

[0226] Specifically, the key negotiation algorithm may be a key negotiation algorithm pre-agreed between the first node and the second node, or the second node may determine the algorithm to be used for the key negotiation process from one or more key negotiation algorithms supported by the first node based on requirements, or the first node may add an identifier of the key negotiation algorithm to a message sent to the second node to indicate the key negotiation algorithm to be used.

[0227] This application presents several ways to determine the first shared key based on the second key negotiation parameters and the key negotiation algorithm.

[0228] Scheme 1: The second node determines a secret key of the second node, and determines an exchange key based on the key negotiation algorithm, the second key negotiation parameter, and the secret key of the second node. The exchange key may be used as the first shared key.

[0229] Scheme 2: The second node may determine an exchange key based on the second key negotiation parameter and the second node's private key. The second node determines a first shared key based on the exchange key and the freshness parameter.

[0230] Please note that for the above implementation example, reference can be made to the detailed description of the first node determining the first shared key in step S503.

[0231] Step S509: The second node obtains second identity authentication information based on the first shared key and / or the PSK.

[0232] Specifically, the PSK is a secret value shared between the first node and the second node. The PSK may be generated based on a fresh parameter from the second node and a fresh parameter from the first node, or may be pre-configured or pre-defined on the first node and the second node.

[0233] Before determining the second identity authentication information, the second node may first obtain a PSK between the second node and the first node. The following shows two possible cases in which the second node obtains a PSK between the first node and the second node.

[0234] Case 1: A correspondence between the PSK and the identity of the first node exists on the second node, and the second node may obtain the corresponding PSK according to the identity of the first node and the correspondence. This correspondence may be in one or more forms of a set of correspondence, a data table, a database, etc. This application is not limited thereto. For details, please refer to the related description of the first node in step S504. Here, the details will not be described again.

[0235] Please note that if the second node obtains the PSK in the manner of case 1, step S509 may alternatively be performed before step S501, and the PSK may be used to encrypt the first key negotiation parameters.

[0236] Case 2: The second node generates a PSK between the second node and the first node. Specifically, the parameters for generating the PSK may include one or more of the following: a first password, a first shared key, a first fresh parameter, a second fresh parameter, an identity of the first node, and an identity of the second node, etc. For detailed description, please refer to the detailed description of the generation of the PSK by the first node in step S504. Details will not be described again here.

[0237] Optionally, the second node obtaining the second identity authentication information based on the first shared key and / or the PSK may include at least the following three implementation examples.

[0238] Implementation Example 1: A second node obtains a second identity credential based on a PSK. Optionally, the optional parameters involved in the generation of the second identity credential further include a first shared key (which is K KE The message may include one or more of the following: a first message, a second message, a third message in which the second identity authentication information is placed (described below), a key negotiation algorithm function of the first node, and a key negotiation algorithm function of the second node. The aforementioned messages may be the entire message or some parameters in the message. For example, the entire second message may be used as the parameter, or a second fresh parameter (NONCEt) in the second message may be used as the parameter.

[0239] For example, in one possible design example, the second identity authentication information AUTHt satisfies AUTHt=KDF(PSK, first message, second message, some parameters in the third message, key negotiation algorithm function of the first node). In this way, another node (e.g., the first node) may verify whether the PSK on the other node is the same as the PSK on the second node based on the second identity authentication information (if the PSK is the same as the PSK on the second node, this indicates that the identity of the second node is trustworthy), and may further verify whether some parameters in the first message, the second message, and the third message have been tampered with. In other words, the second identity authentication information can not only authenticate the identity of the second node, but also protect the integrity of the first message, the second message, and the third message.

[0240] In another example, in another possible design example, the second identity authentication information AUTHt is AUTHg=AUF(PSK,K KE , the second message, NONCEt, may satisfy the key negotiation algorithm function of the first node). For information on these parameters, see the above description.

[0241] Implementation example 2: The PSK in implementation example 1 is the exchange key K KE Or it may be replaced with the first shared key Kgt.

[0242] Implementation Example 3: The second node determines a first key (also called an identity authentication key) based on the first shared key and / or the PSK, and generates a second identity authentication information based on the first key. In other words, Kgt in Implementation Example 1 may be replaced with the first key Kauth.

[0243] It will be appreciated that in generating the second identity credential, neither the PSK nor the first shared key is used directly, but the first key derived based on the PSK or the first shared key is used, thus improving the security of the PSK and the first shared key.

[0244] Optionally, the second identity authentication information AUTHt generated by the second node satisfies AUTHt=KDF(Kauth, the first message, the second message, some parameters in the third message, a function of the key negotiation algorithm of the first node). For the meaning of these parameters, please refer to the definition above.

[0245] It should be noted that for the specific case in which the second node generates the first key Kauth, the encryption key, and the integrity protection key, reference can be made to the description of the first node in step S505, and the details will not be described again here.

[0246] Optionally, the secure access method in this embodiment of the present application may further include one or more of Steps S510 to S514 shown in Figure 7. Steps S510 to S514 are specifically as follows.

[0247] Step S510: The second node authenticates the identity of the first node based on the first identity authentication information.

[0248] Specifically, when a first node sends first identity information to a second node (e.g., a second message carries the first identity authentication information), the second node may authenticate the identity of the first node based on the first identity information.

[0249] In an optional solution, according to the protocol specification, if the first node generates the first identity authentication information using a certain parameter, the second node should also generate the verification information using the same parameter. If the verification information is the same as the first identity authentication information, it is considered that the verification is successful.

[0250] For example, since the first identity authentication information is determined based on the first shared key and / or PSK, the second node may authenticate the identity of the first node based on the first shared key and / or PSK and the first identity authentication information. Specifically, if the verification information generated by the second node based on the first shared key and / or PSK is the same as the first identity authentication information, it is determined that the identity authentication of the first node is successful.

[0251] In another example, if the first identity authentication information AUTHg satisfies AUTHg=KDF(Kauth, first message, some parameters in the second message), and the second node generates verification information check1=KDF(Kauth, first message, some parameters in the second message) based on Kauth, and the verification information check1 is the same as AUTHg, it is determined that the identity authentication of the first node is successful.

[0252] Optionally, if the verification of the first identity credential fails, the second node may disconnect the communication connection between the second node and the first node or discard the second message, and may resend the first message to the first node. For example, if the verification of the first identity credential fails, this indicates that the first shared key (PSK) on the second node is different from the first shared key (PSK) on the second node. Therefore, the identity of the first node cannot be trusted, and the first node may be a node impersonated by an attacker. Therefore, the second message is discarded and the first message is resent to the first node. In this way, access to untrusted nodes is avoided.

[0253] It should be noted that step S510 may alternatively be performed before step S509. The order of performing other steps in the present application may also be changed without affecting the implementation of the solution.

[0254] Step S511: The second node transmits a third message to the first node.

[0255] Specifically, the third message carries the second identity authentication information, which may be the second identity authentication information determined in step S509.

[0256] It will be appreciated that the second node transmits a third message to the first node and, in response, the first node receives a third message from the second node.

[0257] Step S512: The first node authenticates the identity of the second node based on the second identity authentication information.

[0258] Specifically, since the second identity credential is determined by the second node based on the first shared key and / or PSK, the first node may also obtain the first shared key and / or PSK to verify the second identity credential.

[0259] In an optional solution, according to the protocol specification, if the second node generates the second identity authentication information using a certain parameter, the first node should also generate the confirmation information using the same parameter. If the confirmation information is the same as the second identity authentication information, it is considered that the verification is successful.

[0260] For example, since the second identity authentication information is determined based on the first shared key and / or PSK, the first node may authenticate the identity of the second node based on the first shared key and / or PSK and the second identity authentication information. Specifically, if the verification information generated by the first node based on the first shared key and / or PSK is the same as the second identity authentication information, it is determined that the identity authentication of the first node is successful.

