Key update method and related device

Abstract

To provide key updating method and device that improve data security in a key updating process.SOLUTION: In a key updating method, a first node sends a first key updating request to a second node S501. The first key updating request includes a first key negotiation parameter and first identity authentication information, and the first identity authentication information is generated by using a first shared key. Then, the second node sends a first response message including second identity authentication information to the first node S504. After that, the first node performs verification on the second identity authentication information by using the first shared key S505. Then, when the verification on the second identity authentication information is successful, a first target key is determined on the basis of the first key negotiation parameter S506.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to the field of communication technologies, in particular to the field of short-range communication technologies, such as cab domain communication. In particular, the present invention relates to a key update method and related apparatus. [Background technology]

[0002] Communication technology has permeated people's lives. While people enjoy the convenience of communication, they also face the threat of security vulnerabilities and privacy leakage. To ensure the security of data transmission and storage in the communication process, a node usually encrypts the transmitted data before storing or transmitting the data. After receiving the data, the receiving node decrypts the ciphertext to recover the plaintext. In addition, the node may further perform integrity protection (or integrity protection for short) on the data. After receiving the data, the receiving node performs integrity verification on the message. If the integrity verification is successful, it indicates that the message has not been modified in the transmission process. During secure data communication, both sides of the communication need to have keys, such as encryption / decryption keys and integrity protection keys. If keys, such as encryption / decryption keys and integrity protection keys, are revoked or cracked, information about the execution of encryption or integrity protection using the keys is likely to be leaked, thereby affecting data transmission security.

[0003] The key has a finite life span. To prevent the key from being exposed or cracked, a key renewal mechanism is usually used, i.e., when the key is nearing the end of its validity period, the old key is replaced by a new key. In the key renewal process, the messages used for key renewal and sent by the nodes are vulnerable to man-in-the-middle attacks, which affects data security.

[0004] Therefore, those skilled in the art have investigated the problem of how to improve data security in the key update process. Summary of the Invention

[0005] SUMMARY OF THE PRESENT APPLICATION The present application discloses a key updating method and related apparatus for improving data security in the key updating process.

[0006] According to a first aspect, an embodiment of the present application discloses a key updating method, comprising the following steps.

[0007] A first key update request is sent to the second node, where the first key update request includes the first key negotiation parameters and the first identity authentication information, and the first identity authentication information is generated by using a first shared key. The first shared key is an identical secret value stored in both nodes of the communication, and may be a master key, a session key, a pre-shared key (PSK), or the like. The session key may be used to perform encryption or integrity protection on data or files sent by the nodes. In addition, the first identity authentication information may be generated by using a cryptographic algorithm based on the first shared key. The cryptographic algorithm may be a hash algorithm (also referred to as a hash algorithm), an authentication algorithm, or the like, for example, a hash-based message authentication code HMAC algorithm (including HMAC Secure Hash Algorithm HMAC-SHA256, HMAC-SHA3, HMAC Chinese Encryption Algorithm HMAC-SM3, etc.). Furthermore, the cryptographic algorithm may further include a cDNA End Rapid Amplification RACE Integrity Primitive Evaluation Message Digest RIPEMD algorithm.

[0008] A first response message is received from the second node, where the first response message includes the second identity authentication information. The principle of generating the second identity authentication information is the same as that of the first identity authentication information, and the details are not described again in this specification.

[0009] Verification is performed on the second identity credentials by using the first shared key.

[0010] If the verification against the second identity credential is successful, a first target key is determined based on the first key negotiation parameters.

[0011] In the above-mentioned method, before the original key expires, the first node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful does it update the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge the identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0012] In a possible implementation of the first embodiment, the first key update request is used to indicate at least one of the first update time point and the validity period of the first target key.

[0013] In the traditional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, in the key updating method in the present application, the first node can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the second node, so that the first target key can be activated accordingly.

[0014] In yet another possible implementation of the first aspect, the first key update request includes a first frame number, and the first frame number is indicated by using a number of bits, for example, F bits. The first key update request is used to indicate the first update time point by using the first frame number. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0015] In yet another possible implementation of the first aspect, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0016] In yet another possible implementation of the first aspect, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and determining the first target key based on the first key negotiation parameters includes generating the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0017] The first key negotiation algorithm parameters and the second key negotiation algorithm parameters are algorithm parameters generated in a key negotiation process. Key negotiation is a process in which both sides of a communication exchange some parameters to obtain a key through negotiation. The algorithm used in key negotiation is called a key negotiation algorithm or a key exchange algorithm. In this embodiment of the present application, the first node generates the first key negotiation algorithm parameters, and the second node generates the second key negotiation algorithm parameters. The first target key is determined by using the key negotiation algorithm parameters provided by both sides. Taking the DH algorithm as an example, the two nodes generate random numbers a and b by using the same large prime number p and the same generator number g, respectively. The first node transmits a value A generated by raising g to the power a mod P to the second node, and the second node transmits a value B generated by raising g to the power b mod P to the first node. Then, the first node performs a power operation on the received value A, and the second node performs a power operation on the received value B. K=A b mod p=(g a mod p) b mod p=g ab mod p=(g b mod p) a mod p=B a Since mod p, the keys K generated by the first and second nodes are identical.

[0018] In yet another possible implementation of the first aspect, the first key negotiation parameters include new parameters, and determining the first target key based on the first key negotiation parameters includes generating the first target key based on the second target key and the new parameters.

[0019] The second target key may be a secret value shared between the first node and the second node, or may be referred to as a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0020] In yet another possible implementation of the first aspect, the first target key is a master key.

[0021] The master key is a high-class secret value of a node, and is mainly used to protect keys such as session keys. In an optional solution, the session key is obtained by using a key derivation function (KDF) based on the master key. Optionally, the master key can be used to encrypt the session key.

[0022] In yet another possible implementation of the first aspect, the first key negotiation parameters include new parameters, and determining the first target key based on the first key negotiation parameters includes generating the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark an algorithm used to determine the encryption key or the integrity protection key.

[0023] In yet another possible implementation of the first aspect, the first target key is an integrity protecting key or an encryption key.

[0024] In yet another possible implementation of the first aspect, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0025] It can be understood that the conventional key update method is to update the key when the old key (i.e., the second target key) expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining the new key. However, in this embodiment of the present application, the first target key can be determined before the second target key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0026] In yet another possible implementation of the first aspect, sending the first key update request to the second node includes sending the first key update request to the second node by using a first communication frame, where the second frame number of the first communication frame is smaller than the third frame number held in the key update request used during the previous key update, and the third frame number is used to indicate the start time of the previous updated key, and the first frame number is larger than the second frame number and smaller than the third frame number. When security protection is performed on the communication frame in the communication process, the encryption method used can be to perform encryption based on the frame number and the previous updated key. Thus, the first target key is determined before the frame number repeats to the frame number of the previous updated key, so that the data frame is encrypted by using the first target key. In this way, the data frame with the same frame number can be encrypted twice by using different keys, thereby improving data security. In an alternative solution, the first key update request includes a MAC serial number (MAC SN) instead of the first frame number, and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Alternatively, the third frame number held in the key update request used during the previous key update can also be replaced with the MAC SN indicated by the MAC SN, i.e., a part of the bits used to indicate the third frame number. In this alternative solution, the value relationship between the first frame number, the second frame number, and the third frame number remains unchanged. Specifically, the bits used to indicate the first frame number include two parts, i.e., an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are bits used to indicate the hyperframe number. In this alternative scheme, as little information as possible can be held in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0027] In yet another possible implementation of the first aspect, the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame. Furthermore, the frame number in this application is the frame number of the communication frame.

[0028] In yet another possible implementation of the first aspect, the method further includes disconnecting the communication connection to the second node or sending update failure information to the second node if verification of the second identity information fails.

[0029] If the verification for the second identity authentication information fails, it may be found to indicate that the identity of the second node is not trustworthy. Thus, the first node may disconnect the communication connection to the second node or send update failure information to the second node, so that the access request for the node that needs to perform the key update is reinitialized, thereby ensuring data security in the key update process.

[0030] In yet another possible implementation of the first aspect, before performing verification on the second identity authentication information by using the first shared key, the method further comprises the steps of performing an integrity verification on the first response message, and if the integrity verification is successful, subsequently performing a step of performing verification on the second identity authentication information by using the first shared key, and if the integrity verification is unsuccessful, disconnecting the communication connection to the second node or sending an update failure information to the second node.

[0031] In the above-mentioned method, before performing verification on the identity information, the first node first performs an integrity verification on the first response message to determine that the information in the first response message has not been tampered with. If the integrity verification fails, it indicates that the data in the first response information has been tampered with and the key cannot be updated. Therefore, the first node cuts off the communication connection to the second node or sends update failure information to the second node, so that the first node re-accesses the node that needs to perform key update, thereby ensuring data security in the key update process.

[0032] According to a second aspect, an embodiment of the present application discloses a key updating method, including the following steps.

[0033] A first key update request is received from the first node, where the first key update request includes a first key negotiation parameter and a first identity authentication information. The first identity authentication information may be generated by using a cryptographic algorithm based on the first shared key. The cryptographic algorithm may be a hash algorithm (also referred to as a hash algorithm), an authentication algorithm, or the like, for example, a Hash-Based Message Authentication Code HMAC algorithm (including HMAC Secure Hash Algorithm HMAC-SHA256, HMAC-SHA3, HMA Chinese Encryption Algorithm HMAC-SM3, etc.). Furthermore, the cryptographic algorithm may further include a cDNA End Rapid Amplification RACE Integrity Primitive Evaluation Message Digest RIPEMD algorithm.

[0034] Verification is performed on the first identity authentication information by using a first shared key. The first shared key is an identical secret value stored in both nodes of the communication, and may be a master key, a session key, a pre-shared key (PSK) or the like. The session key may be used to perform encryption or integrity protection on data or files transmitted by the nodes. In addition, the first identity authentication information may be generated by using a cryptographic algorithm based on the first shared key. Thus, the second node may perform verification on the first identity authentication information by using a cryptographic algorithm based on the first shared key. If the verification on the first identity authentication information is successful, a first target key is determined based on the first key negotiation parameters.

[0035] A first response message is sent to the first node, where the first response message includes a second identity authentication information, and the second identity authentication information is generated by using the first shared key. The principle of generating the second identity authentication information is the same as that of the first identity authentication information, and the details will not be described again in this specification.

[0036] In the above-mentioned method, before the original session key expires, the first node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful does it update the key based on the second key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge the identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0037] In a possible implementation of the second embodiment, the first key update request is used to indicate at least one of the first update time point and the validity period of the first target key.

[0038] In the traditional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, in the key updating method in the present application, the first node can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the second node, so that the first target key can be activated accordingly.

[0039] In yet another possible implementation of the second aspect, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0040] In yet another possible implementation of the second aspect, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0041] In yet another possible implementation of the second aspect, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and determining the first target key based on the first key negotiation parameters includes generating the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0042] The first key negotiation algorithm parameters and the second key negotiation algorithm parameters are algorithm parameters generated in a key negotiation process. Key negotiation is a process in which both sides of a communication exchange some parameters to obtain a key through negotiation. The algorithm used in key negotiation is called a key negotiation algorithm or a key exchange algorithm. In this embodiment of the present application, the first node generates the first key negotiation algorithm parameters, and the second node generates the second key negotiation algorithm parameters. The first target key is determined by using the key negotiation algorithm parameters provided by both sides. Taking the DH algorithm as an example, the two nodes generate random numbers a and b by using the same large prime number p and the same generator number g, respectively. The first node transmits a value A generated by raising g to the power a mod P to the second node, and the second node transmits a value B generated by raising g to the power b mod P to the first node. Then, the first node performs a power operation on the received value A, and the second node performs a power operation on the received value B. K=A b mod p=(g a mod p) b mod p=g ab mod p=(g b mod p) a mod p=B a Since mod p, the keys K generated by the first and second nodes are identical.

[0043] In yet another possible implementation of the second aspect, the first key negotiation parameters include new parameters, and determining the first target key based on the first key negotiation parameters includes generating the first target key based on the second target key and the new parameters.

[0044] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0045] In yet another possible implementation of the second aspect, the first target key is a master key.

[0046] The master key is a high-class secret value of a node, and is mainly used to protect keys such as session keys. In an optional solution, the session key is obtained by using a key derivation function (KDF) based on the master key. Optionally, the master key can be used to encrypt the session key.

[0047] In yet another possible implementation of the second aspect, the first key negotiation parameters include new parameters, and determining the first target key based on the first key negotiation parameters includes generating the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark an algorithm used to determine the encryption key or the integrity protection key.

[0048] In yet another possible implementation of the second aspect, the first target key is an integrity protecting key or an encryption key.

[0049] In yet another possible implementation of the second aspect, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0050] A conventional key update method can be understood to be updating a key when an old key (i.e., the second target key) expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, in this embodiment of the present application, the first target key can be determined before the second target key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0051] In yet another possible implementation of the second aspect, the method further includes disconnecting the connection to the first node or sending update failure indication information to the first node if verification of the first identity information fails.

[0052] If the verification for the first identity authentication information fails, it may be found to indicate that the identity of the second node is not trusted, and therefore the second node may disconnect the connection to the first node or send update failure indication information to the first node, stopping the current key process, thereby ensuring the data security of the second node in the key update process.

[0053] In yet another possible implementation of the second aspect, before performing verification on the first identity credential by using the first shared key, the method further comprises the steps of performing an integrity verification on the first key update request, and if the integrity verification is successful, subsequently performing a step of performing verification on the second identity credential by using the first shared key, and if the integrity verification fails, disconnecting the connection to the first node or sending an update failure indication information to the first node.

[0054] In the above-mentioned method, before performing verification on the identity information, the second node first performs an integrity verification on the first key update request to determine that the information in the first key update request has not been tampered with. If the integrity verification fails, it indicates that the data in the first key update request has been tampered with and the key cannot be updated. Therefore, the second node may disconnect the connection to the first node or send an update failure indication information to the first node, thereby ensuring data security in the key update process.

[0055] According to a third aspect, an embodiment of the present application discloses an apparatus, comprising: a sending unit configured to send a first key update request to a second node, the first key update request including first key negotiation parameters and a first identity authentication information, the first identity authentication information being generated by using a first shared key; a receiving unit configured to receive a first response message from the second node, the first response message including a second identity authentication information; a verification unit configured to perform verification on the second identity authentication information by using the first shared key; and a determination unit configured to determine a first target key based on the first key negotiation parameters if the verification on the second identity authentication information is successful.

[0056] In the key renewal process, the above-mentioned node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, renews the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key renewal process.

[0057] In a possible implementation of the third aspect, the first key update request is used to indicate at least one of the first update time point and the validity period of the first target key.

[0058] In the conventional key update process, the key update time is predefined in the protocol and cannot be flexibly selected. However, the node provided in the present application can customize the update time of the first target key and / or the validity period of the first target key, and indicate the update time and / or the validity period to the second node, so that the first target key can be activated accordingly.

[0059] In yet another possible implementation of the third aspect, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0060] In yet another possible implementation of the third aspect, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0061] In yet another possible implementation of the third aspect, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and the determination unit is configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0062] In yet another possible implementation of the third aspect, the first key negotiation parameters include a new parameter, and the decision unit is configured to generate the first target key based on the second target key and the new parameter.

[0063] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0064] In yet another possible implementation of the third aspect, the first target key is a master key of the node.

[0065] In yet another possible implementation of the third aspect, the first key negotiation parameters include new parameters, and the determination unit is configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark an algorithm used to determine the encryption key or the integrity protection key.

[0066] In yet another possible implementation of the third aspect, the first target key is an integrity protection key or an encryption key of the node.

[0067] In yet another possible implementation of the third aspect, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0068] A conventional key update method can be understood to be updating a key when an old key expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, the node provided in this embodiment of the present application can determine the first target key before the key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0069] In yet another possible implementation of the third aspect, the sending unit is configured to send a first key update request to the second node by using a first communication frame, where a second frame number of the first communication frame is smaller than a third frame number held in the key update request used during a previous key update, the third frame number being used to indicate the start time of the previously updated key, and the first frame number being larger than the second frame number and smaller than the third frame number.

[0070] When security protection is performed on the communication frame in the communication process, the encryption method used may be to perform encryption based on the frame number and the previously updated key. Thus, the first target key is determined before the frame number repeats to the frame number of the previously updated key, so that the data frame is encrypted by using the first target key. In this way, the data frame with the same frame number may be encrypted twice by using different keys, thereby improving data security. In an alternative solution, the first key update request includes a MAC serial number (MAC SN) instead of the first frame number, and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Alternatively, the third frame number held in the key update request used during the previous key update may also be replaced with the MAC SN, i.e., the MAC SN indicated by a part of the bits used to indicate the third frame number. In this alternative solution, the value relationship between the first frame number, the second frame number, and the third frame number remains unchanged. Specifically, the bits used to indicate the first frame number include two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are bits used to indicate the hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0071] In yet another possible implementation of the third aspect, the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame.

[0072] In yet another possible implementation of the third aspect, if verification of the second identity information fails, the sending unit and the receiving unit disconnect the communication connection to the second node or send update failure information to the second node.

[0073] If the verification of the second identity authentication information fails, it may be found to indicate that the identity of the second node is not trustworthy. Thus, the above-mentioned node may disconnect the communication connection to the second node or send update failure information to the second node, so that the access request to the node that needs to perform the key update is reinitialized, thereby ensuring data security in the key update process.

[0074] In yet another possible implementation of the third aspect, the verification unit is further configured to perform integrity verification on the first response message, and if the integrity verification is successful, subsequently performs a step of performing verification on the second identity authentication information by using the first shared key, and if the integrity verification fails, the transmitting unit and the receiving unit may disconnect the communication connection to the second node, or send update failure information to the second node by using the transmitting unit, or send the update failure information to the second node.

[0075] Before performing verification on the identity information, the node may first perform an integrity verification on the first response message and determine that the information in the first response message has not been tampered with. If the integrity verification fails, it indicates that the data in the first response information has been tampered with and the key cannot be updated. Therefore, the node may disconnect the communication connection to the second node or send update failure information to the second node, so that the node re-accesses the node that needs to perform key update, thereby ensuring data security in the key update process.

