Communication method and related apparatus

Abstract

To provide a communication method and an apparatus to protect privacy of a group key and improve security in a multicast communication process.SOLUTION: In a communication system, a communication method includes: a first node receiving an association request message from a second node, determining a group key of a first communication group, encrypting the group key of the first communication group based on a shared key between the first node and the second node to obtain a first protection key, and sending a first association establishment message to the second node; and the second node acquiring the group key of the first communication group based on the shared key between the first node and the second node and the first protection key.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to the field of communication technologies, in particular to the field of short-range communication technologies, for example cockpit domain communication, and in particular to communication methods and related devices. [Background technology]

[0002] With the rapid development of information technology, communication technology has become more and more prevalent in people's lives. There are three communication modes in the node communication process: unicast, broadcast, and multicast.

[0003] Unicast is a point-to-point communication mode in which interested nodes communicate with each other. Broadcast is a point-to-multipoint communication mode in which a node sends a message to all nodes in a subnet. Between these two modes is multicast point-to-multipoint communication, in which a node (e.g., referred to as the first node) sends a message to nodes in a communication group, and all nodes in the communication group can receive the message. Multicast is one of the important technologies in computer networking, and has wide applications in the application layer, network layer, and media access layer, such as media broadcasting, multi-party conference, and array detection.

[0004] In the communication process, security protection needs to be performed on messages in the communication process to prevent data leakage and ensure communication security. Encryption of unicast messages is implemented by using unicast keys, and a pair of private temporary keys (PTKs) is established between two nodes, which can ensure one-to-one unicast security. Both unicast and multicast messages need to be protected. Only group members in a communication group know the group key used for encryption and decryption. In this way, only group members can interpret encrypted packets, and non-group members cannot obtain the packet contents. This ensures the security of multicast communication.

[0005] The protection of multicast messages depends on the group key. Therefore, protecting the group key is extremely important. For communication systems, the leakage of the group key allows an attacker to listen to messages within the group by using the group key, resulting in data leakage and threatening user privacy and security. Particularly for in-vehicle communication systems, the leakage of the group key may lead to the leakage of important vehicle data, and communication between the vehicle and a node that has stolen the group key may occur, threatening the safety of the vehicle.

[0006] It can be seen that how to protect the privacy of group keys and improve security in a multicast communication process is a technical problem being studied by those skilled in the art. Summary of the Invention [Means for solving the problem]

[0007] SUMMARY OF THE INVENTION The embodiments of the present application disclose a communication method and related apparatus for protecting the privacy of a group key and improving security in a multicast communication process.

[0008] According to a first aspect, an embodiment of the present application discloses a communication method, the method comprising: receiving an association request message from a second node; determining a group key of a first communication group, the first communication group being a communication group to which the second node belongs, and the group key of the first communication group being obtained based on at least one of a first freshness parameter and an identifier ID of the first communication group; encrypting a group key of a first communication group based on a shared key between the first node and the second node to obtain a first protection key; Sending a first association establishment message to the second node, the first association establishment message including the first protection key.

[0009] In the above method, after receiving an association request from a second node, a group key of a first communication group to which the second node belongs may be determined, and then the group key is encrypted using a shared key between the first node and the second node to obtain a first protection key, the first protection key is carried in an association establishment message, and the association establishment message is sent to the second node. Since the protection key carried in the association establishment message is obtained by encrypting the group key using the shared key, it can be seen that the privacy of the group key can be protected regardless of whether the first association establishment message is encrypted. In this way, when performing multicast communication with the first communication group, the first node can encrypt the multicast message by using the group key to protect the multicast message, prevent non-group members from obtaining the communication content, and improve the security of the multicast communication.

[0010] Furthermore, the first node may send the group key to the second node in the association establishment message by using the protected key, and the group key distribution procedure may be integrated into the procedure of establishing an association between the first node and the second node. Therefore, no additional key distribution procedure is needed, which saves the overhead of network resources and improves the efficiency of multicast communication.

[0011] In one possible implementation of the first aspect, the first node and the second node share a shared key.

[0012] It can be known that the shared key is a secret value shared between the first node and the second node, and the shared key can be generated by the first node and the second node using the same key derivation method, or can be predefined or preconfigured on the first node and the second node, or can be sent to the first node and the second node separately by a trusted device. For example, the first node and the second node can generate a key S by exchanging public keys, and the value of the key S generated by the first node is the same as the value of the key S generated by the second node. Therefore, the key S can be used as a shared key between the first node and the second node. In addition, another key can be obtained based on the original shared key by using a key derivation function (KDF). Because the first node and the second node can derive the key by using the same method, a key derived based on the shared key is also a shared key.

[0013] In another possible implementation method of the first aspect, encrypting the group key of the first communication group based on the shared key between the first node and the second node to obtain the first protection key includes: and encrypting a group key of the first communication group based on a shared key between the first node and the second node and a second freshness parameter to obtain a first protection key.

[0014] The above description describes an encryption method. Since the value of the freshness parameter is different, the first protection key obtained by encrypting the group key of the first communication group is also different each time. This improves the privacy of the group key.

[0015] In yet another possible implementation method of the first aspect, encrypting the group key of the first communication group based on the shared key between the first node and the second node to obtain the first protection key includes: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF); and encrypting a group key of the first communication group by using the first intermediate key to obtain a first protection key.

[0016] The above description describes yet another encryption method: the first node generates a first intermediate key by using the shared key and the second freshness parameter, and encrypts the group key by using the first intermediate key.

[0017] In yet another possible implementation method of the first aspect, encrypting the group key of the first communication group based on the shared key between the first node and the second node to obtain the first protection key includes: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF), where the first KDF is a KDF supported by the second node; and performing an exclusive-or operation on the first intermediate key and the group key of the first communication group to obtain a first protection key.

[0018] The above description describes yet another encryption method. The first node generates a first intermediate key by using a shared key and a second freshness parameter. After performing the exclusive-or operation twice, the original value can be obtained, so the first node performs an exclusive-or operation on the first intermediate key and the group key of the first communication group. Further optionally, after receiving the first protection key, the second node generates the same first intermediate key based on the shared key and the value of the second freshness parameter, and performs an exclusive-or operation on the first intermediate key and the first protection key to obtain the key of the first communication group.

[0019] In yet another possible implementation method of the first aspect, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0020] The above description describes possible cases of shared keys and freshness parameters. The encryption key between the first node and the second node may be shared. Thus, the group key may be encrypted by using the encryption key between the first node and the second node. The second freshness parameter may be a number once (NONCE). A NONCE is a random value that is used only once (or non-repeatedly). The second freshness parameter may be sent to the second node in the first association establishment message, so that the second node can decrypt the first protection key based on the second freshness parameter and obtain the group key for the first communication group.

[0021] In yet another possible implementation method of the first aspect, the second freshness parameter is a value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0022] The above description describes possible cases of the freshness parameter. The second freshness parameter may be the value of a first counter, which is used to represent the number of times to encrypt the group key of the first communication group based on the shared key. In this way, each time the shared key is used to encrypt the group key, the value of the used counter is different, and therefore the first protection key obtained by encrypting the same group key of the first communication group is also different each time. This improves the privacy of the group key.

[0023] In yet another possible implementation method of the first aspect, determining a group key for the first communication group includes: determining a group key for the first communication group based on an ID of the first communication group, wherein a correspondence exists between the ID of the first communication group and the group key of the first communication group; or generating a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF;

[0024] The above description describes a scheme for determining a group key for a first communication group. In one aspect, there is a correspondence between an ID of the first communication group and the group key. Thus, the group key for the communication group can be determined based on the ID of the communication group. In another aspect, the group key for the first communication group can be generated by using a KDF. Further optionally, if the ID of the first communication group does not have a corresponding group key (e.g., a new communication group is created), the group key for the first communication group can be generated by using a KDF.

[0025] In yet another possible implementation of the first aspect, the method comprises: The method further includes determining a group security algorithm, wherein the group security algorithm is an algorithm supported by the nodes of the first communication group, and the group security algorithm includes at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0026] The first association establishment message further includes information used to indicate the group security algorithm.

[0027] It can be seen that the first association establishment message further includes a group security algorithm, and the security algorithm is determined by an algorithm supported by all nodes in the group.

[0028] In yet another possible implementation method of the first aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group; or Determining the group security algorithm involves: Determining a group security algorithm based on an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0029] In yet another possible implementation method of the first aspect, the group security algorithm includes a third KDF algorithm, the method comprising: Further comprising generating a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0030] By using the group KDF algorithm, it is known that a session key may be derived from the group key based on the type of session key and is used for encryption in the session process.

[0031] In yet another possible implementation method of the first aspect, the type of key includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the type of session key corresponds to a scenario to which the session key is applied.

[0032] In yet another possible implementation method of the first aspect, the method includes, before encrypting the group key of the first communication group based on the shared key between the first node and the second node to obtain the protection key: The method further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0033] In yet another possible implementation of the first aspect, the method comprises: The method further includes, when encryption is enabled for signaling plane messages between the first node and the second node, sending a second association establishment message to the second node, the second association establishment message including a group key of the first communication group, the second association establishment message belonging to the signaling plane messages between the first node and the second node.

[0034] It can be seen that different protection methods can be used when signaling plane encryption is enabled or disabled. In particular, if it is determined that encryption is enabled for signaling plane messages, when encryption is enabled for the signaling plane, the group key may not be encrypted but is protected by encrypting the signaling plane messages. This avoids the calculation of additional encrypted data and improves group key distribution efficiency.

[0035] In yet another possible implementation of the first aspect, the method comprises: determining that a condition for updating a group key of a first communication group is met; determining a first key based on at least one of a third freshness parameter and an identifier ID of the first communication group; encrypting the first key based on a shared key between the first node and the second node to obtain a second protection key; Sending a key update message to the second node, the key update message including the second protection key.

[0036] In yet another possible implementation method of the first aspect, the first key is used to replace a group key of a first communication group.

[0037] The above description describes a scheme for updating a group key. After it is determined that the conditions for updating the group key are met, a first key may be determined, and after the first key is encrypted using the shared key, the first key is transmitted to the second node using a key update message. Since the protection key carried in the key update message is obtained by encrypting the first key using the shared key, it can be seen that the privacy of the first key can be protected regardless of whether the key update message is encrypted. Optionally, the key update message may be a multicast message transmitted by the first node to the second node in the first communication group, or may be a unicast message between the first node and the second node. Further optionally, when the key update message is a unicast message, the first node may further transmit a unicast message to another second node in the first communication group.

[0038] In yet another possible implementation method of the first aspect, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0039] It will be appreciated that the key update message may indicate the update time of the first target key and / or the validity period of the first target key, and thus when to apply the first target key is determined as needed.

[0040] In yet another possible implementation method of the first aspect, the method includes, after sending a key update message to the second node: determining that an update acknowledgement message has been received from at least one second node belonging to the first communication group; applying the first key to a first key start time.

[0041] In yet another possible implementation method of the first aspect, determining that an update acknowledgement message has been received from at least one second node belonging to the first communication group includes: determining that update acknowledgement messages have been received from all second nodes belonging to the first communication group;

[0042] In yet another possible implementation method of the first aspect, encrypting the first key based on a shared key between the first node and the second node to obtain the second protection key includes: and encrypting the first key based on a shared key between the first node and the second node and a fourth freshness parameter to obtain a second protection key.

[0043] The above description describes a method for encrypting the first key. Since the value of the freshness parameter is different, the second protection key obtained by encrypting the first key each time is also different. This improves the privacy of the group key.

[0044] In yet another possible implementation method of the first aspect, encrypting the first key based on a shared key between the first node and the second node to obtain the second protection key includes: generating a second intermediate key based on the shared key between the first node and the second node and a fourth freshness parameter by using a first key derivation function (KDF); and encrypting the first key by using the second intermediate key to obtain a second protection key.

[0045] In yet another possible implementation method of the first aspect, encrypting the first key based on a shared key between the first node and the second node to obtain the second protection key includes: generating a second intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF), where the first KDF is a KDF supported by the second node; and performing an exclusive-or operation on the second intermediate key and the first key to obtain a second protection key.

[0046] In yet another possible implementation of the first aspect, the condition for updating is: a difference between the frame number of the current communication frame and the marked frame number is equal to or greater than a first threshold, the frame number of the current communication frame and the marked frame number are within the count cycle of the same round, and the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; a difference between the marked frame number and the frame number of the current communication frame is equal to or less than a second threshold, the frame number of the current communication frame is within the count cycle of the next round of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; The validity period of the group key of the first communication group expires or the usage duration of the group key of the first communication group reaches a third threshold; or At least one second node in the first communication group exits the first communication group.

[0047] The preceding description describes the conditions for updating the group key. It may be determined that the group key needs to be updated when one of the following conditions is met: (1) the access point's group freshness parameter (e.g., frame number) is repeated or is about to be flipped (or exceeds a threshold before flipping), (2) the group key's validity period expires or the group key's usage duration exceeds a threshold, or (3) the membership in the group changes.

[0048] According to a second aspect, an embodiment of the present application discloses a communication method, the method comprising: sending an association request message to the first node; receiving a first association establishment message from the first node, the first association establishment message including a first protection key; and obtaining a group key for a first communication group based on a shared key between the first node and the second node and a first protection key, the first communication group being a communication group to which the second node belongs.

[0049] In one possible implementation of the second aspect, the first node and the second node share a shared key.

[0050] In another possible implementation method of the second aspect, obtaining a group key for the first communication group based on the shared key between the first node and the second node and the first protection key includes: The method includes obtaining a group key for the first communication group based on the shared key between the first node and the second node, the second freshness parameter, and the first protection key.

[0051] In yet another possible implementation method of the second aspect, obtaining a group key for the first communication group based on the shared key between the first node and the second node and the first protection key includes: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF); and deriving a group key for the first communication group based on the first intermediate key and the first protection key.

[0052] In yet another possible implementation method of the second aspect, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0053] In yet another possible implementation method of the second aspect, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0054] In yet another possible implementation method of the second aspect, the first association establishment message further includes information used to indicate a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0055] In yet another possible implementation method of the second aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group; or Determining the group security algorithm corresponds to an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0056] In yet another possible implementation method of the second aspect, the group security algorithm includes a third KDF algorithm, the method comprising: Further comprising generating a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0057] In yet another possible implementation method of the second aspect, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to a scenario to which the session key is applied.

[0058] In yet another possible implementation method of the second aspect, the method includes, before obtaining a group key of the first communication group based on the shared key between the first node and the second node and the first protection key, and verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0059] In yet another possible implementation of the second aspect, the method includes: receiving a second association establishment message from the first node, the second association establishment message including a group key of the first communication group, the second association establishment message belonging to a signaling plane message between the first node and the second node; and if encryption is enabled for signaling plane messages between the first node and the second node, obtaining a group key for the first communication group by using a signaling plane encryption key between the first node and the second node and the second association establishment message.

[0060] In yet another possible implementation of the second aspect, the method includes: receiving a key update message from the first node, the key update message including a second protection key; and deriving a first key based on the shared key between the first node and the second node and the second protection key.

[0061] In yet another possible implementation method of the second aspect, the first key is used to replace a group key of a first communication group.

[0062] In yet another possible implementation method of the second aspect, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0063] In yet another possible implementation method of the second aspect, the method includes, after obtaining a first key based on a shared key between the first node and the second node and a second protection key, sending an update acknowledgement message to the first node; and applying the first key at a start time of the first key.

[0064] In yet another possible implementation method of the second aspect, obtaining the first key based on the shared key between the first node and the second node and the second protection key includes: The method includes deriving a first key based on a shared key between the first node and the second node, a fourth freshness parameter, and a second protection key.