[0261] In another example, the second identity authentication information AUTHt satisfies AUTHt=KDF(Kauth, the first message, the second message, some parameters in the third message, the key negotiation algorithm function of the first node). In this case, the first node may generate the authentication information check2 based on the same parameters and scheme, that is, the authentication information check2 satisfies check2=KDF(Kauth, the first message, the second message, some parameters in the third message, the key negotiation algorithm function of the first node). If the authentication information check2 is the same as the second identity authentication information AUTHt, it is determined that the identity authentication of the second node is successful.

[0262] Optionally, if the verification of the second identity credential fails, the first node may disconnect the communication connection between the second node and the first node. If the verification of the second identity credential succeeds, this indicates that the identity of the second node is trusted, and the first node may communicate with the second node.

[0263] Step S513: The first node transmits a fourth message to the second node.

[0264] Optionally, the fourth message is used to indicate to the second node that an association has been established, or to indicate to the second node that access has been successful, or to indicate that identity verification of the second node has been successful, etc. In response, the second node may receive a fourth message from the first node.

[0265] Furthermore, the fourth message may be referred to as an association establishment message (or an association completion message in certain scenarios).

[0266] In the embodiment shown in FIG. 5, the second node encrypts the first key negotiation parameter based on the security parameter (the security parameter can be a PSK or a first password) to obtain a first ciphertext. Since the same security parameter is pre-set for the first node or the first node can obtain the same security parameter, the first node can decrypt the first ciphertext to obtain the first key negotiation parameter, and then generate a shared key based on the first key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated and the second node cannot access the first node. Therefore, it is possible to prevent the attacker from using the second node to access the first node, and to prevent the first node from successfully associating with an attacker having an untrusted identity.

[0267] The embodiment of the method shown in Figures 5 and 7 includes several possible implementation solutions. In the following, some implementation solutions are described by examples with reference to Figures 8A and 8B. It should be noted that for related concepts, operations, or logical relationships not described in Figures 8A and 8B, reference can be made to the corresponding descriptions of the embodiments shown in Figures 5 and 7.

[0268] Figures 8A and 8B are a secure access method according to an embodiment of the present application. Figures 9A to 9E are possible schematic operation diagrams of the secure access method. The method can be realized based on the architecture shown in Figure 3. The secure access method may include the following steps:

[0269] Step S801: A second node encrypts a first key negotiation parameter based on a security parameter to obtain a first ciphertext.

[0270] Specifically, the first key negotiation parameter is generally determined based on the secret key of the second node. Referring to Figures 9A to 9E, assuming that the key negotiation algorithm is an ECDH algorithm, the second node may determine the first key negotiation parameter KEt based on the secret key a and the base point G.

[0271] 9A to 9E, the second node may encrypt the first key negotiation parameter KEt using the security parameter 901 to obtain the first ciphertext C1. For a specific encryption method, please refer to the detailed description of step S501. Here, the details will not be described again.

[0272] Step S802: The second node sends a first message to the first node, the first message including the identity of the second node, a first ciphertext, and a first freshness parameter NONCEt.

[0273] Step S803: The first node decrypts the first ciphertext to obtain a first key negotiation parameter.

[0274] Specifically, the first ciphertext is obtained based on the security parameter and the first key negotiation parameter. Therefore, the first node can decrypt the first ciphertext based on the security parameter to obtain the first key negotiation parameter. Referring to FIG. 9A to FIG. 9E, since the security parameter 901 is a parameter shared between the first node and the second node, the first node can decrypt the first ciphertext C1 based on the security parameter 901 to obtain the first key negotiation parameter KEt. For a specific decryption method, please refer to the detailed description of step S502. Here, the details will not be described again.

[0275] Step S804: The first node encrypts the second key negotiation parameter based on the security parameter to obtain a second ciphertext.

[0276] Generally, the second key negotiation parameter is determined based on the secret key of the first node. With reference to Figures 9A to 9E, assuming that the key negotiation algorithm is an ECDH algorithm, the first node may determine the second key negotiation parameter KEg based on the secret key b and the base point G. For a specific encryption method, please refer to the detailed description of step S506. Here, the details will not be described again.

[0277] Step S805: The first node determines a first shared key based on the key negotiation algorithm, the first key negotiation parameter, the first fresh parameter, and the second fresh parameter.

[0278] Specifically, for example, referring to FIG. 9A to FIG. 9E, the first node derives an exchange key K based on the first node's secret key b and a first key negotiation parameter KEt. KE and exchange key K KE , the first shared key Kgt may be determined based on the first fresh parameter NONCEt and the second fresh parameter NONCEg.

[0279] In some possible scenarios, the first fresh parameter NONCEt and the second fresh parameter NONCEg are optional parameters (the parameters and steps shown with dashed lines in FIGS. 9A to 9E are optional parameters and steps).

[0280] Step S806: The first node determines an identity authentication key based on the first shared key and / or the PSK between the first node and the second node.

[0281] For details, please refer to the relevant description of step S504, and the details will not be described again here.

[0282] Referring to FIG. 9A to FIG. 9E, the identity authentication key Kauth generated by the first node is

number

number

[0283] Step S807: The first node determines first identity authentication information based on the identity authentication key and at least one of the first message and the second message.

[0284] For more details, please refer to the detailed description of step S505.

[0285] Step S808: The first node sends a second message to the second node, where the second message includes a second ciphertext, a second freshness parameter, and the first identity authentication information.

[0286] Step S809: The second node decrypts the second ciphertext to obtain second key negotiation parameters.

[0287] Specifically, the second ciphertext is obtained based on the security parameter and the second key negotiation parameter. Therefore, the second node can decrypt the second ciphertext based on the security parameter to obtain the second key negotiation parameter. Referring to FIG. 9A to FIG. 9E, since the security parameter 902 is a parameter shared between the first node and the second node, the first node can decrypt the first ciphertext C1 based on the security parameter 902 to obtain the second key negotiation parameter KEt. For a specific decryption method, please refer to the detailed description of step S507. Here, the details will not be described again.

[0288] It should be noted that in a specific implementation process, the security parameter 901 and the security parameter 902 are usually the same parameters. For example, the second node uses a first password as the security parameter 901, and the first node also uses the first password as the security parameter 902. However, in some scenarios, the security parameter 901 and the security parameter 902 may be different parameters. For example, the first node uses a first public key as the security parameter 901, and the second node uses a first private key as the security parameter 902, and the first public key and the first private key are a public-private key pair.

[0289] Step S810: The second node determines a first shared key based on the key negotiation algorithm, the second key negotiation parameter, the first fresh parameter, and the second fresh parameter.

[0290] For example, referring to FIG. 9A to FIG. 9E, the second node negotiates an exchange key K based on the second node's secret key a and a second key negotiation parameter KEg. KE and exchange key K KE, the first shared key Kgt may be determined based on the first fresh parameter NONCEt and the second fresh parameter NONCEg. The first fresh parameter NONCEt and the second fresh parameter NONCEg are optional parameters.

[0291] Step S811: The second node determines an identity authentication key based on the first shared key and the PSK between the first node and the second node.

[0292] For details, please refer to the relevant description of step S504, and the details will not be described again here.

[0293] Step S812: The second node verifies the first identity authentication information based on the identity authentication key and at least one of the first message and the second message.

[0294] For details, please refer to the relevant description of step S510, and the details will not be described again here.

[0295] Step S813: The second node determines second identity authentication information based on the identity authentication key and at least one of the first message, the second message, and the third message.

[0296] For more details, please refer to the detailed description of step S509.

[0297] Step S814: The second node sends a third message to the first node, where the third message includes second identity authentication information.

[0298] For details, see the description of step S511. Optionally, referring to Figures 9A-9E, the third message may be encrypted using an encryption key 903. The encryption key may be derived based on the first shared key and the PSK.

[0299] Optionally, integrity protection may further be performed on the third message using an integrity protection key.