[0076] According to a fourth aspect, an embodiment of the present application discloses an apparatus, comprising: a receiving unit configured to receive a first key update request from a first node, the first key update request including first key negotiation parameters and a first identity authentication information; a verification unit configured to perform a verification on the first identity authentication information by using a first shared key; a determination unit configured to determine a first target key based on the first key negotiation parameters if the verification on the first identity authentication information is successful; and a sending unit configured to send a first response message to the first node, the first response message including second identity authentication information, the second identity authentication information being generated by using the first shared key.

[0077] Before the original session key expires, the above-mentioned node and the first node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge the identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0078] In a possible implementation of the fourth aspect, the first key update request is used to indicate at least one of the first update time point and the validity period of the first target key.

[0079] In the traditional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, in the key updating method in the present application, the first node can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the node, so that the first target key can be activated accordingly.

[0080] In a possible implementation of the fourth aspect, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0081] In yet another possible implementation of the fourth aspect, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0082] In yet another possible implementation of the fourth aspect, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and the determination unit is configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0083] In yet another possible implementation of the fourth aspect, the first key negotiation parameters include a new parameter, and the decision unit is configured to generate the first target key based on the second target key and the new parameter.

[0084] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0085] In yet another possible implementation of the fourth aspect, the first target key is a master key of the node.

[0086] In yet another possible implementation of the fourth aspect, the first key negotiation parameters include new parameters, and the determination unit is configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to identify an algorithm used to determine the encryption key or the integrity protection key.

[0087] In yet another possible implementation of the fourth aspect, the first target key is an integrity protection key or an encryption key of the second node. In yet another possible implementation of the fourth aspect, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0088] A conventional key update method can be understood as updating a key when an old key expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, in this embodiment of the present application, the first target key can be determined before the key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0089] In yet another possible implementation of the fourth aspect, if verification of the first identity information fails, the transmitting unit and the receiving unit disconnect the connection to the first node or send update failure indication information to the first node by using the transmitting unit.

[0090] If the verification for the first identity authentication information fails, it may be found to indicate that the identity of the second node is not trusted, and therefore the node may disconnect the connection to the first node or send update failure indication information to the first node, stopping the current key process, thereby ensuring the data security of the node in the key update process.

[0091] In yet another possible implementation of the fourth aspect, the verification unit is further configured to perform integrity verification on the first key update request, and if the integrity verification is successful, then performs a step of performing verification on the second identity authentication information by using the first shared key, and if the integrity verification fails, the node disconnects the connection to the first node or sends update failure indication information to the first node by using the sending unit.

[0092] Before performing verification on the identity information, the above-mentioned node first performs an integrity verification on the first key update request to determine that the information in the first key update request has not been tampered with. If the integrity verification fails, it indicates that the data in the first key update request has been tampered with and the key cannot be updated. Therefore, the above-mentioned node may disconnect the connection to the first node or send an update failure indication information to the first node, thereby ensuring data security in the key update process.

[0093] According to a fifth aspect, an embodiment of the present application discloses an apparatus, wherein a node includes a memory, a processor and a communication interface, the memory stores a computer program, and the processor calls the computer program stored in the memory to perform the following operations: sending a first key update request to a second node through the communication interface, the first key update request including a first key negotiation parameter and a first identity authentication information, the first identity authentication information being generated by using a first shared key; receiving a first response message from the second node through the communication interface, the first response message including a second identity authentication information; performing verification on the second identity authentication information by using the first shared key; and determining a first target key based on the first key negotiation parameter if the verification on the second identity authentication information is successful.

[0094] In the key renewal process, the above-mentioned node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, renews the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key renewal process.

[0095] In a possible implementation of the fifth aspect, the first key update request is used to indicate at least one of the first update time point and the validity period of the first target key.

[0096] In the conventional key update process, the key update time is predefined in the protocol and cannot be flexibly selected. However, the node provided in the present application can customize the update time of the first target key and / or the validity period of the first target key, and indicate the update time and / or the validity period to the second node, so that the first target key can be activated accordingly.

[0097] In yet another possible implementation of the fifth aspect, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0098] In yet another possible implementation of the fifth aspect, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0099] In yet another possible implementation of the fifth aspect, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor is specifically configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0100] In yet another possible implementation of the fifth aspect, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor is specifically configured to generate the first target key based on the second target key and the new parameters.

[0101] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0102] In yet another possible implementation of the fifth aspect, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor is specifically configured as follows.

[0103] In yet another possible implementation of the fifth aspect, the first target key is a master key of the node. The first target key is generated based on the second target key, the new parameters, and an algorithm identifier, where the algorithm identifier is used to mark an algorithm used to determine an encryption key or an integrity protection key.

[0104] In yet another possible implementation of the fifth aspect, the first target key is an integrity protection key or an encryption key of the node.

[0105] In yet another possible implementation of the fifth aspect, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0106] A conventional key update method can be understood to update a key when an old key expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, in this embodiment of the present application, the first target key can be determined before the key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0107] In yet another possible implementation of the fifth aspect, the communication interface transmits a first key update request to the second node by using a first communication frame, where a second frame number of the first communication frame is smaller than a third frame number held in the key update request used during a previous key update, the third frame number being used to indicate the start time of the previously updated key, and the first frame number is larger than the second frame number and smaller than the third frame number.

[0108] When security protection is performed on the communication frame in the communication process, the encryption method used may be to perform encryption based on the frame number and the previously updated key. Thus, the first target key is determined before the frame number repeats to the frame number of the previously updated key, so that the data frame is encrypted by using the first target key. In this way, the data frame with the same frame number may be encrypted twice by using different keys, thereby improving data security. In an alternative solution, the first key update request includes a MAC serial number (MAC SN) instead of the first frame number, and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Alternatively, the third frame number held in the key update request used during the previous key update may also be replaced with the MAC SN, i.e., the MAC SN indicated by a part of the bits used to indicate the third frame number. In this alternative solution, the value relationship between the first frame number, the second frame number, and the third frame number remains unchanged. Specifically, the bits used to indicate the first frame number include two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are bits used to indicate the hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0109] In yet another possible implementation of the fifth aspect, the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame.

[0110] In yet another possible implementation of the fifth aspect, the processor is further configured to indicate to the communication interface to disconnect the communication connection to the second node or to send update failure information to the second node via the communication interface if the verification against the second identity information fails.

[0111] If the verification of the second identity authentication information fails, it may be found to indicate that the identity of the second node is not trustworthy. Thus, the above-mentioned node may disconnect the communication connection to the second node or send update failure information to the second node, so that the access request to the node that needs to perform the key update is reinitialized, thereby ensuring data security in the key update process.

[0112] In yet another possible implementation of the fifth aspect, the processor is further configured to perform a step of performing an integrity verification on the first response message after receiving the first response message from the second node, and if the integrity verification is successful, subsequently performing a verification on the second identity authentication information by using the first shared key, and the processor is further configured to indicate to the communication interface to disconnect the communication connection to the second node or to send update failure information to the second node via the communication interface if the integrity verification fails.

[0113] It can be seen that the integrity verification can be performed to determine whether the information has been tampered with. Thus, before performing the verification on the identity information, the above-mentioned node first performs the integrity verification on the first response message to determine that the information in the first response message has not been tampered with. If the integrity verification fails, it indicates that the data in the first response information has been tampered with and the key cannot be updated. Thus, the node cuts off the communication connection to the second node or sends update failure information to the second node, so that the node re-accesses the node that needs to perform the key update, thereby ensuring data security in the key update process.

[0114] According to a sixth aspect, an embodiment of the present application discloses an apparatus, wherein the node comprises a memory, a processor and a communication interface, the memory stores a computer program, and the processor is configured to call the computer program stored in the memory and perform the following operations: sending a first key update request to a second node through the communication interface, the first key update request including a first key negotiation parameter and a first identity authentication information, the first identity authentication information being generated by using a first shared key, receiving a first response message from the second node through the communication interface, the first response message including a second identity authentication information, performing verification on the second identity authentication information by using the first shared key, and determining a first target key based on the first key negotiation parameter if the verification on the second identity authentication information is successful.

[0115] Before the original session key expires, the above-mentioned node and the first node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful does it update the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge the identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0116] In a possible implementation of the sixth aspect, the first key update request is used to indicate at least one of the first update time point and the validity period of the first target key.

[0117] In the conventional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, in the present application, the first node can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the node, so that the first target key can be activated accordingly.

[0118] In yet another possible implementation of the sixth aspect, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0119] In yet another possible implementation of the sixth aspect, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0120] In yet another possible implementation of the sixth aspect, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor is specifically configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0121] In yet another possible implementation of the sixth aspect, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor is specifically configured to generate the first target key based on the second target key and the new parameters.

[0122] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0123] In yet another possible implementation of the sixth aspect, the first target key is a master key of the node.

[0124] In yet another possible implementation of the sixth aspect, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor is specifically configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark an algorithm used to determine an encryption key or an integrity protection key.

[0125] In yet another possible implementation of the sixth aspect, the first target key is an integrity protection key or an encryption key of the node.

[0126] In yet another possible implementation of the sixth aspect, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0127] It can be understood that the conventional key update method is to update the key when the old key expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining the new key. However, in this embodiment of the present application, the first target key can be determined before the key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0128] In yet another possible implementation of the sixth aspect, the processor is further configured to indicate to the communication interface to disconnect the communication connection to the first node or to send update failure indication information to the first node via the communication interface if verification of the first identity information fails.

[0129] If the verification for the first identity authentication information fails, the node may disconnect the connection to the first node or send update failure indication information to the first node and stop the current key process, thereby ensuring the data security of the node in the key update process.

[0130] In yet another possible implementation of the sixth aspect, the processor is further configured to perform a step of performing an integrity verification on the first key update request after receiving the first key update request from the first node, and if the integrity verification is successful, subsequently performing a verification on the first identity authentication information by using the first shared key, and the processor is further configured to indicate to the communication interface to disconnect the connection to the first node or to send update failure indication information to the first node via the communication interface if the integrity verification fails.

[0131] Before performing verification on the identity information, the above-mentioned node first performs an integrity verification on the first key update request to determine that the information in the first key update request has not been tampered with. If the integrity verification fails, it indicates that the data in the first key update request has been tampered with and the key cannot be updated. Therefore, the above-mentioned node may disconnect the connection to the first node or send an update failure indication information to the first node, thereby ensuring data security in the key update process.

[0132] According to a seventh aspect, an embodiment of the present application discloses a computer-readable storage medium, which stores a computer program, which, when executed on one or more processors, performs the method of the first aspect and any one of the possible implementations of the first aspect, or the method of the second aspect and any one of the possible implementations of the second aspect.

[0133] According to an eighth aspect, an embodiment of the present application discloses a chip system, the chip system includes at least one processor, a memory and an interface circuit, the interface circuit is configured to provide information input / output for the at least one processor, the at least one memory stores a computer program, and when the computer program is executed on the one or more processors, the method in the first aspect and any one of the possible implementations of the first aspect or the method in the second aspect and any one of the possible implementations of the second aspect is executed.

[0134] According to a ninth aspect, an embodiment of the present application discloses a vehicle. The vehicle includes a first node (e.g., a vehicle driver domain controller CDC). In addition, the vehicle further includes a second node (e.g., at least one of a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a keyless entry, or a start system controller, etc.). The first node is a node in any one of the third aspect and possible implementations of the third aspect, or in any one of the fifth aspect and possible implementations of the fifth aspect, and the second node is a node in any one of the fourth aspect and possible implementations of the fourth aspect, or in any one of the sixth aspect and possible implementations of the sixth aspect. [Brief description of the drawings]

[0135] The accompanying drawings used in the embodiments of the present application are described below.

[0136] [Figure 1] FIG. 1 is a schematic diagram of a DH algorithm according to an embodiment of the present application.

[0137] [Diagram 2] FIG. 2 is a schematic diagram of a key derivation algorithm according to an embodiment of the present application;

[0138] [Diagram 3] FIG. 1 is a schematic architecture diagram of a communication system according to an embodiment of the present application;

[0139] [Figure 4] FIG. 2 is a schematic diagram of a usage scenario of the key updating method according to an embodiment of the present application;

[0140] [Diagram 5] 1 is a schematic flowchart of a key updating method according to an embodiment of the present application;

[0141] [Figure 6A] 4 is a schematic flowchart of yet another key updating method according to an embodiment of the present application; [Figure 6B] 4 is a schematic flowchart of yet another key updating method according to an embodiment of the present application;

[0142] [Figure 7A] 4 is a schematic flowchart of yet another key updating method according to an embodiment of the present application; [Figure 7B] 4 is a schematic flowchart of yet another key updating method according to an embodiment of the present application;

[0143] [Figure 8A] 4 is a schematic flowchart of yet another key updating method according to an embodiment of the present application; [Figure 8B] 4 is a schematic flowchart of yet another key updating method according to an embodiment of the present application;

[0144] [Figure 9] FIG. 2 is a schematic structural diagram of a node according to an embodiment of the present application;

[0145] [Figure 10] FIG. 13 is a schematic structural diagram of yet another node according to an embodiment of the present application;

[0146] [Figure 11] FIG. 13 is a schematic structural diagram of yet another node according to an embodiment of the present application;

[0147] [Figure 12] FIG. 13 is a schematic structural diagram of yet another node according to an embodiment of the present application; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0148] Hereinafter, the embodiments of the present application will be described with reference to the accompanying drawings in the embodiments of the present application. Please note that in this application, words such as "example", "for example" or the like are used to represent providing an example, illustration or explanation. Any embodiment or design solution described in this application as "example" or "for example" is not described as being preferred or having more advantages than another embodiment or design solution. Strictly speaking, the use of words such as "example", "for example" or the like is intended to present a relative concept in a particular manner.

[0149] In the following, for ease of understanding, first, a brief description of relevant technologies and technical terms in this application will be given.

[0150] 1. Node

[0151] A node is an electronic device that has data receiving / transmitting capabilities. For example, a node may be a Cockpit Domain device or a module in the Cockpit Domain device (one or more of the following modules: a cockpit domain controller (CDC), a camera, a screen, a microphone, a speaker, an electronic key and keyless entry, or a start system controller). In a specific implementation process, the node may be a data forwarding device, such as a router, a repeater, a bridge or a switch, or may be various types of terminal devices, such as user equipment (UE), a mobile phone, a tablet computer (pad), a desktop computer, a headset and a speaker, and may further include machine intelligence devices, such as self-driving devices, transportation safety devices, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, machine type communication (MTC) devices, industrial control devices, remote medical devices, smart grid devices and smart city devices, and may further include wearable devices (such as smart watches, smart bands or pedometers). In some technology scenarios, the names of devices with similar data receiving / transmitting capabilities may not be referred to as nodes. However, for ease of explanation, electronic devices having data reception / transmission capabilities are collectively referred to as nodes in the embodiments of this application.

[0152] 2. Key

[0153] In a communication process, data is transmitted between communicating nodes. If the data needs to be kept secret, it needs to be encrypted by using a key. Since the secret level and secret class of the contents that need to be kept secret at the nodes may be different, different types of keys need to be used for encryption. Common key types include session keys, master keys, shared keys, etc.

[0154] (1) Session key

[0155] Session keys include encryption keys, integrity protection keys, file keys, etc. Encryption keys may be used to protect data transmitted by a node and may also be referred to as data encryption keys. Integrity protection keys may be used to perform integrity protection on transmitted data. File keys may be used to protect transmitted files. Optionally, session keys may be pre-configured in both nodes of a communication, or may be obtained through negotiation between both nodes of a communication, or may be derived by using an original key, or may be assigned by a Key Distribution Center (KDC). Optionally, a session key may be a key of a symmetric encryption algorithm or a key of an asymmetric encryption algorithm.

[0156] (2) Master key

[0157] A master key is a high-class secret value of a node and may be used to derive session keys, sub-master keys, etc. Sub-master keys are keys whose class is between the master key and the session key and are sometimes referred to as intermediate keys.

[0158] In some possible solutions, the master key may be strictly protected through physical or electronic segregation.

[0159] (3)Shared key (SK)

[0160] A shared key is an identical secret value that is stored on both communicating nodes. In some optional solutions, the nodes may use a master key, a session key, or a pre-shared key (PSK) as the shared key. A node may have one or more shared keys.

[0161] For example, the nodes use the session key as a shared key. For example, when node A and node B communicate with each other using a symmetric encryption algorithm (i.e., the same key is used for encryption and decryption), node A encrypts a plaintext message by using the encryption key Km and sends the plaintext message to node B, and node B decrypts the plaintext message by using the decryption key Km. In this case, the encryption key Km may be used as a shared key between the two nodes.

[0162] As another example, the nodes may use a pre-shared key as the shared key, where the pre-shared key is a secret value that identifies the connection between the two nodes. The pre-shared key may be pre-configured in both nodes of the communication. For example, a cockpit domain controller (CDC) and an interior radar device of a vehicle are two nodes that may communicate with each other, and a secret value is pre-configured for the CDC and the interior radar during deployment, and only the CDC of the vehicle may connect to the roof radar or may transmit data to the roof radar. The pre-shared key may alternatively be obtained by both nodes of the communication through communication. For example, a pre-shared key may be generated by confirming pairing before the CDC is connected to the mobile phone through Bluetooth. In addition, the pre-shared key may be sent to the first node and the second node separately by a trusted device (e.g., KDC).

[0163] 3. Key Negotiation

[0164] Key negotiation is the process where both sides exchange some parameters to obtain a key through negotiation. The algorithm used for key negotiation is called key negotiation algorithm or key exchange algorithm. Common key negotiation algorithms include Diffie-Hellman (DH) algorithm, Elliptic Curve Cryptosystems (ECC) Diffie-Hellman (ECDH) algorithm, Oakley algorithm, and Chinese encryption algorithm (e.g. SM1, SM2, SM3, and SM4).

[0165] Taking the DH algorithm as an example, two nodes generate random numbers a and b by using the same prime number p and the same random number g, respectively. The first node sends the value generated by raising g to the power a mod P to the second node, and the second node sends the value generated by raising g to the power b mod P to the first node, then the first node performs a power operation on the received result, and the second node performs a power operation on the received result, where mod represents modulus operation. Finally, a password is formed and the key exchange is completed.