[0065] According to a third aspect, an embodiment of the present application provides a communication device, comprising: a unit configured to perform the method described in the first aspect or any one of the possible implementations of the first aspect.

[0066] In one possible implementation of the third aspect, an apparatus includes: a receiving unit configured to receive an association request message from the second node; a processing unit configured to determine a group key for a first communication group, the first communication group being a communication group to which the second node belongs, the group key for the first communication group being determined based on at least one of a first freshness parameter and an identifier ID of the first communication group; a processing unit configured to encrypt a group key of a first communication group based on a shared key between the first node and the second node to obtain a first protection key; In particular, the method comprises: a transmitting unit configured to transmit a first association establishment message to the second node, the first association establishment message including the first protection key.

[0067] In another possible implementation of the third aspect, the processing unit: It is particularly configured to encrypt the group key of the first communication group based on the shared key between the first node and the second node and the second freshness parameter to obtain a first protection key.

[0068] In yet another possible implementation of the third aspect, the processing unit: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF); It is particularly configured to encrypt the first communication key by using the first intermediate key to obtain the first protection key.

[0069] In yet another possible implementation of the third aspect, the processing unit: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF), where the first KDF is a KDF supported by the second node; It is particularly configured to perform an exclusive-or operation between the first intermediate key and the group key of the first communication group to obtain the first protection key.

[0070] In yet another possible implementation method of the third aspect, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0071] In yet another possible implementation method of the third aspect, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0072] In yet another possible implementation of the third aspect, the processing unit: determining a group key of the first communication group based on the ID of the first communication group, and determining whether there is a correspondence between the ID of the first communication group and the group key of the first communication group; or It is particularly configured to generate a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using the second KDF.

[0073] In yet another possible implementation of the third aspect, the processing unit: The method is further configured to determine a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0074] The first association establishment message further includes information used to indicate the group security algorithm.

[0075] In yet another possible implementation method of the third aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group; or Determining the group security algorithm involves: Determining a group security algorithm based on an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0076] In yet another possible implementation manner of the third aspect, the group security algorithm includes a third KDF algorithm, and the processing unit: The communication device is further configured to generate a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0077] In yet another possible implementation method of the third aspect, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to a scenario to which the session key is applied.

[0078] In yet another possible implementation of the third aspect, the processing unit: The node is further configured to verify that encryption is not enabled for signaling plane messages between the first node and the second node.

[0079] In yet another possible implementation manner of the third aspect, encryption is enabled for signaling plane messages between the first node and the second node, and the sending unit comprises: The method is further configured to send a second association establishment message to the second node, the second association establishment message including a group key of the first communication group, the second association establishment message belonging to a signaling plane message between the first node and the second node.

[0080] In yet another possible implementation manner of the third aspect, the processing unit is further configured to determine that a condition for updating a group key of the first communication group is met.

[0081] The processing unit is further configured to determine the first key based on at least one of the third freshness parameter and the identifier ID of the first communication group.

[0082] The processing unit is further configured to encrypt the first key based on a shared key between the first node and the second node to obtain a second protection key.

[0083] The sending unit is further configured to send a key update message to the second node, the key update message including the second protection key.

[0084] In yet another possible implementation method of the third aspect, the first key is used to replace a group key of a first communication group.

[0085] In yet another possible implementation method of the third aspect, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0086] In yet another possible implementation of the third aspect, the processing unit: determining that an update acknowledgement message has been received from at least one second node belonging to the first communication group; The method is further configured to apply the first key to a start time of the first key.

[0087] In yet another possible implementation of the third aspect, the processing unit: It is particularly configured to determine that it has received update acknowledgement messages from all second nodes belonging to the first communication group.

[0088] In yet another possible implementation of the third aspect, the processing unit: It is particularly configured to encrypt the first key based on the shared key between the first node and the second node and the fourth freshness parameter to obtain a second protection key.

[0089] In yet another possible implementation of the third aspect, the condition for updating is: a difference between the frame number of the current communication frame and the marked frame number is equal to or greater than a first threshold, the frame number of the current communication frame and the marked frame number are within the count cycle of the same round, and the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; a difference between the marked frame number and the frame number of the current communication frame is equal to or less than a second threshold, the frame number of the current communication frame is within the count cycle of the next round of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; The validity period of the group key of the first communication group expires or the usage duration of the group key of the first communication group reaches a third threshold; or At least one second node in the first communication group exits the first communication group.

[0090] According to a fourth aspect, an embodiment of the present application provides a communication device, comprising: a unit configured to perform the method described in the second aspect or any one of the possible implementations of the second aspect.

[0091] In one possible implementation of the fourth aspect, an apparatus includes: a transmitting unit configured to transmit an association request message to the first node; a receiving unit configured to receive a first association establishment message from a first node, the first association establishment message including a first protection key; In particular, the method comprises: a processing unit configured to obtain a group key for a first communication group based on a shared key between the first node and the second node and a first protection key, the first communication group being a communication group to which the second node belongs.

[0092] In another possible implementation of the fourth aspect, the first node and the second node share a shared key.

[0093] In yet another possible implementation of the fourth aspect, the processing unit: The node is particularly configured to obtain a group key for the first communication group based on the shared key between the first node and the second node, the second freshness parameter, and the first protection key.

[0094] In yet another possible implementation of the fourth aspect, the processing unit: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF); It is particularly configured to derive a group key for the first communication group based on the first intermediate key and the first protection key.

[0095] In yet another possible implementation method of the fourth aspect, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0096] In yet another possible implementation method of the fourth aspect, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0097] In yet another possible implementation method of the fourth aspect, the first association establishment message further includes information used to indicate a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0098] In yet another possible implementation method of the fourth aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group; or Determining the group security algorithm corresponds to an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0099] In yet another possible implementation of the fourth aspect, the processing unit: The communication device is further configured to generate a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0100] In yet another possible implementation method of the fourth aspect, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to a scenario to which the session key is applied.

[0101] In yet another possible implementation method of the fourth aspect, before obtaining a group key of the first communication group based on the shared key between the first node and the second node and the first protection key, The method further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0102] In yet another possible implementation method of the fourth aspect, the receiving unit is further configured to receive a second association establishment message from the first node, the second association establishment message including a group key of the first communication group, the second association establishment message belonging to a signaling plane message between the first node and the second node; The processing unit is further configured to decrypt the second association establishment message by using a signaling plane encryption key between the first node and the second node to obtain a group key of the first communication group.

[0103] In yet another possible implementation method of the fourth aspect, the receiving unit is further configured to receive a key update message from the first node, the key update message including the second protection key; The processing unit is further configured to derive a first key based on the shared key between the first node and the second node and the second protection key.

[0104] In yet another possible implementation method of the fourth aspect, the first key is used to replace a group key of a first communication group.

[0105] In yet another possible implementation method of the fourth aspect, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0106] In yet another possible implementation of the fourth aspect, the processing unit: sending an update acknowledgement message to the first node; The method is further configured to apply the first key to a start time of the first key.

[0107] In yet another possible implementation of the fourth aspect, the processing unit: The node is particularly configured to derive the first key based on the shared key between the first node and the second node, the fourth freshness parameter, and the second protection key.

[0108] According to a fifth aspect, an embodiment of the present application further provides a communication device, the communication device comprising: at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, and the at least one processor configured to invoke a computer program stored in at least one memory, such that the device implements the method described in the first aspect or any one of the possible implementations of the first aspect, or the method described in the second aspect or any one of the possible implementations of the second aspect.

[0109] According to a sixth aspect, an embodiment of the present application further provides a communication system, comprising: a first node and a second node, wherein the first node is an apparatus described in the third aspect or any one of the possible implementations of the third aspect, and the second node is an apparatus described in the fourth aspect or any one of the possible implementations of the fourth aspect.

[0110] According to a seventh aspect, an embodiment of the present application provides a chip system, wherein a communication device of the chip system comprises at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, and the at least one processor being configured to invoke a computer program stored in at least one memory, so that an apparatus in which the chip system is arranged implements the method described in the first aspect or any one of the possible implementations of the first aspect, or the method described in the second aspect or any one of the possible implementations of the second aspect.

[0111] According to an eighth aspect, an embodiment of the present application discloses a computer-readable storage medium, the computer-readable storage medium storing a computer program, which, when executed on one or more processors, performs the method described in the first aspect or any one of the possible implementations of the first aspect, or the second aspect or any one of the possible implementations of the second aspect.

[0112] According to a ninth aspect, an embodiment of the present application discloses a computer program product, which, when executed on one or more processors, performs a method described in the first aspect or any one of the possible implementations of the first aspect, or the second aspect or any one of the possible implementations of the second aspect.

[0113] According to a tenth aspect, an embodiment of the present application discloses a terminal. The terminal includes a first node (e.g., an automobile cockpit domain controller CDC) and / or a second node (e.g., at least one of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a passive entry / passive start system controller). The first node is the device described in the third aspect or any one of the possible implementations of the third aspect, and the second node is the device described in the fourth aspect or any one of the possible implementations of the fourth aspect.

[0114] Further optionally, the terminal may be a vehicle, an unmanned aerial vehicle, a robot, a device in a smart home scenario, a device in a smart manufacturing scenario, or the like.

[0115] It can be understood that the technical solutions in the second, third and fourth aspects of the present application correspond to the technical solutions in the first aspect, and for the related beneficial effects, please refer to the beneficial effects in the first aspect, and therefore, the details will not be described again.

[0116] Next, the accompanying drawings used in the embodiments of the present application will be described. [Brief explanation of the drawings]

[0117] [Figure 1] 1 is a schematic diagram of the architecture of a communication system according to an embodiment of the present application; [Figure 2] FIG. 1 is a schematic diagram of an application scenario of a communication method according to an embodiment of the present application; [Figure 3] 1 is a flowchart of a communication method according to an embodiment of the present application; [Figure 4] FIG. 2 is a schematic diagram of a method for encrypting a group key according to an embodiment of the present application; [Figure 5] FIG. 2 is a schematic diagram of another method for encrypting a group key according to an embodiment of the present application; [Figure 6A] FIG. 2 is a schematic diagram of a method for determining a group security algorithm according to an embodiment of the present application; [Figure 6B] FIG. 2 is a schematic diagram of a method for determining a group security algorithm according to an embodiment of the present application; [Figure 7] 4 is a flowchart of another communication method according to an embodiment of the present application; [Figure 8A] 1 is a schematic diagram of a communication scenario according to an embodiment of the present application; [Figure 8B] 1 is a schematic diagram of a communication scenario according to an embodiment of the present application; [Figure 9A] FIG. 2 is a schematic diagram of a scenario for updating a group key according to an embodiment of the present application; [Figure 9B] FIG. 2 is a schematic diagram of a scenario for updating a group key according to an embodiment of the present application; [Figure 10A] FIG. 10 is a schematic diagram of another scenario for updating a group key according to an embodiment of the present application; [Figure 10B] FIG. 10 is a schematic diagram of another scenario for updating a group key according to an embodiment of the present application; [Figure 11] 1 is a flowchart of yet another communication method according to an embodiment of the present application; [Figure 12A] 4 is a flowchart of yet another communication method according to an embodiment of the present application; [Figure 12B] 4 is a flowchart of yet another communication method according to an embodiment of the present application; [Figure 13] 1 is a schematic diagram of the structure of a communication device according to an embodiment of the present application; [Figure 14] FIG. 2 is a schematic diagram of the structure of another communication device according to an embodiment of the present application; [Figure 15] 1 is a schematic diagram of the structure of yet another communication device according to an embodiment of the present application; [Figure 16] FIG. 10 is a schematic diagram of the structure of yet another communication device according to an embodiment of the present application; DETAILED DESCRIPTION OF THE INVENTION

[0118] Next, embodiments of the present application will be described with reference to the accompanying drawings in the embodiments of the present application. In this application, the word "example" or the phrase "for example" is used to indicate providing an example, illustration, or explanation. Any embodiment or design solution described in this application by using "example" or "for example" should not be described as being preferred or having more advantages than another embodiment or design scheme. The use of the word "example" or the phrase "for example" is intended to present the related concept in a particular manner.

[0119] In the following paragraphs, we first provide a brief description of the relevant technologies and technical terminology of this application for ease of understanding.

[0120] 1. Node

[0121] A node is an electronic device that has data reception and transmission capabilities. For example, a node may be a Cockpit Domain device or a module within a Cockpit Domain device (e.g., one or more of the following modules: a cockpit domain controller (CDC), a camera, a screen, a microphone, a speaker, an electronic key, a controller of a passive entry / passive start system, etc.). In certain implementations, a node may alternatively be a data forwarding device, for example, a router, a repeater, a bridge, or a switch, or may be a terminal device, for example, various types of user equipment (UE), a mobile phone, a tablet computer (pad), a desktop computer, a headset, or a speaker, or may be a machine intelligence device such as a self-driving device, a transportation safety device, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a machine type communication (MTC) device, an industrial control device, a remote medical device, a smart grid device, or a smart city device, or may further include a wearable device (e.g., a smart watch, a smart band, or a pedometer), or the like. In some technical scenarios, the name of a device having similar data receiving and transmitting capabilities may not be a node. However, for ease of explanation, in the embodiments of the present application, an electronic device having data reception and transmission capabilities is referred to as a node.

[0122] 2.Shared key (SK)

[0123] The shared key is the same secret value stored in the nodes of both communicating parties. The shared key may be generated by both communicating parties by using the same key derivation method, or may be predefined or preconfigured in the nodes of both communicating parties, or may be transmitted separately to the first node and the second node from a trusted device (e.g., a key distribution center (KDC)).

[0124] For example, a vehicle's cockpit domain controller (CDC) and a vehicle owner's mobile phone are two nodes that can communicate with each other by using short-range communication technology. When the vehicle owner needs to perform pairing with the vehicle's CDC by using the mobile phone, the vehicle owner may first generate a shared key by exchanging public keys, e.g., by exchanging key agreement algorithm parameters between the mobile phone and the vehicle's CDC by using a key agreement algorithm. The shared key may be used to verify the identities of both nodes when the mobile phone subsequently requests pairing with the vehicle's CDC again.

[0125] In another example, a vehicle's cockpit domain controller (CDC) and an onboard radar device are two nodes that can communicate with each other. When deploying the CDC and onboard radar, employees at the automobile factory pre-configure a shared key between the CDC and the onboard radar. The security of the communication between the vehicle's CDC and the onboard radar can be ensured by using the shared key.

[0126] In addition, a node may derive another key based on the original shared key through key derivation. Because both party nodes may derive keys by using the same method, a key derived based on the original shared key may also be considered a shared key. For example, a first node derives a session key Kenc by using the shared key Kdh, and correspondingly, a second node derives a session key Kenc by using the same method. Because the shared key Kdh is a secret value shared by the first node and the second node, the derived session key Kenc may also be considered a shared key between the first node and the second node.

[0127] 3. Multicast communication

[0128] Multicast technology aims to transmit one piece of information to a group of nodes. In this way, the group of nodes can be regarded as a communication group. In some scenarios, such a communication group is also referred to as a target group or a multicast group. When a node (e.g., referred to as a first node) transmits information to multiple target nodes, the first node may transmit only one piece of data, and the destination address of the data is the multicast group address. In this way, all target nodes belonging to the group can receive the data transmitted by the first node. Therefore, the multicast mode solves the problems of repeated data transmission and repeated bandwidth occupation in the unicast mode, and also solves the waste of bandwidth resources in the broadcast mode.

