Communication methods and related devices

Abstract

An embodiment of the present application provides a communication method and apparatus applicable to a node supporting short-range communication, such as a Bluetooth node or a node in an in-vehicle short-range communication system. The method includes receiving an association request message from a second node; determining a group key for a first communication group, where the first communication group is a communication group to which the second node belongs; encrypting the group key for the first communication group based on a shared key between the first node and the second node to obtain a first protection key; and transmitting a first association establishment message to the second node, where the first association establishment message includes the first protection key. According to the embodiment of the present application, security of multicast communication can be improved. This solution can be further used to improve the capabilities of autonomous driving or advanced driver assistance systems (ADAS), and can be applied to Internet of Vehicles, such as vehicle-to-everything (V2X), long-term evolution (LTE-V), and vehicle-to-vehicle (V2V).

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and more particularly, to the field of short-distance communication technologies, such as cockpit domain communication, and more particularly, to communication methods and related devices.

Background Art

[0002] With the rapid development of informatization, communication technologies have penetrated into people's lives. In the communication process of nodes, there are three communication modes: unicast, broadcast, and multicast.

[0003] Unicast is a point-to-point communication mode in which the nodes of interest communicate with each other. Broadcast is a point-to-multipoint communication mode in which a node sends a message to all nodes in a subnet. Between these two modes is multicast point-to-multipoint communication, where a node (referred to as the first node for example) sends a message to the nodes in a communication group, and all nodes in the communication group can receive that message. Multicast is one of the important technologies in computer networks and has a wide range of applications in the application layer, network layer, and media access layer, such as media broadcast, multiparty conferences, and array detection.

[0004] In communication processes, security protection must be implemented for messages to prevent data leakage and ensure communication security. Encryption of unicast messages is implemented using unicast keys, where a pair of private temporary keys (PTKs) is established between two nodes, thereby ensuring one-to-one unicast security. Both unicast and multicast messages need to be protected. Only group members within a communication group know the group key used for encryption and decryption. Thus, only group members can interpret encrypted packets, and non-group members cannot obtain the packet contents. This ensures the security of multicast communication.

[0005] The protection of multicast messages relies on group keys. Therefore, protecting group keys is extremely important. In communication systems, the leakage of a group key allows an attacker to listen in on messages within the group by using the group key, resulting in data leakage and threatening user privacy and security. Particularly in in-vehicle communication systems, the leakage of a group key can, in some cases, lead to the leakage of critical vehicle data, and communication between the vehicle and the node that stole the group key can occur, threatening the vehicle's security.

[0006] How to protect the privacy of group keys and improve security in multicast communication processes is a technical problem that has been studied by those skilled in the art. [Overview of the project] [Means for solving the problem]

[0007] Embodiments of this application disclose a communication method and related devices for protecting the privacy of group keys and improving security in multicast communication processes.

[0008] According to a first aspect, one embodiment of the present application discloses a communication method, the method is Receiving an association request message from the second node, The determination of the group key of a first communication group, wherein the first communication group is the communication group to which the second node belongs, and the group key of the first communication group is obtained based on at least one of the first freshness parameter and the identifier ID of the first communication group. Based on the shared key between the first node and the second node, the group key of the first communication group is encrypted to obtain the first protective key, The process includes sending a first association establishment message to a second node, wherein the first association establishment message includes a first protection key.

[0009] In the method described above, after an association request is received from the second node, the group key of the first communication group to which the second node belongs may be determined. Then, the group key is encrypted using a shared key between the first and second nodes to obtain a first protective key, which is carried in an association establishment message, and the association establishment message is sent to the second node. Since the protective key carried in the association establishment message is obtained by encrypting the group key using a shared key, it can be seen that the privacy of the group key can be protected regardless of whether the first association establishment message is encrypted or not. In this way, when performing multicast communication with the first communication group, the first node can encrypt the multicast message using the group key to protect the multicast message, prevent non-group members from obtaining the communication content, and improve the security of multicast communication.

[0010] Furthermore, the first node can send the group key to the second node using a protective key in the association establishment message, integrating the group key distribution procedure into the procedure for establishing the association between the first and second nodes. Therefore, no additional key distribution procedure is required, thereby reducing network resource overhead and improving the efficiency of multicast communication.

[0011] In one possible implementation of the first embodiment, the first node and the second node share a shared key.

[0012] A shared key is a secret shared between a first node and a second node, and it can be understood that a shared key can be generated by the first and second nodes using the same key acquisition method, or it can be predefined or preconfigured on the first and second nodes, or it can be transmitted separately to the first and second nodes by a trusted device. For example, the first and second nodes may generate a key S by exchanging public keys, and the value of key S generated by the first node is the same as the value of key S generated by the second node. Thus, key S can be used as a shared key between the first and second nodes. In addition, another key can be obtained based on the original shared key by using a key derivation function (KDF). Since the first and second nodes can derive keys using the same method, the key derived based on the shared key is also a shared key.

[0013] In another possible implementation of the first embodiment, the group key of the first communication group is encrypted based on a shared key between the first node and the second node in order to obtain the first protective key, This includes encrypting the group key of the first communication group based on the shared key between the first node and the second node and a second freshness parameter, and obtaining the first protective key.

[0014] The explanation above describes the encryption method. Since the freshness parameter values ​​are different, the first protective key obtained by encrypting the group key of the first communication group will also be different each time. This improves the privacy of the group key.

[0015] In yet another possible implementation of the first embodiment, encrypting the group key of the first communication group based on the shared key between the first node and the second node in order to obtain the first protective key is: By using the first key derivation function KDF, a first intermediate key is generated based on the shared key between the first and second nodes and a second freshness parameter, This includes encrypting the group key of the first communication group using the first intermediate key to obtain the first protective key.

[0016] The above explanation describes yet another encryption method. The first node generates a first intermediate key using the shared key and a second freshness parameter, and then encrypts the group key using the first intermediate key.

[0017] In yet another possible implementation of the first embodiment, encrypting the group key of the first communication group based on the shared key between the first node and the second node in order to obtain the first protective key is: The method involves generating a first intermediate key based on a shared key between a first node and a second node and a second freshness parameter, using a first key derivation function (KDF), wherein the first KDF is a KDF supported by the second node. This includes performing an exclusive OR operation between the first intermediate key and the group key of the first communication group to obtain the first protective key.

[0018] The above explanation describes yet another encryption method. The first node generates a first intermediate key using the shared key and a second freshness parameter. Since the original value can be obtained after two exclusive OR operations, the first node performs an exclusive OR operation on the first intermediate key and the group key of the first communication group. Optionally, after receiving the first protected key, the second node generates the same first intermediate key based on the shared key and the value of the second freshness parameter, and performs an exclusive OR operation on the first intermediate key and the first protected key to obtain the key of the first communication group.

[0019] In yet another possible implementation of the first embodiment, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0020] The above description outlines the possible cases for shared keys and freshness parameters. The encryption key between the first and second nodes may be shared. Therefore, the group key may be encrypted using the encryption key between the first and second nodes. The second freshness parameter may be a one-time number (number once, NONCE). NONCE is a random value used only once (or non-repeatedly). The second freshness parameter may be sent to the second node in the first association establishment message, so that the second node decrypts the first protection key based on the second freshness parameter and obtains the group key for the first communication group.

[0021] In yet another possible implementation of the first embodiment, the second freshness parameter is the value of a first counter, the first counter is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0022] The above explanation describes the possible cases for the freshness parameter. The second freshness parameter may be the value of the first counter, which is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key. In this way, each time the shared key is used to encrypt the group key, the value of the used counter will be different, and therefore the first protected key obtained by encrypting the same group key of the first communication group will also be different each time. This improves the privacy of the group key.

[0023] In yet another possible implementation of the first embodiment, determining the group key of the first communication group is: Determining the group key of the first communication group based on the ID of the first communication group, and determining whether a correspondence exists between the ID of the first communication group and the group key of the first communication group, or Generating a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF.

[0024] In the foregoing description, a method for determining the group key of the first communication group is described. In one aspect, there is a correspondence between the ID of the first communication group and the group key. Therefore, the group key of the communication group can be determined based on the ID of the communication group. In another aspect, the group key of the first communication group can be generated by using a KDF. Further optionally, if the first communication group does not have a corresponding group key (for example, a new communication group is created), the group key of the first communication group can be generated by using a KDF.

[0025] In yet another possible implementation method of the first aspect, this method Determining a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm further including determining at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0026] The first association establishment message further includes information used to indicate the group security algorithm.

[0027] The first association establishment message further includes a group security algorithm, and it can be seen that the security algorithm is determined by an algorithm supported by all nodes in the group.

[0028] In yet another possible implementation of the first aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group, or Determining the group security algorithm is The process involves determining a group security algorithm based on an algorithm selection policy, wherein the algorithm selection policy includes at least one of a priority-based algorithm selection policy and a sequence-based algorithm selection policy.

[0029] In yet another possible implementation of the first embodiment, the group security algorithm includes a third KDF algorithm, and this method is The method further includes generating a session key for a first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0030] By using the group KDF algorithm, the session key can be derived from the group key based on the type of session key, and it can be seen that it is used for encryption in the session process.

[0031] In yet another possible implementation of the first embodiment, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key is applied.

[0032] In yet another possible implementation of the first embodiment, this method encrypts the group key of the first communication group based on the shared key between the first node and the second node in order to obtain a protective key, This further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0033] In yet another possible implementation of the first embodiment, this method is Sending a second association establishment message to the second node, provided that encryption is enabled for the signaling plane message between the first node and the second node, the second association establishment message includes the group key of the first communication group, and the second association establishment message belongs to the signaling plane message between the first node and the second node.

[0034] It can be seen that different protection methods may be used when signaling plane encryption is enabled or disabled. In particular, when it is determined that encryption is enabled for signaling plane messages, the group key cannot be encrypted, but the signaling plane messages are protected by encryption. This avoids the calculation of additional encrypted data and improves the efficiency of group key distribution.

[0035] In yet another possible implementation of the first embodiment, this method is Determine that the conditions for updating the group key of the first communication group are met, The first key is determined based on at least one of the third freshness parameter and the identifier ID of the first communication group, The process involves encrypting the first key based on the shared key between the first and second nodes to obtain the second protected key, The process includes sending a key update message to a second node, wherein the key update message includes a second protective key.

[0036] In yet another possible implementation of the first embodiment, the first key is used to replace the group key of the first communication group.

[0037] The above description describes a method for updating a group key. After it is determined that the conditions for updating the group key have been met, the first key may be determined, encrypted using the shared key, and then sent to the second node using a key update message. Since the protected key carried in the key update message is obtained by encrypting the first key using the shared key, it can be seen that the privacy of the first key can be protected regardless of whether the key update message is encrypted or not. Optionally, the key update message may be a multicast message sent by the first node to the second node in the first communication group, or a unicast message between the first node and the second node. Further optional, when the key update message is a unicast message, the first node may send another unicast message to another second node in the first communication group.

[0038] In yet another possible implementation of the first embodiment, the key update message is further used to indicate the start time and the validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0039] The key update message may indicate the update time and / or the validity period of the first target key, and thus it can be seen that when the first target key should be applied is determined as needed.

[0040] In yet another possible implementation of the first embodiment, the method sends a key update message to the second node, It is determined that an update acknowledgment message has been received from at least one second node belonging to the first communication group, This further includes applying the first key to the start time of the first key.

[0041] In yet another possible implementation of the first embodiment, determining that an update acknowledgment message has been received from at least one second node belonging to the first communication group means: This includes determining that update acknowledgment messages have been received from all second nodes belonging to the first communication group.

[0042] In yet another possible implementation of the first embodiment, obtaining a second protected key by encrypting the first key based on a shared key between the first node and the second node is: This includes encrypting the first key based on the shared key between the first node and the second node and a fourth freshness parameter to obtain the second protected key.

[0043] The explanation above describes the method for encrypting the first key. Since the freshness parameter value is different each time, the second protective key obtained by encrypting the first key will also be different. This improves the privacy of the group key.

[0044] In yet another possible implementation of the first embodiment, obtaining a second protected key by encrypting the first key based on a shared key between the first node and the second node is: By using the first key derivation function KDF, a second intermediate key is generated based on the shared key between the first and second nodes and the fourth freshness parameter, This includes encrypting the first key using a second intermediate key to obtain a second protective key.

[0045] In yet another possible implementation of the first embodiment, obtaining a second protected key by encrypting the first key based on a shared key between the first node and the second node is: The method involves generating a second intermediate key based on a shared key between a first node and a second node and a second freshness parameter, using a first key derivation function (KDF), wherein the first KDF is a KDF supported by the second node. This includes performing an exclusive OR operation on the second intermediate key and the first key to obtain the second protected key.

[0046] In yet another possible implementation of the first embodiment, the conditions for updating are: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the same round count cycle, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The difference between the marked frame number and the frame number of the current communication frame is less than or equal to the second threshold, the frame number of the current communication frame is within the next round count cycle of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The validity period of the group key for the first communication group expires, or the usage duration of the group key for the first communication group reaches a third threshold, or This includes at least one second node in the first communication group leaving the first communication group.

[0047] The above explanation describes the conditions for updating a group key. It may be determined that a group key needs to be updated when one of the following conditions is met: (1) The group freshness parameter of the access point (e.g., frame number) is repeated or about to be reversed (or exceeds the threshold before being reversed). (2) The validity period of the group key expires or the usage duration of the group key exceeds the threshold. (3) The members in the group change.

[0048] According to a second aspect, one embodiment of the present application discloses a communication method, the method is Sending an association request message to the first node, Receiving a first association establishment message from a first node, wherein the first association establishment message includes a first protection key, The method includes obtaining a group key for a first communication group based on a shared key and a first protective key between a first node and a second node, wherein the first communication group is the communication group to which the second node belongs.

[0049] In one possible implementation of the second embodiment, the first node and the second node share a shared key.

[0050] In another possible implementation of the second aspect, obtaining a group key for a first communication group based on a shared key and a first protective key between a first node and a second node is: This includes obtaining a group key for a first communication group based on a shared key between a first node and a second node, a second freshness parameter, and a first protection key.

[0051] In yet another possible implementation of the second aspect, obtaining a group key for the first communication group based on the shared key and the first protective key between the first node and the second node is: By using the first key derivation function KDF, a first intermediate key is generated based on the shared key between the first and second nodes and a second freshness parameter, This includes obtaining a group key for a first communication group based on a first intermediate key and a first protective key.

[0052] In yet another possible implementation of the second embodiment, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0053] In yet another possible implementation of the second embodiment, the second freshness parameter is the value of the first counter, which is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0054] In yet another possible implementation of the second embodiment, the first association establishment message further includes information used to instruct a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, the group security algorithm comprising at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0055] In yet another possible implementation of the second aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group, or Determining a group security algorithm corresponds to an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and a sequence-based algorithm selection policy.

[0056] In yet another possible implementation of the second aspect, the group security algorithm includes a third KDF algorithm, and this method is The method further includes generating a session key for a first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0057] In yet another possible implementation of the second embodiment, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key is applied.

[0058] In yet another possible implementation of the second aspect, this method obtains the group key of the first communication group based on the shared key and the first protective key between the first node and the second node, This includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0059] In yet another possible implementation of the second embodiment, this method is: Receiving a second association establishment message from the first node, wherein the second association establishment message includes the group key of the first communication group, and the second association establishment message belongs to the signaling plane message between the first node and the second node, If encryption is enabled for the signaling plane messages between the first node and the second node, the method further includes obtaining the group key for the first communication group by using the signaling plane encryption key between the first node and the second node and the second association establishment message.

[0060] In yet another possible implementation of the second embodiment, this method is: Receiving a key update message from the first node, wherein the key update message includes a second protective key, This further includes obtaining a first key based on a shared key and a second protected key between the first and second nodes.