[0166] 1 is a schematic diagram of the DH algorithm according to an embodiment of the present application. The steps of exchanging keys in the DH algorithm are as follows:

[0167] Step 1: The first node determines a prime number p, a random number g, and a random number a.

[0168] Step 2: The first node generates a first calculated value A, where A is calculated according to the following formula: A=g a Satisfy mod p.

[0169] Step 3: The first node sends the prime number p, the random number g, and the first calculated value A to the second node.

[0170] Step 4: The second node determines a random number b.

[0171] Step 5: The second node obtains a second calculation value B through calculation, where B is, for example, the following formula: B=g b Satisfy mod p.

[0172] Step 6: The second node negotiates key s=A b Calculate the square root of p.

[0173] Step 7: The second node sends the first calculated value B to the first node.

[0174] Step 8: First node s=B a Calculate the square root of p.

[0175] K=A b mod p=(g a mod p) b mod p=g ab mod p=(g b mod p) a mod p=B a Since DH mod p, the keys s calculated by the first node and the second node are identical. In addition, the key s is not transmitted over the network, and the values ​​of the prime number p, the random number g, the random number a, and the random number b selected in the algorithm are very large in practice, so it is difficult to derive the key s based on the prime number p, the random number g, the first calculated value A, and the second calculated value B transmitted over the network. Therefore, the key obtained by using the DH algorithm is secure.

[0176] 4. Key Derivation

[0177] Key derivation is the derivation of one or more keys from a secret value. The algorithm used to derive a key is called a key derivation function (KDF). For example, a new key DK derived by using a secret value Key can be expressed as DK=KDF(Key, fresh), where fresh is a fresh parameter, a parameter used in updating, and may include at least one of a counter value, a serial number, a random value, a frame number, etc. The fresh parameters at different moments are usually different. The frame number is the number of a frame, and a frame is a specific information structure that includes multiple bits or fields. For example, in time division multiple access (TDMA) communication technology, time is segmented into periodic frames, and the frame number of each frame changes periodically from 0 to 2715647.

[0178] Common key derivation algorithms include password-based key derivation function (PBKDF), scrypt algorithm, etc. The PBKDF algorithm further includes the first generation PBKDF1 and the second generation PBKDF2. Optionally, in the key derivation process of some KDF algorithms, a hash algorithm is used to perform a hash modification on the input secret value. Therefore, an algorithm identifier may further be received as an input in the KDF function to indicate the hash algorithm to be used.

[0179] Taking PBKDF2 as an example, a new key DK derived by using a secret value Key in the PBKDF2 algorithm can be expressed as DK=PBKDF2(PRF, Key, salt, c, dk_len), where the parameter PRF indicates the identifier of the hash algorithm used, salt is a randomly generated salt and can be regarded as a new parameter, c is the amount of iterations, and dk_len is the length of the generated DK, which can also be referred to as a block size and can be the default. Figure 2 is a schematic diagram of a key derivation algorithm according to an embodiment of the present application. A derived key 1 can be obtained by using a secret value 201, an algorithm identifier 1, and a new parameter fresh1, and a derived key 2 can be obtained by using a secret value 201, an algorithm identifier 1, and a new parameter fresh2, where the amount of iterations and the block size are preset.

[0180] 5. Cryptographic Algorithms

[0181] A cryptographic algorithm may be a mathematical function for encryption and / or decryption, and may also be referred to as a cryptographic function. Common cryptographic algorithms include hash algorithms, authentication algorithms, or the like. A hash algorithm is also referred to as a hash function or hash algorithm. A hash algorithm may be used to convert information of any length into an identifier, and the reverse rule is difficult to discover. Common hash algorithms include hash-based message authentication code (HMAC), HMAC Chinese cryptographic algorithm HMAC-SM (e.g., HMAC-SM3), HMAC secure hash algorithm (HMAC secure hash algorithm, HMAC-SHA), such as HMAC-SHA256 or HMAC-SHA3, and may further include a message digest (MD) algorithm, such as MD2, MD4, or MD5. Additionally, the cryptographic algorithm may further include a rapid-amplification of cDNA ends (RACE) Integrity Primitives Evaluation Message Digest (RIPEMD) algorithm.

[0182] The following describes the system architecture and service scenarios in the embodiments of the present application. It should be noted that the system architecture and service scenarios described in this application are intended to more clearly describe the technical solutions in this application, and do not constitute limitations on the technical solutions provided in this application. Those skilled in the art may find that with the development of system architecture and the emergence of new service scenarios, the technical solutions provided in this application can also be applied to similar technical problems.

[0183] FIG. 3 is a schematic architecture diagram of a communication system according to an embodiment of the present application. The communication system includes a first node 301 and a second node 302. The first node 301 may communicate with the second node 302 through a data link. In order to prevent an eavesdropper (or an attacker) from obtaining the content of the information, the information being communicated may be encrypted by using an encryption key. For example, the first node 301 encrypts a plaintext message 303 that needs to be transmitted by using an encryption key 305 to obtain a ciphertext message 304. The first node 301 transmits the ciphertext message 304 to the second node 302. Correspondingly, after receiving the ciphertext message 304, the second node 302 may decrypt the ciphertext message 304 by using a key to obtain the plaintext message 303, thereby completing the data transmission. In addition to the encryption key and the decryption key, the first node 301 and the second node 302 may further include keys such as an integrity protection key, a file key, and a master key.

[0184] It should be noted that the first node 301 and the second node 302 can be different devices. For example, FIG. 4 is a schematic diagram of a usage scenario of the key update method according to an embodiment of the present application. The CDC 401 and the camera 402 are two nodes in a smart cab device. The CDC 401 can be regarded as the first node 301, and the camera 402 can be regarded as the second node 302. The camera 402 encrypts video data by using a key and sends the encrypted video data to the CDC 401 through Bluetooth, and the CDC 401 receives the encrypted video data through Bluetooth and decrypts the encrypted video data to obtain the captured video data. The first node 301 and the second node 302 can alternatively be the same type of node. For example, if the first node 301 is a mobile phone A and the second node 302 is a mobile phone B, the mobile phone A can encrypt local voice data and send the encrypted voice data to the B side through a network call.

[0185] Optionally, a data link for transmitting data between the first node 301 and the second node 302 may include various types of connection media, for example, a wired link, a wireless link (e.g., Wi-Fi or Bluetooth) or an optical fiber link.

[0186] Optionally, the first node 301 may be the one that initiates the communication and may be referred to as the master node, and correspondingly, the second node 302 may be the one that receives the communication and may be referred to as the secondary node.

[0187] To ensure that the encrypted contents of a node are not disclosed, the key is usually used for a limited period of time. Therefore, a mechanism for updating the key must be introduced. For example, take the CDC 401 and the camera 402 connected through Bluetooth as an example. When the E0 encryption method is used, the CDC 401 and the camera 402 will update the key for 2 28 The key must be updated once within 2 Bluetooth ticks (approximately 23.3 hours). If the advanced encryption standard (AES) encryption algorithm is used, the CDC 401 and the camera 402 must update the key once within 2 38 A key needs to be updated once within a tick (approximately 2.72 years). As another example, when a session key is generated by using a master key and a counter value in a node that contains a master key and a session key, the master key needs to be updated before the counter value is inverted (or a new round of counting is restarted). In the key update process, messages used for key update and sent between nodes are vulnerable to man-in-the-middle attacks, which affect data security. To solve this problem, the embodiment of the present application provides the following method.

[0188] 5 is a schematic flowchart of a key updating method according to an embodiment of the present application. The key updating method may be implemented based on the architecture shown in FIG 3. The method includes, but is not limited to, the following steps:

[0189] Step: S501: The first node sends a first key update request to the second node.

[0190] Specifically, the first key update request includes a first key negotiation parameter and a first identity authentication information. The first key negotiation parameter is a key parameter used to generate a first target key. Several optional cases are described as follows.

[0191] Case 1: The first key negotiation parameter may include a parameter KEm of the key negotiation algorithm. For ease of explanation, the parameter KEm of the key negotiation algorithm may be referred to as the first key negotiation algorithm parameter.

[0192] In an example where the key negotiation algorithm is a DH algorithm, the parameters of the DH algorithm determined at the first node include a prime number p, a random number g, a random number a, and a calculated value A. The calculated value A is calculated according to the following formula: A=g a mod p, the prime number p and the random number g are further used by the second node to generate another parameter of the DH algorithm. Optionally, since the prime number p, the random number g, and the calculated value A need to be transmitted to the second node, the prime number p, the random number g, and the calculated value A can be regarded as the public key of the first node. Correspondingly, since the random number a is not transmitted to the second node, the random number a can be regarded as the private key of the first node. Optionally, the first node can use the calculated value A as the first key negotiation algorithm parameter KEm and transmit the prime number p and the random number g to the second node before transmitting the first key update request, or use the prime number p, the random number g, and the calculated value A as the first key negotiation algorithm parameter KEm and transmit the first key negotiation algorithm parameter KEm to the second node by using the first key update request.

[0193] Case 2: The first key negotiation parameters may include fresh parameters.

[0194] In this embodiment of the present application, the first identity authentication information in the first key update request may be generated by using a shared key between the first node and the second node. For ease of description, the shared key for generating the first key update request is referred to as a first shared key, and the first shared key may be a key such as a master key or a pre-shared key PSK.

[0195] In an optional solution, the first identity authentication information may be generated by using a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC, the HMAC is used to receive an input of one or more character parameters and output an identifier, and the identifier may be used as the first identity authentication information. In the following, an example where the hash function is HMAC is used for explanation.

[0196] Example 1: The first identity authentication information AUTHm generated by the first node may be HMAC(PSK), or in other words, AUTHm=HMAC(PSK).

[0197] Example 2: If the first key negotiation parameter is denoted as S1, the first identity authentication information AUTHm generated by the first node may be HMAC(PSK, S1), or in other words, AUTHm=HMAC(PSK, S1). S1 may be the first key negotiation algorithm parameter KEm in case 1 above, or may be a new parameter (e.g., at least one of a counter value, a serial number, a random value, and a frame number) in case 2 above.

[0198] Example 3: If the first key update request further includes a random value (a number used once, NONCE), the first identity authentication information AUTHm generated by the first node may be HMAC(PSK, S1, NONCEm), where NONCEm is the random value generated by the first node, or in other words, AUTHm=HMAC(PSK, S1, NONCEm).

[0199] In this embodiment of the present application, the first key update request may further indicate at least one information about the expiration and the first update time of the first target key. The first update time is used to indicate the time when the first target key is activated, and may also be referred to as activation time or start time.

[0200] For example, the first key update request includes first indication information indicating the validity period of the first target key. The first indication information may be a specific date and time. For example, if the first indication information is 00:52:50 on February 6, 2020, it may indicate that the validity date and time of the first target key ends at 00:52:50 on February 6, 2020, or the invalidity date and time starts after 00:52:50 on February 6, 2020. The first indication information may alternatively be a character string indicating the validity time or invalidity time, for example, a timestamp "1590921570" indicating 00:52:50 on February 6, 2020. The first indication information may alternatively be a timer or the like. For example, if the validity period of the first target key is 1000 seconds, it indicates that the first target key is valid until 1000 seconds after it is generated or activated. The second indication information may further include a frame number, etc.

[0201] As another example, the first key update request includes second indication information indicating the first update time point. The second indication information may be one or more of a frame number, a specific date and time, a character string, a timer, or the like. The frame number is a number or index of a communication frame, and the communication frame is a message structure when the first node communicates with the second node. The communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame. The frame number of the communication frame usually rotates within a preset frame number value range. For example, in a time division multiple access TDMA communication technology, time is segmented into periodic frames, and the frame number of each frame changes periodically from 0 to 2715647. The first node may indicate the first update time point by using the frame number carried in the update request. For ease of explanation, the frame number carried in the first key update request is referred to as the first frame number. For example, if the first frame number is 2345, it indicates that the first target key is applied after the communication frame starting from frame number 2345. Optionally, the first frame number may be multiple frame numbers. For example, if the first frame number may include frame number A of a user plane downlink frame and frame number B of a user plane uplink frame, it may indicate that the first target key is applied to the user plane downlink frame starting from frame number A and subsequent thereto, and that the first target key is applied to the user plane uplink frame starting from frame number B and subsequent thereto.

[0202] Optionally, when the first key update request indicates the first update time by using the first frame number, the first frame number can be indicated by using multiple bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Specifically, the multiple bits used to indicate the first frame number include two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are multiple bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency. For ease of explanation, the first frame number is used as an example for explanation in this specification, but is not intended to limit the present invention.

[0203] If the first key update request further includes a validity period and / or a first update time point, the following examples may also exist for the first identity credential.

[0204] Example 4: If the first key update request includes information expiration indicating the validity period of the first target key, the identity authentication information AUTHm generated by the first node may be HMAC(PSK, S1, expiration), or in other words, AUTHm=HMAC(PSK, S1, expiration).

[0205] Example 5: If the first key update request includes information timer indicating the first update time, the identity authentication information AUTHm generated by the first node can be HMAC(PSK, S1, timer), or in other words, AUTHm=HMAC(PSK, S1, timer). The activation time timer indicates the time when the new key is started.

[0206] Example 6: If the first key update request includes a random value NONCEm, information expiration indicating the validity period of the first target key, and information timer indicating the first update time, the identity authentication information AUTHm generated by the first node may be HMAC(PSK, S1, NONCEm, expiration, timer), or in other words, AUTHm=HMAC(PSK, S1, NONCEm, expiration, timer).

[0207] Of course, when the first identity authentication information is generated, in addition to the first shared key, other information (such as the number of the first node, the address of the first node, or the identifier of the connection between the first node and the second node) may be included. It should be noted that when the first key update request includes parameters such as a random value NONCEm, information expiration indicating the validity period of the first target key, and information timer indicating the first update time, the first node may alternatively not use some or all of the parameters in the first-generation identity authentication information AUTHm.

[0208] Optionally, the first node may send a first key update request to the second node by using a first communication frame, where the second frame number of the first communication frame is smaller than the third frame number carried in the key update request used during the previous key update, and the third frame number is used to indicate the start time of the previous updated key. The first frame number carried in the first key update request is larger than the second frame number and smaller than the third frame number. For example, if the third frame number is 2365, it indicates that the previous updated key will be applied after the communication frame whose frame number starts from 2365, and the first node needs to determine the first target key again before the frame number reaches 2365. Therefore, the first node may send a first key update request in a first communication frame whose frame number is 2345, and the first frame number 2355 is used to indicate the start time of the first target key in the first key update request. When security protection is performed on communication frames in a communication process, the encryption method used can be to perform encryption based on a frame number and a previously updated key. Thus, before the frame number repeats to the frame number of the previously updated key, a first target key is determined, and then the data frame is encrypted by using the first target key. In this way, a data frame with the same frame number can be encrypted twice by using different keys, thereby improving data security.

[0209] In an alternative solution, the first key update request includes a MAC serial number (MAC SN) instead of the first frame number, and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Alternatively, the third frame number held in the key update request used during the previous key update can also be replaced with the MAC SN, i.e., the MAC SN indicated by a part of the bits used to indicate the third frame number. In this alternative solution, the value relationship between the first frame number, the second frame number, and the third frame number remains unchanged. Specifically, the bits used to indicate the first frame number include two parts, i.e., an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are bits used to indicate the hyperframe number. In this alternative scheme, as little information as possible can be held in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0210] Optionally, the first target key and the previously updated key are the same type of key, for example, when the first target key requested to be updated in the first key update request is an encryption key, the third frame number is the frame number held in the key update request used to previously update the encryption key.

[0211] Optionally, the first node may record a frame number of the communication frame, and send a first key update request when the frame number and the third frame number of the communication frame are equal to or less than a first threshold. For example, the first node presets the first threshold to 20. If the third frame number is 2365, the first node may send a first key update request when recording a communication frame whose frame number is 2345. Furthermore, the first node may record frame numbers of one or more communication frames, for example, record at least two frame numbers of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame. If the difference between the frame number of one communication frame and the third frame number reaches a first threshold, the first key update request is sent.

[0212] Optionally, in the process of the previous key update, if no information indicating a key start time is kept or the first node has not performed a key update before, the first node may pre-configure a target frame number. If the first node detects that the difference between the current communication frame number and the target frame number is less than or equal to a first threshold, the first node sends a first key update request. It should be noted that in addition to obtaining the third frame number kept in the previous key update, the first node may record the frame number in the key update request sent during the previous key update, the frame number when a response message was last received, or the frame number of the communication frame used when the last updated key was used for communication for the first time, to detect whether the current key needs to be updated.

[0213] Step S502: The second node performs verification on the first identity authentication information based on the first shared key.

[0214] Specifically, the first identity authentication information is generated by the first node based on a first shared key between the first node and the second node, and the second node can therefore verify whether the first identity authentication information is accurate based on the first shared key.

[0215] In an optional solution, the protocol specifies that the first node uses a specific parameter to generate the first identity authentication information, and therefore the second node must also use the same parameter to generate the identity authentication information used for verification. If the identity authentication information used for verification is identical to the first identity authentication information, the verification is deemed successful. For example, the first identity authentication information is generated by using HMAC. Thus, the second node may generate the identity authentication information used for verification, also referred to as check value check1, by using HMAC, and then verify whether the first identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0216] For example, if the first identity authentication information AUTHm is HMAC(PSK), the second node obtains a check value check1=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the second node and the first node. If the check value check1 is identical to AUTHm, the verification is successful.

[0217] As another example, if the first identity authentication information AUTHm is HMAC(PSK, S1), the second node obtains a check value check1=HMAC(PSK, S1) by using HMAC based on the pre-shared key PSK between the second node and the first node and the first key negotiation parameter S1. If the check value check1 is identical to AUTHm, the verification is successful. For the first key negotiation parameter S1, please refer to the corresponding description in step S501.

[0218] Optionally, if the verification on the first identity information fails, it indicates that the identity of the first node is not trusted. Thus, the second node may not perform the subsequent key update steps. In this case, the second node may disconnect the communication connection with the first node, or the second node may send update failure indication information to the first node, or the second node may discard and not respond to the first key update request, thereby ensuring data security of the second node.