[0129] 4. Security Algorithms

[0130] Security algorithms may include encryption algorithms, integrity protection algorithms, key derivation functions, and the like.

[0131] Encryption algorithms include symmetric encryption algorithms and asymmetric encryption algorithms. Generally, the encryption key and decryption key of a symmetric encryption algorithm are the same, while the encryption key and decryption key of an asymmetric encryption algorithm are different. In addition, there are hash algorithms that do not require a key. Common symmetric encryption algorithms mainly include the data encryption standard (DES), triple data encryption algorithm (3DES), advanced encryption standard (AES), and the like. Common asymmetric encryption algorithms mainly include the RSA encryption algorithm, data structure analysis (DSA) algorithm, and the like. Hash algorithms mainly include the secure hash algorithm 1 (SHA-1), message digest (MD) algorithms (such as MD2, MD4, or MD5), and the like.

[0132] An integrity protection algorithm is an algorithm used to protect message integrity and may also be referred to as a message authentication code (MAC) algorithm. For example, an integrity protection algorithm implemented by using a hash algorithm is referred to as a hash-based message authentication code (HMAC) algorithm, where the hash algorithm may be one of MD5, SHA-1, SHA-256, and the like, and these different HMAC implementations are commonly described as HMAC-MD5, HMAC-SHA1, HMAC-SHA256, and the like. In another example, a MAC algorithm implemented based on a cipher algorithm may be referred to as a cipher-based message authentication code (CMAC) algorithm, where the cipher algorithm may be AES. Because the AES block cipher has four modes of operation, ECB, CBC, CFB, and OFB, integrity protection algorithms implemented based on block cipher algorithms with different modes of operation may be referred to as an ECB-MAC algorithm, a CBC-MAC algorithm, and the like, respectively. Furthermore, one-key message authentication code (CBC-MAC, OMAC) is improved from the CBC-MAC algorithm. In addition, the integrity protection algorithm may further include Galois message authentication code (GMAC), ZUC encryption algorithm (such as ZUC128 and ZUC256), and MD algorithm (such as MD2, MD4, or MD5).

[0133] In some specific scenarios, data may be encrypted for a given original text by using an authenticated encryption algorithm, and a message authentication code may be generated for the given original text. Thus, the authenticated encryption algorithm may be used as an encryption algorithm or an integrity protection algorithm. For example, the AES algorithm based on GMAC and counting encryption mode (AES-Galois / counter mode, AES-GCM) and the AES algorithm based on CMAC and counting encryption mode (AES-CMAC / counter mode, AES-CCM) may perform authenticated encryption on a message, and a MAC may be generated in the process of performing authenticated encryption to protect the integrity of the message.

[0134] A key derivation function (KDF) is used to derive one or more secret values from a secret value, and is also referred to as a key derivation algorithm. For example, a new secret value DK derived from a secret value Key can be expressed as DK=KDF(Key). Common key derivation algorithms include a password-based key derivation function (PBKDF), a scrypt algorithm, and the like. PBKDF algorithms further include a first-generation PBKDF1 and a second-generation PBKDF2. Optionally, in the key derivation process of some KDF algorithms, a hash algorithm is used to perform a hash modification on the input secret value. Therefore, an algorithm identifier can be further accepted as an input of the KDF function to indicate the hash algorithm to be used.

[0135] It should be noted herein that in the embodiments of the present application, in order to facilitate the description of the KDFs used in the key derivation process, the terms "first KDF," "second KDF," and "third KDF" are used in the description. The "first KDF," "second KDF," and "third KDF" may be different KDFs or the same KDF.

[0136] 5. Freshness parameters

[0137] The freshness parameter is used to generate keys, authentication parameters, and the like, and may also be referred to as freshness or freshness parameter, and may include at least one of a number once (NONCE), a counter, a serial number, a frame number, and the like. A NONCE is a random value that is used only once (or non-repeatedly). Freshness parameters generated at different moments are usually different. In other words, the specific value of the freshness parameter changes every time the freshness parameter is generated. Therefore, the freshness parameter used to generate a key (or authentication parameter, or the like) this time is different from the freshness parameter used to generate a key (or authentication parameter, or the like) last time. This can improve the security of the generated key.

[0138] For example, the freshness parameter may be a random number obtained by the node by using a random number generator.

[0139] For another example, the freshness parameter may be a packet data convergence protocol count (PDCP COUNT), where the PDCP COUNT may further include an uplink PDCP COUNT and a downlink PDCP COUNT. The uplink PDCP COUNT is incremented by one each time the second node sends an uplink PDCP data packet, and the downlink PDCP COUNT is incremented by one each time the first node sends a downlink PDCP data packet. Because the PDCP COUNT is constantly changing, the key generated each time by using the PDCP COUNT is different from the key generated last time by using the PDCP COUNT.

[0140] 6. Frame Number

[0141] A protocol data unit (PDU) is a data unit transmitted between peer layers during communication. In a protocol stack of a communication system, an entity at each layer can establish a PDU for an entity at that layer. The PDU contains information from an entity at a higher layer and additional information about the entity at the current layer, and is then transmitted to the next layer. In some scenarios, information about the entity at the current layer, such as transparent transmission, may not be attached. For example, for two sublayers, Logical Link Control (LLC) and Media Access Control (MAC), an LLC entity may establish an LLC PDU, and a MAC entity may establish a MAC PDU. For ease of explanation, protocol data units transferred in a communication system are collectively referred to as communication frames in the present embodiment. In particular, a control-type protocol data unit may also be referred to as a control frame or a management frame, and a data-type protocol data unit may also be referred to as a data frame. For example, a communication frame may be a media access control (MAC) data frame.

[0142] A communication frame received and transmitted by a node using a network has a corresponding serial number (SN), which is also called a sequence number. The value of the serial number is indicated by using n bits, and the serial number of the next communication frame is the serial number of the previous communication frame plus 1. For example, if the value of the serial number of communication frame A is assumed to be 192, the value of the serial number of the next communication frame B will be 193, and so on. Note that when a serial number rollover (SN rollover) occurs because the serial number exceeds the maximum representable value, the serial number value of the subsequent communication frame will be smaller than that of the previous communication frame. For example, the serial number is 8 bits. The serial number of the first communication frame is 0 and is incremented by 1 each time. When the serial number increases and reaches 0xFF, a serial number rollover occurs. In other words, the serial number has a cyclical property. For a serial number containing n bits, the serial number is 2 n This is repeated every time a communication frame passes through. Therefore, a communication frame does not have a unique serial number, but is unique in each serial number cycle (SN cycle).

[0143] In an embodiment of the present application, the frame number (FN) is indicated by using N bits. The N bits include n lower bits used to indicate bits of the serial number of the communication frame and Nn upper bits used to indicate bits of the recorded value. The initial value of the recorded value is 0 or a specified value, and when a rollover occurs in the serial number of the communication frame, the recorded value is incremented by 1. For example, the frame number is 32 bits and the serial number is 8 bits. Assume that the recorded value is 0x00 0000 and the value of the serial number of the communication frame is 0xFF, then the current frame number is 0x0000 00FF. The value of the serial number of the next data packet is incremented by 1 and then inverted. Therefore, the value of the serial number of the next protocol data unit is 0x00. Because a rollover occurs in the serial number, the recorded value changes to 0x00 0001. Therefore, the next frame number is 0x0000 0100. Since the frame number is an N-bit number, it can be understood that the frame number also has a count cycle (FN cycle). When the frame number exceeds the maximum value, a frame number rollover (FN rollover) also occurs.

[0144] Optionally, for setting the frame number, see the related definition of PCDP COUNT. PCDP COUNT includes the Hyper Frame Number (HFN) part and the serial number part of the protocol data unit. The starting value of the hyper frame number is set to 0 or a specified value, and when a rollover occurs for the protocol data unit serial number, the hyper frame number is incremented by 1.

[0145] Optionally, a node may maintain multiple frame numbers. For example, a node may separately maintain a frame number for an uplink communication frame and a frame number for a downlink communication frame. When transmitting an uplink communication frame, the node may increment the frame number of the uplink communication by one based on a change in the serial number of the communication frame. When transmitting a downlink communication frame, the node may adjust the frame number of the downlink communication frame based on a change in the serial number of the communication frame.

[0146] Next, the system architecture and service scenarios in the embodiments of the present application will be described. It should be noted that the system architecture and service scenarios described in this application are intended to more clearly explain the technical solutions of the present application, and do not constitute limitations on the technical solutions provided in this application. Those skilled in the art may know that with the development of system architecture and the emergence of new service scenarios, the technical solutions provided in this application can also be applied to similar technical problems.

[0147] 1 is a schematic diagram of the architecture of a communication system according to an embodiment of the present application. The communication system includes a first node 101, a first communication group 102, a second node 103, and a second node 104.

[0148] The first communication group 102 includes multiple second nodes, and the second node 103 and the second node 104 are both nodes belonging to the first communication group 103. It can be understood that the first communication group 102 may include one second node or multiple second nodes. In this specification, only an example in which the first communication group 102 includes two second nodes is used for explanation. This is not limited in the present application. Optionally, the first node 101 may also be referred to as a primary node or an access point (AP). Correspondingly, the second node 103 or the second node 104 in the first communication group 102 may be referred to as a second node.

[0149] The first node 101 may perform multicast communication with nodes in the first communication group 102, or may perform unicast communication with the second node 103 (or the second node 104) in the first communication group. Optionally, the communication data link may include various types of connection media, and may be a long-range connection technology, including, for example, radio access type technologies such as Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), and Universal Mobile Telecommunications System (UMTS), or, in another example, a short-range connection technology, including 802.11b / g, Bluetooth, Zigbee, Radio Frequency Identification (RFID) technology, Ultra-Wideband (UWB) technology, in-vehicle wireless short-range transmission technology, and the like. Of course, there are other technologies that may be used to support communication between the first node 101 and the second node.

[0150] A first node 101 may perform multicast communication with multiple second nodes in a first communication group 102, and the communication messages need to be encrypted to ensure that only members in the group can interpret the encrypted packets and non-group members cannot obtain the contents of the packets, thereby protecting the security of the multicast communication. For a second node 103 in the group, the first node 101 needs to send a group key to the second node 103, so that the second node 103 decrypts the multicast message by using the group key.

[0151] The first node 101 may encrypt a signaling message including the group key by using a signaling plane encryption key (e.g., a unicast key PTK between the first node 101 and the second node 103) and send the encrypted signaling message to the second node 103.

[0152] Please note that for ease of explanation, the second node 103 is used as an example in the description herein. For the second node 104 in the group, the first node 101 also needs to send the group key to the second node 104, so that the second node 104 can decrypt the multicast message by using the group key.

[0153] For example, Figure 2 is a schematic diagram of an application scenario of a communication method according to an embodiment of the present application. A vehicle cockpit domain controller (CDC) 201 is a control center in a smart cockpit device and may be regarded as the first node 101. A camera 202 and a camera 203 are in-vehicle camera devices. To facilitate control, the camera 202 and the camera 203 are configured as a communication group. The CDC 201 may perform multicast communication with the camera 202 and the camera 203 by using Wireless Fidelity (Wi-Fi) technology. Before the multicast communication, the CDC 201 may encrypt a signaling message including a group key by using the signaling plane encryption keys of the CDC 201 and the camera 203, and then send the encrypted signaling message to the camera 203. Correspondingly, CDC 201 may encrypt a signaling message including the group key by using the signaling plane encryption keys of CDC 201 and camera 203 , and then send the encrypted signaling message to camera 202 .

[0154] However, in the above method, the group key is protected by relying on encryption of signaling plane messages. If encryption is not enabled for signaling plane messages, the group key cannot be protected, which may lead to group key leakage.

[0155] For example, see Figure 2. An attacking device 204 may listen to the multicast communications. If encryption is not enabled for signaling plane messages, the attacker may obtain the group key by listening to the signaling messages that carry the group key, and then eavesdrop on or listen to the content of the multicast communications, or even launch an attack on the CDC 201, threatening vehicle safety.

[0156] 3 is a schematic flowchart of a communication method according to an embodiment of the present application, which can be implemented based on the architecture shown in FIG. 1. The method includes, but is not limited to, the following steps:

[0157] Step S301: The second node sends an association request message to the first node.

[0158] In particular, the second node may send a first association request message to the first node by using a wireless link (e.g., one of Wi-Fi, Bluetooth, ZigBee, or another short-range wireless link such as an in-vehicle short-range wireless communication link) or a wired link (e.g., optical fiber), and in response, the first node receives the first association request message from the second node.

[0159] Optionally, the association request message may include a device identifier of the second node, which may be an identity (ID), a media access control (MAC) address, a domain name, a domain address, or another user-defined identifier.

[0160] In this method, a first node may transmit an access message or a broadcast message, and a second node may receive the access message or the broadcast message from the first node. The second node may transmit a first association request message to the first node based on the access message or the broadcast message. In particular, the access message or the broadcast message of the first node may include at least one of an ID of the first node, descriptive information of the first node, information used to direct access of another node, or the like.

[0161] Optionally, the first association request message may further include information about security algorithms supported by the second node (or security capabilities (Sec Capabilities) of the second node). The information about the security algorithms may be names, identifiers, predefined symbols, or the like of the security algorithms. The information about the security algorithms supported by the second node may be used by the first node to determine one or more of a security algorithm (or a unicast security algorithm) between the first node and the second node, a group security algorithm for the first communication group, or the like.

[0162] Further optionally, after receiving the association request message from the first node, the second node may send a security context request message to the second node. The security context request message includes information regarding the unicast security algorithm determined by the first node and first identity authentication information, where the first identity authentication information is used by the second node to authenticate the identity of the first node. Further, the second node may feed back a security context response message to the first node. The security context response message includes second identity authentication information, where the second identity authentication information is used by the first node to verify the identity of the second node.

[0163] Step S302: The first node determines a group key for the first communication group.

[0164] In particular, the first communication group is a communication group to which the second node belongs. Optionally, the first node may obtain the device identifier of the second node in advance and determine the communication group to which the second node belongs based on the device identifier of the second node. That is, there is a correspondence between the device identifier of the second node and the communication group. For example, see Table 1 for the correspondence. Table 1 is a possible communication group information table provided in this embodiment of the present application. The correspondence displayed in the communication group information table may be preconfigured or predefined on the first node. The specific configuration and definition format are not limited to the table format, and the correspondence may be reflected. The communication group information table includes the ID of the communication group and the nodes included in the communication group. Optionally, information such as a group key or group algorithm of the communication group may be further included. The first node may determine the group key of the first communication group to which the first node is assigned based on the device identifier of the second node. For example, if the device identifier of the second node is "E0", the first node determines the group key for the communication group whose ID is "GID1". [Table 1]

[0165] Optionally, the first node may determine or obtain a group key for the first communication group by using at least the following method.

[0166] Method 1: The first node determines a group key for the first communication group based on the ID of the first communication group, and a correspondence exists between the ID of the first communication group and the group key of the first communication group. In particular, the correspondence between the ID of the communication group and the group key is predefined or preconfigured on the first node. Thus, the first node may determine the group key for the first communication group based on the ID of the first communication group. For example, see Table 1. The first node may determine that the group key of the communication group is "GK1" based on the ID of the communication group "GID1."

[0167] Method 2: The first node obtains a one-time number NONCEa and uses NONCEa as the group key for the first communication group.

[0168] Method 3: The first node generates a group key for the first communication group based on at least one of a first freshness parameter and an ID of the first communication group by using a second KDF. The first freshness parameter is a freshness parameter obtained (or generated) by the first node, and there may be one or more first freshness parameters. Optionally, the second KDF may be a KDF algorithm that gives the first node the highest priority. Generating a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using the second KDF may particularly include the following implementation forms.