[0300] Step S815: The first node verifies the second identity authentication information based on the identity authentication key and at least one of the first message, the second message, and the third message.

[0301] For details, please refer to the related description of step S512.

[0302] Optionally, the embodiment shown in FIG. 8A and FIG. 8B may further include step S816, specifically as follows.

[0303] Step S816: The first node transmits a fourth message to the second node.

[0304] Optionally, with reference to FIGS. 9A-9E, the fourth message may be encrypted using an encryption key 903.

[0305] Optionally, integrity protection may further be performed on the fourth message using an integrity protection key.

[0306] The method in the embodiment of the present application is described in detail above, and the apparatus in the embodiment of the present application is provided below.

[0307] FIG. 10 is a schematic diagram of the structure of a communication device 100 according to an embodiment of the present application. The device 100 may be a node, and may be referred to as a first node for ease of description. Of course, the device 100 may alternatively be a component in the first node, for example a chip or an integrated circuit. The device 100 may include a receiving unit 1001 and a processing unit 1002. The communication device 100 is configured to implement the secure access method described above, for example the secure access method in any of the embodiments shown in FIG. 5, FIG. 7, or FIG. 8A and FIG. 8B.

[0308] In one possible implementation example, the receiving unit 1001 is configured to receive a first message from the second node, the first message including a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key PSK between the first node and the second node or a first password, the first password being an agreed access password between the first node and the second node, the PSK between the first node and the second node being a secret value shared between the first node and the second node, and the first password may be regarded as a password used by the second node to access the first node; the processing unit 1002 is configured to decrypt the first ciphertext based on the security parameter and obtain the first key negotiation parameter; the processing unit 1002 is further configured to determine the first shared key based on the first key negotiation parameter and the key negotiation algorithm.

[0309] In this embodiment of the present application, the second node encrypts the first key negotiation parameter based on a security parameter (the security parameter can be a PSK or a first password). The same security parameter may be pre-set for the communication device, or the communication device can obtain the same security parameter, so that the communication device can decrypt the first ciphertext to obtain the first key negotiation parameter, and then generate a shared key based on the first key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated, and the second node cannot access the first node. Therefore, it is possible to prevent the attacker from using the second node to access the first node, and to prevent the first node from successfully associating with an attacker with an untrusted identity.

[0310] In one possible implementation example, the processing unit 1002 is further configured to obtain a PSK between the first node and the second node; and obtain first identity authentication information based on the first shared key and the PSK between the first node and the second node, where the first identity authentication information is used to authenticate the identity of the first node.

[0311] The communication device 100 may obtain a first identity authentication information based on the first shared key and the PSK, and the first identity authentication information may be used to authenticate the identity of the first node. In the present application, a method for authenticating the identity of the first node using the first identity information is presented. That is, the second node determines the first shared key and generates a verification information based on the first shared key and the PSK. If the verification information is the same as the first identity authentication information, this indicates that the first shared key and the PSK on the first node are the same as those on the second node. In this way, the identity of the first node can be authenticated, and communication between the node and an attacker is prevented, improving the security of the node.

[0312] In another possible implementation example, the processing unit 1002 is specifically configured to obtain a PSK between the first node and the second node based on the first correspondence; or determine a PSK between the first node and the second node based on the first password, the first shared key, the first random number, and the second random number, where the first message further includes the first random number.

[0313] It can be seen that the first node may store the correspondence relationship between the PSK and the second node in the form of a correspondence relationship, and thus the communication device 100 can obtain the PSK between the first node and the second node based on the first relationship.

[0314] In one possible design example, the PSK is determined based on the first password, the first shared key, the first random number, and the second random number. If the first node is associating with the second node for the first time or if the first node has not obtained the first correspondence, the first node does not have a PSK corresponding to the identity of the second node, and the communication device 100 can determine a new PSK.

[0315] In yet another possible implementation example, the processing unit 1002 is specifically configured to determine a second shared key based on the first shared key, the first random number, and the second random number; and to determine a PSK between the first node and the second node based on the first password, the second shared key, the first random number, and the second random number.

[0316] In yet another possible implementation example, the first ciphertext is obtained based on a hash value of the security parameter and the first key negotiation parameter; the processing unit 1002 is specifically configured to decrypt the first ciphertext based on the hash value of the security parameter and obtain the first key negotiation parameter.

[0317] In yet another possible implementation example, the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; the processing unit 1002 is specifically configured to obtain the first key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the first ciphertext.

[0318] In yet another possible implementation example, the processing unit 1002 is specifically configured to determine a first intermediate key based on the hash value of the security parameter and the first random number; decrypt the first ciphertext based on the first intermediate key, and obtain the first key negotiation parameter.

[0319] In yet another possible implementation example, the processing unit 1002 is specifically configured to: derive a first key based on the first shared key, the PSK, the first random number, and the second random number; and generate first identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

[0320] In yet another possible implementation example, the processing unit 1002 is further configured to encrypt the second key negotiation parameters based on the security parameters to obtain a second ciphertext; the apparatus 100 further includes a transmitting unit 1003 configured to transmit a second message to the second node, the second message including the first identity authentication information and the second ciphertext, and the second ciphertext is used by the second node to determine the first shared key.

[0321] The second key negotiation parameter is used by the second node to determine the shared key. It is understood that the communication device 100 can encrypt the second key negotiation parameter based on the security parameter, and the second key negotiation parameter can be decrypted to generate the shared key only after the security parameter is cracked. This prevents an attacker from masquerading as the second node to access the device 100, ensuring the security of the key negotiation process.

[0322] In yet another possible implementation example, the receiving unit 1001 is further configured to receive a third message from the second node, the third message including second identity authentication information; the processing unit 1002 is further configured to determine that the identity authentication of the second node is successful based on the PSK, the first shared key, and the second identity authentication information between the first node and the second node.

[0323] The above describes a method for authenticating the identity of the second node. The second identity authentication information is generated by the second node based on the PSK and the first shared key. Therefore, the communication device 100 can determine whether the first shared key and PSK on the second node are the same as those on the first node based on the PSK, the first shared key, and the second identity authentication information, so that the identity of the second node can be authenticated.

[0324] In yet another possible implementation example, the first message may also be referred to as an access request message (or an association request message). Furthermore, the second message may also be referred to as a security context request message (or an identity authentication request message). The third message may also be referred to as a security context response message (or an identity authentication response message).

[0325] In yet another possible implementation example, the sending unit 1003 is further configured to send a fourth message to the second node, where the fourth message is used to indicate that the access is successful or is used to indicate that the association is completed. Furthermore, the fourth message may be referred to as an association establishment message (or an access association completion message), or an association completion message, etc.

[0326] It should be noted that for the implementation of each unit, reference can be made to the corresponding description of the embodiment shown in Figure 5 or Figures 8A and 8B. The communication device 100 may be a first node in the embodiment shown in Figure 5 or Figures 8A and 8B.

[0327] It will be understood that in the embodiment of the device of the present application, the division into multiple units or modules is merely a logical division based on each function, and is not intended to limit the specific structure of the device. In a specific implementation, some functional modules may be subdivided into smaller functional modules, and some functional modules may be combined into one functional module. However, regardless of whether these functional modules are subdivided or combined, the general procedures performed by the device 100 in the secure access process are the same. For example, the receiving unit 1001 and the transmitting unit 1003 in the device 100 may be integrated into a communication unit, and the communication unit may implement the functions realized by the receiving unit 1001 and the transmitting unit 1003. Typically, each unit corresponds to a respective program code (or program instruction). When the program code corresponding to the unit runs on the processor, the unit is controlled by the processing unit to perform a corresponding procedure to realize the corresponding function.