[0061] In yet another possible implementation of the second embodiment, the first key is used to replace the group key of the first communication group.

[0062] In yet another possible implementation of the second embodiment, the key update message is further used to indicate the start time and the validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0063] In yet another possible implementation of the second aspect, the method obtains the first key based on the shared key and the second protected key between the first node and the second node, Sending an update confirmation response message to the first node, This further includes applying the first key to the start time of the first key.

[0064] In yet another possible implementation of the second aspect, obtaining the first key based on the shared key and the second protected key between the first node and the second node is: This includes obtaining a first key based on a shared key between the first node and the second node, a fourth freshness parameter, and a second protective key.

[0065] According to a third aspect, one embodiment of the present application provides a communication device. The communication device comprises a unit configured to perform a method described in any one of the first aspects or possible implementations of the first aspect.

[0066] In one possible implementation method of the third embodiment, the device is A receiving unit configured to receive association request messages from a second node, A processing unit configured to determine the group key of a first communication group, wherein the first communication group is a communication group to which a second node belongs, and the group key of the first communication group is determined based on at least one of a first freshness parameter and the identifier ID of the first communication group. A processing unit is configured to obtain a first protective key by encrypting the group key of a first communication group based on a shared key between a first node and a second node. A transmitting unit configured to send a first association establishment message to a second node, wherein the first association establishment message includes a first protection key, particularly comprising the transmitting unit.

[0067] In another possible implementation of the third embodiment, the processing unit is: The system is specifically configured to encrypt the group key of the first communication group based on the shared key between the first node and the second node and a second freshness parameter, thereby obtaining the first protective key.

[0068] In yet another possible implementation of the third embodiment, the processing unit is: By using the first key derivation function KDF, a first intermediate key is generated based on the shared key between the first and second nodes and the second freshness parameter. It is specifically configured to encrypt the first communication key and obtain the first protective key by using the first intermediate key.

[0069] In yet another possible implementation of the third embodiment, the processing unit is: A first intermediate key is generated based on the shared key between the first and second nodes and a second freshness parameter using a first key derivation function (KDF), and the first KDF is a KDF supported by the second node. It is specifically configured to obtain a first protective key by performing an exclusive OR operation between the first intermediate key and the group key of the first communication group.

[0070] In yet another possible implementation of the third aspect, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0071] In yet another possible implementation of the third embodiment, the second freshness parameter is the value of a first counter, the first counter is used to represent the number of times the group key of a first communication group has been encrypted based on the shared key.

[0072] In yet another possible implementation of the third embodiment, the processing unit is: Based on the ID of the first communication group, the group key of the first communication group is determined, and a correspondence exists between the ID of the first communication group and the group key of the first communication group, or The system is specifically configured to generate a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF.

[0073] In yet another possible implementation of the third embodiment, the processing unit is: A group security algorithm is determined, and the group security algorithm is an algorithm supported by the nodes of the first communication group, and the group security algorithm is further configured to include at least one of the group encryption algorithm, the group integrity protection algorithm, and the group KDF algorithm.

[0074] The first association establishment message further includes information used to instruct the group security algorithm.

[0075] In yet another possible implementation of the third aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group, or Determining the group security algorithm is The process involves determining a group security algorithm based on an algorithm selection policy, wherein the algorithm selection policy includes at least one of a priority-based algorithm selection policy and a sequence-based algorithm selection policy.

[0076] In yet another possible implementation of the third aspect, the group security algorithm includes a third KDF algorithm, and the processing unit is The system is further configured to generate the session key for the first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0077] In yet another possible implementation of the third aspect, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key applies.

[0078] In yet another possible implementation of the third embodiment, the processing unit is: It is further configured to ensure that encryption is not enabled for signaling plane messages between the first node and the second node.

[0079] In yet another possible implementation of the third embodiment, encryption is enabled for signaling plane messages between the first node and the second node, and the transmitting unit, The system is further configured to send a second association establishment message to a second node, the second association establishment message containing the group key of the first communication group, and the second association establishment message belonging to the signaling plane message between the first node and the second node.

[0080] In yet another possible implementation of the third embodiment, the processing unit is further configured to determine that the conditions for updating the group key of the first communication group are met.

[0081] The processing unit is further configured to determine a first key based on at least one of a third freshness parameter and a first communication group identifier ID.

[0082] The processing unit is further configured to encrypt the first key based on the shared key between the first node and the second node to obtain the second protected key.

[0083] The transmission unit is further configured to send a key update message to a second node. The key update message contains the second protective key.

[0084] In yet another possible implementation of the third embodiment, the first key is used to replace the group key of the first communication group.

[0085] In yet another possible implementation of the third aspect, the key update message is further used to indicate the start time and the validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0086] In yet another possible implementation of the third embodiment, the processing unit is: It is determined that an update acknowledgment message has been received from at least one second node belonging to the first communication group. The first key is further configured to be applied to the start time of the first key.

[0087] In yet another possible implementation of the third embodiment, the processing unit is: It is specifically configured to determine that it has received update acknowledgment messages from all second nodes belonging to the first communication group.

[0088] In yet another possible implementation of the third embodiment, the processing unit is: The system is specifically configured to encrypt the first key based on a shared key between the first node and the second node and a fourth freshness parameter, in order to obtain the second protected key.

[0089] In yet another possible implementation of the third aspect, the conditions for updating are: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the same round count cycle, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The difference between the marked frame number and the frame number of the current communication frame is less than or equal to the second threshold, the frame number of the current communication frame is within the next round count cycle of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The validity period of the group key for the first communication group expires, or the usage duration of the group key for the first communication group reaches a third threshold, or This includes at least one second node in the first communication group leaving the first communication group.

[0090] According to a fourth aspect, one embodiment of the present application provides a communication device. The communication device comprises a unit configured to perform a method described in any one of the second aspect or possible implementations of the second aspect.

[0091] In one possible implementation method of the fourth embodiment, the device is A transmitting unit configured to send an association request message to a first node, A receiving unit configured to receive a first association establishment message from a first node, wherein the first association establishment message includes a first protection key, and the receiving unit... A processing unit configured to obtain a group key for a first communication group based on a shared key and a first protective key between a first node and a second node, wherein the first communication group is the communication group to which the second node belongs.

[0092] In another possible implementation of the fourth aspect, the first node and the second node share a shared key.

[0093] In yet another possible implementation of the fourth aspect, the processing unit is: It is specifically configured to obtain a group key for a first communication group based on a shared key between the first node and the second node, a second freshness parameter, and a first protection key.

[0094] In yet another possible implementation of the fourth aspect, the processing unit is: By using the first key derivation function KDF, a first intermediate key is generated based on the shared key between the first and second nodes and the second freshness parameter. It is specifically configured to obtain a group key for a first communication group based on a first intermediate key and a first protective key.

[0095] In yet another possible implementation of the fourth aspect, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0096] In yet another possible implementation of the fourth aspect, the second freshness parameter is the value of a first counter, the first counter is used to represent the number of times the group key of a first communication group has been encrypted based on the shared key.

[0097] In yet another possible implementation of the fourth aspect, the first association establishment message further includes information used to instruct a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, the group security algorithm comprising at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0098] In yet another possible implementation of the fourth aspect, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes in the first communication group, or Determining a group security algorithm corresponds to an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and a sequence-based algorithm selection policy.

[0099] In yet another possible implementation of the fourth aspect, the processing unit is: The system is further configured to generate the session key for the first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0100] In yet another possible implementation of the fourth aspect, the key type includes one or more of a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type corresponds to the scenario to which the session key applies.

[0101] In yet another possible implementation of the fourth aspect, this is performed before obtaining the group key of the first communication group based on the shared key and the first protective key between the first node and the second node, This further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0102] In yet another possible implementation of the fourth embodiment, the receiving unit is further configured to receive a second association establishment message from the first node, the second association establishment message includes a group key for the first communication group, and the second association establishment message belongs to a signaling plane message between the first node and the second node. The processing unit is further configured to decrypt the second association establishment message by using the signaling plane encryption key between the first node and the second node to obtain the group key for the first communication group.

[0103] In yet another possible implementation of the fourth aspect, the receiving unit is further configured to receive a key update message from a first node, the key update message including a second protective key, The processing unit is further configured to obtain the first key based on the shared key and the second protected key between the first and second nodes.

[0104] In yet another possible implementation of the fourth aspect, the first key is used to replace the group key of the first communication group.

[0105] In yet another possible implementation of the fourth aspect, the key update message is further used to indicate the start time and the validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0106] In yet another possible implementation of the fourth aspect, the processing unit is: Send an update confirmation response message to the first node, The first key is further configured to be applied to the start time of the first key.

[0107] In yet another possible implementation of the fourth aspect, the processing unit is: It is specifically configured to obtain the first key based on the shared key between the first node and the second node, a fourth freshness parameter, and the second protected key.

[0108] According to a fifth aspect, one embodiment of the present application further provides a communication device comprising at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, and the at least one processor being configured to invoke a computer program stored in at least one memory, thereby the device implementing the method described in the first aspect or one of the possible implementations of the first aspect, or the method described in the second aspect or one of the possible implementations of the second aspect.

[0109] According to a sixth aspect, one embodiment of the present application further provides a communication system comprising a first node and a second node. The first node is a device described in any one of the third aspect or a possible implementation of the third aspect, and the second node is a device described in any one of the fourth aspect or a possible implementation of the fourth aspect.

[0110] According to a seventh aspect, one embodiment of the present application provides a chip system. The communication device of the chip system comprises at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, and the at least one processor being configured to invoke a computer program stored in at least one memory, thereby enabling the device on which the chip system is installed to implement the method described in the first aspect or one of the possible implementations of the first aspect, or the method described in the second aspect or one of the possible implementations of the second aspect.

[0111] According to the eighth aspect, one embodiment of the present application discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed on one or more processors, a method described in the first aspect or one of the possible implementations of the first aspect, or in the second aspect or one of the possible implementations of the second aspect is performed.

[0112] According to the ninth aspect, one embodiment of the present application discloses a computer program product. When the computer program product is executed on one or more processors, a method described in the first aspect or one of the possible implementations of the first aspect, or in the second aspect or one of the possible implementations of the second aspect is performed.

[0113] According to the tenth aspect, one embodiment of the present application discloses a terminal comprising a first node (e.g., an automotive cockpit domain controller CDC) and / or a second node (e.g., at least one of modules such as a camera, screen, microphone, speaker, radar, electronic key, and passive entry / passive start system controller). The first node is an apparatus described in the third aspect or any one of possible implementations of the third aspect, and the second node is an apparatus described in the fourth aspect or any one of possible implementations of the fourth aspect.

[0114] Furthermore, optionally, the terminal may be a vehicle, an unmanned aerial vehicle, a robot, a device in a smart home scenario, a device in a smart manufacturing scenario, or similar.

[0115] It can be understood that the technical solutions in the second, third, and fourth aspects of this application correspond to the technical solution in the first aspect. For the relevant beneficial effects, please refer to the beneficial effects in the first aspect. Therefore, further details will not be explained.

[0116] Next, the accompanying drawings used in the embodiments of this application will be described. [Brief explanation of the drawing]

[0117] [Figure 1] This is a schematic diagram of the architecture of a communication system according to one embodiment of this application. [Figure 2] This is a schematic diagram of an application scenario for a communication method according to one embodiment of this application. [Figure 3] This is a flowchart of a communication method according to one embodiment of this application. [Figure 4] This is a schematic diagram of a method for encrypting a group key according to one embodiment of this application. [Figure 5] This is a schematic diagram of another method for encrypting a group key according to one embodiment of this application. [Figure 6A] This is a schematic diagram of a method for determining a group security algorithm according to one embodiment of this application. [Figure 6B] This is a schematic diagram of a method for determining a group security algorithm according to one embodiment of this application. [Figure 7] This is a flowchart of another communication method according to one embodiment of this application. [Figure 8A] This is a schematic diagram of a communication scenario according to one embodiment of this application. [Figure 8B] This is a schematic diagram of a communication scenario according to one embodiment of this application. [Figure 9A] This is a schematic diagram of a scenario for updating a group key according to one embodiment of this application. [Figure 9B] This is a schematic diagram of a scenario for updating a group key according to one embodiment of this application. [Figure 10A] This is a schematic diagram of another scenario for updating a group key according to one embodiment of this application. [Figure 10B] This is a schematic diagram of another scenario for updating a group key according to one embodiment of this application. [Figure 11] This is a flowchart of yet another communication method according to one embodiment of this application. [Figure 12A] This is a flowchart of yet another communication method according to one embodiment of this application. [Figure 12B] This is a flowchart of yet another communication method according to one embodiment of this application. [Figure 13] This is a schematic diagram of the structure of a communication device according to one embodiment of this application. [Figure 14] This is a schematic diagram of the structure of another communication device according to one embodiment of this application. [Figure 15] This is a schematic diagram of the structure of yet another communication device according to one embodiment of this application. [Figure 16] This is a schematic diagram of the structure of yet another communication device according to one embodiment of this application. [Modes for carrying out the invention]

[0118] Next, embodiments of the present application will be described with reference to the accompanying drawings of embodiments of the present application. In this application, the word “example” or the phrase “for example” is used to indicate that an example, illustration, or explanation is being given. Any embodiment or design solution described by using “example” or “for example” in this application should not be described as being preferable to or having more advantages than another embodiment or design scheme. The use of the word “example” or the phrase “for example” is intended to present concepts relating in a particular manner.

[0119] The following paragraphs will begin by briefly explaining the relevant technologies and technical terms in this application, in order to facilitate understanding.

[0120] 1. Node

[0121] A node is an electronic device that has the capability to receive and transmit data. For example, a node may be a cockpit domain device or a module within a cockpit domain device (for example, one or more modules such as a cockpit domain controller (CDC), camera, screen, microphone, speaker, electronic key, or passive entry / passive start system controller). In certain implementations, a node may alternatively be a data transfer device, such as a router, repeater, bridge, or switch; or a terminal device, such as various types of user equipment (UE), mobile phone, tablet computer (pad), desktop computer, headset, or speaker; or a machine intelligence device such as a self-driving device, transportation safety device, virtual reality (VR) terminal device, augmented reality (AR) terminal device, machine type communication (MTC) device, industrial control device, remote medical device, smart grid device, or smart city device; or a wearable device (such as a smartwatch, smart band, or pedometer), or similar. In some technical scenarios, devices with similar data receiving and transmitting capabilities may not be referred to as nodes. However, for the sake of clarity, in the embodiments of this application, an electronic device having the capability to receive and transmit data is referred to as a node.

[0122] 2.Shared key (SK)

[0123] A shared key is the same secret value stored on the nodes of both communicating parties. The shared key can be generated by both communicating parties using the same key acquisition method, or it can be predefined or preconfigured on the nodes of both communicating parties, or it can be sent separately to the first and second nodes from a trusted device (e.g., a key distribution center, KDC).

[0124] For example, a vehicle's cockpit domain controller (CDC) and the vehicle owner's mobile phone are two nodes that can communicate with each other using short-range communication technology. When the vehicle owner needs to pair with the vehicle's CDC using their mobile phone, the vehicle owner can first generate a shared key by exchanging public keys, for example, by exchanging key agreement algorithm parameters between the mobile phone and the vehicle's CDC using a key agreement algorithm. The shared key can then be used to verify the identities of both nodes when the mobile phone subsequently requests pairing with the vehicle's CDC again.

[0125] In another example, a vehicle's cockpit domain controller (CDC) and an on-board radar device are two nodes that can communicate with each other. When deploying the CDC and the on-board radar, employees at the automotive factory pre-configure a shared key between the CDC and the on-board radar. The security of communication between the vehicle's CDC and the on-board radar can be ensured by using this shared key.