[0169] Implementation 1: A first node generates a group key for a first communication group based on a first freshness parameter and an ID of the first communication group by using a second KDF. For example, the first freshness parameter is a freshness parameter NONCEg, and the ID of the first communication group is GID. The generated group key for the first communication group satisfies the formula GK=second KDF(NONCEg, GID).

[0170] Implementation 2: The first node generates a group key for the first communication group based on a first freshness parameter by using a second KDF. For example, the first freshness parameter is a freshness parameter NONCEg1 and a freshness parameter NONCEg2, and the ID of the first communication group is a GID. The generated group key for the first communication group satisfies the formula GK=KDF(NONCEg1, NONCEg2).

[0171] Implementation 3: The first node generates a group key for the first communication group based on a group ID of the first communication group by using a second KDF. For example, the generated group key for the first communication group satisfies the formula GK=KDF(GID).

[0172] Optionally, the parameters participating in the GK generation may further include other information, for example, one or more of the length of the generated key, an identifier of the hash algorithm used, and the like.

[0173] Optionally, the first node may generate an identifier GK ID of the group key GK, and further establish a correspondence between the GK ID and the ID of the first communication group, so that the next time a group key is determined, the corresponding GK ID is determined based on the ID of the first communication group, thereby obtaining the group key GK indicated by the GK ID.

[0174] It should be noted that before determining the group key of the first communication group, the first node may first determine whether the first communication group has a corresponding group key. If a corresponding group key exists, the group key of the first communication group is determined by using the method described in Method 1, or if a corresponding group key does not exist, the group key of the first communication group is determined by using the method described in Method 2 or Method 3. For example, when a new communication group is created, the new communication group does not have a corresponding group key, so the group key of the first communication group may be determined by using the method described in Method 2 or Method 3.

[0175] Step S303: The first node encrypts the group key of the first communication group based on the shared key between the first node and the second node to obtain a first protection key.

[0176] In particular, a shared key is a secret value shared between a first node and a second node. For example, the first node and the second node may generate a key S by exchanging public keys, and the value of the key S generated by the first node is the same as the value of the key S generated by the second node. Thus, the key S may be used as a shared key between the first node and the second node.

[0177] Optionally, the first node encrypting the group key of the first communication group based on the shared key between the first node and the second node may include at least some of the following implementation solutions.

[0178] Implementation Solution 1: The first node encrypts the group key by using the shared key to obtain a first protection key. For example, see Fig. 4. Fig. 4 is a possible schematic diagram of encrypting a group key according to an embodiment of the present application. The first node encrypts the group key 401 of the first communication group by using the shared key 402 to obtain a first protection key 403.

[0179] Optionally, the shared key may be a unicast key between the first node and the second node, for example, the first node encrypts the group key of the first communication group by using the unicast encryption key and based on the unicast encryption algorithm.

[0180] Implementation Solution 2: The first node may encrypt the group key by using the shared key and the second freshness parameter to obtain a first protection key. The second freshness parameter is one or more of a NONCE obtained (or generated) by the first node, a counter value, a frame number, and the like. For example, the second freshness parameter may be a one-time number NONCEk generated by the first node, or a public key exchanged between the first node and the second node. Since the value of the freshness parameter is different, the first protection key obtained by encrypting the same group key of the first communication group each time is also different. This improves the privacy of the group key. The counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0181] Implementation Solution 3: The first node generates a first intermediate key based on the shared key, and encrypts the group key by using the first intermediate key to obtain a first protection key. For example, see Figure 5. Figure 5 is a possible schematic diagram of encrypting a group key according to an embodiment of the present application. The first node generates a first intermediate key 503 based on the shared key 504, and encrypts the group key 501 by using the first intermediate key 503 to obtain a first protection key 502.

[0182] Implementation solution 4: The first node generates a first intermediate key based on the shared key and the second freshness parameter, and encrypts the group key by using the first intermediate key to obtain a first protection key.

[0183] For example, the first node generates a first intermediate key Kg based on the shared key Kdh and the value of the first counter, counter1, by using the first KDF, e.g., Kg=first KDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the first intermediate key Kg based on the shared key Kdh. Note that the generated first intermediate key Kg is used to encrypt a group key of the first communication group, so the number of times the intermediate key is generated may also represent the number of times the group key is encrypted. For example, the counter value starts from 1. When the first intermediate key is first generated based on the shared key Kdh and the value of the first counter, counter1, the counter value is 1. Correspondingly, when the first intermediate key Kg is secondly generated based on the shared key Kdh and the value of the first counter, counter1, the counter value is 2. Further optionally, when the value of the first counter is greater than or equal to a predefined or preset threshold, the first node updates the shared key Kdh, and after Kdh is updated, the first counter may restart counting.

[0184] In a possible design, if the generated first intermediate key fails to encrypt the group key of the first communication group or fails to transmit the group key of the first communication group, the value of the first counter that rejoins the generation of the first intermediate key may be the previous value of the counter.

[0185] In another example, the first node generates a first intermediate key Kg based on the session key Kenc and the one-time number NONCEk by using a first KDF, for example, Kg = first KDF(Kenc, NONCEk), and then encrypts the group key of the first communication group by using Kg to obtain a first protection key. In another example, the first node generates a shared key Kgt (the shared key Kgt may be specifically derived from the shared key Kdh) and the one-time number NONCK (or a counter value counter) by using a first KDF, for example, Kg = first KDF(Kenc, NONCEk (or counter)), and then encrypts the group key of the first communication group by using Kg to obtain a first protection key.

[0186] Specifically, the first node encrypts the group key of the first communication group by using the first intermediate key as follows: The first node performs an exclusive-OR operation on the group key of the first communication group and the first intermediate key to obtain a first protection key. For example, the first protection key GKc obtained by the first node through encryption can be expressed as follows:

number

number

[0187] Optionally, the first node may determine that encryption is not enabled for signaling plane messages between the first node and the second node, and may encrypt a group key of the first communication group to obtain a first protection key when encryption is not enabled for signaling plane messages. If encryption is enabled for signaling plane messages between the first node and the second node, the first node may send a second association establishment message to the second node. The second association establishment message includes the group key of the first communication group. Because the second association establishment message belongs to the signaling plane messages between the first node and the second node, the group key may be protected by encrypting the signaling plane messages.

[0188] Step S304: The first node sends a first association establishment message to the second node.

[0189] It can be understood that a first node transmits a first association establishment message to a second node, and in response, the second node receives the first association establishment message from the first node. The association establishment message includes a first protection key. For example, see FIG. 4. The first node transmits a first association establishment message 404 to a second node, and the second node receives the association establishment message 404 from the first node. For another example, see FIG. 5. The first node transmits a first association establishment message 505 to a second node, and the second node receives the association establishment message 505 from the first node.

[0190] Optionally, the first association establishment message further includes a second freshness parameter, which may be used by the second node to decrypt the first protection key.

[0191] Further optionally, when the second freshness parameter is a counter value, the second node may also obtain a counter value corresponding to the value of the counter on the first node. Thus, the first association establishment message may not include the second freshness parameter. For example, the value of the first counter on the first node is used as the second freshness parameter, and the value of the first counter represents the number of times to encrypt the group key. The second node also obtains the value of a second counter, and the value of the second counter is used to represent the number of times to decrypt the group key, and the value of the second counter corresponds to the value of the first counter. Thus, the first association establishment message may not include the second freshness parameter.

[0192] Optionally, the first association establishment message further comprises a message authentication code, which is used by the second node to authenticate the integrity of the first association establishment message.

[0193] Further optionally, the first node may encrypt the first association establishment message by using an encryption key, and correspondingly, the second node may decrypt the first association establishment message by using a corresponding decryption key to obtain the content in the first association establishment message.

[0194] Step S305: The second node obtains a group key of the first communication group based on the shared key between the first node and the second node and the first protection key. Optionally, the second node may decrypt the first protection key based on the shared key between the first node and the second node to obtain the group key of the first communication group.

[0195] In particular, the shared key is a secret value shared between the first node and the second node, so that the second node can decrypt the first protection key by using the shared key to obtain the group key of the first communication group.

[0196] Optionally, in response to the manner in which the first node encrypts the group key, the second node decrypts the first protection key based on the shared key between the first node and the second node may include at least some of the following implementation solutions.

[0197] Implementation Solution 1: The second node decrypts the first protection key by using the shared key to obtain the group key of the first communication group. For example, see Figure 4. The first node decrypts the first protection key 403 by using the shared key 402 to obtain the group key 401 of the first communication group.

[0198] Implementation solution 2: The second node may decrypt the first protection key by using the shared key and the second freshness parameter to obtain the group key of the first communication group.

[0199] Implementation Solution 3: The second node generates a first intermediate key based on the shared key, and uses the first intermediate key to decrypt the first protection key to obtain the group key of the first communication group. For example, see Figure 5. The second node generates a first intermediate key 503 based on the shared key 504, and uses the first intermediate key 503 to decrypt the first protection key 502 to obtain the group key 501 of the first communication group.

[0200] Solution 4 of the implementation: The second node generates a first intermediate key based on the shared key and the second freshness parameter, and decrypts the first protection key by using the first intermediate key to obtain a group key for the first communication group. For example, the second node generates a first intermediate key Kg based on the shared key Kdh and the value of a first counter counter1 by using a first KDF, e.g., Kg = first KDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the first intermediate key Kg based on the shared key Kdh. For another example, the second node generates a first intermediate key Kg based on a session key Kenc and the second freshness parameter NONCEk by using a first KDF, e.g., Kg = first KDF(Kenc, NONCEk). For another example, the first node generates a first intermediate key Kg based on the shared key Kgt and a one-time number NONCK (or counter value counter) by using a first KDF, for example, Kg = first KDF(Kenc, NONCEk (or counter)).

[0201] Optionally, the second node decrypting the first protection key by using the first intermediate key may be particularly as follows: the second node performs an exclusive-or operation on the first protection key and the first intermediate key to obtain the group key of the first communication group. For example, the second node decrypts the first protection key GKc to obtain the group key GK of the first communication group, which is expressed by the formula

number

[0202] Optionally, the second node may send an association completion message to the first node. The association completion message is used to indicate to the first node that the association has been successfully established. Optionally, the second node may encrypt the association completion message by using an encryption key. Correspondingly, the first node may decrypt the association completion message by using a corresponding decryption key to obtain the data content of the association completion message. Optionally, the association completion message includes a message authentication code, which is used by the first node to verify the integrity of the association completion message.

[0203] Optionally, the first association establishment message further includes information indicating a group security algorithm of the first communication group. In particular, the first node may determine a group security algorithm of the first communication group. The group security algorithm is an algorithm supported by the nodes in the group and may also be referred to as a group algorithm, and may include one or more of a group encryption algorithm, a group integrity protection algorithm, a group KDF algorithm, or the like.

[0204] It should be noted that "decoding" in the above implementations may be an independent step or a description of a function, i.e., other information may be obtained by decoding the information, or other information may be obtained by using the information in a decoding scheme.

[0205] Further optionally, the first node determining the group security algorithm of the first communication group includes at least the following cases:

[0206] Case 1: A group security algorithm corresponding to a first communication group is pre-configured or defined on the first node. Therefore, the first node can determine the corresponding group security algorithm based on the identifier of the first communication group (e.g., the number of the first communication group). For example, a group integrity protection algorithm is used as an example. FIGS. 6A and 6B are schematic diagrams of a method for determining a group security algorithm according to an embodiment of the present application. It can be seen that the group algorithm corresponding to the ID of the communication group can be determined based on the ID of the communication group. For example, see the information in area 601. It can be seen that the group integrity protection algorithm corresponding to the communication group whose group ID (group identify, GID) is GID2 is the ZUC encryption algorithm (ZUC). Optionally, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0207] Case 2: The first node may determine a group security algorithm based on an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy. See Figures 6A and 6B. An example is used in which the first algorithm selection policy is a priority-based algorithm selection policy. See the information in area 602. It can be seen that node E0 is a node in a communication group whose ID is GID1, and the communication group GID1 includes node E0, node E1, and node E2. The first node may obtain security capability information of the nodes in the group. See the information in area 603. It can be seen that the integrity protection algorithms supported by node E0 are AES-CCM, ZUC, and AES-GCM, the integrity protection algorithms supported by node E1 are AES-CCM and AES-GCM, the security algorithms supported by node E2 are AES-CCM and AES-GCM, and all nodes in the group support AES-CCM and AES-GCM. See region 604. It can be seen that the priority of AES-CCM is 1. See region 605. It can be seen that the priority of AES-GCM is 3. Therefore, AES-CCM can be determined as the integrity protection algorithm.

[0208] Optionally, in an order-based algorithm selection policy, a security algorithm that is earlier in the order may be determined based on a predefined or preset order. Further optionally, if two algorithms supported by nodes in a communication group have the same priority, a security algorithm that is earlier in the order may be selected.

[0209] Further optionally, the group security algorithm of the first communication group includes a third KDF algorithm. The first node may generate a session key for the first communication group by using the third KDF algorithm based on the group key and the type of the session key of the first communication group. The type of the session key may include one or more of a signaling plane encryption key, a signaling plane integrity protection key, a user plane encryption key, a user plane integrity protection key, and the like. For example, the signaling plane encryption key is used as an example. The signaling plane encryption key Kenc is generated based on the group key GK of the first communication group and the key type “enc” of the signaling plane encryption key by using the third KDF, e.g., Kenc = third KDF(GK,”enc”). For another example, the third KDF may specifically include multiple hash algorithms, and the algorithm identifier may be used to indicate the hash algorithm to be used. Therefore, the generated encryption key Kenc may further satisfy the formula Kenc = third KDF (GK, key type, algorithm identifier). Furthermore, the type of the session key may correspond to the scenario to which the session key is applied. In this application, only the above four types are used as examples. In certain implementations, another type of session key may also be included.

[0210] In the embodiment shown in FIG. 3 , after receiving an association request from the second node, the first node may determine a group key for the first communication group to which the second node belongs, then encrypt the group key by using a shared key between the first node and the second node to obtain a first protection key, carry the first protection key in an association establishment message, and send the association establishment message to the second node. It can be seen that since the protection key carried in the association establishment message is obtained by encrypting the group key using the shared key, the privacy of the group key can be protected regardless of whether the first association establishment message is encrypted. In this way, when performing multicast communication with the first communication group, the first node may encrypt the multicast message by using the group key to protect the multicast message, prevent non-group members from obtaining the communication content, and improve the security of the multicast communication.

[0211] Furthermore, the first node may send the group key to the second node in the association establishment message by using the protected key, and the group key distribution procedure may be integrated into the procedure of establishing an association between the first node and the second node. Therefore, no additional key distribution procedure is needed, which saves the overhead of network resources and improves the efficiency of multicast communication.

[0212] Figure 7 illustrates another communication method according to an embodiment of the present application, which can be implemented based on the architecture shown in Figure 1. The method includes at least the following steps:

[0213] Step S701: A first node determines that the conditions for updating the group key of a first communication group are met.

[0214] In particular, the conditions for updating the group key of the first communication group include at least one of the following conditions:

[0215] Condition 1: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the count cycle of the same round, and the marked frame number is the frame number for which key updating needs to be performed, or the marked frame number is the frame number of a communication frame encrypted for the first time using the group key of the first communication group.