[0328] FIG. 11 is a schematic diagram of the structure of a communication device 110 according to an embodiment of the present application. The device 110 may be a node, and may be referred to as a second node for ease of description. Of course, the device 110 may alternatively be a component in the first node, for example, a chip or an integrated circuit. The device 110 may include a sending unit 1101, a receiving unit 1102, and a processing unit 1103. The communication device 110 is configured to implement the secure access method described above, for example, the secure access method in any of the embodiments shown in FIG. 5, FIG. 7, or FIG. 8A and FIG. 8B.

[0329] In one possible implementation example, the sending unit 1101 is configured to send a first message to the first node, where the first message includes a first ciphertext, and the first ciphertext is obtained based on a security parameter and a first key negotiation parameter, where the security parameter is a pre-shared key PSK between the first node and the second node, or a first password, and the first password is an agreed-upon access password between the first node and the second node; the receiving unit 1102 is configured to receive a second message from the first node, where the second message includes a second ciphertext, and the second ciphertext is obtained based on the security parameter and a first key negotiation parameter. The key negotiation parameter is obtained by encrypting the second ciphertext; the processing unit 1103 is configured to decrypt the second ciphertext based on the security parameter to obtain the second key negotiation parameter; the processing unit 1103 is further configured to determine a first shared key based on the second key negotiation parameter and the key negotiation algorithm; the processing unit 1103 is further configured to obtain second identity authentication information based on the first shared key and a PSK between the first node and the second node, where the second identity authentication information is used to authenticate the identity of the second node.

[0330] In this embodiment of the present application, the communication device 110 encrypts the first key negotiation parameter based on the security parameter (the security parameter can be a PSK or a first password), and then sends the encrypted first key negotiation parameter to the first node. Correspondingly, the first node also encrypts the second key negotiation parameter based on the security parameter. Both communication parties may decrypt the ciphertext based on the security parameter and generate a shared key based on the key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated and the second node cannot access the first node. Therefore, the second node can be prevented from accessing the untrusted first node, and the security of the second node is improved.

[0331] In one possible implementation example, the processing unit 1103 is further configured to obtain a PSK between the first node and the second node.

[0332] In another possible implementation example, the processing unit 1103 is specifically configured to obtain a PSK between the first node and the second node based on the second correspondence; or determine a PSK between the first node and the second node based on the first password, the first shared key, the first random number, and the second random number, where the first message further includes the first random number, and the first message includes the first random number.

[0333] It can be seen that the correspondence between the PSK and the first node may be stored in the form of a correspondence, so that the communication device 110 can obtain the PSK between the first node and the second node based on the correspondence.

[0334] In one possible design example, the PSK is determined based on the first password, the first shared key, the first random number, and the second random number. If the first node associates with the second node for the first time or if the first node has not obtained the first correspondence, the second node does not have a PSK corresponding to the first node, so the communication device 110 can determine a new PSK in the manner described above.

[0335] In yet another possible implementation example, the processing unit 1103 is specifically configured to determine a second shared key based on the first shared key, the first random number, and the second random number; and to determine a PSK between the first node and the second node based on the first password, the second shared key, the first random number, and the second random number.

[0336] In yet another possible implementation example, the processing unit 1103 is further configured to encrypt the first key negotiation parameter based on the security parameter to obtain a first ciphertext.

[0337] In yet another possible implementation example, the processing unit 1103 is specifically configured to: encrypt the first key negotiation parameter based on a hash value of the security parameter to obtain a first ciphertext; or obtain the first ciphertext by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; or determine a first intermediate key based on the hash value of the security parameter and a first random number; and encrypt the first key negotiation parameter based on the first intermediate key to obtain the first ciphertext.

[0338] In yet another possible implementation example, the processing unit 1103 is specifically configured to: derive a first key based on the first shared key, the PSK, the first random number, and the second random number; and generate second identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

[0339] In yet another possible implementation example, the second message further includes first identity authentication information; the processing unit 1103 is further configured to determine that the identity authentication of the first node is successful based on the PSK, the first shared key, and the first identity authentication information between the first node and the second node.

[0340] Above, a method for authenticating the identity of a first node has been described. The first identity authentication information is generated by the first node based on the PSK and the first shared key. Therefore, based on the PSK, the first shared key, and the first identity authentication information, it can be determined whether the first shared key and PSK on the first node are the same as those on the second node, so that the identity of the first node can be authenticated. It should be noted that the opportunity to authenticate the identity of the first node may be periodic or aperiodic, or the identity of the first node may be authenticated before some important operation is performed, which is implementation dependent in a particular implementation.

[0341] In yet another possible implementation example, the first message may also be referred to as an access request message (or an association request message). Furthermore, the second message may also be referred to as a security context request message (or an identity authentication request message). The third message may also be referred to as a security context response message (or an identity authentication response message).

[0342] In yet another possible implementation example, the receiving unit 1102 is further configured to receive a fourth message from the first node, where the fourth message is used to indicate that the access is successful or is used to indicate that the association is completed. Furthermore, the fourth message may be referred to as an association establishment message (or an access association completion message), or an association completion message, etc.

[0343] It should be noted that for the implementation of each unit, reference can be made to the corresponding description of the embodiment shown in Figure 5 or Figures 8A and 8B. The communication device 110 may be a second node in the embodiment shown in Figure 5 or Figures 8A and 8B.

[0344] 12 is a schematic diagram of the structure of a communication device 120 according to an embodiment of the present application. The communication device 120 may be a node or a component within a node, for example, a chip or an integrated circuit. The device 120 may include at least one processor 1202 and a communication interface 1204. Additionally, optionally, the communication device may further include at least one memory 1201. Additionally, optionally, the communication device may further include a bus 1203. The memory 1201, the processor 1202, and the communication interface 1204 are connected using the bus 1203.

[0345] The memory 1201 is configured to provide a storage area in which data such as an operating system and computer programs may be stored, and may be one or a combination of random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), compact disc read-only memory (CD-ROM), and the like.

[0346] The processor 1202 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor unit (MPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a complex programmable logic device (CPLD), a co-processor (which assists the central processing unit in completing corresponding processes and applications), and a microcontroller unit (MCU).

[0347] The communication interface 1204 may be configured to provide input or output of information to at least one processor; and / or the communication interface may be configured to receive data transmitted from an external source and / or transmit data to an external source, and may be a wired link interface including an Ethernet cable or the like, or may be a wireless link (such as Wi-Fi, Bluetooth, general purpose radio transmission, or in-vehicle short-range communication technology) interface. Optionally, the communication interface 1204 may further include a transmitter (e.g., a radio frequency transmitter or antenna) or a receiver or the like coupled to the interface.

[0348] The processor 1202 in the device 120 is configured to read a computer program stored in the memory 1201 and perform the secure access method described above, for example the secure access method described in the embodiments shown in Figures 5, 7, or 8A and 8B.

[0349] In one design example, communication device 120 may be a first node in the embodiments shown in FIG. 5, FIG. 7, or FIG. 8A and FIG. 8B. The processor 1202 in the apparatus 120 is configured to read the computer program stored in the memory 1201 and perform the following operations: receiving a first message from the second node using the communication interface 1204, where the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key PSK between the first node and the second node or a first password, the first password being an agreed upon access password between the first node and the second node, the PSK between the first node and the second node being a secret value shared between the first node and the second node, and the first password may be regarded as a password used by the second node to access the first node; decrypting the first ciphertext based on the security parameter to obtain the first key negotiation parameter; and determining a first shared key based on the first key negotiation parameter and the key negotiation algorithm.

[0350] In this embodiment of the present application, the second node encrypts the first key negotiation parameter with a security parameter (the security parameter can be a PSK or a first password) to obtain a first ciphertext. The same security parameter may be pre-set for the communication device 120 or the communication device 120 can obtain the same security parameter, so that the communication device 120 can decrypt the first ciphertext to obtain the first key negotiation parameter, and then generate a shared key based on the first key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated and the second node cannot access the first node. Therefore, it is possible to prevent the attacker from using the second node to access the first node, and to prevent the first node from successfully associating with an attacker with an untrusted identity.