[0219] Optionally, the second node may perform a verification on the message integrity of the first key update request to prevent information in the first key update request from being tampered with by another device. The first key update request may include an integrity protection verification identifier. The second node performs a verification on the message integrity of the first key update request by using the integrity protection verification identifier. If the verification is successful, the second node subsequently performs a step of performing a verification on the first identity authentication information. If the verification is unsuccessful, the second node may disconnect the communication connection with the first node, or may send an update failure indication information to the first node, or the second node may discard and not respond to the first key update request, thereby ensuring the data security of the second node.

[0220] Step S503: If the verification on the first identity authentication information is successful, the second node determines a first target key based on the first key negotiation parameters.

[0221] Specifically, the second node determines the first target key based on the first key negotiation parameters in the first key update request by using at least the following four optional methods:

[0222] Method 1: The first key negotiation parameters satisfy the above-mentioned case 1, that is, the first key negotiation parameters include the first key negotiation algorithm parameter KEm, and the second node may determine the second key negotiation algorithm parameter KEs of the key negotiation algorithm. The second node may generate the first target key based on the first key negotiation algorithm parameter KEm and the second key negotiation algorithm parameter KEs.

[0223] In an example where the key negotiation algorithm is a DH algorithm, the parameters of the DH algorithm received by the second node from the first node may include a prime number p, a random number g, and a first calculated value A, and may be determined by the second node. The parameters of the DH algorithm include a random number b and a calculated value B, i.e., second key negotiation algorithm parameters KEs, where B is expressed by the following formula: B=g b mod p. The second node may determine a first target key K1 based on the random number b, the calculated value A, and the prime number p, where K1 satisfies the following formula: b Satisfy mod p.

[0224] Optionally, in parameters of the DH algorithm determined by the second node, the random number b is used by the second node to generate the first target key, and thus the random number b may be regarded as the private key of the second node, and the calculated value B is sent to the first node, and thus the calculated value B may be regarded as the public key of the second node.

[0225] Method 2: The first key negotiation parameters satisfy the above-mentioned case 2, that is, the first key negotiation parameters include new parameters, and the second node may generate the first target key based on the second target key and the new parameters. The second target key may be a shared key between the first node and the second node.

[0226] Optionally, the second node may generate the first target key by using a KDF.

[0227] For example, the second node determines that the first target key K1 is K1=KDF(K2,fresh) by using the KDF algorithm based on the second target key K2 and the new parameter fresh.

[0228] Method 3: The first key negotiation parameters satisfy the above-mentioned case 2, that is, the first key negotiation parameters include fresh parameters. When the algorithm identifier tag is obtained from the second node, the second node may determine that the first target key K1 is K1=KDF(K2, fresh, tag) by using a KDF algorithm based on the second target key K2, the fresh parameters fresh, and the algorithm identifier tag.

[0229] The algorithm identifier may be used to indicate the algorithm used to generate the first target key. For example, the string "encryption" is used to indicate the algorithm used to generate the encryption key. As another example, the string "integrity" is used to indicate the algorithm used to generate the integrity protection key. The algorithm identifier may alternatively be used to indicate the identifier of the hash algorithm used. For example, the string "SHA256" is used to indicate the algorithm used to determine the first target key is the SHA256 algorithm. The algorithm identifier may alternatively be represented by using a numeric value. For example, 01 represents the AES encryption algorithm and 10 represents the AES-cypher-based message authentication code (AES-CMAC) integrity algorithm.

[0230] The algorithm identifier may be pre-configured between the first node and the second node, or may be determined by the first node and then transmitted to the second node.

[0231] Method 4: The first key negotiation parameters satisfy the above-mentioned case 2, i.e., the first key negotiation parameters include new parameters. If the algorithm identifier tag and the algorithm type type are obtained from the second node, the second node may determine that the first target key K1 is K1=KDF(K2, fresh, tag, type) based on the second target key K2, the new parameters fresh, the algorithm identifier tag, and the key type type, where type represents the key type. For example, the string "encryption" is used to indicate generating an encryption key. As another example, the string "integrity" is used to indicate generating an integrity protection key. The algorithm identifier is used to indicate the algorithm used to generate the first target key.

[0232] The key type may be indicated in the first key update request or may be pre-negotiated by the first and second nodes before the first target key is generated.

[0233] Optionally, in the process of determining the first target key in any one or more of Method 2, Method 3, and Method 4, the second node may first determine an intermediate key based on the first target key K2 and the new parameter fresh, and then determine the first target key K1 based on the intermediate key by using at least one of the algorithm identifier tag and the key type type. For example, the second node obtains an intermediate key Kmid: Kmid=KDF1(K2,fresh) by using a key derivation function KDF1, and then determines the first target key K1: K1=KDF2(Kmid,tag,type) by using a key derivation function KDF2 based on the intermediate key Kmid. KDF1 and KDF2 may be the same key derivation function, or may be different key derivation functions. In this case, the first node only needs to generate new parameters when determining the intermediate key Kmid, and does not need to generate new parameters every time the first target is determined, thereby reducing the amount of times of generating new parameters and facilitating the management of the generated new parameters. In order to more clearly describe the solution in this specification, it should be noted that how to obtain the first target key is described by using two steps. In actual processing, the first target key can alternatively be obtained by using one step. The intermediate key Kmid is just an intermediate result. In other words, the method of determining the first target satisfies K1=KDF2(KDF1(K2, fresh), tag, type).

[0234] Optionally, when the first key update request carries information indicating the first update time point, the first target key generated at the second node is applied after a time starting from the first update time point. Optionally, when the first update time point is indicated by using a first frame number, the first target key is applied after a communication frame starting from the first update time point.

[0235] Optionally, the second node may obtain the third frame number (or the MAC serial number corresponding to the third frame number) carried in the key update request used during the previous key update. If the second node detects that the frame number of the communication frame has been inverted once (or a new round of counting has been restarted), the frame number of the current communication frame is equal to or greater than the third frame number (or the MAC serial number corresponding to the third frame number), and no key update request is received at this time, or no new key is applied, the second node may disconnect the connection to the first node, and may further delete the security context and resume the connection to the other, thereby ensuring security in the communication process. The security context includes at least one security information, such as a shared key, a key validity period, and a key update time.

[0236] Optionally, the second node may further obtain a frame number of a communication frame used when the previously updated key is used for communication for the first time. If the second node detects that the frame number of the communication frame is inverted once, the frame number of the current communication frame is equal to or greater than the frame number of the communication frame used when the previously updated key is used for communication for the first time, and no key update request is received at this time, or no new key is applied, the second node may disconnect the connection to the first node, and may further delete the security context, thereby ensuring security in the communication process.

[0237] Step S504: The second node sends a first response message to the first node.

[0238] Specifically, the first response message includes second identity authentication information used to perform authentication for the identity of the second node. If the second node generates the first target key by using method 1, the first response message further includes second key negotiation algorithm parameters KEs. Optionally, the first response message further includes a random value NONCEs generated by the second node.

[0239] In this embodiment of the present application, the second identity authentication information may be generated by the second node based on a first shared key between the first node and the second node.

[0240] In an optional solution, the second identity authentication information may be generated by using a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC, the HMAC is used to receive an input of one or more character parameters and output an identifier, and the identifier may be used as the identity authentication information. In the following, an example where the cryptographic algorithm is HMAC is used for explanation.

[0241] Example 1: The second identity authentication information AUTHs generated by the second node may be HMAC(PSK), or in other words, AUTHs=HMAC(PSK).

[0242] Example 2: When the first response message further includes a second key negotiation parameter KEs, the second identity authentication information AUTHs generated by the second node may be HMAC(PSK, KEs), or in other words, AUTHs=HMAC(PSK, KEs).

[0243] Example 3: When the first response message further includes the random value NONCEs generated by the second node, the identity authentication information AUTHs generated by the second node may be HMAC(PSK, KEs, NONCEs), or in other words, AUTHs=HMAC(PSK, K1, NONCEs).

[0244] Of course, in addition to the first shared key, other information may be included in the parameters used to generate the second identity authentication information (e.g., the number of the second node, the address of the second node, or an identifier of the connection between the second node and the first node). If the first response message includes parameters such as the second key negotiation parameters KEs and / or the random value NONCEs, the second node may not use these parameters to generate the identity authentication information AUTHs.

[0245] Optionally, the first response message is a response message sent after the second node can authenticate the first identity credential based on the first key negotiation parameters and the first shared key.

[0246] Step S505: The first node performs verification on the second identity authentication information by using the first shared key.

[0247] Specifically, the second identity information is generated by the second node based on the first shared key between the first node and the second node. Therefore, the first node can verify whether the second identity authentication information is accurate based on the first shared key.

[0248] In an optional solution, the protocol specifies that the second node generates the second identity credential using specific parameters, and therefore the first node must also generate the identity credential used for verification using the same parameters. If the identity credential used for verification is identical to the second identity credential, the verification is considered successful.

[0249] For example, the second identity authentication information may be generated by using HMAC. Thus, the first node may generate an identity authentication information used for verification, also referred to as a check value check2, by using HMAC, and then verify whether the second identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0250] For example, if the second identity authentication information AUTHs is HMAC(PSK), the first node obtains a check value check2=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the first node and the second node. If the check value check2 is the same as AUTHs, the verification is successful.

[0251] As another example, if the first identity authentication information AUTHs is HMAC(PSK, KEs), the first node obtains a check value check2=HMAC(PSK, KEs) by using HMAC based on the pre-shared key PSK between the first node and the second node and the second key negotiation parameter KEs in the first response message. If the check value check2 is the same as AUTHs, the verification is successful.

[0252] Optionally, if the verification for the second identity authentication information fails, it indicates that the identity of the second node is not trusted. Thus, the first node may disconnect the connection to the second node, or may send update failure indication information to the second node, or may discard the first response message and not respond, thereby ensuring data security in the data update process and facilitating connection to the node that needs to perform key update.

[0253] Optionally, the first node may perform a verification on the message integrity of the first response message to prevent information in the first response message from being tampered with by another device. The second node may add an integrity protection verification identifier to the first response message. The first node performs a verification on the message integrity of the first response message by using the integrity protection verification identifier. If the verification is successful, the first node subsequently performs a step of performing a verification on the second identity authentication information. If the verification is unsuccessful, the first node may disconnect the connection to the second node, or may send update failure indication information to the second node, or may discard and not respond to the first response message, thereby ensuring data security in the data update process.

[0254] Step S506: If the verification on the second identity authentication information is successful, the first node determines a first target key based on the first key negotiation parameters.

[0255] Specifically, the first node determines the first target key based on the first key negotiation parameters by using at least the following multiple optional methods:

[0256] Method 1: The first key negotiation parameters satisfy the above-mentioned case 1, that is, the first key negotiation parameters include parameters of a key negotiation algorithm, and the first response message includes second key negotiation parameters KEs. The first node may generate a first target key based on the first key negotiation algorithm parameters KEm and the second key negotiation algorithm parameters KEs.

[0257] In an example where the key negotiation algorithm is a DH algorithm, the parameters of the DH algorithm generated at the first node include a prime number p, a random number g, a, and a first calculated value A. The parameters of the DH algorithm received by the first node from the second node include a first calculated value B. The first node may determine a first target key K1 based on the random number a, the calculated value B, and the prime number p, where K1 is determined according to the following formula: K1=B a mod p is satisfied. K1=A b mod p=(g a mod p) b mod p=g ab mod p=(g b mod p) a =B a Since mod p, the first target key K1 determined by the first node and the second node is identical.

[0258] Method 2: The first key negotiation parameters satisfy the above case 2, ie, the first key negotiation parameters include a new parameter, and the first node generates the first target key based on the second target key and the new parameter.

[0259] Optionally, the first node may generate the first target key by using a KDF.

[0260] For example, the first node determines, based on the second target key K2 and the new parameter fresh, by using the KDF, that the first target key K1 is K1=KDF(K2,fresh).

[0261] Method 3: The first key negotiation parameters satisfy the above-mentioned case 2, that is, the first key negotiation parameters include fresh parameters. When the algorithm identifier tag is obtained from the first node, the first node may determine that the first target key K1 is K1=KDF(K2, fresh, tag) by using a KDF algorithm based on the second target key K2, the fresh parameters fresh, and the algorithm identifier tag.

[0262] The algorithm identifier may be used to indicate the algorithm used to generate the first target key. For example, the string "encryption" is used to indicate the algorithm used to generate the encryption key. As another example, the string "integrity" is used to indicate the algorithm used to generate the integrity protection key. The algorithm identifier may alternatively be used to indicate the identifier of the hash algorithm used. For example, the string "SHA256" is used to indicate the algorithm used to determine the first target key is the SHA256 algorithm. The algorithm identifier may alternatively be represented by using a numeric value. For example, 01 represents the AES encryption algorithm and 10 represents the AES-cypher-based message authentication code (AES-CMAC) integrity algorithm.

[0263] The algorithm identifier may be pre-configured between the first node and the second node or may be determined by the first node.

[0264] Method 4: The first key negotiation parameters satisfy the above-mentioned case 2, i.e., the first key negotiation parameters include new parameters. If the algorithm identifier tag and the algorithm type type are obtained from the first node, the first node may determine that the first target key K1 is K1=KDF(K2, fresh, tag, type) based on the second target key K2, the new parameters fresh, the algorithm identifier tag, and the key type type, where type represents the key type. For example, the string "encryption" is used to indicate generating an encryption key. As another example, the string "integrity" is used to indicate generating an integrity protection key. The algorithm identifier is used to indicate the algorithm used to generate the first target key.

[0265] The key type may be indicated in the first key update request or may be pre-negotiated by the first and second nodes before the first target key is generated.

[0266] Optionally, in the process of determining the first target key in any one or more of Method 2, Method 3 and Method 4, the first node may first determine an intermediate key based on the first target key K2 and the new parameter fresh, and then determine the first target key K1 based on the intermediate key by using at least one of the algorithm identifier tag and the key type type. For example, the first node obtains an intermediate key Kmid: Kmid=KDF1(K2,fresh) by using a key derivation function KDF1, and then determines the first target key K1=KDF2(Kmid,tag,type) based on the intermediate key Kmid by using a key derivation function KDF2. KDF1 and KDF2 may be the same key derivation function, or may be different key derivation functions. In order to more clearly explain the present solution in this specification, how to obtain the first target key is described by using two steps. In actual processing, the first target key may alternatively be obtained by using one step. The intermediate key Kmid is just an intermediate result. In other words, the method for determining the first target satisfies K1=KDF2(KDF1(K2, fresh), tag, type).

[0267] Optionally, the first target key may apply to a shared key between the first node and the second node, including a master key, a session key, etc.

[0268] Optionally, if the first key update request indicates a first update time, the first target key may be applied within a time period starting from the first update time. For example, if the first target key is a master key and the information indicating the first private key included in the first key update request is a timestamp "1590921570", it indicates that the time when the first target key is activated is 00:52:50 on February 6, 2020, and therefore the first node and the second node use the first target key as a master key after a time period starting at 00:52:50 on February 6, 2020.

[0269] Optionally, if the first key update request indicates a validity period of the first target key, the first target key may be applied within the validity period of the first target key. For example, if the first target key is a master key and the information indicating the first private key included in the first key update request is a timestamp "1590952447", it indicates that the validity period of the first target key is 09:28:26 on February 6, 2020, and therefore the first node and the second node may use the first target key as a master key at 09:28:26 on February 6, 2020.

[0270] Optionally, the second node may further detect the validity period of the first target key and determine a new target key before the validity period of the first target key.

[0271] It may be understood that when the first key update request indicates a first update time point and a validity period of the first target key, the first target key is applied within the validity period of the first target key starting from the first update time point.

[0272] Optionally, the second target key may be an encryption key. In this case, the first key update request may be encrypted by using the second target key. Correspondingly, the second node may use the second target key for decryption after receiving the first key update request. Similarly, the first response request may be encrypted by using the second target key. Correspondingly, the first node may use the second target key for decryption after receiving the first response message.

[0273] Optionally, the second target key can be an integrity protection key. In this case, integrity protection can be performed on the first key update request by using the second target key. Correspondingly, the second node can check data integrity by using the second target key after receiving the first key update request from the first node. Similarly, integrity protection can be performed on the first response request by using the second target key. Correspondingly, the first node can check data integrity by using the second target key after receiving the first response message. In a conventional key update process, a key update time point is configured. Therefore, when a new key is updated, since the old key has expired, the encryption process needs to be suspended during the key update, and the encryption process resumes after the key update is completed. However, the suspension of the encryption process and the resumption of the encryption process affect the key update efficiency, and the suspension of the encryption process affects the security. However, in the key update method in the present application, the key is updated before the old key expires. Since the old key has not expired, the encryption process does not need to be suspended, thereby improving the key update efficiency and improving the data security.

[0274] Optionally, the second target key may be a master key. In this case, the second target key may be used to determine an encryption key or an integrity protection key. Thus, encryption and / or integrity protection may be performed on the first key update request by using an encryption key determined based on the second target key and / or by using an integrity protection key determined based on the second target key. Correspondingly, after receiving the first key update request, the second node may decrypt the first key update request by using an encryption key determined based on the second target key, and / or the integrity protection key determined based on the second target key may be used to check data integrity by using an integrity protection key determined based on the second target key. Similarly, encryption and / or integrity protection may be performed on the first response request by using an encryption key determined based on the second target key and / or by using an integrity protection key determined based on the second target key. Correspondingly, after receiving the first response message, the first node may decrypt the first response message by using an encryption key determined based on the second target key, and / or the integrity protection key determined based on the second target key may be used to check data integrity by using the integrity protection key determined based on the second target key.

[0275] Optionally, when a first target key is determined by using method 2 and method 3, if the first target key is a session key, encryption or integrity protection may be performed on the first response message by using the first target key.

[0276] Optionally, when the first node updates the session key by using the master key and the counter value, the first node detects whether the counter value is inverted (or a new round of counting is restarted), and sends a first key update request to the second node (the determined first target key is the master key) before the counter value is inverted. Optionally, if the first node does not send the first key update request before the counter value is inverted, the first node may disconnect the communication connection to the second node and re-access the second node, thereby ensuring the security of the process of communication with the second node.

[0277] Optionally, the first node may obtain the third frame number (or the MAC serial number corresponding to the third frame number) held in the key update request used during the previous key update. If the first node detects that the frame number of the communication frame has been inverted once, the frame number of the current communication frame is equal to or greater than the third frame number (or the MAC serial number corresponding to the third frame number), and no key update request is sent or no new key is applied at this time, and the first node may disconnect the connection to the second node, further delete the security context, and resume the connection to the other, thereby ensuring security in the communication process.