[0216] The frame number of a communication frame includes a record value and a serial number of the communication frame. The frame number may be used to encrypt the communication frame in the transmission process of the communication frame. Optionally, the communication frame is a MAC data frame, and the serial number may be a MAC serial number (MAC SN). FIGS. 8A and 8B are schematic diagrams of possible communication scenarios according to an embodiment of the present application. A first node may send a multicast message to multiple nodes in a communication group, and the multicast message is sent in the form of a communication frame. For ease of explanation, the multicast message being sent to a second node is used as an example in FIGS. 8A and 8B. The multicast message may be encrypted by using a group key and a frame number. For example, a communication frame 803 sent by a first node may be encrypted by using a frame number 801 and a group key 802. The frame number 801 is a 32-bit number, and includes a record value of the most significant 22 bits and a serial number of the least significant 10 bits, and the order value of the least significant 10 bits corresponds to the serial number of the current communication frame 803. Because the number of bits in the frame number is limited, a rollover occurs when the frame number reaches its maximum value. For example, in the communication process shown in FIGS. 8A and 8B, the value of frame number 801 is 0x00000000. When communication frames are continuously transmitted, the frame number is accumulated. After the value of the frame number reaches its maximum value (for example, the value of frame number 804 becomes 0xFFFFFFFF), a rollover occurs, and the counting starts again from 0. For example, the value of frame number 804 is 0x00000000. However, if the group key 802 is not updated when the frame number becomes 0x00000001 again, the same key and the same frame number will be used to encrypt two different communication frames (communication frame 803 and communication frame 806). As a result, the key can be easily deciphered, threatening communication security.Therefore, to avoid affecting the privacy of the group key, the group key needs to be updated before its frame number reaches the frame number previously encrypted by using the group key 802. Please note that only the example where the frame number is 32 bits is used in this specification. In one specific implementation process, the size of the frame number is pre-configured based on the requirement, which is not limited in this application.

[0217] In particular, the first node may record the marked frame number. For example, the marked frame number may be the frame number for which the key needs to be updated, or the marked frame number may be the frame number of a communication frame that was encrypted for the first time using the group key of the first communication group. The first node may update the group key before the accumulated frame number reaches the frame number last encrypted using the group key, for example, updating the group key 10 frames ago. Furthermore, the first node may further indicate when a new key is applied, for example, indicating that the new group key is applied 5 frames ago.

[0218] In particular, when the frame number of the current communication frame and the marked frame number are in the same round of count cycles, the group key of the first communication group needs to be updated when the difference between the frame number of the current communication frame and the marked frame number is equal to or greater than a first threshold. For example, the marked frame number is the frame number of a communication frame encrypted for the first time using the group key of the first communication group. Figures 9A and 9B are schematic diagrams of a scenario for updating a group key according to an embodiment of the present application. A communication frame 901 is a communication frame encrypted for the first time using a group key 902, and the frame number of the communication frame is 0x00000001. The first node may mark the frame number (i.e., the marked frame number is 0x00000001). If the first node needs to update the group key 10 frames in advance, the first threshold is preset to 0xFFFF FFF5. In other words, when the frame number of the current communication frame reaches 0xFFFF FFF6, the difference between the frame number of the current communication frame and the marked frame number is 0xFFFF FFF5. Therefore, the first node may update the group key of the first communication group when the frame number reaches 0xFFFF FFF6. Further optionally, when the group key is updated, the time at which the new group key is applied may be indicated. For example, the new group key may be applied five frames before the marked frame number. In this case, when the frame number becomes 0xFFFF FFFB, the first node may encrypt the communication frame 905 by using the new group key 904 and the frame number 0xFFFF FFFB. In this way, a rollover occurs for the frame number of the communication frame, and then, when the frame number reaches the marked frame number 0x00000001, the key for encrypting the communication frame 905 is the new group key 904, and therefore communication security is not affected.

[0219] It should be noted that the thresholds in the present application may be specified in a protocol, or may be predefined or preset on a node, or may be determined by the node based on security requirements. For example, a first threshold may be obtained according to a protocol specification, or may be preset on a first node, or may be determined by the first node based on security requirements.

[0220] Condition 2: The difference between the marked frame number and the frame number of the current communication frame is less than or equal to a second threshold, the frame number of the current communication frame is within the count cycle of the next round of the marked frame number, the marked frame number is the frame number for which key updating needs to be performed, or the marked frame number is the frame number of a communication frame encrypted for the first time by using the group key of the first communication group.

[0221] It can be understood that when the frame number of the current communication frame is in the count cycle of the next round of the marked frame number, the first node needs to update the group key before the marked frame number and the frame number of the current communication frame are equal to or less than the second threshold. For example, the marked frame number is the frame number of the communication frame encrypted for the first time by using the group key of the first communication group. 10A and 10B are schematic diagrams of another scenario for updating the group key according to an embodiment of the present application. A communication frame 1001 is a communication frame encrypted for the first time by using the group key 1002, and the frame number of the communication frame is 0x5555 6666. The first node may mark the frame number (i.e., the marked frame number is 0x5555 6666). If the first node needs to update the group key 10 frames in advance, the second threshold is 10. In other words, when a rollover occurs for the frame number of the current communication frame and the frame number reaches 0x5555 665A, the difference between the marked frame number and the frame number of the current communication frame is 10. Therefore, the first node starts updating the group key for the first communication group when the frame number reaches 0x5555 665A. Further optionally, a start time for the new group key can be determined when the group key is updated. For example, the new group key can be applied five frames before the marked frame number. In this case, when the frame number reaches 0x5555 6661, the first node can encrypt communication frame 1004 by using the new group key 1005 and frame number 0x5555 6661. In this way, when the frame number of the communication frame reaches the marked frame number 0x5555 6666, the key for encrypting communication frame 1006 is the new group key 1005, and therefore communication security is not affected.

[0222] Condition 3: The validity period of the group key of the first communication group expires or the usage duration of the group key of the first communication group reaches a third threshold.

[0223] Optionally, the group key of the first communication group may have a validity period. When the validity period of the group key of the first communication group expires, the group key of the first communication group needs to be updated. For example, the validity period of the group key of the first communication group may be a specific time, or the validity period may be a frame number of a communication frame, or the validity period may be a counter value, or the like. For example, the validity period of the group key of the first communication group may be 8:08:08 on July 6, 2020, indicating that the date and time at which the validity period of the group key of the first communication group is valid is 8:08:08 on July 6, 2020, or that the date and time at which the validity period of the group key of the first communication group is invalid starts after 8:08:08 on July 6, 2020. Therefore, if the current time is the validity period, the first node may update the group key. Optionally, the first node may update the group key of the first communication group in advance before the validity period expires, for example, updating the group key of the first communication group 10 minutes before the validity period expires.

[0224] Optionally, the group key of the first communication group may have a usage duration. When the usage duration of the group key of the first communication group reaches a third threshold (greater than or equal to the third threshold), the group key of the first communication group needs to be updated. Further optionally, the third threshold may be specified in the protocol, or may be predefined or preset on the first node, or the threshold may be determined by the first node based on security requirements. For example, the protocol may specify that the third threshold is 24 hours. When the group key of the first communication group reaches 24 hours, the group key of the first communication group needs to be updated. For another example, in the first node, the third threshold may be predefined as 1000 communication frames (specifically, may include 1000 management frames and 1000 data frames). When 1000 management frames or 1000 data frames are encrypted by using the group key of the first communication group, the group key of the first communication group needs to be updated.

[0225] Condition 4: At least one second node in the first communication group leaves the first communication group.

[0226] It can be understood that when one second node in a communication group leaves the first communication group, the first node needs to update the group key, and communication between the first node and the second node in the first communication group is private. For example, the first communication group GID1 includes three second nodes, from the second node E0 to the second node E2. Because the functionality of the second node E2 is obsolete, the second node E2 sends a request message to the first node to request exit from the first communication group. After the first node determines that the second node E2 has left the first communication group (e.g., after the first node deletes the second node E2 from the nodes included in the communication group GID1 in the communication group information table shown in Table 1), the first node can update the group key of the first communication group. For another example, the first node receives a configuration message sent by an upper layer management node. The configuration message instructs the first node to remove the second node E1 from the first communication group. After the first node determines that the second node E1 has been removed from the first communication group (e.g., after the first node deletes the second node E1 from the nodes included in the communication group GID1 in the communication group information table shown in Table 1), the first node may update the group key of the first communication group.

[0227] Furthermore, the first node may be further configured to update the group key when one second node joins the first communication group or when one second node leaves the first communication group. For example, the first communication group GID2 includes two second nodes, the second node E3 and the second node E4. After the administrator adds the second node E9 to the first communication group (e.g., after the second node E9 is added to the nodes included in the communication group GID2 in the communication group information table shown in Table 1), the first node may update the group key. For another example, the first node receives a configuration message. The configuration message instructs the first node to add the second node E10 to the first communication group GID2. After the first node determines that the second node E9 is to be added to the first communication group GID2 (e.g., after the second node E10 is added to the nodes included in the communication group GID2 in the communication group information table shown in Table 1), the first node may update the group key of the first communication group.

[0228] Step S702: The first node determines a first key based on at least one of the third freshness parameter and the identifier ID of the first communication group.

[0229] In particular, the first node determining the first key based on at least one of the third freshness parameter and the identifier ID of the first communication group includes at least the following two methods:

[0230] Method 1: The first node obtains one third freshness parameter and uses the third freshness parameter as the first key.

[0231] Method 2: The first node generates a first key based on at least one of a third freshness parameter and an ID of the first communication group by using a second KDF. The third freshness parameter is a freshness parameter obtained (or generated) by the first node, and there may be one or more third freshness parameters. Optionally, the second KDF may be a KDF algorithm that gives the first node the highest priority. The first node may generate the first key in the following specific implementation forms.

[0232] Implementation 1: The first node generates a first key based on a third freshness parameter and an ID of a first communication group by using a second KDF. For example, the third freshness parameter is the freshness parameter NONCEg3, and the ID of the first communication group is GID. The generated first key NGK satisfies the formula NGK=KDF(NONCEg3, GID).

[0233] Implementation 2: The first node generates a first key based on a third freshness parameter by using a second KDF. For example, the third freshness parameter is a freshness parameter NONCEg3 and a freshness parameter NONCEg4. The generated first key NGK satisfies the formula NGK=KDF(NONCEg3, NONCEg4).

[0234] Optionally, the first key is used to replace the group key of the first communication group and serves as the new group key for the first communication group.

[0235] Step S703: The first node encrypts the first key based on the shared key between the first node and the second node to obtain a second protection key.

[0236] In particular, the first node encrypting the first key based on the shared key between the first node and the second node may include at least the following solutions in some implementation forms.

[0237] Implementation Solution 1: The first node encrypts the first key by using the shared key to obtain the second protection key.

[0238] Implementation Solution 2: The first node may encrypt the first key by using the shared key and a fourth freshness parameter to obtain the second protection key, where the fourth freshness parameter is one or more of a one-time number value, a counter value, a frame number, and the like obtained (or generated) by the first node.

[0239] Implementation solution 3: The first node generates a second intermediate key based on the shared key, and encrypts the first key by using the second intermediate key to obtain a second protection key.

[0240] Solution 4 of the implementation: The first node generates a second intermediate key based on the shared key and the fourth freshness parameter, and encrypts the first key by using the second intermediate key to obtain a second protection key. For example, the first node generates the second intermediate key Kg2 based on the shared key Kdh and the value of the first counter counter1 by using the KDF, e.g., Kg2=KDF(kdh,counter1). The first counter may be used to represent the number of times the first node generates the second intermediate key Kg based on the shared key Kdh. For another example, the first node generates the second intermediate key Kg2 based on the session key Kenc and the fourth freshness parameter NONCEk2 by using the KDF, e.g., Kg2=KDF(Kenc,NONCEk2).

[0241] The first node encrypting the first key by using the second intermediate key may be particularly as follows: The first node performs an exclusive-or operation on the first key and the first intermediate key to obtain a first protection key. For example, the second protection key GKc2 obtained by the first node through encryption can be expressed as:

number

number

[0242] Optionally, the first node may determine that encryption is not enabled for signaling plane messages between the first node and the second node, and may encrypt the first key to obtain the second protection key when encryption is not enabled for the signaling plane messages. Optionally, when encryption is enabled for signaling plane messages between the first node and the second node, the key update message includes the first key. Because the key update message belongs to the signaling plane messages between the first node and the second node, the first key may be protected by encrypting the signaling plane messages.

[0243] Step S704: The first node sends a key update message to the second node.

[0244] In particular, the key update message includes the second protection key. It can be understood that the first node sends the key update message to the second node, and in response, the second node receives the key update message from the first node.

[0245] Optionally, the key update request message further includes a fourth freshness parameter, which is used by the second node to decrypt the second protection key to obtain the first key.

[0246] Optionally, the key update request is further used to indicate a start time and / or a first key validity period of the first key. The first key start time is used to indicate a time when the first key is applied, and the first key validity period is used to indicate a period of use of the first key. Furthermore, when the key update request includes the first key start time and the first key validity period, the first key is applied within the first key validity period starting from the first key start time.

[0247] Optionally, the key update message may be a multicast message sent by the first node to a second node in the first communication group, or may be a unicast message between the first node and the second node. Optionally, in the case where the key update message is a multicast message, the shared key used when the first node encrypts the first key is a group key of the first communication group (or a session key of the first communication group derived from the group key). Further optionally, when the key update message is a unicast message, the first node may further send the key update message to another second node in the first communication group.

[0248] Optionally, the first node encrypts the key update message by using an encryption key, and correspondingly, the second node may decrypt the key update message by using a corresponding decryption key to obtain data content in the key update message. Optionally, the key update message includes a message authentication code, which is used by the second node to verify the integrity of the key update message.

[0249] Step S705: The second node obtains a first key based on the shared key between the first node and the second node and the second protection key. Optionally, the second node may decrypt the second protection key based on the shared key between the first node and the second node to obtain a group key of the first communication group.

[0250] In particular, corresponding to the manner in which the first node encrypts the first key, the first node decrypting the second protection key based on a shared key between the first node and the second node may include at least some of the following implementation solutions.

[0251] Implementation solution 1: The second node decrypts the second protection key by using the shared key to obtain the first key.

[0252] Implementation solution 2: The second node may decrypt the second protection key by using the shared key and the fourth freshness parameter to obtain the first key.

[0253] Implementation solution 3: The second node generates a second intermediate key based on the shared key, and decrypts the second protection key by using the second intermediate key to obtain the first key.

[0254] Implementation solution 4: The second node generates a second intermediate key based on the shared key and the fourth freshness parameter, and decrypts the second protection key by using the second intermediate key to obtain the first key.

[0255] Optionally, the second node decrypting the second protection key by using the second intermediate key may be particularly as follows: The second node performs an exclusive-or operation on the second protection key and the second intermediate key to obtain the first key. For example, the second node decrypting the second protection key GKc2 based on the second intermediate key Kg2 to obtain the first key NGK may be performed by the formula

number

[0256] It should be noted that "decoding" in the above implementations may be an independent step or a description of a function, i.e., other information may be obtained by decoding the information, or other information may be obtained by using the information in a decoding scheme.

[0257] Optionally, the embodiment shown in Figure 7 further includes some or all of steps S706 to S709. Steps S706 to S709 are as follows.

[0258] Step S706: The second node sends an update acknowledgement message to the first node.

[0259] It can be understood that the second node sends an update acknowledgement message to the first node, and in response, the first node receives an update acknowledgement message from the second node.

[0260] Optionally, the first communication group includes one or more second nodes. The first node may send a key update message to the one or more second nodes. In response, the first node may receive an update acknowledgement message from the one or more second nodes.