[0351] In one possible implementation, the processor 1202 is further configured to obtain a PSK between the first node and the second node; and obtain first identity authentication information based on the first shared key and the PSK between the first node and the second node, where the first identity authentication information is used to authenticate the identity of the first node.

[0352] The second node may obtain a first identity authentication information based on the first shared key and the PSK, and the first identity authentication information may be used to authenticate the identity of the first node. In the present application, a method for authenticating the identity of the first node using the first identity information is presented. That is, the second node determines a first shared key and generates a verification information based on the first shared key and the PSK. If the verification information is the same as the first identity authentication information, this indicates that the first shared key and the PSK on the first node are the same as those on the second node. In this way, the identity of the first node can be authenticated, and communication between the node and an attacker is prevented, improving the security of the node.

[0353] In another possible implementation example, the processor 1202 is specifically configured to obtain a PSK between the first node and the second node based on the first correspondence; or determine a PSK between the first node and the second node based on the first password, the first shared key, the first random number, and the second random number, where the first message further includes the first random number.

[0354] It can be seen that the first node can store the correspondence relationship between the PSK and the second node in the form of a correspondence relationship. Thus, the communication device 120 can obtain the PSK between the first node and the second node based on the first relationship.

[0355] In one possible design, the PSK is determined based on the first password, the first shared key, the first random number, and the second random number. If the first node is associating with the second node for the first time or if the first node has not obtained the first correspondence, the first node does not have a PSK corresponding to the identity of the second node, and the communication device 120 can determine a new PSK.

[0356] In yet another possible implementation example, the processor 1202 is specifically configured to determine a second shared key based on the first shared key, the first random number, and the second random number; and to determine a PSK between the first node and the second node based on the first password, the second shared key, the first random number, and the second random number.

[0357] In yet another possible implementation example, the first ciphertext is obtained based on a hash value of the security parameter and the first key negotiation parameter; the processor 1202 is specifically configured to decrypt the first ciphertext based on the hash value of the security parameter and obtain the first key negotiation parameter.

[0358] In yet another possible implementation example, the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameters and the first key negotiation parameter; the processor 1202 is specifically configured to obtain the first key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameters and the first ciphertext.

[0359] In yet another possible implementation example, the processor 1202 is specifically configured to determine a first intermediate key based on the hash value of the security parameters and the first random number; decrypt the first ciphertext based on the first intermediate key, and obtain a first key negotiation parameter.

[0360] In yet another possible implementation example, the processor 1202 is specifically configured to: derive a first key based on the first shared key, the PSK, the first random number, and the second random number; and generate first identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

[0361] In yet another possible implementation example, the processor 1202 is further configured to encrypt the second key negotiation parameters based on the security parameters to obtain a second ciphertext; and send a second message to the second node using the communication interface 1204, where the second message includes the first identity authentication information and the second ciphertext, and the second ciphertext is used by the second node to determine the first shared key.

[0362] The second key negotiation parameter is used by the second node to determine the shared key. It is known that the communication device 120 can encrypt the second key negotiation parameter based on the security parameter, and the second key negotiation parameter can be decrypted to generate the shared key only after the security parameter is cracked. This prevents an attacker from impersonating the second node to access the device 120, ensuring the security of the key negotiation process.

[0363] In yet another possible implementation example, the processor 1202 is further configured to receive a third message from the second node using the communication interface 1204, where the third message includes second identity authentication information; and determine that identity authentication of the second node is successful based on the PSK, the first shared key, and the second identity authentication information between the first node and the second node.

[0364] The above describes a method for authenticating the identity of the second node. The second identity authentication information is generated by the second node based on the PSK and the first shared key. Therefore, the communication device 120 can determine whether the first shared key and PSK on the second node are the same as those on the first node based on the PSK, the first shared key, and the second identity authentication information, so that the identity of the second node can be authenticated.

[0365] In yet another possible implementation example, the first message may also be referred to as an access request message (or an association request message). Furthermore, the second message may also be referred to as a security context request message (or an identity authentication request message). The third message may also be referred to as a security context response message (or an identity authentication response message).

[0366] In yet another possible implementation example, the processor 1202 is further configured to send a fourth message to the second node using the communication interface, where the fourth message is used to indicate that the access is successful or to indicate that the association is completed. Further, the fourth message may be referred to as an association establishment message (or an access association completion message), or an association completion message, etc.

[0367] For specific implementation, please refer to the detailed description of the embodiment shown in Fig. 3 or Fig. 5. Here, the details will not be described again.

[0368] In one design example, the communication device 120 may be the second node in the embodiment shown in Figure 5, Figure 7, or Figures 8A and 8B. The processor 1202 in the device 120 reads the computer program stored in the memory 1201 to perform operations of sending a first message to the first node using the communication interface 1204, where the first message includes a first ciphertext, the first ciphertext is obtained based on a security parameter and a first key negotiation parameter, the security parameter is a pre-shared key PSK between the first node and the second node or a first password, the first password is an agreed-upon access password between the first node and the second node; receiving a second message from the first node using the communication interface 1204, where the second message includes a first ciphertext, the first ciphertext is obtained based on a security parameter and a first key negotiation parameter, the security parameter is a pre-shared key PSK between the first node and the second node or a first password, the first password is an agreed-upon access password between the first node and the second node; the message includes a second ciphertext, the second ciphertext being obtained by encrypting a second key negotiation parameter based on the security parameter; decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter; determining a first shared key based on the second key negotiation parameter and the key negotiation algorithm; and obtaining second identity authentication information based on the first shared key and a PSK between the first node and the second node, where the second identity authentication information is used to authenticate the identity of the second node.

[0369] In this embodiment of the present application, the communication device 120 encrypts the first key negotiation parameter based on the security parameter (the security parameter can be a PSK or a first password), and then sends the encrypted first key negotiation parameter to the first node. Correspondingly, the first node also encrypts the second key negotiation parameter based on the security parameter. Both communication parties may decrypt the ciphertext based on the security parameter and generate a shared key based on the key negotiation parameter. Without obtaining the security parameter, the shared key cannot be generated and the second node cannot access the first node. Therefore, the second node can be prevented from accessing the untrusted first node, and the security of the second node is improved.

[0370] In one possible implementation, the processor 1202 is further configured to obtain a PSK between the first node and the second node.

[0371] In another possible implementation example of the sixth aspect, the processor is particularly configured to obtain a PSK between the first node and the second node based on the second correspondence; or determine a PSK between the first node and the second node based on the first password, the first shared key, the first random number, and the second random number, where the first message further includes the first random number, and the first message includes the first random number.

[0372] It can be seen that the correspondence between the PSK and the first node may be stored in the form of a correspondence, so that the communication device 120 can obtain the PSK between the first node and the second node based on the correspondence.

[0373] In one possible design example, the PSK is determined based on the first password, the first shared key, the first random number, and the second random number. If the first node associates with the second node for the first time or if the first node has not obtained the first correspondence, the second node does not have a PSK corresponding to the first node, so the communication device 120 can determine a new PSK in the manner described above.

[0374] In yet another possible implementation example, the processor 1202 is specifically configured to determine a second shared key based on the first shared key, the first random number, and the second random number; and to determine a PSK between the first node and the second node based on the first password, the second shared key, the first random number, and the second random number.

[0375] In yet another possible implementation example, the processor 1202 is further configured to encrypt the first key negotiation parameter based on the security parameter to obtain a first ciphertext.

[0376] In yet another possible implementation example, the processor 1202 is specifically configured to: encrypt the first key negotiation parameter based on a hash value of the security parameter to obtain a first ciphertext; or obtain the first ciphertext by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; or determine a first intermediate key based on the hash value of the security parameter and a first random number; and encrypt the first key negotiation parameter based on the first intermediate key to obtain the first ciphertext.