[0126] In addition, a node may derive another key based on the original shared key through key derivation. Since the nodes of both parties can derive keys by using the same method, a key derived based on the original shared key can also be considered a shared key. For example, the first node derives a session key Kenc by using the shared key Kdh, and correspondingly, the second node derives a session key Kenc by using the same method. Since the shared key Kdh is a secret shared by the first and second nodes, the derived session key Kenc can also be considered a shared key between the first and second nodes.

[0127] 3. Multicast communication

[0128] Multicast technology aims to transmit a single piece of information to a group of nodes. In this way, the group of nodes can be considered a communication group. In some scenarios, such a communication group is also referred to as a target group or multicast group. When a node (for example, referred to as the first node) transmits information to multiple target nodes, the first node may transmit only one piece of data, the destination address of which is the multicast group address. In this way, all target nodes belonging to the group can receive the aforementioned data transmitted by the first node. Thus, multicast mode solves the problems of repeated data transmission and repeated bandwidth occupation in unicast mode, and also solves the waste of bandwidth resources in broadcast mode.

[0129] 4. Security Algorithms

[0130] Security algorithms may include encryption algorithms, integrity protection algorithms, key derivation functions, and similar ones.

[0131] Encryption algorithms include symmetric and asymmetric encryption algorithms. Generally, the encryption and decryption keys for symmetric encryption algorithms are the same, while those for asymmetric encryption algorithms are different. In addition, there are hash algorithms, which do not require keys. Common symmetric encryption algorithms mainly include the data encryption standard (DES), the triple data encryption algorithm (3DES), the advanced encryption standard (AES), and similar algorithms. Common asymmetric encryption algorithms mainly include the RSA encryption algorithm, the data structure analysis (DSA) algorithm, and similar algorithms. Hash algorithms mainly include the secure hash algorithm (SHA-1), the message digest (MD) algorithm (MD2, MD4, or MD5, etc.), and similar algorithms.

[0132] An integrity protection algorithm is an algorithm used to protect message integrity and may also be called a MAC (message authentication code, MAC) algorithm. For example, an integrity protection algorithm implemented using a hash algorithm is called a hash-based message authentication code (HMAC) algorithm, where the hash algorithm may be one of MD5, SHA-1, SHA-256, and similar ones, and these different HMAC implementations are generally described as HMAC-MD5, HMAC-SHA1, HMAC-SHA256, and similar. In another example, a MAC algorithm implemented on a cryptographic algorithm may be called a cipher-based message authentication code (CMAC) algorithm, where the cryptographic algorithm may be AES. Since the AES block cipher has four operating modes, ECB, CBC, CFB, and OFB, integrity protection algorithms implemented on block encryption algorithms of different operating modes may be called the ECB-MAC algorithm, the CBC-MAC algorithm, and similar, respectively. Furthermore, one-key message authentication codes (CBC-MAC, OMAC) are improvements over the CBC-MAC algorithm. In addition, integrity protection algorithms may further include Galois message authentication code mode (GMAC), ZUC cryptographic algorithms (such as ZUC128 and ZUC256), and MD algorithms (such as MD2, MD4, or MD5).

[0133] In some specific scenarios, data may be encrypted against a given source text by using an authenticated encryption algorithm, and a message authentication code may be generated against the given source text. Thus, authenticated encryption algorithms can be used as encryption algorithms or integrity protection algorithms. For example, the AES algorithm based on GMAC and count encryption mode (AES-Galois / counter mode, AES-GCM) and the AES algorithm based on CMAC and count encryption mode (AES-CMAC / counter Mode, AES-CCM) are good examples of algorithms that perform authenticated encryption against a message, and the MAC may be generated in the process of performing authenticated encryption to protect the integrity of the message.

[0134] A key derivation function (KDF), also known as a key derivation algorithm, is used to derive one or more secret values ​​from one secret value. For example, a new secret value DK derived from the secret value Key can be expressed as DK = KDF(Key). Common key derivation algorithms include password-based key derivation functions (PBKDFs), scrypt algorithms, and similar ones. The PBKDF algorithm further includes first-generation PBKDF1 and second-generation PBKDF2. Optionally, in the key derivation process of some KDF algorithms, a hash algorithm is used to perform a hash change on the input secret value. Thus, an algorithm identifier may be further accepted as input to the KDF function to indicate which hash algorithm should be used.

[0135] In the embodiments of this application, it should be noted that the terms “First KDF,” “Second KDF,” and “Third KDF” are used in the description to facilitate the explanation of the KDFs used in the key derivation process. The “First KDF,” “Second KDF,” and “Third KDF” may be different KDFs or the same KDF.

[0136] 5. Freshness parameters

[0137] Freshness parameters, also known as freshness or freshness parameter, are used to generate keys, authentication parameters, and similar items, and may include at least one of the following: number once (nonce), counter, serial number, frame number, and similar items. NONCE is a random value used only once (or non-repeatingly). Freshness parameters generated at different moments in time are usually different. In other words, a particular value of a freshness parameter changes each time it is generated. Therefore, the freshness parameter used to generate the key (or authentication parameter, or similar item) this time will be different from the freshness parameter used to generate the previous key (or authentication parameter, or similar item). This can improve the security of the generated key.

[0138] For example, the freshness parameter may be a random number obtained by a node using a random number generator.

[0139] In another example, the freshness parameter may be a packet data convergence protocol count (PDCP COUNT), which may further include an uplink PDCP COUNT and a downlink PDCP COUNT. The uplink PDCP COUNT is incremented by 1 each time a second node transmits an uplink PDCP data packet, and the downlink PDCP COUNT is incremented by 1 each time a first node transmits a downlink PDCP data packet. Since the PDCP COUNT is constantly changing, the key generated each time by using the PDCP COUNT will be different from the key generated the previous time by using the PDCP COUNT.

[0140] 6. Frame number

[0141] A Protocol Data Unit (PDU) is a data unit transmitted between peer layers during communication. In the protocol stack of a communication system, entities in each layer can establish a PDU for entities in that layer. The PDU contains information from entities in higher layers and additional information for entities in the current layer, and is then transmitted to the next layer. In some scenarios, information about entities in the current layer, such as transparent transmission, may not be attached. For example, for two sublayers, Logical Link Control (LLC) and Media Access Control (MAC), an LLC entity may establish an LLC PDU, and a MAC entity may establish a MAC PDU. For ease of explanation, protocol data units transmitted in a communication system are collectively referred to as communication frames in the embodiments of this application. In particular, control-type protocol data units may also be called control frames or management frames, and data type protocol data units may also be called data frames. For example, a communication frame may be a media access control (MAC) data frame.

[0142] Communication frames received and transmitted by nodes using a network have a corresponding serial number (SN), also called a sequence number. The value of the serial number is indicated by using n bits, and the serial number of the next communication frame is the serial number of the previous communication frame plus 1. For example, assuming that the serial number of communication frame A is 192, the serial number of the next communication frame B will be 193, and so on. Note that when a serial number rollover (SN rollover) occurs because the serial number exceeds the maximum representation value, the serial number value of the subsequent communication frame will be smaller than the serial number of the previous communication frame. For example, a serial number is 8 bits. The serial number of the first communication frame is 0 and is incremented by 1 each time. A serial number rollover occurs each time the serial number increases and reaches 0xFF. In other words, the serial number has a periodic characteristic. For a serial number containing n bits, the serial number is 2 n This process is repeated each time a communication frame passes through. Therefore, while communication frames do not have a unique serial number, they are unique within each serial number cycle (SN cycle).

[0143] In embodiments of this application, the frame number (FN) is indicated by using N bits. The N bits include the lower n bits used to indicate the serial number bits of the communication frame and the upper (Nn) bits used to indicate the record value bits. The initial value of the record value is 0 or a specified value, and when a rollover occurs for the serial number of the communication frame, the record value is incremented by 1. For example, the frame number is 32 bits and the serial number is 8 bits. Assuming the record value is 0x00 0000 and the serial number value of the communication frame is 0xFF, the current frame number is 0x0000 00FF. The serial number value of the next data packet is incremented by 1 and then inverted. Therefore, the serial number value of the next protocol data unit is 0x00. Since a rollover occurs for the serial number, the record value changes to 0x00 0001. Therefore, the next frame number is 0x0000 0100. Since the frame number is an N-bit number, it can be understood that the frame number also has a count cycle (FN cycle). When the frame number exceeds the maximum value, a frame number rollover (FN rollover) also occurs.

[0144] For optional settings regarding frame number configuration, please refer to the definitions related to PCDP COUNT. PCDP COUNT includes the Hyper Frame Number (HFN) portion and the serial number portion of the protocol data unit. The starting value of the hyper frame number is set to 0 or a specified value, and the hyper frame number is incremented by 1 when a rollover occurs against the serial number of the protocol data unit.

[0145] Optionally, a node may maintain multiple frame numbers. For example, a node may maintain separate frame numbers for uplink communication frames and downlink communication frames. When transmitting an uplink communication frame, the node may increment the uplink communication frame number by 1 based on a change in the serial number of the communication frame. When transmitting a downlink communication frame, the node may adjust the downlink communication frame number based on a change in the serial number of the communication frame.

[0146] Next, the system architecture and service scenarios in the embodiments of this application will be described. It should be noted that the system architecture and service scenarios described herein are intended to provide a clearer explanation of the technical solutions of this application and do not constitute limitations on the technical solutions provided herein. Those skilled in the art will know that, as system architectures evolve and new service scenarios emerge, the technical solutions provided herein may also be applicable to similar technical problems.

[0147] Figure 1 is a schematic diagram of the architecture of a communication system according to one embodiment of the present application. The communication system includes a first node 101, a first communication group 102, a second node 103, and a second node 104.

[0148] The first communication group 102 includes a plurality of second nodes, where both second nodes 103 and 104 are nodes belonging to the first communication group 103. It can be understood that the first communication group 102 may include one second node or a plurality of second nodes. In this specification, only an example in which the first communication group 102 includes two second nodes is used for description. This is not limited to the present application. Optionally, the first node 101 may also be referred to as a primary node or access point (AP). Correspondingly, the second node 103 or second node 104 in the first communication group 102 may be referred to as a second node.

[0149] The first node 101 may perform multicast communication with nodes in the first communication group 102, or unicast communication with a second node 103 (or second node 104) in the first communication group. Optionally, the communication data link may include various types of connection media, including long-range connection technologies such as wireless access technologies like Global System for Mobile communications (GSM), General Packet Radio Service (GPRS), and Universal Mobile Telecommunications System (UMTS); or, in other examples, short-range connection technologies, including 802.11b / g, Bluetooth, Zigbee, Radio Frequency Identification (RFID) technology, Ultra-Wideband (UWB) technology, In-vehicle wireless short-range transmission technology, and similar technologies. Of course, there are other techniques that could be used to support communication between the first node 101 and the second node.

[0150] The first node 101 may perform multicast communication with multiple second nodes in the first communication group 102, and the communication messages must be encrypted in such a way that only members within the group can interpret the encrypted packets and non-group members cannot obtain the contents of the packets, thereby protecting the security of the multicast communication. For the second node 103 in the group, the first node 101 must send a group key to the second node 103, so that the second node 103 can decrypt the multicast messages by using the group key.

[0151] The first node 101 may encrypt a signaling message containing a group key using a signaling plane encryption key (for example, a unicast key PTK between the first node 101 and the second node 103) and send the encrypted signaling message to the second node 103.

[0152] For the sake of clarity, please note that the second node 103 is used as an example in this description. For the second node 104 in the group, the first node 101 also needs to send a group key to the second node 104, so that the second node 104 can decode multicast messages using the group key.

[0153] For example, Figure 2 is a schematic diagram of an application scenario of a communication method according to one embodiment of the present application. A vehicle cockpit domain controller (CDC) 201 is a control center in a smart cockpit device and can be considered a first node 101. Cameras 202 and 203 are in-vehicle camera devices. For ease of control, cameras 202 and 203 are configured as a communication group. CDC 201 may perform multicast communication with cameras 202 and 203 by using Wireless Fidelity (Wi-Fi) technology. Prior to multicast communication, CDC 201 may encrypt a signaling message containing a group key by using the signaling plane encryption keys of CDC 201 and camera 203, and then send the encrypted signaling message to camera 203. In response, CDC201 may encrypt the signaling message containing the group key by using the signaling plane encryption keys of CDC201 and camera 203, and then send the encrypted signaling message to camera 202.

[0154] However, with the method described above, the group key is protected by relying on the encryption of the signaling plane message. If encryption is not enabled for the signaling plane message, the group key cannot be protected, which can lead to group key leakage.

[0155] For example, see Figure 2. Attacking device 204 may listen in on multicast communications. If encryption is not enabled for signaling plane messages, the attacker could obtain the group key by listening in on the signaling message carrying the group key, and then eavesdrop on or listen in on the contents of multicast communications, or even launch an attack on CDC201 to threaten vehicle security.

[0156] Figure 3 is a schematic flowchart of a communication method according to one embodiment of this application. This method can be implemented based on the architecture shown in Figure 1. This method includes, but is not limited to, the following steps.

[0157] Step S301: The second node sends an association request message to the first node.

[0158] In particular, the second node may send the first association request message to the first node by using a wireless link (for example, one of several short-range wireless links such as Wi-Fi, Bluetooth, ZigBee, or an automotive short-range wireless communication link) or a wired link (for example, optical fiber). In response, the first node receives the first association request message from the second node.

[0159] Optionally, the association request message may include the device identifier of the second node. The node's device identifier may be an ID (identity), a media access control (MAC) address, a domain name, a domain address, or another user-defined identifier.

[0160] In this method, the first node may send an access message or a broadcast message, and the second node may receive an access message or a broadcast message from the first node. The second node sends a first association request message to the first node based on the access message or broadcast message. In particular, the access message or broadcast message from the first node may include at least one of the following: the ID of the first node, descriptive information of the first node, information used to direct access to another node, or the same.

[0161] Optionally, the first association request message may further include information about the security algorithms (or security capabilities (Sec Capabilities)) supported by the second node. This information may include the name, identifier, predefined symbol, or similar. The information about the security algorithms supported by the second node may be used by the first node to determine one or more of the following: the security algorithm (or unicast security algorithm) between the first and second nodes, the group security algorithm of the first communication group, or similar.

[0162] Furthermore, optionally, after receiving an association request message from the first node, the second node may send a security context request message to itself. The security context request message includes information about a unicast security algorithm determined by the first node and first identity authentication information, which the second node uses to authenticate the identity of the first node. Furthermore, the second node may feed back a security context response message to the first node. The security context response message includes second identity authentication information, which the first node uses to verify the identity of the second node.

[0163] Step S302: The first node determines the group key for the first communication group.

[0164] In particular, the first communication group is the communication group to which the second node belongs. Optionally, the first node may pre-obtain the device identifier of the second node and determine the communication group to which the second node belongs based on the device identifier of the second node. That is, there is a correspondence between the device identifier of the second node and the communication group. For example, see Table 1. Table 1 is a possible communication group information table provided in this embodiment of the present application. The correspondences displayed in the communication group information table may be pre-configured or pre-defined on the first node. Specific configurations and definition formats are not limited to table formats and may reflect the correspondences. The communication group information table includes the ID of the communication group and the nodes included in the communication group. Optionally, it may further include information such as the group key or group algorithm of the communication group. The first node may determine the group key of the first communication group to which the first node is located, based on the device identifier of the second node. For example, if the device identifier of the second node is "E0", the first node will determine the group key for the communication group whose ID is "GID1". [Table 1]

[0165] Optionally, the first node may determine or obtain the group key for the first communication group by using at least the following methods:

[0166] Method 1: The first node determines the group key of the first communication group based on the ID of the first communication group, and a correspondence exists between the ID of the first communication group and the group key of the first communication group. In particular, the correspondence between the ID of the communication group and the group key is predefined or preconfigured on the first node. Therefore, the first node can determine the group key of the first communication group based on the ID of the first communication group. For example, see Table 1. The first node can determine that the group key of the communication group is "GK1" based on the ID of the communication group "GID1".