[0261] Optionally, the second node may encrypt the update acknowledgement message by using the encryption key. Correspondingly, the first node may decrypt the update acknowledgement message by using the corresponding decryption key to obtain the data content in the update acknowledgement message. Optionally, the key update acknowledgement message includes a message authentication code, which is used by the first node to verify the integrity of the update acknowledgement message.

[0262] Step S707: The first node determines that an update acknowledgement message has been received from at least one second node in the first communication group.

[0263] In particular, when it is determined that an update acknowledgement message has been received from at least one second node in the first communication group, this indicates that a new key may be applied.

[0264] Optionally, after the first node receives update acknowledgement messages from all nodes in the first communication group, this indicates that the new key may be applied.

[0265] Further optionally, the first node may receive an update acknowledgement message from at least one node within a preset time period. If an update acknowledgement message from at least one second node is received within the preset time period, this indicates that a new key may be applied. Optionally, for a node that does not receive an update acknowledgement message from at least one second node, the first node may reconnect to the at least one second node by using a unicast message. For example, the first communication group includes a second node A and a second node B. The first node sends a key update message to the second node A and the second node B. If the first node receives an update acknowledgement message from the second node A, this indicates that a new key may be applied. For the second node B, the first node may reconnect to the second node B or further send the encrypted new key to the second node B.

[0266] Step S708: The first node applies the first key at the start time of the first key.

[0267] In particular, the start time of the first key may be predefined or preset, or may be indicated by the first node in the key update message. For example, it may be predefined in the first node that the first key is to be applied to the fifth communication frame after the key update message is transmitted. For another example, the first node may indicate in the key update message that a new key is to be applied when the frame number reaches 0xFFFF FFFF6. The first node may use the first key as a new group key for the first communication group at the start time of the first key.

[0268] Step S709: The second node applies the first key at the start time of the first key.

[0269] In particular, the start time of the first key may be predefined or preset, or may be indicated by the first node in a key update message. For example, the second node may predefine that the first key will be applied to the fifth communication frame after the key update message is received. For another example, the first node may indicate in the key update message that a new key will be applied when the frame number reaches 0xFFFF FFFF6. The second node may use the first key as a new group key for the first communication group at the start time of the first key.

[0270] 7, after it is determined that the conditions for updating the group key are met, a first key may be determined, and after the first key is encrypted by using the shared key, the first key is sent to the second node by using a key update message. It can be seen that the privacy of the first key can be protected regardless of whether the key update message is encrypted, because the protection key carried in the key update message is obtained by encrypting the first key using the shared key.

[0271] Optionally, the method in the embodiment shown in Fig. 7 may be a subsequent step of the method in the embodiment shown in Fig. 3. It may be understood that when determining a key for the first communication group by using the communication method shown in Fig. 3, the first node may update a group key for the first communication group by using the communication method shown in Fig. 7. In this case, it may be understood that the method for determining the first key in the embodiment shown in Fig. 7 is consistent with the method for determining a key for the first communication group in Fig. 3, and the method for encrypting the first key in the embodiment shown in Fig. 7 is consistent with the method for encrypting the group key in Fig. 3.

[0272] The above-described method embodiment shown in Fig. 3 includes many possible implementation solutions. Next, some of the implementation solutions will be separately illustrated with reference to Fig. 11 and Fig. 12A and Fig. 12B. Please note that for related concepts, operations, or logical relationships not described in Fig. 11 and Fig. 12A and Fig. 12B, please refer to the corresponding descriptions of the embodiment shown in Fig. 3. Therefore, the details will not be described again.

[0273] 11 is a schematic flowchart of a communication method according to an embodiment of the present application. The method can be implemented based on the architecture shown in FIG. 1. The method includes, but is not limited to, the following steps:

[0274] Step S1101: The second node sends an association request message to the first node.

[0275] In particular, the first association request message may include the second node's device ID (which may be specifically the second node's ID), information about the security algorithms supported by the second node (or the second node's security capabilities (Sec Capabilities)), and a freshness parameter NONCEe obtained by the second node.

[0276] The second node sends a first association request message to the first node, and in response, the first node receives a first association request message from the second node.

[0277] For a specific explanation, please refer to the contents of step S301.

[0278] Step S1102: The first node sends a security context request message to the second node.

[0279] In particular, the security context request message includes first identity authentication information AUTHa. Optionally, the security context request message may further include one or more of a freshness parameter NONCEa obtained by the first node, information on a target security algorithm (a unicast security algorithm between the first node and the second node) algorithm1, a message authentication code MAC1, and the like.

[0280] The first identity authentication information is used by the second node to verify the identity of the first node, and the first identity authentication information is generated by the first node based on a shared key between the first node and the second node. For example, the shared key is a pre-shared key (PSK) between the first node and the second node. The AUTHa generated by the first node by using the PSK satisfies the formula AUTHa = KDF(PSK). Further optionally, the parameters participating in the KDF generation may further include one or more of a freshness parameter NONCEe obtained by the second node, a freshness parameter NONCEa obtained by the first node, an association request message, and the like. For example, AUTHa = KDF(PSK, NONCEa, association request message). These are not listed one by one in this specification.

[0281] The target security algorithm in the security context request message belongs to a set of security algorithms indicated by the information about security algorithms supported by the second node. Optionally, the target security algorithm includes one or more of an encryption algorithm, an integrity protection algorithm, and a KDF, and the target security algorithm is used to indicate a security algorithm to be used when the first node communicates with the second node.

[0282] The message authentication code MAC1 in the security context request message is used to protect the integrity of the security context request message. Optionally, the message authentication code MAC1 may be generated based on some or all of the data in the security context request message and based on an integrity protection key and an integrity protection algorithm.

[0283] It can be understood that a first node sends a security context request message to a second node, and in response, the second node receives a security context request message from the first node.

[0284] Step S1103: The second node verifies the identity of the first node based on the first identity authentication information.

[0285] In particular, the first identity credential is generated by the first node based on the shared key, and the second node may then verify the first identity credential by using the shared key to verify the identity of the first node.

[0286] In one possible implementation solution, the method used by the first node to generate the first identity authentication information according to the protocol specifications is also used by the second node to generate a check value. If the check value is the same as the first identity authentication information, the verification of the identity of the first node is successful. For example, the second node generates a check value check1, i.e., check1=KDF(PSK), based on the PSK stored in the second node, and then compares check1 with the value of the first identity authentication information AUTHa. If check1 is the same as AUTHa, the authentication is successful.

[0287] Optionally, when the security context request message includes a message authentication code MAC1, the second node may further verify the integrity of the security context request message based on the message authentication code MAC1.

[0288] Optionally, if the verification of the identity information of the first node or the verification of the integrity of the security context request message fails, this indicates that the identity of the first node is not trusted or this indicates that communication with the first node is not secure, and therefore the second node may disconnect from the first node or may not perform subsequent communication steps.

[0289] Step S1104: The second node sends a security context response message to the first node.

[0290] In particular, the security context response message includes the second identity authentication information AUTHe. Optionally, the security context response message may further include a message authentication code MAC1 and the like.

[0291] The second identity authentication information is used by the first node to verify the identity of the second node, and the second identity authentication information is generated by the second node based on a shared key between the first node and the second node. For example, the shared key is a PSK. The AUTHe generated by the second node by using the PSK satisfies the formula AUTHe = KDF(PSK). Further optionally, the parameters participating in the KDF generation may further include one or more of a freshness parameter NONCEe obtained by the second node, a freshness parameter NONCEa obtained by the first node, a security context request message, and the like. For example, AUTHa = KDF(PSK, NONCEe, security context request message). These are not listed one by one in this specification.

[0292] The message authentication code MAC2 in the security context response message is used to protect the integrity of the security context response message. Optionally, the message authentication code MAC2 may be generated based on some or all of the data in the security context response message and based on an integrity protection key and an integrity protection algorithm.

[0293] It can be understood that the second node sends a security context response message to the first node, and in response, the first node receives a security context response message from the second node. Optionally, the second node may encrypt the security context response message by using an encryption key. In response, the first node may decrypt the security context response message by using a corresponding decryption key to obtain data content in the security context response message.

[0294] Step S1105: The first node verifies the identity of the second node based on the second identity authentication information.

[0295] In particular, the second identity credential is generated by the second node based on the shared key, and therefore the first node also has the shared key and can verify the second identity credential by using the shared key to verify the identity of the second node.

[0296] In one possible implementation solution, the method used by the second node to generate the second identity authentication information according to the protocol specifications is also used by the first node to generate a check value. If the check value is the same as the second identity authentication information, the verification of the identity of the second node is successful. For example, the first node generates a check value check2, i.e., check2=KDF(PSK), based on the PSK stored in the first node, and then compares check2 with the value of the second identity authentication information AUTHe. If check2 is the same as AUTHe, the authentication is successful.

[0297] Optionally, when the security context response message includes a message authentication code MAC2, the first node may further verify the integrity of the security context response message based on the message authentication code MAC2.

[0298] Optionally, if the verification of the identity information of the second node or the verification of the integrity of the security context response message fails, this indicates that the identity of the second node is not trustworthy or this indicates that communication with the second node is not secure, and therefore the first node may disconnect from the second node or may not perform subsequent communication steps.

[0299] Step S1106: The first node determines a group key for the first communication group.

[0300] In particular, the first node may determine a group key for the first communication group by using at least the following method:

[0301] Method 1: The first node determines a group key of the first communication group based on the ID of the first communication group, and there is a correspondence between the ID of the first communication group and the group key of the first communication group.

[0302] Method 2: The first node obtains a one-time number NONCEa and uses NONCEa as the group key for the first communication group.

[0303] Method 3: The first node generates a group key for the first communication group based on at least one of a first freshness parameter and an ID of the first communication group by using a second KDF. For example, the first freshness parameter is a freshness parameter NONCEg, and the ID of the first communication group is GID. The generated group key for the first communication group satisfies the formula GK=KDF(NONCEg, GID). In another example, the first freshness parameter is a freshness parameter NONCEg1 and a freshness parameter NONCEg2, and the ID of the first communication group is GID. The generated group key for the first communication group satisfies the formula GK=KDF(NONCEg1, NONCEg2). For another example, the generated group key for the first communication group satisfies the formula GK=KDF(GID). Optionally, the parameters participating in the GK generation may further include other information, for example, one or more of the length of the generated key, an identifier of the hash algorithm used, and the like.

[0304] For a specific explanation, please refer to the contents of step S302.

[0305] Step S1107: The first node encrypts the group key of the first communication group based on the shared key between the first node and the second node to obtain a first protection key.

[0306] In particular, at least some of the following implementation solutions may be included:

[0307] Implementation Solution 1: The first node encrypts the group key by using the shared key to obtain a first protection key.

[0308] Implementation solution 2: The first node may encrypt the group key by using the shared key and the second freshness parameter to obtain a first protection key.

[0309] Implementation solution 3: The first node generates a first intermediate key based on the shared key, and encrypts the group key by using the first intermediate key to obtain a first protection key.

[0310] Implementation solution 4: The first node generates a first intermediate key based on the shared key and the second freshness parameter, and encrypts the group key by using the first intermediate key to obtain a first protection key.

[0311] For example, the first node generates the first intermediate key Kg based on the shared key Kdh and the value of the first counter counter1 by using the first KDF, e.g., Kg = firstKDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the first intermediate key Kg based on the shared key Kdh. For another example, the first node generates the first intermediate key Kg based on the session key Kenc and the second freshness parameter NONCEk by using the first KDF, e.g., Kg = firstKDF(Kenc, NONCEk). For another example, the first node generates the first intermediate key Kg based on the shared key Kgt and the one-time number NONCK (or counter value counter) by using the first KDF, e.g., Kg = firstKDF(Kenc, NONCEk (or counter)).

[0312] Optionally, the first node encrypting the group key of the first communication group by using the first intermediate key may be specifically as follows: The first node performs an exclusive-or operation on the group key of the first communication group and the first intermediate key to obtain a first protection key. For example, the first protection key GKc obtained by the first node through encryption can be expressed as:

number

number

[0313] For a specific explanation, please refer to the contents of step S303.

[0314] Optionally, the communication method shown in Figure 11 may further include step S1108. Step S1108 is particularly as follows:

[0315] Step S1108: The first node determines a group security algorithm.

[0316] In particular, the group security algorithm is an algorithm supported by all nodes in the group. Optionally, the first node's determining the group security algorithm of the first communication group includes at least the following cases:

[0317] Case 1: A group security algorithm corresponding to a first communication group exists on the first node. Therefore, the first node can determine the corresponding group security algorithm based on the identifier of the first communication group (e.g., the number of the first communication group). For example, a group integrity protection algorithm is used as an example. Figures 6A and 6B are schematic diagrams of a method for determining a group security algorithm according to an embodiment of the present application. It can be seen that the group algorithm corresponding to the ID of the communication group can be determined based on the ID of the communication group. For example, see the information in area 601. It can be seen that the group integrity protection algorithm corresponding to the communication group whose group ID (group identify, GID) is GID2 is the ZUC encryption algorithm (ZUC).

[0318] Case 2: The first node may determine the group security algorithm based on an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0319] 6A and 6B. An example is used in which the first algorithm selection policy is a priority-based algorithm selection policy. For example, see the information in area 602. It can be seen that node E0 is a node in a communication group whose ID is GID1, and that the communication group GID1 includes node E0, node E1, and node E2. The first node may obtain security capability information of the nodes in the group. See the information in area 603. It can be seen that the integrity protection algorithms supported by node E0 are AES-CCM, ZUC, and AES-GCM, the integrity protection algorithms supported by node E1 are AES-CCM and AES-GCM, the security algorithms supported by node E2 are AES-CCM and AES-GCM, and the algorithms supported by all nodes in the group are AES-CCM and AES-GCM. See area 604. It can be seen that the priority of AES-CCM is 1. See area 605. It can be seen that the priority of AES-GCM is 3. Therefore, AES-CCM can be determined as the integrity protection algorithm.

[0320] Optionally, in an order-based algorithm selection policy, a security algorithm that is earlier in the order may be determined based on a predefined or preset order. Furthermore, if two algorithms supported by nodes in a communication group have the same priority, a security algorithm that is earlier in the order may be selected.

[0321] Optionally, the group security algorithm includes a third KDF algorithm. The first node may generate a session key for the first communication group by using the third KDF algorithm based on the group key and the type of the session key of the first communication group. The type of the session key may include one or more of a signaling plane encryption key, a signaling plane integrity protection key, a user plane encryption key, a user plane integrity protection key, and the like. For example, the signaling plane encryption key is used as an example. The signaling plane encryption key Kenc is generated based on the group key GK of the first communication group and the key type “enc” of the signaling plane encryption key by using the third KDF, e.g., Kenc=third KDF(GK,”enc”). Furthermore, the type of the session key may correspond to a scenario to which the session key is applied. In this application, only the aforementioned four types are used as examples. In certain implementations, another type of session key may be further included.

[0322] Step S109: The first node sends an association establishment message to the second node.

[0323] Optionally, the first association establishment message includes a first protection key GKc and a group security algorithm Galgorithm of the first communication group.

[0324] Optionally, the first association establishment message may further include one or more of a second freshness parameter NONCEk, a first communication group group key expiration period GK expiration, a first communication group group key start time timer, a message authentication code MAC3, and the like. The second freshness parameter may be used by the second node to decrypt the first protection key. The first communication group group key expiration period is used to indicate a usage period of the first communication group group key. The first communication group group key start time is used to indicate an opportunity to apply the first communication group group key.