[0278] In the method described in Fig. 5, in the key update process, the first node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0279] The embodiment of the above-mentioned method shown in Fig. 5 includes many possible implementation solutions. In the following, some implementation solutions are described separately with reference to Fig. 6A, Fig. 6B, Fig. 7A, Fig. 7B, Fig. 8A, and Fig. 8B. It should be noted that for related concepts or operations or logical relationships not described in Fig. 6A, Fig. 6B, Fig. 7A, Fig. 7B, Fig. 8A, and Fig. 8B, reference is made to the corresponding description in the embodiment shown in Fig. 5. Therefore, the details will not be described again.

[0280] 6A and 6B show yet another key updating method according to an embodiment of the present application. The method includes at least the following steps:

[0281] Step S601: The first node sends a first key update request to the second node.

[0282] In this embodiment of the present application, encryption and / or integrity protection may be performed on the first key update request by using an encryption key determined based on a second target key and / or by using an integrity key determined based on a second target key, the second target key being a shared key between the first node and the second node.

[0283] In this embodiment of the present application, the first key update request includes a first key negotiation parameter and a first identity authentication information. The first key negotiation parameter may be a first key negotiation algorithm parameter KEm. Optionally, the first key update request may further include at least one of a random value NONCEm, information timer indicating a first update time point, and information expiration indicating a validity period of the first target key.

[0284] In this embodiment of the present application, the first identity authentication information in the first key update request may be generated by using a first shared key between the first node and the second node, and the first shared key may include a master key, a pre-shared key PSK, etc.

[0285] Optionally, the function for generating the first identity authentication information can be a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC and the first shared key is a pre-shared key PSK, the generated first identity authentication information AUTHm can be expressed as AUTHm=HMAC(PSK, KEm, NONCEm, expiration, timer), and the sequence of parameters can be different. Of course, when the first key update request includes parameters such as the first key negotiation algorithm parameter KEm, the random value NONCEm, the information expiration indicating the validity period of the first target key, or the information timer indicating the first update time, the first node may not use some or all of the parameters to generate the first identity authentication information AUTHm.

[0286] Optionally, the first node may send a first key update request to the second node by using a first communication frame, where the second frame number of the first communication frame is smaller than the third frame number carried in the key update request used during the previous key update, and the third frame number is used to indicate the start time of the previous updated key. The first frame number carried in the first key update request is larger than the second frame number and smaller than the third frame number. For example, if the third frame number is 2365, it indicates that the previous updated key will be applied after the communication frame whose frame number starts from 2365, and the first node needs to determine the first target key again before the frame number reaches 2365. Therefore, the first node may send a first key update request in a first communication frame whose frame number is 2345, and the first frame number 2355 is used to indicate the start time of the first target key in the first key update request. When security protection is performed on communication frames in a communication process, the encryption method used can be to perform encryption based on a frame number and a previously updated key. Thus, before the frame number repeats to the frame number of the previously updated key, a first target key is determined, and then the data frame is encrypted by using the first target key. In this way, a data frame with the same frame number can be encrypted twice by using different keys, thereby improving data security.

[0287] Optionally, if no information indicating a key starting time is kept in a previous key update process or the first node has not performed a key update before, the first node may pre-configure a target frame number, and if the first node detects that the difference between the current communication frame number and the target frame number is less than or equal to a first threshold, the first node sends a first key update request.

[0288] Step S602: The second node decrypts the first key update request.

[0289] Specifically, the second node may decrypt the first key update request by using an encryption key determined based on the second target key.

[0290] Step S603: The second node performs verification on the message integrity of the first key update request.

[0291] Optionally, if the verification fails, the second node may disconnect the communication connection to the first node, or the second node may send an update failure indication information to the first node, or the second node may discard the first key update request.

[0292] Optionally, in the embodiment shown in Figures 6A and 6B, the second node may not perform step S603. In this case, after performing step S602, the second node may subsequently perform step S604 and steps subsequent to step S604.

[0293] Step S604: The second node performs verification on the first identity authentication information.

[0294] Specifically, the first identity authentication information is generated by the first node based on a first shared key between the first node and the second node, and the second node can therefore verify whether the first identity authentication information is accurate based on the first shared key.

[0295] In an optional solution, the protocol specifies that the first node uses a specific parameter to generate the first identity authentication information, and therefore the second node must also use the same parameter to generate the identity authentication information used for verification. If the identity authentication information used for verification is identical to the first identity authentication information, the verification is deemed successful. For example, the first identity authentication information is generated by using HMAC. Thus, the second node may generate the identity authentication information used for verification, also referred to as check value check1, by using HMAC, and then verify whether the first identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for explanation.

[0296] For example, if the first identity authentication information AUTHm is HMAC(PSK), the second node obtains a check value check1=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the second node and the first node. If the check value check1 is identical to AUTHm, the verification is successful.

[0297] As another example, if the first identity authentication information AUTHm is HMAC(PSK, KEm), the second node obtains a check value check1=HMAC(PSK, KEm) by using HMAC based on the pre-shared key PSK and the first key negotiation parameter KEm between the second node and the first node. If the check value check1 is identical to AUTHm, the verification is successful.

[0298] Optionally, if verification of the first identity information fails, the second node may disconnect the communication connection with the first node, or the second node may send update failure indication information to the first node, or the second node may discard the first key update request.

[0299] Optionally, the second node may first perform the operation of S604 and then perform the operation of S603.

[0300] Step S605: If the verification on the first identity authentication information is successful, the second node generates a first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0301] Specifically, the second node may determine second key negotiation algorithm parameters KEs of the key negotiation algorithm. The second node generates a first target key based on the first key negotiation algorithm parameters KEm and the second key negotiation algorithm parameters KEs.

[0302] In an example where the key negotiation algorithm is a DH algorithm, the parameters of the DH algorithm received by the second node from the first node may include a prime number p, a random number g, and a first calculated value A, and may be determined by the second node. The parameters of the DH algorithm include a random number b and a calculated value B, i.e., second key negotiation algorithm parameters KEs, where B is expressed by the following formula: B=g b mod p. The second node may determine a first target key K1 based on the random number b, the calculated value A, and the prime number p, where K1 satisfies the following formula: b Satisfy mod p.

[0303] Step S606: The second node sends a first response message to the first node.

[0304] In this embodiment of the present application, encryption and / or integrity protection may be performed on the first response message by using an encryption key determined based on a second target key and / or by using an integrity key determined based on a second target key, the second target key being a shared key between the second node and the first node.

[0305] The first response message includes second identity authentication information and second key negotiation algorithm parameters KEs, where the second identity authentication information is used to verify the identity of the second node and may be generated by using a first shared key between the first node and the second node. Optionally, the first response message may further include a random value NONCEs.

[0306] In this embodiment of the present application, the second identity authentication information may be generated by using a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC, the generated second identity authentication information AUTHs may be expressed as AUTHs=HMAC(PSK, KEs, NONCEs), and the sequence of parameters may be different. Of course, when the first key update request includes parameters such as the second key negotiation algorithm parameter KEs and the random value NONCEs, the second node may not use some or all of the parameters to generate the second identity authentication information AUTHs.

[0307] Optionally, the second node may first perform the operation of S606 and then perform the operation of S605.

[0308] Step S607: The first node decrypts the first response message.

[0309] Specifically, the first node may decrypt the first response message by using an encryption key determined based on the second target key.

[0310] Optionally, the first node may first perform the operation of S607 and then perform the operation of S606.

[0311] Step S608: The first node performs verification on the message integrity of the first response message.

[0312] Optionally, if the verification for message integrity fails, the first node may disconnect the connection to the second node, or may send an update failure indication information to the second node, or may discard the first response message.

[0313] Optionally, in the embodiment shown in Figures 6A and 6B, the first node may not perform step S608. In this case, after performing step S607, the first node may subsequently perform step S609 and steps subsequent to step S609.

[0314] Step S609: The first node performs verification on the second identity authentication information.

[0315] Specifically, the second identity information is generated by the second node based on the first shared key between the first node and the second node. Therefore, the first node can verify whether the second identity authentication information is accurate based on the first shared key.

[0316] In an optional solution, the protocol specifies that the second node generates the second identity credential using specific parameters, and therefore the first node must also generate the identity credential used for verification using the same parameters. If the identity credential used for verification is identical to the second identity credential, the verification is considered successful.

[0317] For example, the second identity authentication information may be generated by using HMAC. Thus, the first node may generate an identity authentication information used for verification, also referred to as a check value check2, by using HMAC, and then verify whether the second identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0318] For example, if the second identity authentication information AUTHs is HMAC(PSK), the first node obtains a check value check2=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the first node and the second node. If the check value check2 is the same as AUTHs, the verification is successful.

[0319] As another example, if the first identity authentication information AUTHs is HMAC(PSK, KEs), the first node obtains a check value check2=HMAC(PSK, KEs) by using HMAC based on the pre-shared key PSK between the first node and the second node and the second key negotiation parameter KEs in the first response message. If the check value check2 is the same as AUTHs, the verification is successful.

[0320] Optionally, if the verification for the second identity authentication information fails, the first node may disconnect the connection to the second node, or may send an update failure indication information to the second node, or may discard the first response message.

[0321] Optionally, the first node may first perform the operation of S609 and then perform the operation of S608.

[0322] Step S610: If the verification on the second identity authentication information is successful, the first node generates a first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0323] Specifically, since the first response message includes the second key negotiation algorithm parameter KEs, the first node generates a first target key based on the first key negotiation algorithm parameter KEm and the second key negotiation algorithm parameter KEs.

[0324] In an example where the key negotiation algorithm is a DH algorithm, the parameters of the DH algorithm generated at the first node include a prime number p, a random number g, a, and a first calculated value A. The parameters of the DH algorithm received by the first node from the second node include a first calculated value B. The first node may determine a first target key K1 based on the random number a, the calculated value B, and the prime number p, where K1 is determined according to the following formula: K1=B a mod p is satisfied. K1=A b mod p=(g a mod p) b mod p=g ab mod p=(g b mod p) a mod p=B a Since mod p, the first target key K1 determined by the first node and the second node is identical.

[0325] Optionally, the first target key may be applied to a shared key between the first node and the second node, or may be applied to a master key or a session key.

[0326] In the method described in Figure 6A and Figure 6B, in the key update process, the first node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0327] 7A and 7B show yet another key updating method according to an embodiment of the present application. The method includes at least the following steps:

[0328] Step S701: The first node sends a first key update request to the second node.

[0329] In this embodiment of the present application, encryption and / or integrity protection may be performed on the first key update request by using an encryption key determined based on a second target key and / or by using an integrity key determined based on a second target key, the second target key being a shared key between the second node and the first node.

[0330] In this embodiment of the present application, the first key update request includes a first key negotiation parameter and a first identity authentication information. The first key negotiation parameter may be a fresh parameter. Optionally, the first key request may further include at least one of a random value NONCEm, information timer indicating a first update time point, and information expiration indicating a validity period of the first target key.

[0331] In this embodiment of the present application, the first identity authentication information in the first key update request may be generated by using a first shared key between the first node and the second node, and the first shared key may include a master key, a pre-shared key PSK, etc.

[0332] Optionally, the function for generating the first identity authentication information can be a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC and the first shared key is a pre-shared key PSK, the generated first identity authentication information AUTHm can be expressed as AUTHm=HMAC(PSK, fresh, NONCEm, expiration, timer), and the sequence of parameters can be different. Of course, when the first key update request includes information such as a new parameter fresh, a random value NONCEm, information expiration indicating the validity period of the first target key, or information timer indicating the first update time, the first node may not use some or all of the parameters to generate the first identity authentication information AUTHm.

[0333] Optionally, the first node may send a first key update request to the second node by using a first communication frame, where the second frame number of the first communication frame is smaller than the third frame number carried in the key update request used during the previous key update, and the third frame number is used to indicate the start time of the previous updated key. The first frame number carried in the first key update request is larger than the second frame number and smaller than the third frame number. For example, if the third frame number is 2365, it indicates that the previous updated key will be applied after the communication frame whose frame number starts from 2365, and the first node needs to determine the first target key again before the frame number reaches 2365. Therefore, the first node may send a first key update request in a first communication frame whose frame number is 2345, and the first frame number 2355 is used to indicate the start time of the first target key in the first key update request. When security protection is performed on communication frames in a communication process, the encryption method used can be to perform encryption based on a frame number and a previously updated key. Thus, before the frame number repeats to the frame number of the previously updated key, a first target key is determined, and then the data frame is encrypted by using the first target key. In this way, a data frame with the same frame number can be encrypted twice by using different keys, thereby improving data security.

[0334] Optionally, if no information indicating a key starting time is kept in a previous key update process or the first node has not performed a key update before, the first node may pre-configure a target frame number, and if the first node detects that the difference between the current communication frame number and the target frame number is less than or equal to a first threshold, the first node sends a first key update request.

[0335] Step S702: The second node decrypts the first key update request.

[0336] Specifically, the second node may decrypt the first key update request by using an encryption key determined based on the second target key.

[0337] Step S703: The second node performs verification on the message integrity of the first key update request.

[0338] Optionally, if the verification for message integrity fails, the second node may disconnect the communication connection to the first node, or the second node may send an update failure indication information to the first node, or the second node may discard the first key update request.

[0339] Optionally, in the embodiment shown in Figures 7A and 7B, the second node may not perform step S703. In this case, after performing step S702, the second node may subsequently perform step S704 and steps subsequent to step S704.

[0340] Step S704: The second node performs verification on the first identity authentication information.

[0341] Specifically, the first identity authentication information is generated by the first node based on a first shared key between the first node and the second node, and the second node can therefore verify whether the first identity authentication information is accurate based on the first shared key.

[0342] In an optional solution, the protocol specifies that the first node uses a specific parameter to generate the first identity authentication information, and therefore the second node must also use the same parameter to generate the identity authentication information used for verification. If the identity authentication information used for verification is identical to the first identity authentication information, the verification is deemed successful. For example, the first identity authentication information is generated by using HMAC. Thus, the second node may generate the identity authentication information used for verification, also referred to as check value check1, by using HMAC, and then verify whether the first identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0343] For example, if the first identity authentication information AUTHm is HMAC(PSK), the second node obtains a check value check1=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the second node and the first node. If the check value check1 is the same as AUTHm, the verification is successful.

[0344] As another example, if the first key negotiation parameters include a new parameter fresh and the first identity authentication information AUTHm is HMAC(PSK, fresh), the second node obtains a check value check1=HMAC(PSK, fresh) by using HMAC based on the pre-shared key PSK between the second node and the first node and the new parameter fresh. If the check value check1 is the same as AUTHm, the verification is successful.

[0345] Optionally, if verification of the first identity information fails, the second node may disconnect the communication connection with the first node, or the second node may send update failure indication information to the first node, or the second node may discard the first key update request.

[0346] Optionally, in a specific implementation process, the second node may first perform the operation of S704, and then perform the operation of S703.

[0347] Step S705: If the verification on the first identity authentication information is successful, the second node generates the first target key based on the second target key and the new parameters.

[0348] Optionally, if verification of the first identity information fails, the second node may disconnect the communication connection with the first node, or the second node may send update failure indication information to the first node, or the second node may discard the first key update request.

[0349] Specifically, the second node may generate the first target key based on the second target key and the new parameter. For example, the second node may determine that the first target key K1 is K1=KDF(K2,fresh) based on the second target key K2 and the new parameter fresh.

[0350] Step S706: The second node sends a first response message to the first node.

[0351] In this embodiment of the present application, encryption and / or integrity protection may be performed on the first key update request by using an encryption key determined based on a second target key and / or by using an integrity key determined based on a second target key, the second target key being a shared key between the second node and the first node.

[0352] The first response message includes second identity authentication information, which is used to verify the identity of the second node and may be generated by using a first shared key between the first node and the second node. Optionally, the first response message may further include a random value NONCEs.

[0353] In this embodiment of the present application, the algorithm for generating the second identity authentication information may be a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC, the generated second identity authentication information AUTHs may be expressed as AUTHs=HMAC(PSK, NONCEs), and the sequence of parameters may be different. Of course, when the first response message includes parameters such as a random value NONCEs, the second node may not use these parameters to generate the second identity authentication information AUTHs.

[0354] Optionally, in a specific implementation process, the second node may first perform the operation of S706, and then perform the operation of S705.

[0355] Step S707: The first node decrypts the first response message.

[0356] Specifically, the first node may decrypt the first response message by using an encryption key determined based on the second target key.

[0357] Step S708: The first node performs verification on the message integrity of the first response message.

[0358] Optionally, if the verification for message integrity fails, the first node may disconnect the connection to the second node, or may send an update failure indication information to the second node, or may discard the first response message.

[0359] Optionally, in the embodiment shown in Figures 7A and 7B, the first node may not perform step S708. In this case, after performing step S707, the first node may subsequently perform step S709 and steps subsequent to step S709.

[0360] Step S709: The first node performs verification on the second identity authentication information.

[0361] Specifically, the second identity information is generated by the second node based on the first shared key between the first node and the second node. Therefore, the first node can verify whether the second identity authentication information is accurate based on the first shared key.

[0362] In an optional solution, the protocol specifies that the second node generates the second identity credential using specific parameters, and therefore the first node must also generate the identity credential used for verification using the same parameters. If the identity credential used for verification is identical to the second identity credential, the verification is considered successful.

[0363] For example, the second identity authentication information may be generated by using HMAC. Thus, the first node may generate an identity authentication information used for verification, also referred to as a check value check2, by using HMAC, and then verify whether the second identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0364] For example, if the second identity authentication information AUTHs is HMAC(PSK), the first node obtains a check value check2=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the first node and the second node. If the check value check2 is the same as AUTHs, the verification is successful.

[0365] As another example, if the first identity authentication information AUTHs is HMAC(PSK, NONCEs), the first node obtains a check value check2=HMAC(PSK, NONCEs) by using HMAC based on the pre-shared key PSK between the first node and the second node and the random value NONCEs in the first response message. If the check value check2 is identical to AUTHs, the verification is successful.

[0366] Optionally, if the verification for the second identity authentication information fails, the first node may disconnect the communication connection to the second node, or may send an update failure indication information to the second node, or may discard the first response message.