[0167] Method 2: The first node obtains a one-time number NONCEa and uses NONCEa as the group key for the first communication group.

[0168] Method 3: The first node generates a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF. The first freshness parameter is a freshness parameter obtained (or generated) by the first node, and may have one or more first freshness parameters. Optionally, the second KDF may be a KDF algorithm that gives the first node the highest priority. The first node generating a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF may particularly include the following implementation forms.

[0169] Implementation form 1: The first node generates a group key for the first communication group based on the first freshness parameter and the ID of the first communication group by using the second KDF. For example, the first freshness parameter is freshness parameter NONCEg, and the ID of the first communication group is GID. The generated group key for the first communication group satisfies the expression GK = second KDF(NONCEg, GID).

[0170] Implementation form 2: The first node generates a group key for the first communication group based on the first freshness parameters by using the second KDF. For example, the first freshness parameters are freshness parameter NONCEg1 and freshness parameter NONCEg2, and the ID of the first communication group is the GID. The generated group key for the first communication group satisfies the expression GK=KDF(NONCEg1,NONCEg2).

[0171] Implementation form 3: The first node generates a group key for the first communication group based on the group ID of the first communication group by using the second KDF. For example, the generated group key for the first communication group satisfies the formula GK=KDF(GID).

[0172] Optionally, parameters participating in GK generation may further include other information, such as the length of the generated key, the identifier of the hash algorithm used, and one or more of the same.

[0173] Optionally, the first node may generate a group key identifier GK ID. Furthermore, the first node may further establish a correspondence between the GK ID and the ID of the first communication group, so that when the group key is determined next time, the corresponding GK ID is determined based on the ID of the first communication group, thereby obtaining the group key GK indicated by the GK ID.

[0174] It should be noted that before determining the group key of the first communication group, the first node may first determine whether the first communication group has a corresponding group key. If a corresponding group key exists, the group key of the first communication group is determined using the method described in Method 1; or, if a corresponding group key does not exist, the group key of the first communication group is determined using the method described in Method 2 or Method 3. For example, when a new communication group is created, the new communication group does not have a corresponding group key, so the group key of the first communication group may be determined using the method described in Method 2 or Method 3.

[0175] Step S303: The first node encrypts the group key of the first communication group based on the shared key between the first node and the second node, and obtains the first protective key.

[0176] In particular, a shared key is a secret value shared between a first node and a second node. For example, the first and second nodes may generate a key S by exchanging public keys, and the value of the key S generated by the first node is the same as the value of the key S generated by the second node. Therefore, key S can be used as a shared key between the first and second nodes.

[0177] Optionally, the first node encrypting the group key of the first communication group based on the shared key between the first node and the second node may include at least the following implementations of solutions:

[0178] Solution 1 for implementation: The first node encrypts the group key using a shared key to obtain the first protective key. For example, see Figure 4. Figure 4 is a schematic diagram of a possible method for encrypting a group key according to one embodiment of this application. The first node encrypts the group key 401 of the first communication group using a shared key 402 to obtain the first protective key 403.

[0179] Optionally, the shared key may be a unicast key between the first node and the second node. For example, the first node encrypts the group key of the first communication group by using a unicast encryption key and based on a unicast encryption algorithm.

[0180] Implementation Solution 2: The first node may obtain the first protected key by encrypting the group key using a shared key and a second freshness parameter. The second freshness parameter is one or more of the following, obtained (or generated) by the first node: NONCE, counter value, frame number, and similar. For example, the second freshness parameter could be a one-time number NONCEk generated by the first node, or a public key exchanged between the first and second nodes. Since the values ​​of the freshness parameters are different, the first protected key obtained by encrypting the same group key of the first communication group will also be different each time. This improves the privacy of the group key. The counter is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0181] Implementation Method 3: The first node generates a first intermediate key based on the shared key, encrypts the group key using the first intermediate key, and obtains a first protective key. For example, see Figure 5. Figure 5 is a schematic diagram of a possible method for encrypting a group key according to one embodiment of this application. The first node generates a first intermediate key 503 based on the shared key 504, encrypts the group key 501 using the first intermediate key 503, and obtains a first protective key 502.

[0182] Implementation Method 4: The first node generates a first intermediate key based on the shared key and the second freshness parameter, and uses the first intermediate key to encrypt the group key and obtain the first protected key.

[0183] For example, the first node generates a first intermediate key Kg based on the shared key Kdh and the value of the first counter counter1 by using the first KDF, e.g., Kg = first KDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the first intermediate key Kg based on the shared key Kdh. Note that the number of times an intermediate key is generated can also represent the number of times the group key is encrypted, since the generated first intermediate key Kg is used to encrypt the group key of the first communication group. For example, the counter value starts at 1. The counter value is 1 when the first intermediate key is first generated based on the shared key Kdh and the value of the first counter counter1. Correspondingly, when the first intermediate key Kg is generated for the second time based on the shared key Kdh and the value of the first counter counter1, counter1 is 2. Furthermore, optionally, the first node updates the shared key Kdh when the value of the first counter is predefined or greater than or equal to a preset threshold, and after Kdh has been updated, the first counter may resume counting.

[0184] In a possible design, if the generated first intermediate key fails to encrypt the group key of the first communication group, or fails to transmit the group key of the first communication group, the value of the first counter that rejoins the generation of the first intermediate key may be the value of the counter before the failure.

[0185] In another example, the first node generates a first intermediate key Kg based on the session key Kenc and a one-time number NONCEk by using a first KDF, for example Kg = first KDF(Kenc, NONCEk), and then uses Kg to encrypt the group key of the first communication group to obtain the first protective key. In yet another example, the first node generates a shared key Kgt (the shared key Kgt may be specifically derived from the shared key Kdh) and a one-time number NONCK (or counter value counter) by using a first KDF, for example Kg = first KDF(Kenc, NONCEk (or counter)), and then uses Kg to encrypt the group key of the first communication group to obtain the first protective key.

[0186] The encryption of the group key of the first communication group by the first node using the first intermediate key may be as follows: The first node performs an exclusive OR operation on the group key of the first communication group and the first intermediate key to obtain the first protective key. For example, the first protective key GKc obtained by the first node through encryption is given by the expression

number

number

[0187] Optionally, the first node may decide that encryption is not enabled for signaling plane messages between the first node and the second node, and may encrypt the group key of the first communication group in order to obtain the first protection key when encryption is not enabled for signaling plane messages. If encryption is enabled for signaling plane messages between the first node and the second node, the first node sends a second association establishment message to the second node. The second association establishment message contains the group key of the first communication group. Since the second association establishment message belongs to the signaling plane messages between the first node and the second node, the group key may be protected by encrypting the signaling plane messages.

[0188] Step S304: The first node sends the first association establishment message to the second node.

[0189] It can be understood that the first node sends a first association establishment message to the second node, and in response, the second node receives the first association establishment message from the first node. The association establishment message includes a first protection key. See, for example, Figure 4. The first node sends the first association establishment message 404 to the second node, and the second node receives the association establishment message 404 from the first node. See Figure 5 for another example. The first node sends the first association establishment message 505 to the second node, and the second node receives the association establishment message 505 from the first node.

[0190] Optionally, the first association establishment message may further include a second freshness parameter, which may be used by the second node to decrypt the first protection key.

[0191] Furthermore, optionally, when the second freshness parameter is a counter value, the second node may also obtain a counter value corresponding to the counter value on the first node. Therefore, the first association establishment message cannot include the second freshness parameter. For example, the value of the first counter on the first node is used as the second freshness parameter, and the value of the first counter represents the number of times the group key has been encrypted. The second node also obtains the value of the second counter, which is used to represent the number of times the group key has been decrypted, and the value of the second counter corresponds to the value of the first counter. Therefore, the first association establishment message cannot include the second freshness parameter.

[0192] Optionally, the first association establishment message may further include a message authentication code, which is used by the second node to authenticate the integrity of the first association establishment message.

[0193] Furthermore, the first node may optionally encrypt the first association establishment message by using an encryption key. Correspondingly, the second node may decrypt the first association establishment message by using the corresponding decryption key to obtain the contents of the first association establishment message.

[0194] Step S305: The second node obtains the group key for the first communication group based on the shared key and the first protection key between the first and second nodes. Optionally, the second node may decrypt the first protection key based on the shared key between the first and second nodes to obtain the group key for the first communication group.

[0195] In particular, the shared key is a secret value shared between the first node and the second node. Therefore, the second node can use the shared key to decrypt the first protected key and obtain the group key of the first communication group.

[0196] Optionally, the second node decrypting the first protective key based on a shared key between the first and second nodes, in accordance with the first node's method of encrypting the group key, may include at least the following implementations:

[0197] Implementation Method 1: The second node decrypts the first protection key using the shared key and obtains the group key for the first communication group. See Figure 4 for example. The first node decrypts the first protection key 403 using the shared key 402 and obtains the group key 401 for the first communication group.

[0198] Solution 2 for implementation: The second node may decrypt the first protective key by using the shared key and the second freshness parameter to obtain the group key for the first communication group.

[0199] Implementation Method 3: The second node generates a first intermediate key based on the shared key, decrypts the first protective key using the first intermediate key, and obtains the group key for the first communication group. See Figure 5 for example. The second node generates a first intermediate key 503 based on the shared key 504, decrypts the first protective key 502 using the first intermediate key 503, and obtains the group key 501 for the first communication group.

[0200] Implementation Method 4: The second node generates a first intermediate key based on the shared key and a second freshness parameter, and uses the first intermediate key to decrypt the first protective key and obtain the group key for the first communication group. For example, the second node generates a first intermediate key Kg based on the shared key Kdh and the value of a first counter counter1 by using a first KDF, e.g., Kg = first KDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the first intermediate key Kg based on the shared key Kdh. In another example, the second node generates a first intermediate key Kg based on the session key Kenc and a second freshness parameter NONCEk by using a first KDF, e.g., Kg = first KDF(Kenc, NONCEk). In another example, the first node generates a first intermediate key Kg based on a shared key Kgt and a one-time number NONCK (or counter value counter) by using a first KDF, for example, Kg = first KDF(Kenc, NONCEk (or counter)).

[0201] Optionally, the second node may decrypt the first protective key by using the first intermediate key, in particular as follows: The second node performs an exclusive OR operation on the first protective key and the first intermediate key to obtain the group key of the first communication group. For example, the second node decrypts the first protective key GKc to obtain the group key GK of the first communication group, which is given by expression

number

[0202] Optionally, the second node may send an association completion message to the first node. The association completion message is used to indicate to the first node that the association has been successfully established. Optionally, the second node may encrypt the association completion message using an encryption key. Correspondingly, the first node may decrypt the association completion message using the corresponding decryption key to obtain the data contents of the association completion message. Optionally, the association completion message may include a message authentication code, which is used by the first node to verify the integrity of the association completion message.

[0203] Optionally, the first association establishment message may further include information indicating the group security algorithm of the first communication group. In particular, the first node may determine the group security algorithm of the first communication group. The group security algorithm is an algorithm supported by the nodes in the group, and may also be called a group algorithm, and may include one or more of the following: a group encryption algorithm, a group integrity protection algorithm, a group KDF algorithm, or similar.

[0204] It should be noted that "decryption" in the aforementioned implementation can be an independent step or a function. That is, other information can be obtained by decrypting the information, or other information can be obtained by using the information in the decryption method.

[0205] Furthermore, optionally, the first node may determine the group security algorithm for the first communication group, including at least the following cases:

[0206] Case 1: The group security algorithm corresponding to a first communication group is pre-configured or defined on a first node. Thus, the first node can determine the corresponding group security algorithm based on the identifier of the first communication group (e.g., the number of the first communication group). For example, the group integrity protection algorithm is used as an example. Figures 6A and 6B are schematic diagrams of a method for determining a group security algorithm according to one embodiment of the present application. It can be seen that the group algorithm corresponding to the ID of a communication group can be determined based on the ID of the communication group. For example, see the information in area 601. It can be seen that the group integrity protection algorithm corresponding to the communication group whose group ID (group identify, GID) is GID2 is the ZUC cryptographic algorithm (ZUC). Optionally, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the node of the first communication group.

[0207] Case 2: The first node may determine the group security algorithm based on an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy. See Figures 6A and 6B. An example is used where the first algorithm selection policy is a priority-based algorithm selection policy. See the information in area 602. Node E0 is a node in a communication group whose ID is GID1, and it can be seen that communication group GID1 includes nodes E0, E1, and E2. The first node may obtain security capabilities information for the nodes in the group. See the information in area 603. It can be seen that the integrity protection algorithms supported by node E0 are AES-CCM, ZUC, and AES-GCM, the integrity protection algorithms supported by node E1 are AES-CCM and AES-GCM, the security algorithms supported by node E2 are AES-CCM and AES-GCM, and all nodes in the group support AES-CCM and AES-GCM. See area 604. It can be seen that the priority of AES-CCM is 1. See area 605. It can be seen that the priority of AES-GCM is 3. Therefore, AES-CCM can be determined as the integrity protection algorithm.

[0208] Optionally, in an order-based algorithm selection policy, the security algorithm with the earlier order may be determined based on a predefined or preset order. Furthermore, optionally, if two algorithms supported by nodes in a communication group have the same priority, the security algorithm with the earlier order may be selected.

[0209] Optionally, the group security algorithm of the first communication group includes a third KDF algorithm. The first node may generate a session key for the first communication group by using the third KDF algorithm based on the group key and session key type of the first communication group. The session key type may include one or more of the following: signaling plane encryption key, signaling plane integrity protection key, user plane encryption key, user plane integrity protection key, and similar. For example, a signaling plane encryption key is used as an example. The signaling plane encryption key Kenc is generated by using the third KDF based on the group key GK of the first communication group and the key type "enc" of the signaling plane encryption key, for example, Kenc = third KDF(GK,"enc"). In another example, the third KDF may specifically include multiple hash algorithms, and an algorithm identifier may be used to indicate which hash algorithm should be used. Therefore, the generated encryption key Kenc may further satisfy the formula Kenc = third KDF(GK, key type, algorithm identifier). Furthermore, the session key type may correspond to the scenario to which the session key is applied. In this application, only the four types described above are used as examples. In a particular implementation, other types of session keys may be included.

[0210] In the embodiment shown in Figure 3, after receiving an association request from a second node, the first node may determine the group key of the first communication group to which the second node belongs, then encrypt the group key using a shared key between the first and second nodes to obtain a first protective key, and carry the first protective key in an association establishment message, and send the association establishment message to the second node. Since the protective key carried in the association establishment message is obtained by encrypting the group key using a shared key, it can be seen that the privacy of the group key can be protected regardless of whether the first association establishment message is encrypted or not. In this way, when performing multicast communication with a first communication group, the first node can encrypt the multicast message using the group key to protect the multicast message, prevent non-group members from obtaining the communication content, and improve the security of multicast communication.

[0211] Furthermore, the first node can send the group key to the second node using a protective key in the association establishment message, integrating the group key distribution procedure into the procedure for establishing the association between the first and second nodes. Therefore, no additional key distribution procedure is required, thereby reducing network resource overhead and improving the efficiency of multicast communication.

[0212] Figure 7 shows another communication method according to one embodiment of this application. This communication method can be implemented based on the architecture shown in Figure 1. This method includes at least the following steps.

[0213] Step S701: The first node determines that the conditions for updating the group key of the first communication group are met.

[0214] In particular, the conditions for updating the group key of the first communication group include at least one of the following conditions:

[0215] Condition 1: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the same round count cycle, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is the frame number of a communication frame that was encrypted for the first time using the group key of the first communication group.