[0377] In yet another possible implementation example, the processor 1202 is specifically configured to: derive a first key based on the first shared key, the PSK, the first random number, and the second random number; and generate second identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

[0378] In yet another possible implementation example, the second message further includes first identity authentication information; and the processor 1202 is further configured to determine that identity authentication of the first node is successful based on the PSK, the first shared key, and the first identity authentication information between the first node and the second node.

[0379] Above, a method for authenticating the identity of a first node has been described. The first identity authentication information is generated by the first node based on the PSK and the first shared key. Therefore, based on the PSK, the first shared key, and the first identity authentication information, it can be determined whether the first shared key and PSK on the first node are the same as those on the second node, so that the identity of the first node can be authenticated. It should be noted that the opportunity to authenticate the identity of the first node may be periodic or aperiodic, or the identity of the first node may be authenticated before some important operation is performed, which is implementation dependent in a particular implementation.

[0380] In yet another possible implementation example, the first message may also be referred to as an access request message (or an association request message). Furthermore, the second message may also be referred to as a security context request message (or an identity authentication request message). The third message may also be referred to as a security context response message (or an identity authentication response message).

[0381] In yet another possible implementation, the processor 1202 is further configured to receive a fourth message from the first node using the communication interface 1204, where the fourth message is used to indicate that the access is successful or to indicate that the association is completed. Further, the fourth message may be referred to as an association establishment message (or an access association completion message), or an association completion message, etc.

[0382] For specific implementation, please refer to the detailed description of the embodiment shown in Figure 5, Figure 7, or Figure 8A and Figure 8B, and the details will not be described again here.

[0383] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, which, when run on one or more processors, performs the method in the embodiment shown in Figure 5, Figure 7, or Figures 8A and 8B.

[0384] An embodiment of the present application further provides a chip system, which includes at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, and the at least one processor being configured to call a computer program stored in at least one memory to perform the method in the embodiment shown in FIG. 5, FIG. 7, or FIG. 8A and FIG. 8B.

[0385] Furthermore, the at least one processor may include at least one of a CPU, an MPU, an MCU, or a co-processor.

[0386] An embodiment of the present application further provides a terminal. The terminal may be an intelligent cockpit product or a vehicle, etc., and the terminal includes a first node and / or a second node. The first node (e.g., one or more of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, a passive entry passive start system controller, and a user equipment UE) is the first node in the embodiment shown in Figure 5, Figure 7, or Figures 8A and 8B. The second node (e.g., a base station or a cockpit domain controller CDC of a vehicle) is the second node in the embodiment shown in Figure 5, Figure 7, or Figures 8A and 8B.

[0387] Further optionally, the terminal may be an unmanned aerial vehicle, a robot, a device in a smart home scenario, or a device in a smart manufacturing scenario, etc.

[0388] An embodiment of the present application further provides a computer program product, which, when run on one or more processors, may implement the communication methods described in the embodiments shown in Figures 5, 7, or 8A and 8B.

[0389] All or part of the above-described embodiments may be realized in software, hardware, firmware, or any combination thereof.

[0390] When software is used to implement the embodiments, all or part of the embodiments may be implemented in the form of a computer instruction product.

[0391] When the computer instructions are loaded on a computer and executed thereon, all or part of the procedures or functions according to the embodiments of the present application may be implemented. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or another programmable device. The computer instructions may be stored in or transmitted by a computer-readable storage medium. The computer-readable storage medium may be any available medium accessible by a computer, or may be a data storage device such as a server or a data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0392] For each step in the method embodiments of the present application, the order may be adjusted, combined and deleted based on actual requirements.