[0367] Optionally, in a specific implementation process, the first node may first perform the operation of S709, and then perform the operation of S708.

[0368] Step S710: If the verification on the second identity authentication information is successful, the first node generates a first target key based on the second target key and the new parameters.

[0369] Specifically, the first node may generate the first target key by using a key derivation function based on the second target key and the new parameter. For example, the second node may determine that the first target key K1 is K1=KDF(K2,fresh) based on the second target key K2 and the new parameter fresh.

[0370] Optionally, the first target key may apply to a shared key between the first node and the second node, including a master key, a session key, etc.

[0371] In the method described in Figure 7A and Figure 7B, in the key update process, the first node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the second target key and new parameters to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0372] 8A and 8B show yet another key updating method according to an embodiment of the present application, which includes but is not limited to the following steps:

[0373] Step S801: The first node sends a first key update request to the second node.

[0374] In this embodiment of the present application, encryption and / or integrity protection may be performed on the first key update request by using an encryption key determined based on a second target key and / or by using an integrity key determined based on a second target key, the second target key being a shared key between the second node and the first node.

[0375] In this embodiment of the present application, the first key update request includes a first key negotiation parameter, a new parameter fresh, and a first identity authentication information. The first key negotiation parameter may be the new parameter fresh. Optionally, the first key request may further include at least one of a random value NONCEm, information timer indicating a first update time point, and information expiration indicating a validity period of the first target key.

[0376] In this embodiment of the present application, the first identity authentication information in the first key update request may be generated by using a first shared key between the first node and the second node, and the first shared key may include a master key, a pre-shared key PSK, etc.

[0377] Optionally, the algorithm for generating the first identity authentication information may be a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC, the generated first identity authentication information AUTHm may be expressed as AUTHm=HMAC(PSK, fresh, NONCEm, expiration, timer), and the sequence of parameters may be different. Of course, when the first key update request includes information such as a new parameter fresh, a random value NONCEm, information expiration indicating the validity period of the first target key, or information timer indicating the first update time, the first node may not use part or all of the parameters to generate the first identity authentication information AUTHm.

[0378] Optionally, the first node may send a first key update request to the second node by using a first communication frame, where the second frame number of the first communication frame is smaller than the third frame number carried in the key update request used during the previous key update, and the third frame number is used to indicate the start time of the previous updated key. The first frame number carried in the first key update request is larger than the second frame number and smaller than the third frame number. For example, if the third frame number is 2365, it indicates that the previous updated key will be applied after the communication frame whose frame number starts from 2365, and the first node needs to determine the first target key again before the frame number reaches 2365. Therefore, the first node may send a first key update request in a first communication frame whose frame number is 2345, and the first frame number 2355 is used to indicate the start time of the first target key in the first key update request. When security protection is performed on communication frames in a communication process, the encryption method used can be to perform encryption based on a frame number and a previously updated key. Thus, before the frame number repeats to the frame number of the previously updated key, a first target key is determined, and then the data frame is encrypted by using the first target key. In this way, a data frame with the same frame number can be encrypted twice by using different keys, thereby improving data security.

[0379] Optionally, if no information indicating a key starting time is kept in a previous key update process or the first node has not performed a key update before, the first node may pre-configure a target frame number, and if the first node detects that the difference between the current communication frame number and the target frame number is less than or equal to a first threshold, the first node sends a first key update request.

[0380] Step S802: The second node decrypts the first key update request.

[0381] Specifically, the second node may decrypt the first key update request by using an encryption key determined based on the second target key.

[0382] Step S803: The second node performs verification on the message integrity of the first key update request.

[0383] Optionally, if the verification for message integrity fails, the second node may disconnect the communication connection to the first node, or the second node may send an update failure indication information to the first node, or the second node may discard the first key update request and not respond.

[0384] Optionally, in the embodiment shown in Figures 8A and 8B, the second node may not perform step S803. In this case, after performing step S802, the second node may subsequently perform step S804 and steps subsequent to step S804.

[0385] Step S804: The second node performs verification on the first identity authentication information.

[0386] Optionally, if verification of the first identity information fails, the second node may disconnect the communication connection with the first node, or the second node may send update failure indication information to the first node, or the second node may discard the first key update request.

[0387] Optionally, in a specific implementation process, the second node may first perform the operation of S804, and then perform the operation of S803.

[0388] Step S805: If the verification on the first identity authentication information is successful, the second node generates the first target key based on the second target key, the new parameters and the algorithm identifier.

[0389] Specifically, the algorithm identifier may be used to indicate an algorithm for generating a key. The algorithm identifier may be used to indicate an identifier of an algorithm for generating a key, such as a master key, an encryption key, or an integrity protection key. For example, the string "encryption" is used to indicate generating an encryption key. In another example, the string "integrity" is used to indicate generating an integrity protection key. The algorithm identifier may alternatively be used to indicate an identifier of a hash algorithm used, or the like. For example, the string "SHA256" is used to indicate that the algorithm used to determine the first target key is the SHA256 algorithm. The algorithm identifier may be pre-configured between the first node and the second node, or may be determined by the first node and then transmitted to the second node.

[0390] The second node may determine the first target key K1 based on the second target key K2, the freshness parameter fresh, and the algorithm identifier tag.

[0391] For example, the second node determines that the first target key K1 is K1=KDF(K2, fresh, tag) by using the key derivation function KDF based on the second target key K2, the fresh parameter fresh, and the algorithm identifier tag.

[0392] Optionally, the second node may further determine that the first target key K1 is K1=KDF(K2, fresh, tag, type) by using a key derivation function KDF based on the second target key K2, the freshness parameter fresh, the algorithm identifier tag, and the key type type, where type represents the key type. For example, the string "encryption" is used to indicate generating an encryption key. As another example, the string "integrity" is used to indicate generating an integrity protection key.

[0393] Optionally, the second node may first determine an intermediate key based on the first target key K2 and the new parameter fresh, and then determine the first target key K1 by using at least one of the algorithm identifier tag and the key type type based on the intermediate key. For example, the second node obtains an intermediate key Kmid: Kmid=KDF1(K2,fresh) by using a key derivation function KDF1, and then determines the first target key K1=KDF2(Kmid,tag,type) by using a key derivation function KDF2 based on the intermediate key Kmid. In order to explain this solution more clearly in this specification, it should be noted that how to obtain the first target key is described by using two steps. In the actual processing, the first target key can alternatively be obtained by using one step. The intermediate key Kmid is just an intermediate result. In other words, the scheme of determining the first target satisfies K1=KDF2(KDF1(K2,fresh),tag,type).

[0394] Step S806: The second node sends a first response message to the first node.

[0395] In this embodiment of the present application, encryption and / or integrity protection may be performed on the first response message by using an encryption key determined based on a second target key and / or by using an integrity key determined based on a second target key, the second target key being a shared key between the second node and the first node.

[0396] The first response message includes second identity authentication information, where the second identity authentication information is used to authenticate the identity of the second node. Optionally, the second identity authentication information may be generated by using a first shared key between the first node and the second node. Optionally, the first response message further includes a random value NONCEs.

[0397] In this embodiment of the present application, the algorithm for generating the second identity authentication information may be a cryptographic algorithm. In an example where the cryptographic algorithm is HMAC, the generated second identity authentication information AUTHs may be expressed as AUTHs=HMAC(PSK, NONCEs), and the sequence of parameters may be different. Of course, when the first response message includes parameters such as a random value NONCEs, the second node may not use these parameters to generate the second identity authentication information AUTHs.

[0398] Optionally, in a specific implementation process, the second node may first perform the operation of S806, and then perform the operation of S805.

[0399] Step S807: The first node decrypts the first response message.

[0400] Specifically, the first node may decrypt the first response message by using an encryption key determined based on the second target key.

[0401] Step S808: The first node performs verification on the message integrity of the first response message.

[0402] Specifically, the first identity authentication information is generated by the first node based on a first shared key between the first node and the second node, and the second node can therefore verify whether the first identity authentication information is accurate based on the first shared key.

[0403] Optionally, in the embodiment shown in Figures 8A and 8B, the first node may not perform step S808. In this case, after performing step S807, the first node may subsequently perform step S809 and steps subsequent to step S809.

[0404] Step S809: The first node performs verification on the second identity authentication information.

[0405] Specifically, the second identity information is generated by the second node based on the first shared key between the first node and the second node. Therefore, the first node can verify whether the second identity authentication information is accurate based on the first shared key.

[0406] In an optional solution, the protocol specifies that the first node uses a specific parameter to generate the first identity authentication information, and therefore the second node must also use the same parameter to generate the identity authentication information used for verification. If the identity authentication information used for verification is identical to the first identity authentication information, the verification is deemed successful. For example, the first identity authentication information is generated by using HMAC. Thus, the second node may generate the identity authentication information used for verification, also referred to as check value check1, by using HMAC, and then verify whether the first identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0407] For example, if the first identity authentication information AUTHm is HMAC(PSK), the second node obtains a check value check1=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the second node and the first node. If the check value check1 is identical to AUTHm, the verification is successful.

[0408] As another example, if the first key negotiation parameters include a new parameter fresh and the first identity authentication information AUTHm is HMAC(PSK, fresh), the second node obtains a check value check1=HMAC(PSK, fresh) by using HMAC based on the pre-shared key PSK between the second node and the first node and the new parameter fresh. If the check value check1 is the same as AUTHm, the verification is successful.

[0409] Optionally, if the verification on the message integrity fails, indicating that the identity of the second node is not trusted, the first node may therefore either disconnect the connection to the second node, or send an update failure indication information to the second node, or discard the first response message.

[0410] Step S809: The first node performs verification on the second identity authentication information by using the first shared key.

[0411] Specifically, the second identity information is generated by the second node based on the first shared key between the first node and the second node. Therefore, the first node can verify whether the second identity authentication information is accurate based on the first shared key.

[0412] In an optional solution, the protocol specifies that the second node generates the second identity credential using specific parameters, and therefore the first node must also generate the identity credential used for verification using the same parameters. If the identity credential used for verification is identical to the second identity credential, the verification is considered successful.

[0413] For example, the second identity authentication information may be generated by using HMAC. Thus, the first node may generate an identity authentication information used for verification, also referred to as a check value check2, by using HMAC, and then verify whether the second identity authentication information is accurate by using the identity authentication information used for verification. An example is used below for illustration.

[0414] For example, if the second identity authentication information AUTHs is HMAC(PSK), the first node obtains a check value check2=HMAC(PSK) by using HMAC based on the pre-shared key PSK between the first node and the second node. If the check value check2 is the same as AUTHs, the verification is successful.

[0415] As another example, if the first identity authentication information AUTHs is HMAC(PSK, NONCEs), the first node obtains a check value check2=HMAC(PSK, NONCEs) by using HMAC based on the pre-shared key PSK between the first node and the second node and the random value NONCEs in the first response message. If the check value check2 is identical to AUTHs, the verification is successful.

[0416] Optionally, if the verification for the second identity authentication information fails, the first node may disconnect the connection to the second node, or may send an update failure indication information to the second node, or may discard the first response message.

[0417] Optionally, in a specific implementation process, the first node may first perform the operation of S809, and then perform the operation of S808.

[0418] Step S810: If the verification of the second identity authentication information is successful, the first node generates a first target key based on the second target key and the new parameters.

[0419] Specifically, the algorithm identifier may be used to indicate an algorithm for generating a key. The algorithm identifier may be used to indicate an identifier of an algorithm for generating a key, such as a master key, an encryption key, or an integrity protection key. For example, the string "encryption" is used to indicate generating an encryption key. In another example, the string "integrity" is used to indicate generating an integrity protection key. The algorithm identifier may alternatively be used to indicate an identifier of a hash algorithm used, or the like. For example, the string "SHA256" is used to indicate that the algorithm used to determine the first target key is the SHA256 algorithm. The algorithm identifier may be pre-configured between the first node and the second node, or may be determined by the first node.

[0420] The first node may determine that the first target key K1 is K1=KDF(K2, fresh, tag) by using the KDF algorithm based on the second target key K2, the fresh parameter fresh, and the algorithm identifier tag.

[0421] Optionally, the first node may first determine an intermediate key based on the first target key K2 and the new parameter fresh, and then determine the first target key K1 by using at least one of the algorithm identifier tag and the key type type based on the intermediate key. For example, the first node obtains an intermediate key Kmid: Kmid=KDF1(K2,fresh) by using a key derivation function KDF1, and then determines the first target key K1=KDF2(Kmid,tag,type) by using a key derivation function KDF2 based on the intermediate key Kmid. KDF1 and KDF2 may be the same key derivation function, or may be different key derivation functions. It should be noted that in this specification, in order to more clearly describe the solution, how to obtain the first target key is described by using two steps. In actual processing, the first target key may alternatively be obtained by using one step. The intermediate key Kmid is just an intermediate result. In other words, the method for determining the first target satisfies K1=KDF2(KDF1(K2, fresh), tag, type).

[0422] Optionally, the first target key can be applied to the shared key between the first node and the second node, including a master key, a session key, etc. In the method described in Figure 8A and Figure 8B, in the key update process, the first node and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the second target key, new parameters, and an algorithm identifier, and obtains the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0423] Optionally, in the embodiment shown in Figures 6A and 6B, 7A and 7B, or 8A and 8B, the first key update request sent by the first node may not carry the first identity authentication information. Correspondingly, the second node may not perform a process to perform verification on the first identity information. Similarly, the first response message may not carry the second identity authentication information. Correspondingly, the second node may not perform a process to perform verification on the second identity authentication information. In this case, the first key update request is encrypted by using the second target key (or a session key derived from the second target key) to authenticate both identities.

[0424] In a possible solution, the first node and the second node include a master key and a session key. If the session key is a key determined based on the master key, when the master key expires, the master key can be updated by using the key update method shown in Figures 6A and 6B or 7A and 7B. Since the master key is updated, the session key determined based on the master key also needs to be updated. Therefore, the first node and the second node can update the session key by using the key update method shown in Figures 8A and 8B.

[0425] The method in the embodiment of the present application is described in detail above. The apparatus in the embodiment of the present application is provided below.

[0426] 9 is a schematic structural diagram of an apparatus 90 according to an embodiment of the present application. The apparatus 90 may be an electronic device having data receiving / transmitting capability, or may be a component, such as a chip or an integrated circuit, in an electronic device having data receiving / transmitting capability. The apparatus 90 may include a sending unit 901, a receiving unit 902, a verifying unit 903, and a determining unit 904. The units are described as follows:

[0427] The sending unit 901 is configured to send a first key update request to the second node, where the first key update request includes first key negotiation parameters and first identity authentication information, and the first identity authentication information is generated by using a first shared key.

[0428] The receiving unit 902 is configured to receive a first response message from the second node, where the first response message includes second identity authentication information.

[0429] The verification unit 903 is configured to perform verification on the second identity credential by using the first shared key.

[0430] The determining unit 904 is configured to determine a first target key based on the first key negotiation parameters if the verification against the second identity credential is successful.

[0431] In the key update process, the above-mentioned device 90 and the second node generate identity authentication information according to the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key according to the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0432] It should be noted that in this specification, the division of the above-mentioned multiple units is merely a logical division based on functions, and is not intended to limit the specific structure of the device 90. In a specific implementation, some functional modules may be subdivided into finer functional modules, and some functional modules may be combined into one functional module. However, regardless of whether the functional modules are subdivided or combined, the general procedure performed by the device 90 in the key update process is the same. For example, the above-mentioned multiple units may be simplified as a communication unit and a processing unit. The communication unit is configured to implement one or more functions of the sending unit 901 and the receiving unit 902, and the processing unit is configured to implement one or more functions of the verifying unit 903 and the determining unit 904. Typically, each unit corresponds to a respective program code (or program instruction). When the program code corresponding to the unit is executed on the processor, the unit executes the corresponding procedure to implement the corresponding function.

[0433] In a possible implementation, the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key.

[0434] In the conventional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, the device 90 provided in the present application can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the second node, so that the first target key can be activated accordingly.

[0435] In yet another possible implementation, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0436] For example, the first frame number held in the first key update request may be 2345, indicating that the first target key is to be applied after the communication frame starting at frame number 2345.

[0437] In yet another possible implementation, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0438] In the conventional key updating process, a key updating time is configured. Thus, a new key is updated when the old key expires. Since the old key has expired, the encryption process needs to be suspended during the key updating, and the encryption process is resumed after the key updating is completed. However, the suspension of the encryption process and the resumption of the encryption process affect the key updating efficiency, and the suspension of the encryption process affects the security. However, in the device 90 of the present application, since the old key has not expired, the encryption process does not need to be suspended during the key updating, thereby improving the key updating efficiency and improving the data security.

[0439] In yet another possible implementation, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and the determination unit 904 is configured to generate a first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0440] In yet another possible implementation, the first key negotiation parameters include a new parameter, and the determining unit 904 is configured to generate the first target key based on the second target key and the new parameter.

[0441] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0442] In yet another possible implementation, the first target key is the master key of device 90 .

[0443] In yet another possible implementation, the first key negotiation parameters include new parameters, and the determination unit 904 is configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark the algorithm used to determine the encryption key or the integrity protection key.

[0444] In yet another possible implementation, the first target key is an integrity protection key or an encryption key of device 90 .

[0445] In yet another possible implementation, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0446] It can be understood that the conventional key update method is to update the key when the old key expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining the new key. However, the device 90 provided in this embodiment of the present application can determine the first target key before the key expires. Therefore, the first key update request and the first response message can be encrypted by using the key determined based on the second target key, thereby improving data security.

[0447] In yet another possible implementation, the sending unit 901 is configured to send a first key update request to the second node by using a first communication frame, where a second frame number of the first communication frame is smaller than a third frame number held in the key update request used during the previous key update, the third frame number is used to indicate the start time of the previously updated key, and the first frame number is larger than the second frame number and smaller than the third frame number.

[0448] When security protection is performed on the communication frame in the communication process, the encryption method used may be to perform encryption based on the frame number and the previously updated key. Thus, the first target key is determined before the frame number repeats to the frame number of the previously updated key, so that the data frame is encrypted by using the first target key. In this way, the data frame with the same frame number may be encrypted twice by using different keys, thereby improving data security. In an alternative solution, the first key update request includes a MAC serial number (MAC SN) instead of the first frame number, and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Alternatively, the third frame number held in the key update request used during the previous key update may also be replaced with the MAC SN, i.e., the MAC SN indicated by a part of the bits used to indicate the third frame number. In this alternative solution, the value relationship between the first frame number, the second frame number, and the third frame number remains unchanged. Specifically, the bits used to indicate the first frame number include two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are bits used to indicate the hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0449] In yet another possible implementation, the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame.