[0216] The frame number of a communication frame includes the record value and serial number of the communication frame. The frame number may be used to encrypt the communication frame during the transmission process of the communication frame. Optionally, the communication frame may be a MAC data frame, and the serial number may be a MAC serial number (MAC SN). Figures 8A and 8B are schematic diagrams of possible communication scenarios according to one embodiment of the present application. A first node may send a multicast message to multiple nodes in a communication group, and the multicast message is sent in the form of a communication frame. For ease of explanation, the sending of a multicast message to a second node is used as an example in Figures 8A and 8B. The multicast message may be encrypted using a group key and a frame number. For example, communication frame 803 sent by the first node may be encrypted using frame number 801 and group key 802. Frame number 801 is a 32-bit number, and frame number 801 includes the upper 22 bits record value and the lower 10 bits serial number, where the lower 10 bits order value corresponds to the serial number of the current communication frame 803. Because the number of bits in a frame number is limited, a rollover occurs when the frame number reaches its maximum value. For example, in the communication process shown in Figures 8A and 8B, the value of frame number 801 is 0x00000000. When communication frames are sent consecutively, the frame numbers are accumulated. After the frame number value reaches its maximum value (for example, when the value of frame number 804 becomes 0xFFFFFFFF), a rollover occurs and the count starts again from 0. For example, the value of frame number 804 is 0x00000000. However, if the group key 802 is not updated when the frame number becomes 0x00000001 again, the same key and the same frame number will be used to encrypt two different communication frames (communication frame 803 and communication frame 806). As a result, the key can be easily decrypted, and communication security is compromised.Therefore, in order to avoid affecting the privacy of the group key, the group key 802 must be updated before its frame number reaches the last encrypted frame number. Note that only examples where the frame number is 32 bits are used herein. In a particular implementation process, the size of the frame number is preconfigured based on requirements, and is not limited herein.

[0217] In particular, the first node may record marked frame numbers. For example, the marked frame number may be the frame number for which the key needs to be updated, or the frame number of a communication frame that was first encrypted using the group key of the first communication group. The first node may update the group key before the accumulated frame number reaches the frame number that was last encrypted using the group key, for example, 10 frames ago. Furthermore, the first node may indicate when the new key will be applied, for example, that the new group key will be applied 5 frames ago.

[0218] In particular, the group key of the first communication group needs to be updated when the difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, while the frame number of the current communication frame and the marked frame number are in the same round count cycle. For example, the marked frame number is the frame number of the communication frame that was first encrypted using the group key of the first communication group. Figures 9A and 9B are schematic diagrams of a scenario for updating a group key according to one embodiment of the present application. Communication frame 901 is a communication frame that was first encrypted using the group key 902, and the frame number of the communication frame is 0x00000001. The first node may mark the frame number (i.e., the marked frame number is 0x00000001). If the first node needed to update the group key 10 frames ago, the first threshold is preset to 0xFFFF FFF5. In other words, when the frame number of the current communication frame reaches 0xFFFF FFF6, the difference between the frame number of the current communication frame and the marked frame number is 0xFFFF FFF5. Therefore, the first node can update the group key of the first communication group when the frame number reaches 0xFFFF FFF6. Optionally, when the group key is updated, the time at which the new group key is applied can be specified. For example, the new group key may be applied 5 frames before the marked frame number. In this case, when the frame number becomes 0xFFFF FFFB, the first node can encrypt communication frame 905 by using the new group key 904 and frame number 0xFFFF FFFB. Thus, a rollover occurs for the frame number of the communication frame, and then when the frame number reaches the marked frame number 0x00000001, the key for encrypting communication frame 905 is the new group key 904, and therefore communication security is unaffected.

[0219] It should be noted that the multiple thresholds in this application may be specified in the protocol, predefined or preset on a node, or determined by the node based on security requirements. For example, the first threshold may be obtained according to the provisions of the protocol, preset on a first node, or determined by the first node based on security requirements.

[0220] Condition 2: The difference between the marked frame number and the frame number of the current communication frame is less than or equal to the second threshold, the frame number of the current communication frame is within the next round count cycle of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is the frame number of a communication frame that has been encrypted for the first time by using the group key of the first communication group.

[0221] It can be understood that if the frame number of the current communication frame is in the next round count cycle of the marked frame number, the first node needs to update the group key before the marked frame number and the frame number of the current communication frame fall below a second threshold. For example, the marked frame number is the frame number of the communication frame that was first encrypted using the group key of the first communication group. Figures 10A and 10B are schematic diagrams of another scenario for updating a group key according to one embodiment of the present application. Communication frame 1001 is a communication frame that was first encrypted using the group key 1002, and the frame number of the communication frame is 0x5555 6666. The first node may mark the frame number (i.e., the marked frame number is 0x5555 6666). If the first node needs to update the group key 10 frames before, the second threshold is 10. In other words, if a rollover occurs for the frame number of the current communication frame and the frame number reaches 0x5555 665A, the difference between the marked frame number and the frame number of the current communication frame is 10. Therefore, the first node begins updating the group key for the first communication group when the frame number reaches 0x5555 665A. Optionally, when the group key is updated, the start time of the new group key may be determined. For example, the new group key may be applied 5 frames before the marked frame number. In this case, when the frame number reaches 0x5555 6661, the first node can encrypt communication frame 1004 by using the new group key 1005 and frame number 0x5555 6661. Thus, when the frame number of the communication frame reaches the marked frame number 0x5555 6666, the key for encrypting communication frame 1006 is the new group key 1005, and therefore communication security is unaffected.

[0222] Condition 3: The validity period of the group key for the first communication group expires, or the usage duration of the group key for the first communication group reaches the third threshold.

[0223] Optionally, the group key of the first communication group may have an expiration period. When the expiration period of the group key of the first communication group expires, the group key of the first communication group needs to be renewed. For example, the expiration period of the group key of the first communication group may be a specific time, or the frame number of a communication frame, or a counter value, or something similar. For example, the expiration period of the group key of the first communication group may be July 6, 2020, 8:08:08 AM, and may indicate that the date and time when the expiration period of the group key of the first communication group is valid is July 6, 2020, 8:08:08 AM, or that the date and time when the expiration period of the group key of the first communication group expires begins on or after July 6, 2020, 8:08:08 AM. Therefore, if the current time is the expiration period, the first node may renew the group key. Optionally, the first node may update the group key of the first communication group in advance of the expiration of its validity period, for example, 10 minutes before the validity period expires.

[0224] Optionally, the group key of the first communication group may have a usage duration. The group key of the first communication group must be updated when the usage duration of the group key of the first communication group reaches a third threshold (greater than or equal to the third threshold). Optionally, the third threshold may be specified in the protocol, predefined or preset on the first node, or determined by the first node based on security requirements. For example, the protocol may specify that the third threshold is 24 hours. The group key of the first communication group must be updated when it reaches 24 hours. In another example, the third threshold may be predefined on the first node as 1000 communication frames (specifically, possibly including 1000 management frames and 1000 data frames). The group key of the first communication group must be updated when 1000 management frames or 1000 data frames are encrypted using the group key of the first communication group.

[0225] Condition 4: At least one second node in the first communication group leaves the first communication group.

[0226] If one second node in a communication group leaves the first communication group, the first node needs to update its group key, and it can be understood that communication between the first and second nodes in the first communication group is private. For example, the first communication group GID1 includes three second nodes, from second node E0 to second node E2. Because the functionality of second node E2 is obsolete, second node E2 sends a request message to the first node, which is used to instruct it to request to exit the first communication group. After the first node determines that second node E2 has left the first communication group (for example, after the first node removes second node E2 from the nodes included in communication group GID1 in the communication group information table shown in Table 1), the first node may update the group key for the first communication group. In another example, the first node receives a configuration message sent by a higher-tier management node. The configuration message instructs the first node to remove the second node E1 from the first communication group. After the first node determines that the second node E1 has been removed from the first communication group (for example, after the first node removes the second node E1 from the nodes included in communication group GID1 in the communication group information table shown in Table 1), the first node may update the group key for the first communication group.

[0227] Furthermore, the first node may be further configured to update the group key when a second node joins the first communication group or when a second node leaves the first communication group. For example, the first communication group GID2 includes two second nodes, second node E3 and second node E4. After the administrator adds second node E9 to the first communication group (for example, after second node E9 is added to the nodes included in communication group GID2 in the communication group information table shown in Table 1), the first node may update the group key. In another example, the first node receives a configuration message instructing the first node to add second node E10 to the first communication group GID2. After the first node decides that the second node E9 will be added to the first communication group GID2 (for example, after the second node E10 is added to the nodes included in communication group GID2 in the communication group information table shown in Table 1), the first node may update the group key of the first communication group.

[0228] Step S702: The first node determines the first key based on at least one of the third freshness parameter and the identifier ID of the first communication group.

[0229] In particular, the first node determining the first key based on at least one of the third freshness parameter and the identifier ID of the first communication group includes at least two methods.

[0230] Method 1: The first node obtains one third freshness parameter and uses the third freshness parameter as the first key.

[0231] Method 2: The first node generates a first key based on at least one of a third freshness parameter and the ID of the first communication group by using a second KDF. The third freshness parameter is a freshness parameter obtained (or generated) by the first node, and can be one or more third freshness parameters. Optionally, the second KDF may be a KDF algorithm that gives the first node the highest priority. The first node may generate a first key in the following specific implementation forms:

[0232] Implementation form 1: The first node generates a first key based on a third freshness parameter and the ID of the first communication group by using a second KDF. For example, the third freshness parameter is freshness parameter NONCEg3, and the ID of the first communication group is GID. The generated first key NGK satisfies the formula NGK=KDF(NONCEg3,GID).

[0233] Implementation form 2: The first node generates a first key based on a third freshness parameter by using a second KDF. For example, the third freshness parameters are freshness parameter NONCEg3 and freshness parameter NONCEg4. The generated first key NGK satisfies the formula NGK=KDF(NONCEg3,NONCEg4).

[0234] Optionally, the first key is used to replace the group key of the first communication group and acts as the new group key for the first communication group.

[0235] Step S703: The first node encrypts the first key based on the shared key between the first node and the second node to obtain the second protected key.

[0236] In particular, the first node encrypting the first key based on the shared key between the first node and the second node may include at least the following implementations of solutions.

[0237] Implementation Solution 1: The first node encrypts the first key using a shared key and obtains the second protected key.

[0238] Solution 2 for implementation: The first node may obtain the second protected key by encrypting the first key using the shared key and a fourth freshness parameter. The fourth freshness parameter is one or more of the following: a one-time number value, counter value, frame number, and similar values ​​obtained (or generated) by the first node.

[0239] Solution 3 for implementation: The first node generates a second intermediate key based on the shared key, encrypts the first key using the second intermediate key, and obtains the second protected key.

[0240] Implementation Method 4: The first node generates a second intermediate key based on the shared key and a fourth freshness parameter, and uses the second intermediate key to encrypt the first key and obtain the second protected key. For example, the first node generates a second intermediate key Kg2 based on the shared key Kdh and the value of a first counter counter1 by using a KDF, e.g., Kg2 = KDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the second intermediate key Kg based on the shared key Kdh. In another example, the first node generates a second intermediate key Kg2 based on the session key Kenc and a fourth freshness parameter NONCEk2 by using a KDF, e.g., Kg2 = KDF(Kenc, NONCEk2).

[0241] The encryption of the first key by the first node using the second intermediate key may be as follows: The first node performs an exclusive OR operation on the first key and the first intermediate key to obtain the first protected key. For example, the second protected key GKc2 obtained by the first node through encryption is given by the expression

number

Number

[0242] Optionally, the first node determines that encryption is not enabled for the signaling plane message between the first node and the second node, and may encrypt the first key to obtain the second protection key when encryption is not enabled for the signaling plane message. Optionally, when encryption is enabled for the signaling plane message between the first node and the second node, the key update message includes the first key. Since the key update message belongs to the signaling plane message between the first node and the second node, the first key can be protected by encrypting the signaling plane message.

[0243] Step S704: The first node sends a key update message to the second node.

[0244] Specifically, the key update message includes the second protection key. It can be understood that the first node sends the key update message to the second node, and correspondingly, the second node receives the key update message from the first node.

[0245] Optionally, the key update request message further includes a fourth freshness parameter, and the fourth freshness parameter is used by the second node to decrypt the second protection key to obtain the first key.

[0246] Optionally, a key renewal request may be further used to specify the start time and / or the validity period of the first key. The start time of the first key is used to specify the time when the first key applies, and the validity period of the first key is used to specify the duration of use of the first key. Furthermore, when a key renewal request includes the start time and the validity period of the first key, the first key applies within the validity period of the first key, starting from the start time of the first key.

[0247] Optionally, the key update message may be a multicast message sent by the first node to a second node in the first communication group, or a unicast message between the first node and the second node. Optionally, if the key update message is a multicast message, the shared key used by the first node when encrypting the first key is the group key of the first communication group (or the session key of the first communication group derived from the group key). Furthermore, optionally, if the key update message is a unicast message, the first node may further send the key update message to another second node in the first communication group.

[0248] Optionally, the first node may encrypt the key update message using an encryption key, and the second node may decrypt the key update message using a corresponding decryption key to obtain the data content within the key update message. Optionally, the key update message may include a message authentication code, which the second node may use to verify the integrity of the key update message.

[0249] Step S705: The second node obtains the first key based on the shared key and the second protective key between the first and second nodes. Optionally, the second node may decrypt the second protective key based on the shared key between the first and second nodes to obtain the group key for the first communication group.

[0250] In particular, the method by which the first node encrypts the first key, and by which the first node decrypts the second protected key based on the shared key between the first node and the second node, may include at least the following implementations:

[0251] Implementation Solution 1: The second node decrypts the second protected key using the shared key and obtains the first key.

[0252] Solution 2 for implementation: The second node may decrypt the second protected key and obtain the first key by using the shared key and the fourth freshness parameter.

[0253] Solution 3 for implementation: The second node generates a second intermediate key based on the shared key, and uses the second intermediate key to decrypt the second protected key and obtain the first key.

[0254] Implementation method 4: The second node generates a second intermediate key based on the shared key and the fourth freshness parameter, and uses the second intermediate key to decrypt the second protected key and obtain the first key.

[0255] Optionally, a second node may decrypt the second protective key by using the second intermediate key, in particular as follows: The second node performs an exclusive OR operation on the second protective key and the second intermediate key to obtain the first key. For example, the second node decrypting the second protective key GKc2 based on the second intermediate key Kg2 to obtain the first key NGK is expressed as follows:

number

[0256] It should be noted that "decryption" in the aforementioned implementation can be an independent step or a function. That is, other information can be obtained by decrypting the information, or other information can be obtained by using the information in the decryption method.

[0257] Optionally, the embodiment shown in Figure 7 further includes some or all of steps S706 to S709. Steps S706 to S709 are as follows:

[0258] Step S706: The second node sends an update acknowledgment message to the first node.

[0259] It can be understood that the second node sends an update acknowledgment message to the first node, and in response, the first node receives an update acknowledgment message from the second node.

[0260] Optionally, the first communication group includes one or more second nodes. The first node may send key update messages to one or more second nodes. In response, the first node may receive update acknowledgment messages from one or more second nodes.

[0261] Optionally, the second node may encrypt the update acknowledgment message using an encryption key. Correspondingly, the first node may decrypt the update acknowledgment message using the corresponding decryption key to obtain the data content within the update acknowledgment message. Optionally, the key update acknowledgment message may include a message authentication code, which is used by the first node to verify the integrity of the update acknowledgment message.

[0262] Step S707: The first node determines that it has received an update acknowledgment message from at least one second node in the first communication group.