[0325] The message authentication code MAC3 in the association establishment message is used by the second node to verify the integrity of the association establishment message.

[0326] It may be understood that a first node transmits a first association establishment message to a second node, and in response, the second node receives the first association establishment message from the first node. Optionally, the first node may encrypt the first association establishment message by using an encryption key. Correspondingly, the second node may decrypt the first association establishment message by using a corresponding decryption key to obtain data content in the first association establishment message.

[0327] Step S1110: The second node decrypts the first protection key based on the shared key between the first node and the second node to obtain the group key of the first communication group.

[0328] For a specific explanation, please refer to the contents of step S305.

[0329] Optionally, the communication method shown in Figure 11 may further include step S1111. Step S1111 is particularly as follows:

[0330] Step S1111: The second node sends an association complete message to the first node.

[0331] In particular, the association completion message is used to indicate to the first node that the association has been successfully established. It may be understood that the second node may send the association completion message to the first node, and the first node may correspondingly receive the association completion message from the second node. Optionally, the first node may encrypt the first association establishment message by using an encryption key. Correspondingly, the second node may decrypt the first association establishment message by using a corresponding decryption key to obtain data content in the first association establishment message. Optionally, the association completion message includes a message authentication code MAC4, which is used by the first node to verify the integrity of the association completion message.

[0332] 12A and 12B are schematic flowcharts of a communication method according to an embodiment of the present application, which may be implemented based on the architecture shown in FIG. 1. The method includes, but is not limited to, the following steps:

[0333] Step S1201: The second node sends an association request message to the first node.

[0334] For a specific explanation, please refer to the contents of step S1101.

[0335] Step S1202: The first node sends a security context request message to the second node.

[0336] For a specific explanation, please refer to the contents of step S1102.

[0337] Step S1203: The second node verifies the identity of the first node based on the first identity authentication information.

[0338] For a specific explanation, please refer to the contents of step S1103.

[0339] Step S1204: The second node sends a security context response message to the first node.

[0340] For a specific explanation, please refer to the contents of step S1104.

[0341] Step S1205: The first node verifies the identity of the second node based on the second identity authentication information.

[0342] For a specific explanation, please refer to the contents of step S1105.

[0343] Step S1206: The first node determines a group key for the first communication group.

[0344] For a specific explanation, please refer to the contents of step S1106.

[0345] Step S1207: The first node determines whether encryption is enabled for signaling plane messages between the first node and the second node.

[0346] In particular, if the first node determines that encryption is not enabled for signaling plane messages between the first node and the second node, the first node may perform step S1208 or a step after step S1208.

[0347] If the first node determines that encryption is enabled for signaling plane messages between the first node and the second node, the first node may perform step S1212 or a step after step S1212.

[0348] Step S1208: The first node encrypts the group key of the first communication group based on the shared key between the first node and the second node to obtain a first protection key.

[0349] For a specific explanation, please refer to the contents of step S1107.

[0350] Step S1209: The first node determines a group security algorithm.

[0351] For a specific explanation, please refer to the contents of step S1108.

[0352] Step S1210: The first node sends a first association establishment message to the second node.

[0353] For a specific explanation, please refer to the contents of step S1109.

[0354] Step S1211: The second node decrypts the first protection key based on the shared key between the first node and the second node to obtain the group key of the first communication group.

[0355] For a specific explanation, please refer to the contents of step S1110.

[0356] Step S1212: The first node sends a second association establishment message to the second node.

[0357] In particular, if encryption is enabled for signaling plane messages between the first node and the second node, the first node sends a second association establishment message to the second node, the second association establishment message including a group key for the first communication group, and because the second association establishment message belongs to the signaling plane messages between the first node and the second node, the group key can be protected by encrypting the signaling plane messages.

[0358] Step S1213: The second node sends an association complete message to the first node.

[0359] In particular, the association completion message is used to indicate to the first node that the association has been successfully established. It may be understood that the second node may send the association completion message to the first node, and in response, the first node may receive the association completion message from the second node. Optionally, the first node may encrypt the first association establishment message by using an encryption key. Correspondingly, the second node may decrypt the first association establishment message by using a corresponding decryption key to obtain data content in the first association establishment message. Optionally, the association completion message includes a message authentication code, which is used by the first node to verify the integrity of the association completion message.

[0360] The method in the embodiment of the present application is described in detail above, and the apparatus in the embodiment of the present application is provided as follows.

[0361] 13 is a schematic diagram of the structure of a communication device 130 according to an embodiment of the present application. The device 130 may be a node or a component within a node, for example, a chip or an integrated circuit. The device 130 may include a receiving unit 1301, a processing unit 1302, and a transmitting unit 1303. The units are described as follows:

[0362] The receiving unit 1301 is configured to receive an association request message from a second node.

[0363] The processing unit 1302 is configured to determine a group key for a first communication group, the first communication group being the communication group to which the second node belongs, and the group key for the first communication group being determined based on at least one of a first freshness parameter and an identifier ID of the first communication group.

[0364] The processing unit 1302 is configured to encrypt a group key of a first communication group based on a shared key between the first node and the second node to obtain a first protection key.

[0365] The sending unit 1303 is configured to send a first association establishment message to the second node, the first association establishment message including the first protection key.

[0366] In yet another possible implementation, the processing unit 1302: It is particularly configured to encrypt the group key of the first communication group based on the shared key between the first node and the second node and the second freshness parameter to obtain a first protection key.

[0367] In yet another possible implementation, the processing unit 1302: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF), where the first KDF is a KDF supported by the second node; It is particularly configured to perform an exclusive-or operation between the first intermediate key and the group key of the first communication group to obtain the first protection key.

[0368] In yet another possible implementation method, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0369] In yet another possible implementation method, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0370] In yet another possible implementation, the processing unit 1302: determining a group key of the first communication group based on the ID of the first communication group, and determining whether there is a correspondence between the ID of the first communication group and the group key of the first communication group; or It is particularly configured to generate a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using the second KDF.

[0371] In yet another possible implementation, the processing unit 1302: The method is further configured to determine a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0372] The first association establishment message further includes information used to indicate the group security algorithm.

[0373] In yet another possible implementation method, the algorithm for group security is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0374] In yet another possible implementation manner, the processing unit 1302 is specifically configured to determine the group security algorithm based on an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0375] In yet another possible implementation method, the group security algorithm includes a third KDF algorithm, and the processing unit: The communication device is further configured to generate a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0376] In yet another possible implementation method, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key is applied.

[0377] In yet another possible implementation, the processing unit 1302: The node is further configured to verify that encryption is not enabled for signaling plane messages between the first node and the second node.

[0378] In yet another possible implementation manner, encryption is enabled for signaling plane messages between the first node and the second node, and the sending unit 1303 includes: The method is further configured to send a second association establishment message to the second node, the second association establishment message including a group key of the first communication group, the second association establishment message belonging to a signaling plane message between the first node and the second node.

[0379] In yet another possible implementation manner, the processing unit 1302 is further configured to determine that a condition for updating a group key of the first communication group is met.

[0380] The processing unit 1302 is further configured to determine the first key based on at least one of the third freshness parameter and the identifier ID of the first communication group.

[0381] The processing unit 1302 is further configured to encrypt the first key based on a shared key between the first node and the second node to obtain a second protection key.

[0382] The sending unit 1303 is further configured to send a key update message to the second node, wherein the key update message includes the second protection key.

[0383] In yet another possible implementation method, the first key is used to replace the group key of the first communication group.

[0384] In yet another possible implementation method, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0385] In yet another possible implementation, the processing unit 1302: determining that an update acknowledgement message has been received from at least one second node belonging to the first communication group; The method is further configured to apply the first key to a start time of the first key.

[0386] In yet another possible implementation, the processing unit 1302: It is particularly configured to determine that it has received update acknowledgement messages from all second nodes belonging to the first communication group.

[0387] In yet another possible implementation, the processing unit 1302: It is particularly configured to encrypt the key based on the shared key between the first node and the second node and the fourth freshness parameter to obtain a second protection key.

[0388] In yet another possible implementation, the condition for updating is: a difference between the frame number of the current communication frame and the marked frame number is equal to or greater than a first threshold, the frame number of the current communication frame and the marked frame number are within the count cycle of the same round, and the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; a difference between the marked frame number and the frame number of the current communication frame is equal to or less than a second threshold, the frame number of the current communication frame is within the count cycle of the next round of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; The validity period of the group key of the first communication group expires or the usage duration of the group key of the first communication group reaches a third threshold; or At least one second node in the first communication group exits the first communication group.

[0389] For the implementation of each unit, please refer to the corresponding description in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B. The device 130 may be the first node in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B.

[0390] It may be understood that in the device embodiments of the present application, the division into multiple units is merely a logical division based on function and is not intended to limit the specific structure of the device. In certain implementations, some functional modules may be further divided into smaller functional modules, and some functional modules may be combined into one functional module. However, regardless of whether the functional modules are further divided or combined, the general procedures performed by the device in the communication process remain the same. For example, the receiving unit 1301 and the transmitting unit 1303 in the device 130 may also be combined into one communication unit. Typically, each unit corresponds to a respective program code (or program instruction). When the program code corresponding to a unit is executed on a processor, the unit executes the corresponding procedure to implement the corresponding function.

[0391] 14 is a schematic diagram of the structure of a communication device 140 according to an embodiment of the present application. The device 140 may be a node or a component within a node, for example, a chip or an integrated circuit. The device 140 may include a transmitting unit 1401, a receiving unit 1402, and a processing unit 1403. The units are described as follows:

[0392] The sending unit 1401 is configured to send an association request message to the first node.

[0393] The receiving unit 1402 is configured to receive a first association establishment message from a first node, the first association establishment message including a first protection key.

[0394] The processing unit 1403 is configured to obtain a group key of a first communication group based on the shared key between the first node and the second node and the first protection key, where the first communication group is a communication group to which the second node belongs.

[0395] In yet another possible implementation, the first node and the second node share a shared key.

[0396] In yet another possible implementation, the processing unit 1403: The node is particularly configured to obtain a group key for the first communication group based on the shared key between the first node and the second node, the second freshness parameter, and the first protection key.

[0397] In yet another possible implementation, the processing unit 1403: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF); It is particularly configured to derive a group key for the first communication group based on the first intermediate key and the first protection key.

[0398] In yet another possible implementation method, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0399] In yet another possible implementation method, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0400] In yet another possible implementation method, the first association establishment message further includes information used to indicate a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0401] In yet another possible implementation method, the algorithm for group security is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0402] Alternatively, determining the group security algorithm corresponds to an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0403] In yet another possible implementation, the processing unit 1403: The communication device is further configured to generate a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0404] In yet another possible implementation method, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key is applied.

[0405] In yet another possible implementation method, before encrypting the first protection key based on the shared key between the first node and the second node to obtain a group key of the first communication group, The method further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0406] In yet another possible implementation manner, the receiving unit 1402 is further configured to receive a second association establishment message from the first node, the second association establishment message including a group key of the first communication group, and the second association establishment message belonging to a signaling plane message between the first node and the second node.

[0407] The processing unit 1403 is further configured to decrypt the second association establishment message by using the signaling plane encryption key between the first node and the second node to obtain a group key of the first communication group.

[0408] In yet another possible implementation manner, the receiving unit 1402 is further configured to receive a key update message from the first node, the key update message including the second protection key.

[0409] The processing unit 1403 is further configured to obtain a first key based on the shared key between the first node and the second node and the second protection key.

[0410] In yet another possible implementation method, the first key is used to replace the group key of the first communication group.

[0411] In yet another possible implementation method, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0412] In yet another possible implementation, the processing unit 1403: sending an update acknowledgement message to the first node; The method is further configured to apply the first key to a start time of the first key.

[0413] In yet another possible implementation, the processing unit 1403: The node is particularly configured to derive the first key based on the shared key between the first node and the second node, the fourth freshness parameter, and the second protection key.

[0414] For the implementation of each unit, please refer to the corresponding description in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B. The device 140 may be a second node in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B.

[0415] 15 is a schematic diagram of the structure of a communication device 150 according to an embodiment of the present application. The communication device 150 may be a node or a component within a node, for example, a chip or an integrated circuit. The device 150 may include at least one memory 1501 and at least one processor 1502. Optionally, a bus 1503 may be further included. Further optionally, a communication interface 1504 may be further included. The memory 1501, the processor 1502, and the communication interface 1504 are connected through the bus 1503.

[0416] The memory 1501 is configured to provide storage space, which may store data such as an operating system and computer programs, etc. The memory 1501 may be one or a combination of random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), portable read-only memory (compact disc read-only memory (CD-ROM)), or the like.

[0417] The processor 1502 is a module that performs arithmetic and / or logical operations, and may specifically be one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor unit (MPU), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), and a complex programmable logic device (CPLD).

[0418] The communication interface 1504 is configured to receive data transmitted by an external device and / or transmit data to an external device, and may be a wired link interface such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, general wireless transmission, or the like) interface. Optionally, the communication interface 1504 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0419] The processor 1502 in the device 150 is configured to read a computer program stored in the memory 1501 and to perform the communication methods described above, for example, the communication methods described in Figures 3, 7, 11, or 12A and 12B.

[0420] For example, the processor 1502 in the device 150 reads a computer program stored in the memory 1501, receiving an association request message from a second node via communication interface 1504; an operation of determining a group key for a first communication group, the first communication group being a communication group to which the second node belongs, and the group key for the first communication group being determined based on at least one of a first freshness parameter and an identifier ID of the first communication group; an operation of encrypting a group key of a first communication group based on a shared key between the first node and the second node to obtain a first protection key; and performing an operation of sending a first association establishment message to the second node through the communication interface 1504, the first association establishment message including the first protection key.

[0421] In yet another possible implementation, the processor 1502 It is particularly configured to encrypt the group key of the first communication group based on the shared key between the first node and the second node and the second freshness parameter to obtain a first protection key.

[0422] In yet another possible implementation, the processor 1502 generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF), where the first KDF is a KDF supported by the second node; It is particularly configured to perform an exclusive-or operation on the first intermediate key and the group key of the first communication group to obtain the first protection key.

[0423] In yet another possible implementation method, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0424] In yet another possible implementation method, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0425] In yet another possible implementation, the processor 1502 determining a group key of the first communication group based on the ID of the first communication group, and determining whether there is a correspondence between the ID of the first communication group and the group key of the first communication group; or It is particularly configured to generate a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using the second KDF.

[0426] In yet another possible implementation, the processor 1502 The method is further configured to determine a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0427] The first association establishment message further includes information used to indicate the group security algorithm.

[0428] In yet another possible implementation method, the algorithm for group security is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0429] In yet another possible implementation method, the processor 1502 is specifically configured to determine the group security algorithm based on an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0430] In yet another possible implementation method, the group security algorithm includes a third KDF algorithm, and the processing unit: The communication device is further configured to generate a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0431] In yet another possible implementation method, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key is applied.

[0432] In yet another possible implementation, the processor 1502 The node is further configured to verify that encryption is not enabled for signaling plane messages between the first node and the second node.

[0433] In yet another possible implementation manner, encryption is enabled for signaling plane messages between the first node and the second node, and the processor 1502: The node is further configured to send a second association establishment message to the second node through the communication interface 1504, the second association establishment message including a group key of the first communication group, and the second association establishment message belonging to a signaling plane message between the first node and the second node.