[0450] In yet another possible implementation, if verification of the second identity information fails, the transmitting unit 901 and the receiving unit 902 disconnect the communication connection to the second node or send update failure information to the second node by using the transmitting unit 901.

[0451] If the verification of the second identity authentication information fails, it may be found to indicate that the identity of the second node is not trustworthy. Therefore, the above-mentioned device 90 may disconnect the communication connection to the second node or send update failure information to the second node, so that the access request to the node that needs to perform the key update is reinitialized, thereby ensuring data security in the key update process.

[0452] In yet another possible implementation, the verification unit 903 is further configured to perform integrity verification on the first response message, and if the integrity verification is successful, then perform a step of performing verification on the second identity authentication information by using the first shared key, and if the integrity verification fails, the transmitting unit 901 and the receiving unit 902 may disconnect the communication connection to the second node, or send update failure information to the second node by using the transmitting unit 901, or send the update failure information to the second node.

[0453] Before performing verification on the identity information, the device 90 may first perform an integrity verification on the first response message, and determine that the information in the first response message has not been tampered with. If the integrity verification fails, it indicates that the data in the first response information has been tampered with and the key cannot be updated. Therefore, the device 90 cuts off the communication connection to the second node or sends update failure information to the second node, so that the device 90 re-accesses the node that needs to perform the key update, thereby ensuring data security in the key update process.

[0454] Please note that for the implementation of each unit, please refer to the corresponding description in any embodiment shown in Figures 5, 6A and 6B, 7A and 7B, or 8A and 8B. The device 90 is the first node in any embodiment shown in Figures 5, 6A and 6B, 7A and 7B, or 8A and 8B.

[0455] 10 is a schematic structural diagram of an apparatus 100 according to an embodiment of the present application. The apparatus 100 may be an electronic device having data receiving / transmitting capability, or may be a component such as a chip or integrated circuit in an electronic device having data receiving / transmitting capability. The apparatus 100 may include a receiving unit 1001, a verifying unit 1002, a determining unit 1003, and a sending unit 1004. The units are described as follows:

[0456] The receiving unit 1001 is configured to receive a first key update request from a first node, where the first key update request includes a first key negotiation parameter and a first identity authentication information.

[0457] The verification unit 1002 is configured to perform verification on the first identity credential by using the first shared key.

[0458] The determining unit 1003 is configured to determine a first target key based on the first key negotiation parameters if the verification to the first identity credential is successful.

[0459] The sending unit 1004 is configured to send a first response message to the first node, where the first response message includes second identity authentication information, and the second identity authentication information is generated by using the first shared key.

[0460] Before the original session key expires, the above-mentioned device 100 and the first node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0461] It should be noted that in this specification, the division of the above-mentioned multiple units is merely a logical division based on functions, and is not intended to be limited to a specific structure of the device 100. In a specific implementation, some functional modules may be subdivided into finer functional modules, and some functional modules may be combined into one functional module. However, regardless of whether the functional modules are subdivided or combined, the general procedures performed by the device 100 in the key update process are the same. For example, the above-mentioned multiple units may be simplified as a communication unit and a processing unit. The communication unit is configured to implement the functions of the receiving unit 1001 and the sending unit 1004, and the processing unit is configured to implement one or more functions of the verifying unit 1002 and the determining unit 1003. Typically, each unit corresponds to a respective program code (or program instruction). When the program code corresponding to the unit is executed on a processor, the unit executes the corresponding procedure to implement the corresponding function.

[0462] In a possible implementation, the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key.

[0463] In the conventional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, in the key updating method in the present application, the first node can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the device 100, so that the first target key can be activated accordingly.

[0464] In yet another possible implementation, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0465] For example, the first frame number held in the first key update request may be 2345, indicating that the first target key is to be applied after the communication frame starting at frame number 2345.

[0466] In yet another possible implementation, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0467] In yet another possible implementation, the first key negotiation parameters include first key negotiation algorithm parameters, the first response message includes second key negotiation algorithm parameters, and the determination unit 1003 is configured to generate a first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0468] In yet another possible implementation, the first key negotiation parameters include a new parameter, and the determining unit 1003 is configured to generate the first target key based on the second target key and the new parameter.

[0469] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0470] In yet another possible implementation, the first target key is the master key of the device 100 .

[0471] In yet another possible implementation, the first key negotiation parameters include new parameters, and the determination unit 1003 is configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to identify an algorithm used to determine the encryption key or the integrity protection key.

[0472] In yet another possible implementation, the first target key is an integrity protection key or an encryption key of the device 100 .

[0473] In yet another possible implementation, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0474] A conventional key update method can be understood to be updating a key when an old key is expired. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, in this embodiment of the present application, the device 100 can determine a first target key before the key is expired. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0475] In yet another possible implementation, the sending unit 1004 is further configured to cause the apparatus 100 to disconnect the communication connection to the first node or send update failure indication information to the first node if the verification on the first identity information fails.

[0476] If the verification for the first identity authentication information fails, it may be found to indicate that the identity of the second node is not trusted. Therefore, the device 100 may disconnect the connection to the first node or send an update failure indication information to the first node, and stop the current key process, thereby ensuring the data security of the device 100 in the key update process.

[0477] In yet another possible implementation, the verification unit 1002 is further configured to perform an integrity verification on the first response message, and if the integrity verification is successful, then perform a step of performing verification on the second identity authentication information by using the first shared key, and the sending unit 1004 is further configured to cause the device 100 to disconnect the communication connection to the first node or send update failure indication information to the first node if the integrity verification fails.

[0478] Before performing verification on the identity information, the above-mentioned apparatus 100 first performs an integrity verification on the first key update request to determine whether the information in the first key update request has been tampered with. If the integrity verification fails, it indicates that the data in the first key update request has been tampered with and the key cannot be updated. Therefore, the above-mentioned apparatus 100 may disconnect the connection to the first node or send an update failure indication information to the first node, thereby ensuring data security in the key update process.

[0479] Please note that for the implementation of each unit, please refer to the corresponding description in any embodiment shown in Figures 5, 6A and 6B, 7A and 7B, or 8A and 8B. The device 100 is a second node in any embodiment shown in Figures 5, 6A and 6B, 7A and 7B, or 8A and 8B.

[0480] 11 is a schematic structural diagram of an apparatus 110 according to an embodiment of the present application. The apparatus 110 may be an electronic device having a data receiving / transmitting capability, or may be a component such as a chip or an integrated circuit in an electronic device having a data receiving / transmitting capability. The apparatus 110 may include a memory 1101, a processor 1102, and a communication interface 1103. Optionally, a bus 1104 may be further included. The memory 1101, the processor 1102, and the communication interface 1103 are connected through the bus 1104.

[0481] The memory 1101 is configured to provide a storage space that may store data such as an operating system and computer programs, including, but not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or compact disc read-only memory (CD-ROM).

[0482] The processor 1102 is a module that performs arithmetic and logical operations, and may be one or a combination of processing modules, such as a central processing unit (CPU), a graphics processing unit (GPU), or a microprocessor unit (MPU).

[0483] The communication interface 1103 is configured to receive data transmitted by an external device and / or transmit data to an external device, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link interface (Wi-Fi, Bluetooth, or the like). Optionally, the communication interface may further include a transmitter (e.g., a radio frequency transmitter), a receiver, or the like coupled to the interface.

[0484] The processor 1102 in the device 110 is configured to read computer program code stored in the memory 1101 and perform the following operations: sending a first key update request to the second node through the communication interface 1103, the first key update request including first key negotiation parameters and first identity authentication information, the first identity authentication information being generated by using a first shared key; receiving a first response message from the second node through the communication interface 1104, the first response message including the second identity authentication information; performing verification on the second identity authentication information by using the first shared key; and determining a first target key based on the first key negotiation parameters if the verification on the second identity authentication information is successful.

[0485] In the key update process, the above-mentioned device 110 and the second node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0486] In a possible implementation, the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key.

[0487] In the conventional key update process, the key update time is predefined in the protocol and cannot be flexibly selected. However, the device 110 provided in the present application can customize the update time of the first target key and / or the validity period of the first target key, and indicate the update time and / or the validity period to the second node, so that the first target key can be activated accordingly.

[0488] In yet another possible implementation, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0489] For example, the first frame number held in the first key update request may be 2345, indicating that the first target key is to be applied after the communication frame starting at frame number 2345.

[0490] In yet another possible implementation, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0491] In the conventional key update process, a key update time is configured. Thus, a new key is updated when the old key expires. Since the old key has expired, the encryption process needs to be suspended during the key update, and the encryption process is resumed after the key update is completed. However, the suspension of the encryption process and the resumption of the encryption process affect the key update efficiency, and the suspension of the encryption process affects the security. However, in the device 110 provided in this application, since the old key has not expired, the encryption process does not need to be suspended during the key update, thereby improving the key update efficiency and improving the data security.

[0492] In yet another possible implementation, the first key negotiation parameters include first key negotiation algorithm parameters, and the first response message further includes second key negotiation algorithm parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor 1102 is specifically configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0493] In yet another possible implementation, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor 1102 is specifically configured to generate the first target key based on the second target key and the new parameters.

[0494] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter and is a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0495] In yet another possible implementation, the first target key is the master key of the device 110 .

[0496] In yet another possible implementation, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor 1102 is specifically configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark the algorithm used to determine the encryption key or the integrity protection key.

[0497] In yet another possible implementation, the first target key is an integrity protection key or an encryption key of the device 110 .

[0498] In yet another possible implementation, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0499] A conventional key update method can be understood to be updating a key when an old key is expired. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, in this embodiment of the present application, the device 110 can determine the first target key before the key is expired. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0500] In yet another possible implementation, the communication interface 1103 sends a first key update request to the second node by using a first communication frame, where a second frame number of the first communication frame is smaller than a third frame number held in the key update request used during a previous key update, the third frame number is used to indicate the start time of the previously updated key, and the first frame number is greater than the second frame number and smaller than the third frame number.

[0501] When security protection is performed on communication frames in a communication process, the encryption method used can be to perform encryption based on the frame number and the previously updated key. Thus, a first target key is determined before the frame number repeats to the frame number of the previously updated key, so that the data frame is encrypted by using the first target key. In this way, a data frame with the same frame number can be encrypted twice by using different keys, thereby improving data security.

[0502] In an alternative solution, the first key update request includes a MAC serial number (MAC SN) instead of the first frame number, and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is smaller than F. Alternatively, the third frame number held in the key update request used during the previous key update can also be replaced with the MAC SN indicated by the MAC SN, i.e., a part of the bits used to indicate the third frame number. In this alternative solution, the value relationship between the first frame number, the second frame number, and the third frame number remains unchanged. Specifically, the bits used to indicate the first frame number include two parts, i.e., an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, the N bits are bits used to indicate the hyperframe number. In this alternative scheme, as little information as possible can be held in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0503] In yet another possible implementation, the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame.

[0504] In yet another possible implementation, the processor 1102 is further configured to indicate to the communication interface 1103 to disconnect the communication connection to the second node or to send update failure information to the second node via the communication interface 1103 if verification of the second identity information fails.

[0505] If the verification of the second identity authentication information fails, it may be found to indicate that the identity of the second node is not trustworthy. Thus, the above-mentioned device 110 may disconnect the communication connection to the second node or send update failure information to the second node, so that the access request to the node that needs to perform the key update is reinitialized, thereby ensuring data security in the key update process.

[0506] In yet another possible implementation, the processor 1102 is further configured to perform a step of performing integrity verification on the first response message after receiving the first response message from the second node, and if the integrity verification is successful, then performing verification on the second identity authentication information by using the first shared key, and the processor 1102 is further configured to indicate to the communication interface 1103 to disconnect the communication connection to the second node or to send update failure information to the second node through the communication interface 1103 if the integrity verification fails.

[0507] It can be seen that integrity verification can be performed to determine whether information has been tampered with. Thus, before performing verification on identity information, the above-mentioned device 110 first performs integrity verification on the first response message to determine whether information in the first response message has not been tampered with. If the integrity verification fails, it indicates that data in the first response information has been tampered with and the key cannot be updated. Thus, the device 110 cuts off the communication connection to the second node or sends update failure information to the second node, so that the device 110 re-accesses the node that needs to perform key update, thereby ensuring data security in the key update process.

[0508] Please note that for the implementation of each unit, please refer to the corresponding description in any embodiment shown in Figure 5, Figure 6A and Figure 6B, Figure 7A and Figure 7B, or Figure 8A and Figure 8B. Node 10 is the first node in any embodiment shown in Figure 5, Figure 6A and Figure 6B, Figure 7A and Figure 7B, or Figure 8A and Figure 8B.

[0509] 12 is a schematic structural diagram of an apparatus 120 according to an embodiment of the present application. The apparatus 120 may be an electronic device having a data receiving / transmitting capability, or may be a component such as a chip or an integrated circuit in an electronic device having a data receiving / transmitting capability. The apparatus 120 may include a memory 1201, a processor 1202, and a communication interface 1203. Optionally, a bus 1204 may further be included. The memory 1201, the processor 1202, and the communication interface 1203 are connected through the bus 1204.

[0510] The memory 1201 is configured to provide a storage space that may store data such as an operating system and computer programs, including, but not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or compact disc read-only memory (CD-ROM).

[0511] The processor 1202 is a module that performs arithmetic and logical operations, and may be one or a combination of processing modules such as a central processing unit (CPU), a graphics processing unit (GPU), or a microprocessor unit (MPU).

[0512] The communication interface 1203 is configured to receive data transmitted by an external device and / or transmit data to an external device, and may be a wired link interface, such as an Ethernet cable, or may be a wireless link interface (Wi-Fi, Bluetooth, or the like). Optionally, the communication interface may further include a transmitter (e.g., a radio frequency transmitter), a receiver, or the like coupled to the interface.

[0513] The processor 1202 in the device 120 is configured to read computer program code stored in the memory 1201 and perform the following operations: sending a first key update request to the second node through the communication interface 1203, where the first key update request includes first key negotiation parameters and first identity authentication information, where the first identity authentication information is generated by using a first shared key; receiving a first response message from the second node through the communication interface 1203, where the first response message includes the second identity authentication information; performing verification on the second identity authentication information by using the first shared key; and determining a first target key based on the first key negotiation parameters if the verification on the second identity authentication information is successful.

[0514] Before the original session key expires, the above-mentioned device 120 and the first node generate identity authentication information based on the first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and only after the identity authentication is successful, updates the key based on the first key negotiation parameter to obtain the first target key. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the key update process.

[0515] In a possible implementation, the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key.

[0516] In the traditional key updating process, the key updating time is predefined in the protocol and cannot be flexibly selected. However, in the present application, the first node can customize the updating time of the first target key and / or the validity period of the first target key, and indicate the updating time and / or the validity period to the device 120, so that the first target key can be activated accordingly.

[0517] In yet another possible implementation, the first key update request includes a first frame number, and the first key update request indicates the first update time by using the first frame number. The first frame number is indicated by using a number of bits, for example, F bits. Alternatively, the first key update request includes a media access control serial number (MAC SN), and the MAC SN is indicated by using M bits, where M bits are a part of F bits, and M is less than F. Specifically, the number of bits used to indicate the first frame number includes two parts, namely, an upper part and a lower part. The lower part is M bits used to indicate the MAC SN. The upper part is indicated by using N bits. Optionally, N bits are a number of bits used to indicate a hyperframe number. In this alternative scheme, as little information as possible can be kept in the key update request, thereby reducing signaling consumption and improving communication efficiency.

[0518] For example, the first frame number held in the first key update request may be 2345, indicating that the first target key is to be applied after the communication frame starting at frame number 2345.

[0519] In yet another possible implementation, the first target key is applied within a validity period of the first target key starting from the first update time point.

[0520] In the conventional key update process, a key update time is configured. Thus, when the old key expires, a new key is updated. Since the old key has expired, the encryption process needs to be suspended during the key update, and the encryption process is resumed after the key update is completed. However, the suspension of the encryption process and the resumption of the encryption process affect the key update efficiency, and the suspension of the encryption process affects the security. However, in the device 120 provided in this application, since the old key has not expired, the encryption process does not need to be suspended during the key update, thereby improving the key update efficiency and improving the data security.

[0521] In yet another possible implementation, the first key negotiation parameters include first key negotiation algorithm parameters, and the first response message further includes second key negotiation algorithm parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor 1202 is specifically configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters.

[0522] In yet another possible implementation, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor 1202 is specifically configured to generate the first target key based on the second target key and the new parameters.

[0523] The second target key may be a shared key between the first node and the second node, including a master key, a session key, a pre-shared key PSK, etc. In addition, the first target key may be generated by using a key derivation algorithm KDF based on the second target key and new parameters. For example, a new key DK derived by using a secret value Key may be expressed as DK=KDF(Key, fresh), where fresh is a new parameter, a parameter used for updating, and may include a counter value, a serial number, a random value, a frame number, etc.

[0524] In yet another possible implementation, the first target key is a master key of the device 120 .

[0525] In yet another possible implementation, the first key negotiation parameters include new parameters, and in the operation of determining the first target key based on the first key negotiation parameters, the processor 1202 is specifically configured to generate the first target key based on the second target key, the new parameters and an algorithm identifier, where the algorithm identifier is used to mark the algorithm used to determine the encryption key or the integrity protection key.

[0526] In yet another possible implementation, the first target key is an integrity protection key or an encryption key of the device 120 .

[0527] In yet another possible implementation, at least one of the first key update request and the first response message is encrypted by using an encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using an integrity protection key determined based on the second target key.

[0528] A conventional key update method can be understood to be updating a key when an old key expires. Since the second target key has expired, encryption and integrity protection are not performed in the process of determining a new key. However, in this embodiment of the present application, the first target key can be determined before the key expires. Therefore, the first key update request and the first response message can be encrypted by using a key determined based on the second target key, thereby improving data security.