[0263] In particular, this indicates that a new key may be applied when it is determined that an update acknowledgment message has been received from at least one second node within the first communication group.

[0264] Optionally, after the first node receives update confirmation response messages from all nodes within the first communication group, this indicates that a new key may be applied.

[0265] Further optionally, the first node may receive update confirmation response messages from at least one node within a preset time period. If an update confirmation response message from at least one second node is received within the preset time period, this indicates that a new key may be applied. Optionally, for a node that does not receive an update confirmation response message from at least one second node, the first node may reconnect to at least one second node by using a unicast message. For example, the first communication group includes a second node A and a second node B. The first node sends a key update message to the second node A and the second node B. If the first node receives an update confirmation response message from the second node A, this indicates that a new key may be applied. For the second node B, the first node may reconnect to the second node B or further send a new encrypted key to the second node B.

[0266] Step S708: The first node applies the first key at the start time of the first key.

[0267] In particular, the start time of the first key may be predefined or preset, or may be indicated in a key update message by the first node. For example, it is predefined in the first node that the first key is applied to the fifth communication frame after the key update message is sent. For another example, the first node indicates in the key update message to apply a new key when the frame number reaches 0xFFFF FFFF6. The first node may use the first key as the new group key of the first communication group at the start time of the first key.

[0268] Step S709: The second node applies the first key at the start time of the first key.

[0269] In particular, the start time of the first key may be predefined, preset, or indicated by the first node in a key update message. For example, the second node may predefine that the first key is applied to the fifth communication frame after the key update message is received. In another example, the first node may instruct in the key update message to apply the new key when the frame number reaches 0xFFFF FFFF6. The second node may then use the first key as the new group key for the first communication group at the start time of the first key.

[0270] In the embodiment shown in Figure 7, after it is determined that the conditions for updating the group key have been met, the first key may be determined, encrypted using the shared key, and then sent to the second node using a key update message. Since the protected key carried in the key update message is obtained by encrypting the first key using the shared key, it can be seen that the privacy of the first key can be protected regardless of whether the key update message is encrypted or not.

[0271] Optionally, the method in the embodiment shown in Figure 7 may be a subsequent step of the method in the embodiment shown in Figure 3. When determining the key of a first communication group using the communication method shown in Figure 3, it can be understood that the first node may update the group key of the first communication group using the communication method shown in Figure 7. In this case, it can be understood that the method for determining the first key in the embodiment shown in Figure 7 is equivalent to the method for determining the key of the first communication group in Figure 3, and the method for encrypting the first key in the embodiment shown in Figure 7 is equivalent to the method for encrypting the group key in Figure 3.

[0272] The aforementioned method embodiment shown in Figure 3 includes solutions for many possible implementation forms. Some of these implementation solutions are then illustrated separately with reference to Figures 11, 12A, and 12B. Note that for any related concepts, operations, or logical relationships not described in Figures 11, 12A, and 12B, refer to the corresponding descriptions of the embodiments shown in Figure 3. Therefore, further details will not be provided.

[0273] Figure 11 is a schematic flowchart of a communication method according to one embodiment of this application. This method can be implemented based on the architecture shown in Figure 1. This method includes, but is not limited to, the following steps.

[0274] Step S1101: The second node sends an association request message to the first node.

[0275] In particular, the first association request message may include the device ID of the second node (which may specifically be the ID of the second node), information about the security algorithms supported by the second node (or the security capabilities (Sec Capabilities) of the second node), and freshness parameter NONCEe obtained by the second node.

[0276] The second node sends the first association request message to the first node, and in response, the first node receives the first association request message from the second node.

[0277] For a detailed explanation, please refer to the content of step S301.

[0278] Step S1102: The first node sends a security context request message to the second node.

[0279] In particular, the security context request message includes the first identity authentication information AUTHa. Optionally, the security context request message may further include one or more of the freshness parameter NONCEa obtained by the first node, information about the target security algorithm (unicast security algorithm between the first and second nodes) algorithm1, the message authentication code MAC1, and similar information.

[0280] The first ID authentication information is used by the second node to verify the ID of the first node, and the first ID authentication information is generated by the first node based on a shared key between the first and second nodes. For example, the shared key is a pre-shared key (PSK) between the first and second nodes. The AUTHa generated by the first node using the PSK satisfies the formula AUTHa = KDF(PSK). Optionally, parameters participating in KDF generation may further include one or more of the following: freshness parameter NONCEe obtained by the second node, freshness parameter NONCEa obtained by the first node, association request message, and similar. For example, AUTHa = KDF(PSK, NONCEa, association request message). These are not listed one by one in this specification.

[0281] The target security algorithm in a security context request message belongs to a set of security algorithms indicated by information about the security algorithms supported by the second node. Optionally, the target security algorithm may include one or more of the following: encryption algorithms, integrity protection algorithms, and KDFs. The target security algorithm is used to indicate the security algorithm to be used when the first node communicates with the second node.

[0282] The message authentication code MAC1 within a security context request message is used to protect the integrity of the security context request message. Optionally, the message authentication code MAC1 may be generated based on some or all of the data within the security context request message, and based on the integrity protection key and integrity protection algorithm.

[0283] It can be understood that the first node sends a security context request message to the second node, and in response, the second node receives a security context request message from the first node.

[0284] Step S1103: The second node verifies the identity of the first node based on the identity authentication information of the first node.

[0285] In particular, the first ID authentication information is generated by the first node based on a shared key. Therefore, the second node may verify the first ID authentication information and the ID of the first node by using the shared key.

[0286] In one possible implementation, the method used by the first node to generate the first ID authentication information, according to the protocol's specifications, is also used by the second node to generate a check value. If the check value is the same as the first ID authentication information, the ID verification by the first node is successful. For example, the second node generates a check value check1, i.e., check1=KDF(PSK), based on the PSK stored in the second node, and then compares check1 with the value of the first ID authentication information AUTHa. If check1 is the same as AUTHa, authentication is successful.

[0287] Optionally, if the security context request message includes message authentication code MAC1, the second node may further verify the integrity of the security context request message based on the message authentication code MAC1.

[0288] Optionally, if the verification of the first node's identity information fails, or if the verification of the integrity of the security context request message fails, this indicates that the first node's identity is untrustworthy, or that communication with the first node is insecure. Therefore, the second node may disconnect from the first node or may not be able to perform subsequent communication steps.

[0289] Step S1104. The second node sends a security context response message to the first node.

[0290] In particular, the security context response message includes a second identity authentication information AUTHe. Optionally, the security context response message may further include a message authentication code MAC1 and similar.

[0291] The second identity authentication information is used by the first node to verify the identity of the second node, and the second identity authentication information is generated by the second node based on a shared key between the first and second nodes. For example, the shared key is a PSK. The AUTHe generated by the second node using the PSK satisfies the expression AUTHe=KDF(PSK). Optionally, parameters participating in KDF generation may further include one or more of the freshness parameter NONCEe obtained by the second node, the freshness parameter NONCEa obtained by the first node, a security context request message, and similar. For example, AUTHe=KDF(PSK,NONCEe,security context request message). These are not listed one by one in this specification.

[0292] The message authentication code MAC2 within a security context response message is used to protect the integrity of the security context response message. Optionally, the message authentication code MAC2 may be generated based on some or all of the data within the security context response message, and based on the integrity protection key and integrity protection algorithm.

[0293] It can be understood that the second node sends a security context response message to the first node, and in response, the first node receives a security context response message from the second node. Optionally, the second node may encrypt the security context response message using an encryption key. In response, the first node may decrypt the security context response message using the corresponding decryption key to obtain the data content within the security context response message.

[0294] Step S1105: The first node verifies the identity of the second node based on the second identity authentication information.

[0295] In particular, the second identity authentication information is generated by the second node based on the shared key. Therefore, the first node also possesses the shared key and can verify the identity of the second node by using the shared key to verify the second identity authentication information.

[0296] In one possible implementation, the method used by the second node to generate the second identity authentication information, according to the protocol's specifications, is also used by the first node to generate a check value. If the check value is the same as the second identity authentication information, the second node's identity verification is successful. For example, the first node generates a check value check2, i.e., check2=KDF(PSK), based on the PSK stored in the first node, and then compares check2 with the value of the second identity authentication information AUTHe. If check2 is the same as AUTHe, authentication is successful.

[0297] Optionally, if the security context response message includes a message authentication code MAC2, the first node may further verify the integrity of the security context response message based on the message authentication code MAC2.

[0298] Optionally, if verification of the second node's identity information fails, or if verification of the integrity of the security context response message fails, this indicates that the second node's identity is untrustworthy, or that communication with the second node is insecure. Therefore, the first node may disconnect from the second node or may not be able to perform subsequent communication steps.

[0299] Step S1106: The first node determines the group key for the first communication group.

[0300] In particular, the first node may determine the group key of the first communication group by using at least the following method:

[0301] Method 1: The first node determines the group key of the first communication group based on the ID of the first communication group, and a correspondence exists between the ID of the first communication group and the group key of the first communication group.

[0302] Method 2: The first node obtains a one-time number NONCEa and uses NONCEa as the group key for the first communication group.

[0303] Method 3: The first node generates a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using the second KDF. For example, the first freshness parameter is freshness parameter NONCEg, and the ID of the first communication group is GID. The generated group key for the first communication group satisfies the expression GK=KDF(NONCEg,GID). In another example, the first freshness parameters are freshness parameter NONCEg1 and freshness parameter NONCEg2, and the ID of the first communication group is GID. The generated group key for the first communication group satisfies the expression GK=KDF(NONCEg1,NONCEg2). In yet another example, the generated group key for the first communication group satisfies the expression GK=KDF(GID). Optionally, parameters participating in GK generation may further include other information, such as the length of the generated key, the identifier of the hash algorithm used, and one or more of the same.

[0304] For a detailed explanation, please refer to the content of step S302.

[0305] Step S1107: The first node encrypts the group key of the first communication group based on the shared key between the first node and the second node, and obtains the first protective key.

[0306] In particular, solutions in at least the following implementation forms may be included.

[0307] Implementation Solution 1: The first node encrypts the group key using a shared key and obtains the first protected key.

[0308] Solution for implementation form 2: The first node may encrypt the group key using the shared key and the second freshness parameter to obtain the first protected key.

[0309] Solution 3 for implementation: The first node generates a first intermediate key based on the shared key, encrypts the group key using the first intermediate key, and obtains the first protected key.

[0310] Implementation Method 4: The first node generates a first intermediate key based on the shared key and the second freshness parameter, and uses the first intermediate key to encrypt the group key and obtain the first protected key.

[0311] For example, the first node generates a first intermediate key Kg based on the shared key Kdh and the value of the first counter counter1 by using the first KDF, e.g., Kg = first KDF(kdh, counter1). The first counter may be used to represent the number of times the first node generates the first intermediate key Kg based on the shared key Kdh. In another example, the first node generates a first intermediate key Kg based on the session key Kenc and the second freshness parameter NONCEk by using the first KDF, e.g., Kg = first KDF(Kenc, NONCEk). In yet another example, the first node generates a first intermediate key Kg based on the shared key Kgt and the one-time number NONCK (or counter value counter) by using the first KDF, e.g., Kg = first KDF(Kenc, NONCEk (or counter)).

[0312] Optionally, the first node may encrypt the group key of the first communication group by using the first intermediate key, specifically as follows: The first node performs an exclusive OR operation on the group key of the first communication group and the first intermediate key to obtain the first protective key. For example, the first protective key GKc obtained by the first node through encryption is given by the expression

number

number

[0313] For a detailed explanation, please refer to the contents of step S303.

[0314] Optionally, the communication method shown in Figure 11 may further include step S1108. Step S1108 is, in particular, as follows:

[0315] Step S1108: The first node determines the group security algorithm.

[0316] In particular, a group security algorithm is an algorithm supported by all nodes in a group. Optionally, the first node determining the group security algorithm for a first communication group includes at least the following cases:

[0317] Case 1: The group security algorithm corresponding to the first communication group resides on the first node. Therefore, the first node can determine the corresponding group security algorithm based on the identifier of the first communication group (for example, the number of the first communication group). For example, the group integrity protection algorithm is used as an example. Figures 6A and 6B are schematic diagrams of a method for determining a group security algorithm according to one embodiment of the present application. It can be seen that the group algorithm corresponding to the ID of the communication group can be determined based on the ID of the communication group. For example, see the information in area 601. It can be seen that the group integrity protection algorithm corresponding to the communication group whose group ID (group identify, GID) is GID2 is the ZUC cryptographic algorithm (ZUC).

[0318] Case 2: The first node may determine the group security algorithm based on an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0319] Refer to Figures 6A and 6B. An example is used where the first algorithm selection policy is a priority-based algorithm selection policy. For example, refer to the information in area 602. It can be seen that node E0 is a node in a communication group whose ID is GID1, and that communication group GID1 includes nodes E0, E1, and E2. The first node can obtain security capabilities information for the nodes in the group. Refer to the information in area 603. It can be seen that the integrity protection algorithms supported by node E0 are AES-CCM, ZUC, and AES-GCM, the integrity protection algorithms supported by node E1 are AES-CCM and AES-GCM, the security algorithms supported by node E2 are AES-CCM and AES-GCM, and the algorithms supported by all nodes in the group are AES-CCM and AES-GCM. Refer to area 604. It can be seen that the priority of AES-CCM is 1. Refer to area 605. It can be seen that AES-GCM has a priority of 3. Therefore, AES-CCM can be determined as the integrity protection algorithm.

[0320] Optionally, in an order-based algorithm selection policy, the security algorithm with the earlier order may be determined based on a predefined or preset order. Furthermore, if two algorithms supported by nodes in a communication group have the same priority, the security algorithm with the earlier order may be selected.

[0321] Optionally, the group security algorithm includes a third KDF algorithm. The first node may generate a session key for the first communication group by using the third KDF algorithm based on the group key and session key type of the first communication group. The session key type may include one or more of the following: signaling plane encryption key, signaling plane integrity protection key, user plane encryption key, user plane integrity protection key, and similar. For example, the signaling plane encryption key is used as an example. The signaling plane encryption key Kenc is generated by using the third KDF based on the group key GK of the first communication group and the key type "enc" of the signaling plane encryption key, for example, Kenc = third KDF(GK,"enc"). Furthermore, the session key type may correspond to the scenario in which the session key is applied. In this application, only the four types described above are used as examples. In specific implementations, other types of session keys may be included.

[0322] Step S109: The first node sends an association establishment message to the second node.

[0323] Optionally, the first association establishment message includes the first protective key GKc and the first communication group's group security algorithm Galgorithm.

[0324] Optionally, the first association establishment message may further include one or more of the following: a second freshness parameter NONCEk, the expiration period GK of the first communication group's group key, the start time timer of the first communication group's group key, a message authentication code MAC3, and similar. The second freshness parameter may be used by the second node to decrypt the first protection key. The expiration period of the first communication group's group key is used to indicate the usage period of the first communication group's group key. The start time timer of the first communication group's group key is used to indicate the opportunity to apply the first communication group's group key.

[0325] The MAC3 message authentication code within the association establishment message is used by the second node to verify the integrity of the association establishment message.

[0326] It can be understood that the first node sends a first association establishment message to the second node, and in response, the second node receives the first association establishment message from the first node. Optionally, the first node may encrypt the first association establishment message using an encryption key. In response, the second node may decrypt the first association establishment message using a corresponding decryption key to obtain the data content within the first association establishment message.

[0327] Step S1110: The second node decrypts the first protection key based on the shared key between the first node and the second node to obtain the group key for the first communication group.

[0328] For a detailed explanation, please refer to the contents of step S305.

[0329] Optionally, the communication method shown in Figure 11 may further include step S1111. Step S1111 is, in particular, as follows:

[0330] Step S1111: The second node sends an association completion message to the first node.