[0434] In yet another possible implementation, the processor 1502 determining that a condition for updating a group key of the first communication group is met; determining a first key based on at least one of a third freshness parameter and an identifier ID of the first communication group; encrypting the first key based on a shared key between the first node and the second node to obtain a second protection key; It is further configured to send a key update message to the second node via the communication interface 1504, the key update message including the second protection key.

[0435] In yet another possible implementation method, the first key is used to replace the group key of the first communication group.

[0436] In yet another possible implementation method, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0437] In yet another possible implementation, the processor 1502 determining that an update acknowledgement message has been received from at least one second node belonging to the first communication group; The method is further configured to apply the first key to a start time of the first key.

[0438] In yet another possible implementation, the processor 1502 It is particularly configured to determine that it has received update acknowledgement messages from all second nodes belonging to the first communication group.

[0439] In yet another possible implementation, the processor 1502 The encryption method is particularly configured to encrypt the first key based on a shared key between the first node and the second node and a fourth freshness parameter to obtain a second protection key.

[0440] In yet another possible implementation, the condition for updating is: a difference between the frame number of the current communication frame and the marked frame number is equal to or greater than a first threshold, the frame number of the current communication frame and the marked frame number are within the count cycle of the same round, and the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; a difference between the marked frame number and the frame number of the current communication frame is equal to or less than a second threshold, the frame number of the current communication frame is within the count cycle of the next round of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; The validity period of the group key of the first communication group expires or the usage duration of the group key of the first communication group reaches a third threshold; or At least one second node in the first communication group exits the first communication group.

[0441] For the implementation of each unit, please refer to the corresponding description in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B. The device 150 may be the first node in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B.

[0442] 16 is a schematic diagram of the structure of a communication device 160 according to an embodiment of the present application. The communication device 160 may be a node or a component within a node, for example, a chip or an integrated circuit. The device 160 may include at least one memory 1601 and at least one processor 1602. Optionally, a bus 1603 may be further included. Further optionally, a communication interface 1604 may be further included. The memory 1601, the processor 1602, and the communication interface 1604 are connected through the bus 1603.

[0443] The memory 1601 is configured to provide storage space, and the storage space may store data such as an operating system and computer programs. The memory 1601 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and the like.

[0444] The processor 1602 is a module that performs arithmetic and / or logical operations and may be one or a combination of processing modules such as a CPU, GPU, MPU, ASIC, FPGA, and CPLD, among others.

[0445] The communication interface 1604 is configured to receive data transmitted by an external device and / or transmit data to an external device, and may be a wired link interface such as an Ethernet cable, or may be a wireless link (Wi-Fi, Bluetooth, or the like) interface. Optionally, the communication interface 1604 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or the like coupled to the interface.

[0446] The processor 1602 in the device 160 is configured to read a computer program stored in the memory 1601 and to perform the communication methods described above, for example, the communication methods described in Figures 3, 7, 11, or 12A and 12B.

[0447] For example, the processor 1602 in the device 160 reads a computer program stored in the memory 1601, sending an association request message to the first node via the communication interface 1604; an operation of receiving a first association establishment message from a first node via communication interface 1604, the first association establishment message including a first protection key; and performing an operation of obtaining a group key for a first communication group based on a shared key between the first node and the second node and a first protection key, the first communication group being a communication group to which the second node belongs.

[0448] In yet another possible implementation, the first node and the second node share a shared key.

[0449] In yet another possible implementation, the processor 1602: The node is particularly configured to obtain a group key for the first communication group based on the shared key between the first node and the second node, the second freshness parameter, and the first protection key.

[0450] In yet another possible implementation, the processor 1602: generating a first intermediate key based on the shared key between the first node and the second node and a second freshness parameter by using a first key derivation function (KDF); It is particularly configured to derive a group key for the first communication group based on the first intermediate key and the first protection key.

[0451] In yet another possible implementation method, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0452] In yet another possible implementation method, the second freshness parameter is the value of a first counter, and the first counter is used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

[0453] In yet another possible implementation method, the first association establishment message further includes information used to indicate a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0454] In yet another possible implementation method, the algorithm for group security is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0455] Determining the group security algorithm corresponds to an algorithm selection policy, where the algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0456] In yet another possible implementation, the processor 1602: The communication device is further configured to generate a session key for the first communication group by using a third KDF algorithm based on the group key of the first communication group and the type of the session key.

[0457] In yet another possible implementation method, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key is applied.

[0458] In yet another possible implementation method, before obtaining a group key for the first communication group based on the shared key between the first node and the second node and the first protection key, The method further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0459] In yet another possible implementation, the processor 1602: receiving a second association establishment message from the first node through the communication interface 1604, the second association establishment message including a group key of the first communication group, the second association establishment message belonging to a signaling plane message between the first node and the second node; and further configured to decrypt the second association establishment message by using the signaling plane encryption key between the first node and the second node to obtain a group key for the first communication group.

[0460] In yet another possible implementation, the processor 1602: receiving a key update message from the first node via the communication interface 1604, the key update message including the second protection key; The node is further configured to derive a first key based on a shared key between the first node and the second node and the second protection key.

[0461] In yet another possible implementation method, the first key is used to replace the group key of the first communication group.

[0462] In yet another possible implementation method, the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

[0463] In yet another possible implementation, the processor 1602: sending an update acknowledgement message to the first node; The method is further configured to apply the first key to a start time of the first key.

[0464] In yet another possible implementation, the processor 1602: The node is particularly configured to derive the first key based on the shared key between the first node and the second node, the fourth freshness parameter, and the second protection key.

[0465] For the implementation of each unit, please refer to the corresponding description in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B. The device 160 may be a second node in the embodiment shown in Figure 3, Figure 7, Figure 11, or Figure 12A and Figure 12B.

[0466] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, which, when executed on one or more processors, performs the method of any of the embodiments shown in Figures 3, 7, 11, or 12A and 12B.

[0467] An embodiment of the present application further provides a chip system. The chip system includes a communication device including at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, and the at least one processor configured to invoke a computer program stored in at least one memory. When the computer program is executed on the one or more processors, the method of any of the embodiments shown in Figures 3, 7, 11, or 12A and 12B is performed.

[0468] An embodiment of the present application further provides a terminal. The terminal includes a first node (e.g., an automobile cockpit domain controller CDC) and / or a second node (e.g., at least one of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a passive entry / passive start system controller). The first node includes the device described in the embodiment shown in FIG. 13 or 15, and the second node includes the device described in the embodiment shown in FIG. 13 or 15.

[0469] Further optionally, the terminal may be a vehicle, an unmanned aerial vehicle, a robot, a device in a smart home scenario, a device in a smart manufacturing scenario, or the like.

[0470] An embodiment of the present application further provides an intelligent cockpit product. The intelligent cockpit product includes a first node (e.g., an automobile cockpit domain controller CDC). The first node is the first node in any of the embodiments shown in FIG. 3, FIG. 7, FIG. 11, or FIG. 12A and FIG. 12B. Furthermore, the intelligent cockpit product includes a second node (e.g., at least one of modules such as a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a passive entry / passive start system controller). The second node is the second node in any of the embodiments shown in FIG. 3, FIG. 7, FIG. 11, or FIG. 12A and FIG. 12B.

[0471] An embodiment of the present application further provides a vehicle. The vehicle includes a first node (e.g., an automobile cockpit domain controller CDC). The vehicle further includes a second node (e.g., at least one of a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a passive entry / passive start system controller). The first node is the first node in any of the embodiments shown in FIGS. 3, 7, 11, or 12A and 12B, and the second node is the second node in any of the embodiments shown in FIGS. 3, 7, 11, or 12A and 12B. Alternatively, the vehicle may be replaced by an intelligent terminal or a transportation means such as an unmanned aerial vehicle or a robot.

[0472] An embodiment of the present application further provides a computer program product, which, when executed on one or more processors, can perform the communication methods described in any of the embodiments shown in Figures 3, 7, 11, or 12A and 12B.

[0473] All or part of the above-described embodiments may be implemented by using software, hardware, firmware, or any combination thereof. When software is used to implement the embodiments, all or some of the embodiments may be implemented in the form of a computer product (e.g., a computer program or computer instructions). When the computer program product is loaded and executed on a computer, the procedures or functions of the embodiments of the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or another programmable device. The computer program product may be stored in or transmitted through a computer-readable storage medium. The computer-readable storage medium may be any available medium accessible by a computer or a data storage device, such as a server or data center, that integrates one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a DVD), a semiconductor medium (e.g., a solid-state disk (SSD)), or the like.

[0474] The order adjustment, combination or deletion may be performed on the steps in the method embodiments of the present application based on actual requirements.

[0475] Combination, division and deletion can be performed on the modules in the device embodiments of the present application based on actual requirements. [Explanation of symbols]

[0476] 101 First Node 102 First Communications Group 103 Second Node 104 Second Node 130 Communication equipment 140 Communication equipment 150 Communication equipment 160 Communication Equipment 201 Cockpit Domain Controller 202 Camera 203 Camera 401 Group Key 402 shared key 403 First Protection Key 404 Initial Association Establishment Message 501 Group Key 502 First Protection Key 503 First Intermediate Key 504 shared key 505 First Association Establishment Message 601 area 602 areas 603 area 604 area 605 area 801 Frame Number 802 Group Key 803 Communication Frame 806 Communication Frame 901 Communication Frame 902 Group Key 904 Group Key 905 Communication Frame 1001 Communication Frame 1002 Group Key 1004 Communication Frame 1005 Group Key 1006 Communication Frame 1301 receiving unit 1302 Processing Unit 1303 Transmitting Unit 1401 Transmitting Unit 1402 receiving unit 1403 Processing Unit 1501 memory 1502 processor 1503 Bus 1504 Communication Interface 1601 memory 1602 processor 1603 Bus 1604 Communication Interface

Claims

1. 1. A communication method comprising: receiving an association request message from a second node; determining a group key of a first communication group, the first communication group being a communication group to which the second node belongs, and the group key of the first communication group being obtained based on at least one of a first freshness parameter and an identifier ID of the first communication group; encrypting the group key of the first communication group based on a shared key between a first node and the second node to obtain a first protection key; sending a first association establishment message to the second node, the first association establishment message including the first protection key.

2. the step of encrypting the group key of the first communication group based on a shared key between a first node and the second node to obtain a first protection key includes:

2. The method of claim 1, further comprising: encrypting the group key of the first communication group based on the shared key between the first node and the second node and a second freshness parameter to obtain the first protection key.

3. 3. The method of claim 2, wherein the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

4. 3. The method of claim 2, wherein the second freshness parameter is a value of a first counter, the first counter being used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

5. said step of determining a group key for a first communication group comprising: determining the group key of the first communication group based on the ID of the first communication group, wherein there is a correspondence between the ID of the first communication group and the group key of the first communication group; or 5. The method of claim 1, further comprising generating the group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF.

6. The method comprises: determining a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, the group security algorithm including at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm; The method according to claim 1 , further comprising the step of: the first association establishment message further including information used to indicate the group security algorithm.

7. The group security algorithm includes a third KDF algorithm, and the method further comprises:

7. The method of claim 6, further comprising generating a session key for the first communication group by using the third KDF algorithm based on the group key of the first communication group and a type of the session key.

8. Before the step of encrypting the group key of the first communication group based on a shared key between a first node and the second node to obtain a protection key, the method includes:

8. The method of any one of claims 1 to 7, further comprising the step of verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

9. The method comprises: determining that a condition for updating the group key of the first communication group is met; determining a first key based on at least one of a third freshness parameter and the identifier ID of the first communication group; encrypting the first key based on the shared key between the first node and the second node to obtain a second protection key; 9. The method of claim 1, further comprising the step of: sending a key update message to the second node, the key update message including the second protection key.

10. 10. The method of claim 9, wherein the key update message is further used to indicate a start time of the first key and a validity period of the first key, and the first key is applied within the validity period of the first key starting from the start time of the first key.

11. After the step of sending a key update message to the second node, the method further comprises: determining that an update acknowledgement message has been received from at least one second node belonging to the first communication group; and applying the first key to the start time of the first key.

12. the step of encrypting the first key based on the shared key between the first node and the second node to obtain a second protection key includes:

12. The method of claim 9, further comprising: encrypting the first key based on the shared key between the first node and the second node and a fourth freshness parameter to obtain the second protection key.

13. The condition for updating the group key of the first communication group is: a difference between a frame number of a current communication frame and a marked frame number is equal to or greater than a first threshold, the frame number of the current communication frame and the marked frame number are within a count cycle of the same round, and the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; a difference between the marked frame number and the frame number of the current communication frame is less than or equal to a second threshold, the frame number of the current communication frame is within a count cycle of a next round of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame encrypted for the first time by using the group key of the first communication group; the validity period of the group key of the first communication group expires or the usage duration of the group key of the first communication group reaches a third threshold; or 13. The method of any one of claims 9 to 12, comprising the at least one second node in the first communication group leaving the first communication group.

14. 1. A communication method comprising: sending an association request message to the first node; receiving a first association establishment message from the first node, the first association establishment message including a first protection key; and obtaining a group key for a first communication group based on a shared key between the first node and the second node and the first protection key, wherein the first communication group is a communication group to which the second node belongs.

15. The step of obtaining a group key for a first communication group based on a shared key between the first node and the second node includes:

15. The method of claim 14, further comprising: obtaining the group key for the first communication group based on the shared key between the first node and the second node, a second freshness parameter, and the first protection key.

16. 16. The method of claim 15, wherein the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

17. 16. The method of claim 15, wherein the second freshness parameter is a value of a first counter, the first counter being used to represent the number of times to encrypt the group key of the first communication group based on the shared key.

18. 18. The method of claim 14, wherein the first association establishment message further includes information used to indicate a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm includes at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

19. The group security algorithm includes a third KDF algorithm, and the method further comprises:

20. The method of claim 18, further comprising generating a session key for the first communication group by using the third KDF algorithm based on the group key of the first communication group and a type of the session key.

20. Before the step of obtaining a group key of a first communication group based on the shared key between the first node and the second node and the first protection key, the method includes:

20. The method of any one of claims 14 to 19, further comprising the step of verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

21. The method comprises: receiving a key update message from the first node, the key update message including a second protection key; 21. The method of claim 14, further comprising: obtaining a first key based on the shared key between the first node and the second node and the second protection key.

22. 22. The method of claim 21, wherein the key update message is further used to indicate a start time of the first key and a validity period of the first key, and wherein the first key is applied within the validity period of the first key starting from the start time of the first key.

23. After the step of obtaining a first key based on the shared key between the first node and the second node and the second protection key, the method further comprises: sending an update acknowledgement message to the first node; 23. The method of claim 22, further comprising: applying the first key to the start time of the first key.

24. A communication device comprising a unit adapted to carry out the method according to any one of claims 1 to 13.

25. A communication device comprising a unit adapted to carry out the method according to any one of claims 14 to 23.

26. A chip system comprising at least one processor and a communication interface, the communication interface configured to transmit and / or receive data, the at least one processor calling a computer program stored in at least one memory, whereby a device in which the chip system is located implements the method of any one of claims 1 to 13.

27. A chip system comprising at least one processor and a communication interface, the communication interface configured to send and / or receive data, the at least one processor calling a computer program stored in at least one memory, whereby a device in which the chip system is located implements the method of any one of claims 14 to 23.

28. 14. A computer-readable storage medium storing a computer program that, when executed on one or more processors, performs the method of any one of claims 1 to 13.

29. 24. A computer-readable storage medium storing a computer program that, when executed on one or more processors, performs the method of any one of claims 14 to 23.

30. 1. A communication system comprising: a first node comprising the communication device of claim 24; and a second node comprising the communication device according to claim 25.

Images