[0529] In yet another possible implementation, the processor 1202 is further configured to indicate to the communication interface 1203 to disconnect the communication connection to the first node or to send update failure indication information to the first node via the communication interface 1203 if verification of the first identity information fails.

[0530] If the verification for the first identity authentication information fails, the device 120 may disconnect the connection to the first node or send update failure indication information to the first node and stop the current key process, thereby ensuring the data security of the node in the key update process.

[0531] In yet another possible implementation, the processor 1202 is further configured to perform a step of performing an integrity verification on the first key update request after receiving the first key update request from the first node, and if the integrity verification is successful, then performing a verification on the first identity authentication information by using the first shared key, and the processor 1202 is further configured to indicate to the communication interface 1203 to disconnect the connection to the first node or send update failure indication information to the first node via the communication interface 1203 if the integrity verification fails.

[0532] Before performing verification on the identity information, the above-mentioned device 120 first performs an integrity verification on the first key update request to determine that the information in the first key update request has not been tampered with. If the integrity verification fails, it indicates that the data in the first key update request has been tampered with and the key cannot be updated. Therefore, the above-mentioned device 120 can disconnect the connection to the first node or send an update failure indication information to the first node, thereby ensuring data security in the key update process.

[0533] Please note that for the implementation of each unit, please refer to the corresponding description in any embodiment shown in Figure 5, Figures 6A and 6B, Figures 7A and 7B, or Figures 8A and 8B. The device 120 is the first node in any embodiment shown in Figure 5, Figures 6A and 6B, Figures 7A and 7B, or Figures 8A and 8B.

[0534] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, which, when executed on one or more processors, performs the method in any one of the embodiments shown in Figure 5, Figures 6A and 6B, Figures 7A and 7B, or Figures 8A and 8B.

[0535] The embodiment of the present application further provides a chip system, which includes at least one processor, a memory and an interface circuit, the interface circuit is configured to provide information input / output for the at least one processor, and the at least one memory stores a computer program, and when the computer program is executed on one or more processors, the key update method in any embodiment shown in Figure 5, Figures 6A and 6B, Figures 7A and 7B, or Figures 8A and 8B is executed.

[0536] An embodiment of the present application further provides a smart cab product, the smart cab product includes a first node (e.g., a vehicle cab domain controller CDC), the first node being the first node in any embodiment shown in Figure 5, Figure 6A and Figure 6B, Figure 7A and Figure 7B, or Figure 8A and Figure 8B, and the vehicle further includes a second node (e.g., at least one of a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a keyless entry and start system controller, etc.), the second node being the second node in any embodiment shown in Figure 5, Figure 6A and Figure 6B, Figure 7A and Figure 7B, or Figure 8A and Figure 8B.

[0537] An embodiment of the present application further provides a vehicle. The vehicle includes a first node (e.g., a vehicle driver domain controller CDC). The vehicle further includes a second node (e.g., at least one of a camera, a screen, a microphone, a speaker, a radar, an electronic key, and a module such as a keyless entry or a start system controller). The first node is the first node in any embodiment shown in FIG. 5, FIG. 6A, and FIG. 6B, FIG. 7A and FIG. 7B, or FIG. 8A and FIG. 8B, and the second node is the second node in any embodiment shown in FIG. 5, FIG. 6A, and FIG. 6B, FIG. 7A and FIG. 7B, or FIG. 8A and FIG. 8B. An embodiment of the present application further provides a computer program product. When the computer program product is executed on one or more processors, the key update method in any embodiment shown in FIG. 5, FIG. 6A, and FIG. 6B, FIG. 7A and FIG. 7B, or FIG. 8A and FIG. 8B can be executed.

[0538] In view of the above, according to the key update method provided in the embodiment of the present application, before the key is updated, both nodes in communication need to generate identity authentication information based on a first shared key. After receiving a message from another node, a node first determines the identity of the other node by using the identity authentication information, and determines the first target key based on the key negotiation parameters after the identity authentication is successful. In this case, even if an eavesdropper cracks the original session key, the eavesdropper cannot forge identity information, thereby avoiding man-in-the-middle attacks and improving data security in the data update process.

[0539] It should be noted that for the sake of brevity, the above-mentioned method embodiments are represented as a combination of a series of operations. However, those skilled in the art should understand that the present application is not limited to the order of operations described, since some steps may be performed in a different order or simultaneously according to the present application. Those skilled in the art should further understand that all the embodiments described herein belong to exemplary embodiments, and the associated operations and modules are not necessarily required by the present application.

[0540] The sequence of steps of the methods according to the embodiments of the present application may be adjusted, combined or deleted based on actual requirements.

[0541] The modules in the apparatus according to the embodiments of the present application can be combined, divided or deleted based on actual requirements.

[0542] Those skilled in the art may understand that all or some of the steps of the method according to the embodiments may be implemented by a program that instructs relevant hardware. The program may be stored in a computer-readable storage medium. The storage medium may include a flash memory, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, an optical disk, or the like.

[0543] The above disclosure is merely an exemplary embodiment of the present application. Those skilled in the art can understand that the whole or part of the procedures for implementing the above embodiments and the equivalent modifications made according to the claims of the present application are included in the scope of the present application. [Other possible items] (Item 1) 1. A key update method, comprising: sending a first key update request to a second node, the first key update request including first key negotiation parameters and first identity authentication information, the first identity authentication information being generated by using a first shared key; receiving a first response message from the second node, the first response message including second identity authentication information; performing verification on the second identity credential by using the first shared key; determining a first target key based on the first key negotiation parameters if the verification of the second identity credential is successful; A method for providing the above. (Item 2) 2. The method of claim 1, wherein the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key. (Item 3) 3. The method of claim 2, wherein the first key update request includes a first frame number or a first media access control (MAC) serial number, and the first key update request is used to indicate the first update time by using the first frame number or the first MAC serial number. (Item 4) 3. The method according to claim 2, wherein the first target key is applied within the validity period of the first target key starting from the first update time point. (Item 5) 5. The method according to claim 1, wherein the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and wherein determining a first target key based on the first key negotiation parameters includes generating the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters. (Item 6) 5. The method according to claim 1, wherein the first key negotiation parameters include new parameters, and wherein the step of determining a first target key based on the first key negotiation parameters includes a step of generating the first target key based on a second target key and the new parameters. (Item 7) 5. The method according to any one of claims 1 to 4, wherein the first key negotiation parameters include new parameters, and the step of determining a first target key based on the first key negotiation parameters comprises a step of generating the first target key based on a second target key, the new parameters and an algorithm identifier, the algorithm identifier being used to mark an algorithm used to determine an encryption key or an integrity protection key. (Item 8) 8. The method according to any one of items 1 to 7, wherein at least one of the first key updating request and the first response message is encrypted by using the encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key updating request and the first response message by using the integrity protection key determined based on the second target key. (Item 9) The first key update request includes the first frame number, the first frame number being used to indicate an update time point of the first target key, and the step of sending the first key update request to the second node includes: 9. The method according to any one of claims 1 to 8, comprising a step of transmitting the first key update request to the second node by using a first communication frame, a second frame number of the first communication frame being smaller than a third frame number carried in the key update request used during a previous key update, the third frame number being used to indicate a start time of a previously updated key, the first frame number being larger than the second frame number and smaller than the third frame number. (Item 10) 10. The method of claim 9, wherein the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame. (Item 11) 1. A key update method, comprising: receiving a first key update request from a first node, the first key update request including first key negotiation parameters and first identity authentication information; performing verification on the first identity credential by using a first shared key; if the verification of the first identity credential is successful, determining a first target key based on the first key negotiation parameters; sending a first response message to the first node, the first response message including second identity authentication information, the second identity authentication information being generated by using the first shared key; A method for providing the above. (Item 12) Item 12. The method according to item 11, wherein the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key. (Item 13) Item 13. The method of item 12, wherein the first key update request includes a first frame number or a first media access control (MAC) serial number, and the first key update request is used to indicate the first update time by using the first frame number or the first MAC serial number. (Item 14) Item 13. The method according to item 12, wherein the first target key is applied within the validity period of the first target key starting from the first update time point. (Item 15) 15. The method according to any one of claims 11 to 14, wherein the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and the step of determining a first target key based on the first key negotiation parameters includes a step of generating the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters. (Item 16) 15. The method according to any one of claims 11 to 14, wherein the first key negotiation parameters include new parameters, and wherein the step of determining a first target key based on the first key negotiation parameters includes a step of generating the first target key based on a second target key and the new parameters. (Item 17) 15. The method according to any one of claims 11 to 14, wherein the first key negotiation parameters include new parameters, and wherein the step of determining a first target key based on the first key negotiation parameters comprises a step of generating the first target key based on a second target key, the new parameters and an algorithm identifier, the algorithm identifier being used to identify an algorithm used to determine the encryption key or the integrity protection key. (Item 18) 18. The method according to any one of items 11 to 17, wherein at least one of the first key updating request and the first response message is encrypted by using the encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key updating request and the first response message by using the integrity protection key determined based on the second target key. (Item 19) An apparatus comprising: a sending unit configured to send a first key update request to a second node, the first key update request including first key negotiation parameters and first identity authentication information, the first identity authentication information being generated by using a first shared key; a receiving unit configured to receive a first response message from the second node, the first response message including second identity authentication information; a verification unit configured to perform verification on the second identity credential by using the first shared key; a determining unit configured to determine a first target key based on the first key negotiation parameters if the verification of the second identity credential is successful; An apparatus comprising: (Item 20) 20. The apparatus of claim 19, wherein the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key. (Item 21) 20. The apparatus of claim 19, wherein the first key update request includes a first frame number or a first media access control (MAC) serial number, and the first key update request is used to indicate the first update time by using the first frame number or the first MAC serial number. (Item 22) 21. The apparatus according to claim 20, wherein the first target key is applied within the validity period of the first target key starting from the first update time point. (Item 23) 23. The apparatus according to any one of claims 19 to 22, wherein the first key negotiation parameters include first key negotiation algorithm parameters, the first response message further includes second key negotiation algorithm parameters, and the determination unit is configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters. (Item 24) 23. The apparatus according to any one of claims 19 to 22, wherein the first key negotiation parameters include new parameters, and the determination unit is configured to generate the first target key based on the second target key and the new parameters. (Item 25) 23. The apparatus according to any one of claims 19 to 22, wherein the first key negotiation parameters include new parameters, and the determination unit is configured to generate the first target key based on a second target key, the new parameters and an algorithm identifier, the algorithm identifier being used to mark an algorithm used to determine an encryption key or an integrity protection key. (Item 26) 26. The apparatus according to any one of claims 19 to 25, wherein at least one of the first key update request and the first response message is encrypted by using the encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using the integrity protection key determined based on the second target key. (Item 27) 27. The apparatus of claim 19, wherein the first key update request includes the first frame number, the first frame number being used to indicate an update time of the first target key, the sending unit is configured to send the first key update request to the second node by using a first communication frame, the second frame number of the first communication frame being smaller than a third frame number held in the key update request used during a previous key update, the third frame number being used to indicate a start time of a previously updated key, and the first frame number being larger than the second frame number and smaller than the third frame number. (Item 28) 28. The apparatus of claim 27, wherein the communication frame includes at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame. (Item 29) An apparatus comprising: a receiving unit configured to receive a first key update request from a first node, the first key update request including first key negotiation parameters and first identity authentication information; a verification unit configured to perform verification on the first identity credential by using a first shared key; a determining unit configured to determine a first target key based on the first key negotiation parameters if the verification of the first identity credential is successful; a transmitting unit configured to transmit a first response message to the first node, the first response message including second identity authentication information, the second identity authentication information being generated by using the first shared key; An apparatus comprising: (Item 30) 30. The apparatus of claim 29, wherein the first key update request is used to indicate at least one of a first update time point and a validity period of the first target key. (Item 31) Item 31. The apparatus of item 30, wherein the first key update request includes a first frame number or a first media access control (MAC) serial number, and the first key update request is used to indicate the first update time by using the first frame number or the first MAC serial number. (Item 32) Item 31. The apparatus of item 30, wherein the first target key is applied within the validity period of the first target key starting from the first update time point. (Item 33) 33. The apparatus according to any one of claims 30 to 32, wherein the first key negotiation parameters include first key negotiation algorithm parameters, the first response message includes second key negotiation algorithm parameters, and the determination unit is configured to generate the first target key based on the first key negotiation algorithm parameters and the second key negotiation algorithm parameters. (Item 34) 33. The apparatus according to any one of items 30 to 32, wherein the first key negotiation parameters include new parameters, and the determination unit is configured to generate the first target key based on the second target key and the new parameters. (Item 35) 33. The apparatus of any one of items 30 to 32, wherein the first key negotiation parameters include new parameters, and the determination unit is configured to generate the first target key based on a second target key, the new parameters and an algorithm identifier, the algorithm identifier being used to identify an algorithm used to determine the encryption key or the integrity protection key. (Item 36) 33. The apparatus according to any one of items 30 to 32, wherein at least one of the first key update request and the first response message is encrypted by using the encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using the integrity protection key determined based on the second target key. (Item 37) An apparatus comprising at least one processor and a communication interface, the at least one processor being configured to invoke a computer program stored in at least one memory, enabling the apparatus to implement the method according to any one of claims 1 to 10. (Item 38) 19. An apparatus comprising at least one processor and a communication interface, the at least one processor being configured to invoke a computer program stored in at least one memory, enabling the apparatus to implement the method according to any one of claims 11 to 18. (Item 39) 19. A computer-readable storage medium storing a computer program, the computer program being adapted, when executed on one or more processors, to perform the method according to any one of items 1 to 18.

Claims

1. 1. A key update method, comprising: sending, by a first node, a first key update request to a second node, the first key update request including first key negotiation parameters and first identity authentication information, the first identity authentication information being generated by using a first shared key; receiving, by the first node, a first response message from the second node, the first response message including second identity authentication information; and performing verification by the first node against the second identity credential by using the first shared key; The first key update request indicates at least one of a first update time and a validity period of a first target key. method.

2. 2. The method of claim 1, wherein the first key update request includes a first frame number or a first medium access control (MAC) serial number, the first frame number or the first MAC serial number indicating the first update time point.

3. The method of claim 1 or 2, wherein the first target key is applied within the validity period of the first target key starting from the first update time point.

4. The method of claim 1 , wherein the first shared key is a master key.

5. The method of claim 1 , wherein the first shared key is a session key, the session key being generated by a key derivation algorithm (KDF) according to a master key.

6. The method of claim 5 , wherein the first key negotiation parameter includes a counter value, and the session key is generated according to the master key and the counter value.

7. 7. The method of claim 1, wherein the first key negotiation parameters include new parameters, and wherein determining a first target key based on the first key negotiation parameters includes the first node generating the first target key based on a second target key and the new parameters.

8. 8. The method of claim 1, wherein the first key negotiation parameters include new parameters, and wherein determining a first target key based on the first key negotiation parameters comprises the first node generating the first target key based on a second target key, the new parameters and an algorithm identifier, the algorithm identifier identifying an algorithm used to determine an encryption key or an integrity protection key.

9. 9. The method of claim 8, wherein at least one of the first key update request and the first response message is encrypted by using the encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using the integrity protection key determined based on the second target key.

10. 10. The method of claim 1, wherein the first key update request includes a first frame number, the first frame number indicating an update time of the first target key, and the step of transmitting the first key update request to the second node includes a step of the first node transmitting the first key update request to the second node by using a first communication frame, a second frame number of the first communication frame being smaller than a third frame number carried in a key update request used during a previous key update, the third frame number indicating an update time of the previous updated key, the first frame number being larger than the second frame number and smaller than the third frame number, a larger frame number indicating a later time.

11. 11. The method of claim 10, wherein the first communication frame comprises at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame.

12. An apparatus comprising: a sending unit configured to send a first key update request to a second node, the first key update request including first key negotiation parameters and first identity authentication information, the first identity authentication information being generated by using a first shared key; a receiving unit configured to receive a first response message from the second node, the first response message including second identity authentication information; a verification unit configured to perform verification on the second identity credential by using the first shared key; The first key update request indicates at least one of a first update time and a validity period of a first target key. Device.

13. 13. The apparatus of claim 12, wherein the first key update request includes a first frame number or a first medium access control (MAC) serial number, the first frame number or the first MAC serial number indicating the first update time point.

14. 14. The apparatus of claim 12 or 13, wherein the first target key is applied within the validity period of the first target key starting from the first update time point.

15. 15. The apparatus of claim 12, wherein the first shared key is a master key.

16. 16. The apparatus of claim 12, wherein the first shared key is a session key, the session key being generated by a key derivation algorithm (KDF) according to a master key.

17. 17. The apparatus of claim 16, wherein the first key negotiation parameter includes a counter value, and the session key is generated according to the master key and the counter value.

18. 18. The apparatus according to claim 12, wherein the first key negotiation parameters include new parameters, the apparatus comprising a determination unit configured to generate the first target key based on a second target key and the new parameters.

19. 18. The apparatus of claim 12, wherein the first key negotiation parameters include new parameters, the apparatus comprising a determination unit configured to generate the first target key based on a second target key, the new parameters and an algorithm identifier, the algorithm identifier identifying an algorithm used to determine an encryption key or an integrity protection key.

20. 20. The apparatus of claim 19, wherein at least one of the first key update request and the first response message are encrypted by using the encryption key determined based on the second target key, and / or integrity protection is performed on at least one of the first key update request and the first response message by using the integrity protection key determined based on the second target key.

21. 21. The apparatus of claim 12, wherein the first key update request includes a first frame number, the first frame number indicating an update time of the first target key, the sending unit is configured to send the first key update request to the second node by using a first communication frame, a second frame number of the first communication frame being smaller than a third frame number carried in the key update request used during a previous key update, the third frame number indicating an update time of the previous updated key, the first frame number being larger than the second frame number and smaller than the third frame number, with a larger frame number indicating a later time.

22. 22. The apparatus of claim 21, wherein the first communication frame comprises at least one of a signaling plane uplink frame, a signaling plane downlink frame, a user plane uplink frame, or a user plane downlink frame.

23. An apparatus comprising at least one processor and a communication interface, the at least one processor being configured to invoke a computer program stored in at least one memory, enabling the apparatus to implement the method according to any one of claims 1 to 11.

24. Causing one or more processors to carry out the method of any one of claims 1 to 11 Computer program.

Images