[0331] In particular, the association completion message is used to indicate to the first node that the association has been successfully established. It can be understood that the second node may send an association completion message to the first node, and in response, the first node may receive an association completion message from the second node. Optionally, the first node may encrypt the first association establishment message by using an encryption key. In response, the second node may decrypt the first association establishment message by using a corresponding decryption key to obtain the data content within the first association establishment message. Optionally, the association completion message may include a message authentication code MAC4, which is used by the first node to verify the integrity of the association completion message.

[0332] Figures 12A and 12B are schematic flowcharts of a communication method according to one embodiment of this application. This method can be implemented based on the architecture shown in Figure 1. This method includes, but is not limited to, the following steps.

[0333] Step S1201: The second node sends an association request message to the first node.

[0334] For a detailed explanation, please refer to the contents of step S1101.

[0335] Step S1202: The first node sends a security context request message to the second node.

[0336] For a detailed explanation, please refer to the content of step S1102.

[0337] Step S1203: The second node verifies the identity of the first node based on the identity authentication information of the first node.

[0338] For a detailed explanation, please refer to the content of step S1103.

[0339] Step S1204: The second node sends a security context response message to the first node.

[0340] For a detailed explanation, please refer to the content of step S1104.

[0341] Step S1205: The first node verifies the identity of the second node based on the second identity authentication information.

[0342] For a detailed explanation, please refer to the contents of Step S1105.

[0343] Step S1206: The first node determines the group key for the first communication group.

[0344] For a detailed explanation, please refer to the contents of step S1106.

[0345] Step S1207: The first node determines whether encryption is enabled for signaling plane messages between the first node and the second node.

[0346] In particular, if the first node determines that encryption is not enabled for signaling plane messages between the first node and the second node, the first node may perform step S1208 or a step after step S1208.

[0347] If the first node determines that encryption is enabled for signaling plane messages between the first node and the second node, the first node may perform step S1212 or a step after step S1212.

[0348] Step S1208: The first node encrypts the group key of the first communication group based on the shared key between the first node and the second node, and obtains the first protective key.

[0349] For a detailed explanation, please refer to the contents of step S1107.

[0350] Step S1209: The first node determines the group security algorithm.

[0351] For a detailed explanation, please refer to the content of step S1108.

[0352] Step S1210: The first node sends the first association establishment message to the second node.

[0353] For a detailed explanation, please refer to the content of step S1109.

[0354] Step S1211: The second node decrypts the first protection key based on the shared key between the first node and the second node to obtain the group key for the first communication group.

[0355] For a detailed explanation, please refer to the contents of step S1110.

[0356] Step S1212: The first node sends the second association establishment message to the second node.

[0357] In particular, if encryption is enabled for signaling plane messages between the first node and the second node, the first node sends a second association establishment message to the second node. The second association establishment message contains the group key for the first communication group. Since the second association establishment message belongs to the signaling plane messages between the first node and the second node, the group key can be protected by encrypting the signaling plane messages.

[0358] Step S1213: The second node sends an association completion message to the first node.

[0359] In particular, the association completion message is used to indicate to the first node that the association has been successfully established. It can be understood that the second node may send an association completion message to the first node, and in response, the first node may receive an association completion message from the second node. Optionally, the first node may encrypt the first association establishment message by using an encryption key. In response, the second node may decrypt the first association establishment message by using a corresponding decryption key to obtain the data content within the first association establishment message. Optionally, the association completion message may include a message authentication code, which the first node may use to verify the integrity of the association completion message.

[0360] The method in the embodiments of this application has been described in detail above, and the apparatus in the embodiments of this application is provided as follows.

[0361] Figure 13 is a schematic diagram of the structure of a communication device 130 according to one embodiment of the present application. The device 130 may be a node or a component within a node, such as a chip or integrated circuit. The device 130 may comprise a receiving unit 1301, a processing unit 1302, and a transmitting unit 1303. The units are described as follows:

[0362] The receiving unit 1301 is configured to receive association request messages from the second node.

[0363] The processing unit 1302 is configured to determine the group key of a first communication group. The first communication group is the communication group to which the second node belongs, and the group key of the first communication group is determined based on at least one of the first freshness parameter and the identifier ID of the first communication group.

[0364] The processing unit 1302 is configured to obtain a first protective key by encrypting the group key of the first communication group based on the shared key between the first node and the second node.

[0365] The transmitting unit 1303 is configured to send a first association establishment message to a second node. The first association establishment message includes a first protection key.

[0366] In another possible implementation method, the processing unit 1302 is: The system is specifically configured to encrypt the group key of the first communication group based on the shared key between the first node and the second node and a second freshness parameter, thereby obtaining the first protective key.

[0367] In another possible implementation method, the processing unit 1302 is: A first intermediate key is generated based on the shared key between the first and second nodes and a second freshness parameter using a first key derivation function (KDF), and the first KDF is a KDF supported by the second node. It is specifically configured to obtain a first protective key by performing an exclusive OR operation between the first intermediate key and the group key of the first communication group.

[0368] In yet another possible implementation, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0369] In yet another possible implementation, the second freshness parameter is the value of the first counter, which is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0370] In another possible implementation method, the processing unit 1302 is: Based on the ID of the first communication group, the group key of the first communication group is determined, and a correspondence exists between the ID of the first communication group and the group key of the first communication group, or The system is specifically configured to generate a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF.

[0371] In another possible implementation method, the processing unit 1302 is: A group security algorithm is determined, and the group security algorithm is an algorithm supported by the nodes of the first communication group, and the group security algorithm is further configured to include at least one of the group encryption algorithm, the group integrity protection algorithm, and the group KDF algorithm.

[0372] The first association establishment message further includes information used to instruct the group security algorithm.

[0373] In yet another possible implementation, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0374] In yet another possible implementation, the processing unit 1302 is specifically configured to determine a group security algorithm based on an algorithm selection policy. The algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0375] In another possible implementation, the group security algorithm includes a third KDF algorithm, and the processing unit is: The system is further configured to generate the session key for the first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0376] In other possible implementations, the key type may include one or more of the following: a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type may correspond to the scenario in which the session key is applied.

[0377] In another possible implementation method, the processing unit 1302 is: It is further configured to ensure that encryption is not enabled for signaling plane messages between the first node and the second node.

[0378] In another possible implementation, encryption is enabled for the signaling plane message between the first node and the second node, and the transmitting unit 1303, The system is further configured to send a second association establishment message to a second node, the second association establishment message containing the group key of the first communication group, and the second association establishment message belonging to the signaling plane message between the first node and the second node.

[0379] In yet another possible implementation, the processing unit 1302 is further configured to determine that the conditions for updating the group key of the first communication group are met.

[0380] The processing unit 1302 is further configured to determine a first key based on at least one of a third freshness parameter and a first communication group identifier ID.

[0381] The processing unit 1302 is further configured to encrypt the first key based on the shared key between the first node and the second node and obtain the second protected key.

[0382] The transmission unit 1303 is further configured to send a key update message to a second node. The key update message includes a second protective key.

[0383] In yet another possible implementation, the first key is used to replace the group key of the first communication group.

[0384] In yet another possible implementation, the key update message is further used to indicate the start time and validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0385] In another possible implementation method, the processing unit 1302 is: It is determined that an update acknowledgment message has been received from at least one second node belonging to the first communication group. The first key is further configured to be applied to the start time of the first key.

[0386] In another possible implementation method, the processing unit 1302 is: It is specifically configured to determine that it has received update acknowledgment messages from all second nodes belonging to the first communication group.

[0387] In another possible implementation method, the processing unit 1302 is: It is specifically configured to encrypt the key based on the shared key between the first node and the second node and a fourth freshness parameter to obtain a second protected key.

[0388] In another possible implementation method, the conditions for updating are: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the same round count cycle, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The difference between the marked frame number and the frame number of the current communication frame is less than or equal to the second threshold, the frame number of the current communication frame is within the next round count cycle of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The validity period of the group key for the first communication group expires, or the usage duration of the group key for the first communication group reaches a third threshold, or This includes at least one second node in the first communication group leaving the first communication group.

[0389] Note that for the implementation configuration of each unit, refer to the corresponding description in the embodiments shown in Figures 3, 7, 11, or 12A and 12B. Apparatus 130 may be the first node in the embodiments shown in Figures 3, 7, 11, or 12A and 12B.

[0390] In the embodiments of the apparatus of this application, it can be understood that the division into multiple units is merely a logical division based on function and is not intended to restrict the specific structure of the apparatus. In a particular implementation, some functional modules may be further divided into smaller functional modules, and some functional modules may be combined into a single functional module. However, regardless of whether the functional modules are further divided or combined, the general procedures performed by the apparatus in the communication process remain the same. For example, the receiving unit 1301 and the transmitting unit 1303 in apparatus 130 may also be combined into a single communication unit. Typically, each unit corresponds to its own program code (or program instruction). When the program code corresponding to a unit is executed on the processor, the unit performs the corresponding procedure to implement the corresponding function.

[0391] Figure 14 is a schematic diagram of the structure of a communication device 140 according to one embodiment of the present application. The device 140 may be a node or a component within a node, such as a chip or integrated circuit. The device 140 may comprise a transmitting unit 1401, a receiving unit 1402, and a processing unit 1403. The units are described as follows:

[0392] The transmitting unit 1401 is configured to send an association request message to the first node.

[0393] The receiving unit 1402 is configured to receive a first association establishment message from the first node. The first association establishment message includes a first protection key.

[0394] The processing unit 1403 is configured to obtain the group key for the first communication group based on the shared key and the first protective key between the first node and the second node. The first communication group is the communication group to which the second node belongs.

[0395] In yet another possible implementation, the first node and the second node share a shared key.

[0396] In another possible implementation method, the processing unit 1403 is: It is specifically configured to obtain a group key for a first communication group based on a shared key between the first node and the second node, a second freshness parameter, and a first protection key.

[0397] In another possible implementation method, the processing unit 1403 is: By using the first key derivation function KDF, a first intermediate key is generated based on the shared key between the first and second nodes and the second freshness parameter. It is specifically configured to obtain a group key for a first communication group based on a first intermediate key and a first protective key.

[0398] In yet another possible implementation, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0399] In yet another possible implementation, the second freshness parameter is the value of the first counter, which is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0400] In yet another possible implementation, the first association establishment message further includes information used to instruct a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm comprising at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0401] In yet another possible implementation, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0402] Alternatively, determining the group security algorithm corresponds to an algorithm selection policy. The algorithm selection policy includes at least one of the following: a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0403] In another possible implementation method, the processing unit 1403 is: The system is further configured to generate the session key for the first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0404] In other possible implementations, the key type may include one or more of the following: a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type may correspond to the scenario in which the session key is applied.

[0405] In yet another possible implementation, before encrypting the first protective key based on the shared key between the first node and the second node to obtain the group key for the first communication group, This further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0406] In yet another possible implementation, the receiving unit 1402 is further configured to receive a second association establishment message from the first node. The second association establishment message includes the group key of the first communication group and belongs to the signaling plane message between the first node and the second node.

[0407] The processing unit 1403 is further configured to decrypt the second association establishment message by using the signaling plane encryption key between the first node and the second node to obtain the group key for the first communication group.

[0408] In yet another possible implementation, the receiving unit 1402 is further configured to receive key update messages from the first node. The key update messages include a second protective key.

[0409] The processing unit 1403 is further configured to obtain the first key based on the shared key and the second protected key between the first node and the second node.

[0410] In yet another possible implementation, the first key is used to replace the group key of the first communication group.

[0411] In yet another possible implementation, the key update message is further used to indicate the start time and validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0412] In another possible implementation method, the processing unit 1403 is: Send an update confirmation response message to the first node, The first key is further configured to be applied to the start time of the first key.

[0413] In another possible implementation, the processing unit 1403 is: It is specifically configured to obtain the first key based on the shared key between the first node and the second node, a fourth freshness parameter, and the second protected key.

[0414] Note that for the implementation configuration of each unit, refer to the corresponding description in the embodiments shown in Figures 3, 7, 11, or 12A and 12B. Device 140 may also be the second node in the embodiments shown in Figures 3, 7, 11, or 12A and 12B.

[0415] Figure 15 is a schematic diagram of the structure of a communication device 150 according to one embodiment of the present application. The communication device 150 may be a node or a component within a node, such as a chip or integrated circuit. The device 150 may comprise at least one memory 1501 and at least one processor 1502. Optionally, a bus 1503 may be further included. Further optional, a communication interface 1504 may be further included. The memory 1501, processor 1502, and communication interface 1504 are connected through the bus 1503.

[0416] Memory 1501 is configured to provide a storage space that can store data such as an operating system and computer programs. Memory 1501 may be one or a combination of random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), compact disc read-only memory (CD-ROM), or similar.

[0417] The processor 1502 is a module that performs arithmetic and / or logical operations, and may be one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor unit (MPU), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), and a complex programmable logic device (CPLD).

[0418] The communication interface 1504 is configured to receive data transmitted by and / or transmit data to an external device, and may be a wired link interface such as an Ethernet cable, or a wireless link interface (Wi-Fi, Bluetooth, general wireless transmission, or similar). Optionally, the communication interface 1504 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or similar coupled to the interface.

[0419] The processor 1502 within the device 150 is configured to read computer programs stored in memory 1501 and to perform the aforementioned communication methods, for example, the communication methods described in Figures 3, 7, 11, or 12A and 12B.

[0420] For example, the processor 1502 in the device 150 reads a computer program stored in memory 1501, The operation of receiving an association request message from the second node via the communication interface 1504, An operation to determine the group key of a first communication group, wherein the first communication group is a communication group to which a second node belongs, and the group key of the first communication group is determined based on at least one of a first freshness parameter and the identifier ID of the first communication group. The operation involves encrypting the group key of the first communication group based on the shared key between the first node and the second node, and obtaining the first protective key. The operation is configured to perform the following: sending a first association establishment message to a second node via a communication interface 1504, wherein the first association establishment message includes a first protection key.

[0421] In yet another possible implementation method, processor 1502, The system is specifically configured to encrypt the group key of the first communication group based on the shared key between the first node and the second node and a second freshness parameter, thereby obtaining the first protective key.

[0422] In yet another possible implementation method, processor 1502, A first intermediate key is generated based on the shared key between the first and second nodes and a second freshness parameter using a first key derivation function (KDF), and the first KDF is a KDF supported by the second node. It is specifically configured to perform an exclusive OR operation on the first intermediate key and the group key of the first communication group to obtain the first protective key.

[0423] In yet another possible implementation, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0424] In yet another possible implementation, the second freshness parameter is the value of the first counter, which is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0425] In yet another possible implementation method, processor 1502, Based on the ID of the first communication group, the group key of the first communication group is determined, and a correspondence exists between the ID of the first communication group and the group key of the first communication group, or The system is specifically configured to generate a group key for the first communication group based on at least one of the first freshness parameter and the ID of the first communication group by using a second KDF.

[0426] In yet another possible implementation method, processor 1502, A group security algorithm is determined, and the group security algorithm is an algorithm supported by the nodes of the first communication group, and the group security algorithm is further configured to include at least one of the group encryption algorithm, the group integrity protection algorithm, and the group KDF algorithm.

[0427] The first association establishment message further includes information used to instruct the group security algorithm.

[0428] In yet another possible implementation, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0429] In yet another possible implementation, the processor 1502 is specifically configured to determine a group security algorithm based on an algorithm selection policy. The algorithm selection policy includes at least one of a priority-based algorithm selection policy and an order-based algorithm selection policy.

[0430] In another possible implementation, the group security algorithm includes a third KDF algorithm, and the processing unit is: The system is further configured to generate the session key for the first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0431] In other possible implementations, the key type may include one or more of the following: a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type may correspond to the scenario in which the session key is applied.