[0393] Each module in the apparatus embodiment of the present application may be combined, divided and deleted based on actual requirements. [Other possible items] [Item 1] 1. A method of secure access, comprising: receiving a first message from a second node, where the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key PSK between the first node and the second node or a first password, the first password being an agreed upon access password between the first node and the second node; decrypting the first ciphertext based on the security parameter to obtain the first key negotiation parameter; determining a first shared key based on the first key negotiation parameters and a key negotiation algorithm; obtaining the PSK between the first node and the second node; and obtaining first identity authentication information based on the first shared key and the PSK between the first node and the second node, where the first identity authentication information is used to authenticate the identity of the first node; A method comprising: [Item 2] obtaining the PSK between the first node and the second node, obtaining the PSK between the first node and the second node based on a first correspondence; or determining the PSK between the first node and the second node based on the first password, the first shared key, a first random number, and a second random number, where the first message further includes the first random number. 2. The method according to item 1, comprising the steps of: [Item 3] the step of obtaining the first ciphertext based on a hash value of the security parameter and the first key negotiation parameter; and decrypting the first ciphertext based on the first password to obtain the first key negotiation parameter, 3. The method of claim 1, further comprising: decrypting the first ciphertext based on the hash value of the security parameter to obtain the first key negotiation parameter. [Item 4] the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; and the step of decrypting the first ciphertext based on the first password to obtain the first key negotiation parameter includes: 4. The method of claim 3, further comprising: obtaining the first key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the first ciphertext. [Item 5] the step of decrypting the first ciphertext based on the security parameter to obtain the first key negotiation parameter, determining a first intermediate key based on the hash value of the security parameter and the first random number; and decrypting the first ciphertext based on the first intermediate key to obtain the first key negotiation parameter. 4. The method according to item 3, comprising the steps of: [Item 6] obtaining first identity authentication information based on the first shared key and the PSK between the first node and the second node, deriving a first key based on the first shared key, the PSK, the first random number, and the second random number; and generating the first identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node. 6. The method according to any one of items 1 to 5, comprising the steps of: [Item 7] The method further comprises: encrypting a second key negotiation parameter based on the security parameter to obtain a second ciphertext; and sending a second message to the second node, where the second message includes the first identity authentication information and the second ciphertext, the second ciphertext being used by the second node to determine the first shared key. 7. The method according to any one of items 1 to 6, comprising: [Item 8] the step of encrypting a second key negotiation parameter based on the security parameter to obtain a second ciphertext, encrypting the second key negotiation parameter based on the hash value of the security parameter to obtain the second ciphertext; or performing an elliptic curve point addition operation based on the hash value of the security parameter and the second key negotiation parameter to obtain the second ciphertext; or determining a second intermediate key based on the hash value of the security parameter and the second random number; and encrypting the second key negotiation parameter based on the second intermediate key to obtain the second ciphertext. 8. The method according to item 7, comprising the steps of: [Item 9] The method further comprises: receiving a third message from the second node, where the third message includes second identity authentication information; and determining that identity authentication of the second node is successful based on the PSK, the first shared key, and the second identity authentication information between the first node and the second node; 9. The method according to item 7 or 8, comprising: [Item 10] A secure access method, comprising: sending a first message to a first node, where the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key PSK between the first node and a second node or a first password, the first password being an agreed upon access password between the first node and the second node; receiving a second message from the first node, where the second message includes a second ciphertext, the second ciphertext being obtained by encrypting a second key negotiation parameter based on the security parameter; decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter; determining a first shared key based on the second key negotiation parameters and a key negotiation algorithm; and obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, where the second identity authentication information is used to authenticate the identity of the second node. A method comprising: [Item 11] Prior to the step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, the method further comprises: Item 11. The method of item 10, comprising obtaining the PSK between the first node and the second node. [Item 12] obtaining the PSK between the first node and the second node, obtaining the PSK between the first node and the second node based on a second correspondence; or determining the PSK between the first node and the second node based on the first password, the first shared key, a first random number, and a second random number, where the first message further includes the first random number, and the first message includes the first random number; 12. The method according to item 10 or 11, comprising the steps of: [Item 13] Prior to the step of transmitting a first message, the method further comprises: 13. The method according to any one of claims 10 to 12, comprising encrypting the first key negotiation parameter based on the security parameter to obtain the first ciphertext. [Item 14] the step of encrypting the first key negotiation parameter based on the security parameter to obtain the first ciphertext, encrypting the first key negotiation parameter based on a hash value of the security parameter to obtain the first ciphertext; or performing an elliptic curve point addition operation based on a hash value of the security parameters and the first key negotiation parameters to obtain the first ciphertext; or determining a first intermediate key based on a hash value of the security parameter and the first random number; and encrypting the first key negotiation parameter based on the first intermediate key to obtain the first ciphertext. Item 14. The method according to item 13, comprising the steps of: [Item 15] the second ciphertext is obtained based on the hash value of the security parameter and the second key negotiation parameter; and the step of decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter comprises: 15. The method according to any one of claims 10 to 14, comprising decrypting the second ciphertext based on the hash value of the security parameter to obtain the second key negotiation parameter. [Item 16] the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; and the step of decrypting the second ciphertext based on the hash value of the security parameter to obtain the second key negotiation parameter comprises: Item 16. The method of item 15, comprising obtaining the second key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the second ciphertext. [Item 17] decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter, determining a second intermediate key based on the hash value of the security parameter and the second random number; and decrypting the second ciphertext based on the second intermediate key to obtain the second key negotiation parameters. Item 16. The method according to item 15, comprising the steps of: [Item 18] The step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node further comprises: deriving a first key based on the first shared key, the PSK, the first random number, and the second random number; and generating the second identity authentication information based on the first key, the first random number, and the second random number, where the second identity authentication information is used to authenticate the identity of the second node. 18. The method according to any one of items 10 to 17, comprising the steps of: [Item 19] the second message further includes first identity authentication information; and prior to the step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, the method further comprising: 20. The method of claim 18, comprising determining that identity authentication of the first node is successful based on the first identity authentication information, the first shared key, and the PSK. [Item 20] a receiving unit configured to receive a first message from a second node, where the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key (PSK) between the first node and the second node, or a first password, the first password being an agreed upon access password between the first node and the second node; and a processing unit configured to decrypt the first ciphertext based on the security parameter to obtain the first key negotiation parameter. Equipped with The processing unit is further configured to determine a first shared key based on the first key negotiation parameter and a key negotiation algorithm; The processing unit is further configured to obtain the PSK between the first node and the second node; the processing unit is further configured to obtain first identity authentication information based on the first shared key and the PSK between the first node and the second node, where the first identity authentication information is used to authenticate an identity of the first node. [Item 21] The processing unit comprises: Obtaining the PSK between the first node and the second node based on a first correspondence; or determining the PSK between the first node and the second node based on the first password, the first shared key, a first random number, and a second random number, where the first message further includes the first random number; 21. The device according to item 20, specifically configured so as to [Item 22] The first ciphertext is obtained based on a hash value of the security parameter and the first key negotiation parameter; and the processing unit: 22. The apparatus according to item 20 or 21, specifically configured to decrypt the first ciphertext based on the hash value of the security parameter to obtain the first key negotiation parameter. [Item 23] the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; and the processing unit 23. The apparatus of claim 22, further comprising: a first ciphertext and a hash value of the security parameter, the first ciphertext being used to obtain the first key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the first ciphertext. [Item 24] The processing unit comprises: determining a first intermediate key based on the hash value of the security parameter and the first random number; Decrypt the first ciphertext based on the first intermediate key to obtain the first key negotiation parameter. 23. The device according to item 22, specifically configured so as to [Item 25] The processing unit comprises: deriving a first key based on the first shared key, the PSK, the first random number, and the second random number; generating the first identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node. 25. The device according to any one of items 20 to 24, specifically configured for: [Item 26] The processing unit further comprises: encrypting a second key negotiation parameter based on the security parameter to obtain a second ciphertext; sending a second message to the second node, where the second message includes the first identity authentication information and the second ciphertext, the second ciphertext being used by the second node to determine the first shared key; 26. The apparatus according to any one of items 20 to 25, configured so as to [Item 27] The processing unit comprises: encrypting the second key negotiation parameter based on the hash value of the security parameter to obtain the second ciphertext; or performing an elliptic curve point addition operation based on the hash value of the security parameter and the second key negotiation parameter to obtain the second ciphertext; or determining a second intermediate key based on the hash value of the security parameter and the second random number; Encrypt the second key negotiation parameter based on the second intermediate key to obtain the second ciphertext. 27. The device according to item 26, specifically configured so as to [Item 28] The processing unit comprises: receiving a third message from the second node, where the third message includes second identity authentication information; determining that identity authentication of the second node is successful based on the PSK, the first shared key, and the second identity authentication information between the first node and the second node; 28. The device according to item 26 or 27, specifically configured for: [Item 29] a sending unit configured to send a first message to a first node, where the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key PSK between the first node and a second node or a first password, the first password being an agreed upon access password between the first node and the second node; a receiving unit configured to receive a second message from the first node, where the second message includes a second ciphertext, the second ciphertext being obtained by encrypting a second key negotiation parameter based on the security parameter; and a processing unit configured to decrypt the second ciphertext based on the security parameter to obtain the second key negotiation parameter. Equipped with the processing unit is further configured to determine a first shared key based on the second key negotiation parameters and a key negotiation algorithm; the processing unit is further configured to obtain second identity authentication information based on the first shared key and the PSK between the first node and the second node, the second identity authentication information being used to authenticate an identity of the second node. [Item 30] The processing unit further comprises: 30. The apparatus of claim 29, configured to obtain the PSK between the first node and the second node. [Item 31] The processing unit comprises: obtaining the PSK between the first node and the second node based on a second correspondence; or determining the PSK between the first node and the second node based on the first password, the first shared key, a first random number, and a second random number, where the first message further includes the first random number, and the first message includes the first random number. 31. The device according to item 29 or 30, specifically configured for: [Item 32] The processing unit further comprises: 32. The apparatus of claim 29, further comprising: an encryption unit configured to: encrypt the first key negotiation parameter based on the security parameter to obtain the first ciphertext. [Item 33] The processing unit comprises: encrypting the first key negotiation parameter based on a hash value of the security parameter to obtain the first ciphertext; or performing an elliptic curve point addition operation based on a hash value of the security parameters and the first key negotiation parameters to obtain the first ciphertext; or determining a first intermediate key based on a hash value of the security parameter and the first random number; Encrypt the first key negotiation parameter based on the first intermediate key to obtain the first ciphertext. Item 33. The device according to item 32, specifically configured so as to [Item 34] the second ciphertext is obtained based on the hash value of the security parameter and the second key negotiation parameter; and the processing unit: 34. The apparatus according to any one of claims 29 to 33, specifically configured to decrypt the second ciphertext based on the hash value of the security parameter to obtain the second key negotiation parameter. [Item 35] the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; and the processing unit Item 35. The apparatus of item 34, specifically configured to obtain the second key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the second ciphertext. [Item 36] The processing unit comprises: determining a second intermediate key based on the hash value of the security parameter and the second random number; Decrypt the second ciphertext based on the second intermediate key to obtain the second key negotiation parameters. Item 35. The device according to item 34, specifically configured for: [Item 37] The processing unit further comprises: deriving a first key based on the first shared key, the PSK, the first random number, and the second random number; generating the second identity authentication information based on the first key, the first random number, and the second random number, where the second identity authentication information is used to authenticate the identity of the second node. 37. The apparatus according to any one of items 29 to 36, configured so as to [Item 38] the second message further comprises first identity authentication information; and the processing unit further comprises: Item 38. The apparatus of item 37, configured to determine that identity authentication of the first node is successful based on the first identity authentication information, the first shared key, and the PSK. [Item 39] A chip system, the chip system comprising at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, and the at least one processor configured to invoke a computer program stored in at least one memory, such that the chip system performs the method according to any one of items 1 to 9. [Item 40] A chip system, the chip system comprising at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, and the at least one processor configured to invoke a computer program stored in at least one memory, such that the chip system implements the method according to any one of items 10 to 19. [Item 41] 10. A computer-readable storage medium having a computer program stored thereon, the computer program enabling the computer to perform the method according to any one of items 1 to 9 when run on a computer. [Item 42] 20. A computer-readable storage medium having a computer program stored thereon, the computer program enabling the computer to perform the method according to any one of items 10 to 19 when run on a computer. [Item 43] a first node, wherein the first node comprises a communication device according to any one of items 20 to 28; and A second node, wherein the second node comprises a communication device according to any one of items 29 to 38. A secure access system comprising:

Claims

1. 1. A method of secure access, comprising: receiving a first message from a second node, wherein the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key (PSK) between the first node and the second node or a first password, the first password being an agreed upon access password between the first node and the second node; decrypting the first ciphertext based on the security parameter to obtain the first key negotiation parameter; determining a first shared key based on the first key negotiation parameters and a key negotiation algorithm; obtaining the PSK between the first node and the second node; obtaining first identity authentication information based on the first shared key and the PSK between the first node and the second node, where the first identity authentication information is used to authenticate an identity of the first node; receiving a third message from the second node, where the third message includes second identity authentication information; and determining that identity authentication of the second node is successful based on the PSK, the first shared key, and the second identity authentication information between the first node and the second node; A method comprising:

2. The step of obtaining the PSK between the first node and the second node further comprises: obtaining the PSK between the first node and the second node based on a first correspondence; or determining the PSK between the first node and the second node based on the first password, the first shared key, a first random number, and a second random number, where the first message further includes the first random number.

2. The method of claim 1, comprising:

3. the step of obtaining the first ciphertext based on a hash value of the security parameter and the first key negotiation parameter; and decrypting the first ciphertext based on the first password to obtain the first key negotiation parameter, 3. The method of claim 1, further comprising the step of decrypting the first ciphertext based on the hash value of the security parameter to obtain the first key negotiation parameter.

4. the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; and the step of decrypting the first ciphertext based on the first password to obtain the first key negotiation parameter comprises:

4. The method of claim 3, further comprising: obtaining the first key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the first ciphertext.

5. the step of decrypting the first ciphertext based on the security parameter to obtain the first key negotiation parameter, determining a first intermediate key based on the hash value of the security parameter and a first random number; and decrypting the first ciphertext based on the first intermediate key to obtain the first key negotiation parameter; 4. The method of claim 3, comprising:

6. obtaining first identity authentication information based on the first shared key and the PSK between the first node and the second node, deriving a first key based on the first shared key, the PSK, a first random number, and a second random number; and generating the first identity authentication information based on the first key, the first random number, and the second random number, where the first identity authentication information is used to authenticate the identity of the first node.

6. The method according to claim 1 , comprising:

7. The method further comprises: encrypting a second key negotiation parameter based on the security parameter to obtain a second ciphertext; and sending a second message to the second node, where the second message includes the first identity authentication information and the second ciphertext, the second ciphertext being used by the second node to determine the first shared key. The method of any one of claims 1 to 6, comprising:

8. the step of encrypting a second key negotiation parameter based on the security parameter to obtain a second ciphertext comprises: encrypting the second key negotiation parameter based on a hash value of the security parameter to obtain the second ciphertext; or performing an elliptic curve point addition operation based on the hash value of the security parameter and the second key negotiation parameter to obtain the second ciphertext; or determining a second intermediate key based on the hash value of the security parameter and a second random number; and encrypting the second key negotiation parameter based on the second intermediate key to obtain the second ciphertext.

8. The method of claim 7, comprising:

9. A secure access method, comprising: sending a first message to a first node, wherein the first message includes a first ciphertext, the first ciphertext being obtained based on a security parameter and a first key negotiation parameter, the security parameter being a pre-shared key PSK between the first node and the second node or a first password, the first password being an agreed upon access password between the first node and the second node; receiving a second message from the first node, where the second message includes a second ciphertext, the second ciphertext being obtained by encrypting a second key negotiation parameter based on the security parameter; decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter; determining a first shared key based on the second key negotiation parameters and a key negotiation algorithm; obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, where the second identity authentication information is used to authenticate the identity of the second node; and sending a third message to the first node, where the third message includes the second identity authentication information; A method comprising:

10. Prior to the step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, the method further comprises:

10. The method of claim 9, comprising obtaining the PSK between the first node and the second node.

11. The step of obtaining the PSK between the first node and the second node further comprises: obtaining the PSK between the first node and the second node based on a second correspondence relationship; or determining the PSK between the first node and the second node based on the first password, the first shared key, a first random number, and a second random number, where the first message further includes the first random number, and the first message includes the first random number; 11. The method of claim 9 or 10, having the following structure:

12. Prior to the step of transmitting a first message, the method further comprises:

12. The method of claim 9, comprising encrypting the first key negotiation parameter based on the security parameter to obtain the first ciphertext.

13. the step of encrypting the first key negotiation parameter based on the security parameter to obtain the first ciphertext, encrypting the first key negotiation parameter based on a hash value of the security parameter to obtain the first ciphertext; or performing an elliptic curve point addition operation based on a hash value of the security parameters and the first key negotiation parameters to obtain the first ciphertext; or determining a first intermediate key based on a hash value of the security parameter and a first random number; and encrypting the first key negotiation parameter based on the first intermediate key to obtain the first ciphertext; 13. The method of claim 12, comprising:

14. the second ciphertext is obtained based on a hash value of the security parameter and the second key negotiation parameter; and the step of decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter comprises:

14. A method according to any one of claims 9 to 13, comprising decrypting the second ciphertext based on the hash value of the security parameter to obtain the second key negotiation parameter.

15. the first ciphertext is obtained by performing an elliptic curve point addition operation based on the hash value of the security parameter and the first key negotiation parameter; and the step of decrypting the second ciphertext based on the hash value of the security parameter to obtain the second key negotiation parameter comprises:

15. The method of claim 14, comprising obtaining the second key negotiation parameter by performing an elliptic curve point subtraction operation based on the hash value of the security parameter and the second ciphertext.

16. the step of decrypting the second ciphertext based on the security parameter to obtain the second key negotiation parameter, determining a second intermediate key based on the hash value of the security parameter and a second random number; and decrypting the second ciphertext based on the second intermediate key to obtain the second key negotiation parameters.

15. The method of claim 14, comprising:

17. The step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node further comprises: deriving a first key based on the first shared key, the PSK, a first random number, and a second random number; and generating the second identity authentication information based on the first key, the first random number, and the second random number, where the second identity authentication information is used to authenticate the identity of the second node.

17. The method according to any one of claims 9 to 16, comprising:

18. the second message further includes first identity authentication information; and prior to the step of obtaining second identity authentication information based on the first shared key and the PSK between the first node and the second node, the method further comprising:

20. The method of claim 17, comprising determining that identity authentication of the first node is successful based on the first identity authentication information, the first shared key, and the PSK.

19. A communications device comprising at least one processor coupled to a memory, the memory configured to store programs or instructions, and the at least one processor configured to execute the programs or instructions, such that the communications device implements a method according to any one of claims 1 to 8.

20. A communications device comprising at least one processor coupled to a memory, the memory configured to store programs or instructions, and the at least one processor configured to execute the programs or instructions, such that the communications device implements a method according to any one of claims 9 to 18.

21. A chip system, the chip system comprising at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, and the at least one processor configured to call a computer program stored in at least one memory, thereby causing the chip system to implement the method of any one of claims 1 to 8.

22. A chip system, the chip system comprising at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, and the at least one processor configured to call a computer program stored in at least one memory, thereby causing the chip system to implement a method according to any one of claims 9 to 18.

23. A computer program product for causing a computer to carry out the method according to any one of claims 1 to 8.

24. A computer program product for causing a computer to carry out the method according to any one of claims 9 to 18.

Images