[0432] In yet another possible implementation method, processor 1502, It is further configured to ensure that encryption is not enabled for signaling plane messages between the first node and the second node.

[0433] In yet another possible implementation, encryption is enabled for signaling plane messages between the first node and the second node, and processor 1502, The system is further configured to send a second association establishment message to a second node via the communication interface 1504, the second association establishment message including the group key of the first communication group, and the second association establishment message belonging to the signaling plane message between the first node and the second node.

[0434] In yet another possible implementation method, processor 1502, Determine that the conditions for updating the group key of the first communication group are met. The first key is determined based on at least one of the third freshness parameter and the identifier ID of the first communication group. The first key is encrypted based on the shared key between the first node and the second node to obtain the second protected key. The system is further configured to send a key update message to a second node via the communication interface 1504, and the key update message includes a second protective key.

[0435] In yet another possible implementation, the first key is used to replace the group key of the first communication group.

[0436] In yet another possible implementation, the key update message is further used to indicate the start time and validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0437] In yet another possible implementation method, processor 1502, It is determined that an update acknowledgment message has been received from at least one second node belonging to the first communication group. The first key is further configured to be applied to the start time of the first key.

[0438] In yet another possible implementation method, processor 1502, It is specifically configured to determine that it has received update acknowledgment messages from all second nodes belonging to the first communication group.

[0439] In yet another possible implementation method, processor 1502, It is specifically configured to encrypt the first key based on the shared key between the first node and the second node and a fourth freshness parameter, thereby obtaining the second protected key.

[0440] In another possible implementation method, the conditions for updating are: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the same round count cycle, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The difference between the marked frame number and the frame number of the current communication frame is less than or equal to the second threshold, the frame number of the current communication frame is within the next round count cycle of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time using the group key of the first communication group. The validity period of the group key for the first communication group expires, or the usage duration of the group key for the first communication group reaches a third threshold, or This includes at least one second node in the first communication group leaving the first communication group.

[0441] Note that for the implementation configuration of each unit, refer to the corresponding description in the embodiments shown in Figures 3, 7, 11, or 12A and 12B. Apparatus 150 may be the first node in the embodiments shown in Figures 3, 7, 11, or 12A and 12B.

[0442] Figure 16 is a schematic diagram of the structure of a communication device 160 according to one embodiment of the present application. The communication device 160 may be a node or a component within a node, such as a chip or integrated circuit. The device 160 may comprise at least one memory 1601 and at least one processor 1602. Optionally, a bus 1603 may be further included. Further optional, a communication interface 1604 may be further included. The memory 1601, processor 1602, and communication interface 1604 are connected through the bus 1603.

[0443] Memory 1601 is configured to provide a storage space, which may store data such as an operating system and computer programs. Memory 1601 may be one or a combination of RAM, ROM, EPROM, CD-ROM, and similar.

[0444] The processor 1602 is a module that performs arithmetic and / or logical operations, and may be one or a combination of processing modules, particularly a CPU, GPU, MPU, ASIC, FPGA, and CPLD.

[0445] The communication interface 1604 is configured to receive data transmitted by and / or transmit data to an external device, and may be a wired link interface such as an Ethernet cable, or a wireless link interface (Wi-Fi, Bluetooth, or similar). Optionally, the communication interface 1604 may further include a transmitter (e.g., a radio frequency transmitter or antenna), a receiver, or similar coupled to the interface.

[0446] The processor 1602 within the device 160 is configured to read computer programs stored in memory 1601 and to perform the aforementioned communication methods, for example, the communication methods described in Figures 3, 7, 11, or 12A and 12B.

[0447] For example, the processor 1602 in the device 160 reads a computer program stored in memory 1601, The operation of sending an association request message to the first node via the communication interface 1604, An operation to receive a first association establishment message from a first node via a communication interface 1604, wherein the first association establishment message includes a first protection key, and The system is configured to perform an operation to obtain a group key for a first communication group based on a shared key and a first protective key between a first node and a second node, wherein the first communication group is the communication group to which the second node belongs.

[0448] In yet another possible implementation, the first node and the second node share a shared key.

[0449] In yet another possible implementation method, processor 1602, It is specifically configured to obtain a group key for a first communication group based on a shared key between the first node and the second node, a second freshness parameter, and a first protection key.

[0450] In yet another possible implementation method, processor 1602, By using the first key derivation function KDF, a first intermediate key is generated based on the shared key between the first and second nodes and the second freshness parameter. It is specifically configured to obtain a group key for a first communication group based on a first intermediate key and a first protective key.

[0451] In yet another possible implementation, the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

[0452] In yet another possible implementation, the second freshness parameter is the value of the first counter, which is used to represent the number of times the group key of the first communication group has been encrypted based on the shared key.

[0453] In yet another possible implementation, the first association establishment message further includes information used to instruct a group security algorithm, the group security algorithm being an algorithm supported by the nodes of the first communication group, and the group security algorithm comprising at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm.

[0454] In yet another possible implementation, the group security algorithm is the algorithm with the highest priority among the algorithms supported by the nodes of the first communication group.

[0455] Determining a group security algorithm corresponds to an algorithm selection policy, which includes at least one of a priority-based algorithm selection policy and a sequence-based algorithm selection policy.

[0456] In yet another possible implementation method, processor 1602, The system is further configured to generate the session key for the first communication group by using a third KDF algorithm based on the group key and session key types of the first communication group.

[0457] In other possible implementations, the key type may include one or more of the following: a signaling plane encryption key, a user plane encryption key, a signaling plane integrity protection key, or a user plane integrity protection key, or the session key type may correspond to the scenario in which the session key is applied.

[0458] In yet another possible implementation, before obtaining the group key for the first communication group based on the shared key and the first protective key between the first node and the second node, This further includes verifying that encryption is not enabled for signaling plane messages between the first node and the second node.

[0459] In yet another possible implementation method, processor 1602, The second association establishment message is received from the first node via the communication interface 1604, the second association establishment message includes the group key of the first communication group, and the second association establishment message belongs to the signaling plane message between the first node and the second node. The system is further configured to decrypt the second association establishment message by using the signaling plane encryption key between the first node and the second node, thereby obtaining the group key for the first communication group.

[0460] In yet another possible implementation method, processor 1602, A key update message is received from the first node via the communication interface 1604, and the key update message includes the second protective key. The system is further configured to obtain the first key based on the shared key and the second protected key between the first and second nodes.

[0461] In yet another possible implementation, the first key is used to replace the group key of the first communication group.

[0462] In yet another possible implementation, the key update message is further used to indicate the start time and validity period of the first key, and the first key is applied within the validity period of the first key, starting from the start time of the first key.

[0463] In yet another possible implementation method, processor 1602, Send an update confirmation response message to the first node, It is further configured to apply the first key to the start time of the first key.

[0464] In yet another possible implementation method, processor 1602, It is specifically configured to obtain the first key based on the shared key between the first node and the second node, a fourth freshness parameter, and the second protected key.

[0465] Note that for the implementation configuration of each unit, refer to the corresponding description in the embodiments shown in Figures 3, 7, 11, or 12A and 12B. Device 160 may also be the second node in the embodiments shown in Figures 3, 7, 11, or 12A and 12B.

[0466] One embodiment of this application further provides a computer-readable storage medium for storing a computer program. When the computer program is executed on one or more processors, the method in any embodiment shown in Figures 3, 7, 11, or 12A and 12B is performed.

[0467] One embodiment of the present application further provides a chip system. The communication device of the chip system comprises at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, and the at least one processor being configured to invoke a computer program stored in at least one memory. When the computer program is executed on one or more processors, the method in any embodiment shown in Figures 3, 7, 11, or 12A and 12B is performed.

[0468] One embodiment of the present application further provides a terminal, which includes a first node (e.g., an automotive cockpit domain controller CDC) and / or a second node (e.g., at least one of modules such as a camera, screen, microphone, speaker, radar, electronic key, and passive entry / passive start system controller). The first node includes the device described in the embodiment shown in Figure 13 or Figure 15, and the second node includes the device described in the embodiment shown in Figure 13 or Figure 15.

[0469] Furthermore, optionally, the terminal may be a vehicle, an unmanned aerial vehicle, a robot, a device in a smart home scenario, a device in a smart manufacturing scenario, or similar.

[0470] One embodiment of the present application further provides an intelligent cockpit product. The intelligent cockpit product includes a first node (e.g., an automotive cockpit domain controller CDC). The first node is the first node in any embodiment shown in Figures 3, 7, 11, or 12A and 12B. Furthermore, the intelligent cockpit product includes a second node (e.g., at least one of modules such as a camera, screen, microphone, speaker, radar, electronic key, and passive entry / passive start system controller). The second node is the second node in any embodiment shown in Figures 3, 7, 11, or 12A and 12B.

[0471] One embodiment of the present application further provides a vehicle. The vehicle includes a first node (e.g., an automotive cockpit domain controller CDC). The vehicle further includes a second node (e.g., at least one of modules such as a camera, screen, microphone, speaker, radar, electronic key, and passive entry / passive start system controller). The first node is the first node in any embodiment shown in Figures 3, 7, 11, or 12A and 12B, and the second node is the second node in any embodiment shown in Figures 3, 7, 11, or 12A and 12B. Alternatively, the vehicle may be replaced by an intelligent terminal or a means of transport such as an unmanned aerial vehicle or robot.

[0472] One embodiment of this application further provides a computer program product. When the computer program product is executed on one or more processors, the communication methods described in any embodiment shown in Figures 3, 7, 11, or 12A and 12B may be performed.

[0473] All or some of the embodiments described above may be implemented using software, hardware, firmware, or any combination thereof. When software is used to implement an embodiment, all or some of the embodiments may be implemented in the form of a computer product (e.g., a computer program or computer instructions). When the computer program product is loaded onto a computer and executed, all or part of the procedures or functions according to the embodiments of this application are generated. The computer may be a general-purpose computer, a dedicated computer, a computer network, or another programmable device. The computer program product may be stored on or transmitted through a computer-readable storage medium. The computer-readable storage medium may be any available medium accessible by a computer or a data storage device, such as a server or data center, which integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, or magnetic tapes), optical media (e.g., DVDs), semiconductor media (e.g., solid-state disks (SSDs)), or similar.

[0474] Reordering, combining, or deleting steps in the method embodiments of this application may be performed on the basis of actual requirements.

[0475] Combinations, divisions, and deletions may be performed on modules in the apparatus embodiments of this application based on actual requirements. [Explanation of Symbols]

[0476] 101 First Node 102 First Communications Group 103 Second node 104 Second node 130 Communication equipment 140 Communication equipment 150 Communication devices 160 Communication devices 201 Cockpit Domain Controller 202 Camera 203 Camera 401 Group Key 402 shared key 403 First protective key 404 First Association Establishment Message 501 Group Key 502 First protective key 503 First intermediate key 504 shared key 505 First Association Establishment Message 601 area 602 areas 603 area 604 area 605 area 801 Frame number 802 Group Key 803 Communication Frame 806 communication frame 901 communication frame 902 Group Key 904 Group Key 905 Communication Frame 1001 Communication Frame 1002 Group Key 1004 Communication Frame 1005 Group Key 1006 Communication Frame 1301 Receiving Unit 1302 Processing Unit 1303 Transmitter Unit 1401 Transmitter Unit 1402 Receiving Unit 1403 Processing Unit 1501 memory 1502 Processors 1503 Bus 1504 Communication Interface 1601 memory 1602 Processor 1603 Bus 1604 Communication Interface

Claims

1. A communication method implemented by the first node, The steps include receiving an association request message from the second node, A step of determining a group key for a first communication group, wherein the first communication group is the communication group to which the second node belongs, and the group key for the first communication group is obtained based on at least one of a first freshness parameter and an identifier (ID) of the first communication group. The steps include: encrypting the group key of the first communication group based on the shared key between the first node and the second node to obtain a first protective key; A step of sending a first association establishment message to the second node, wherein the first association establishment message includes the first protection key, Includes, The step of determining the group key for the first communication group is: The step of generating the group key for the first communication group based on the first freshness parameter and the ID of the first communication group by using a second key derivation function (KDF). A communication method that includes this.

2. The step of obtaining a first protective key by encrypting the group key of the first communication group based on the shared key between the first node and the second node is: The method according to claim 1, further comprising the step of obtaining the first protection key by encrypting the group key of the first communication group based on the shared key and a second freshness parameter between the first node and the second node.

3. The method according to claim 2, wherein the shared key is an encryption key between the first node and the second node, the second freshness parameter is a one-time number, and the first association establishment message includes the second freshness parameter.

4. The method according to claim 2, wherein the second freshness parameter is the value of a first counter, the first counter being used to represent the number of times the group key of the first communication group is encrypted based on the shared key.

5. The aforementioned method, A step of determining a group security algorithm, wherein the group security algorithm is an algorithm supported by the nodes of the first communication group, and the group security algorithm includes at least one of a group encryption algorithm, a group integrity protection algorithm, and a group KDF algorithm. The method according to any one of claims 1 to 4, further comprising the step that the first association establishment message further includes information used to instruct the group security algorithm.

6. The group security algorithm includes a third KDF algorithm, and the method is The method according to claim 5, further comprising the step of generating a session key for the first communication group by using the third KDF algorithm based on the type of the group key and the session key for the first communication group.

7. Prior to the step of obtaining a protective key by encrypting the group key of the first communication group based on the shared key between the first node and the second node, the method: The method according to any one of claims 1 to 6, further comprising the step of confirming that encryption is not enabled for signaling plane messages between the first node and the second node.

8. The aforementioned method, A step of determining whether the conditions for updating the group key of the first communication group are met, A step of determining a first key based on at least one of a third freshness parameter and the ID of the first communication group, The steps include: encrypting the first key based on the shared key between the first node and the second node to obtain a second protective key; A step of sending a key update message to the second node, wherein the key update message includes the second protective key, The method according to any one of claims 1 to 7, including the method described in any one of claims 1 to 7.

9. The method according to claim 8, wherein the key update message is further used to indicate the start time of the first key.

10. After the step of sending the key update message to the preceding second node, the method, The steps include determining that an update acknowledgment message has been received from at least one second node belonging to the first communication group, The steps include applying the first key to the start time of the first key, The method according to claim 9, further comprising:

11. The step of obtaining a second protective key by encrypting the first key based on the shared key between the first node and the second node is: The method according to any one of claims 8 to 10, further comprising the step of encrypting the first key based on the shared key between the first node and the second node and a fourth freshness parameter to obtain the second protective key.

12. The conditions for updating the group key of the first communication group are: The difference between the frame number of the current communication frame and the marked frame number is greater than or equal to a first threshold, the frame number of the current communication frame and the marked frame number are within the same round count cycle, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time by using the group key of the first communication group. The difference between the marked frame number and the frame number of the current communication frame is less than or equal to a second threshold, the frame number of the current communication frame is within the next round count cycle of the marked frame number, the marked frame number is a frame number for which a key update needs to be performed, or the marked frame number is a frame number of a communication frame that has been encrypted for the first time by using the group key of the first communication group. The validity period of the group key of the first communication group expires, or the usage duration of the group key of the first communication group reaches a third threshold, or The method according to any one of claims 8 to 11, comprising the at least one second node in the first communication group leaving the first communication group.

13. A communication device comprising a unit configured to perform the method described in any one of claims 1 to 12.

14. A chip system comprising at least one processor and a communication interface, the communication interface being configured to transmit and / or receive data, the at least one processor calling a computer program stored in at least one memory, thereby the device on which the chip system is located implements the method according to any one of claims 1 to 12.

15. A computer-readable storage medium, the computer-readable storage medium storing a computer program, wherein the method described in any one of claims 1 to 12 is performed when the computer program is executed on one or more processors.

16. A program that causes a computer to perform the steps described in any one of claims 1 to 12.

Images