Secure communication method and apparatus

Abstract

The present application relates to the technical field of wireless communications, and provides a secure communication method and apparatus, for use in improving the data transmission performance. In the method, a communication apparatus receives an i-th codeword, wherein the i-th codeword is obtained by encoding an i-th first data packet. The i-th first data packet is obtained by encrypting an i-th second data packet on the basis of an i-th random seed. The communication apparatus sends response information of the i-th codeword on the basis of a decoding result of the i-th codeword. The response information is used for indicating that the i-th codeword is successfully decoded or fails to be decoded. On the basis of the solution, a communication apparatus of a sending end can determine, on the basis of the response information, whether a communication apparatus of a receiving end correctly decodes the i-th codeword, and when an (i+1)-th codeword is transmitted, the communication apparatus of the sending end can adjust the random seed on the basis of whether the receiving end correctly decodes the i-th codeword, so that an error is prevented from continuing to diffuse when the i-th codeword fails to be decoded.

Description

A secure communication method and device Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a secure communication method and device. Background Art

[0002] Secure transmission is the foundation of communication. Most secure transmission solutions are key-based and can be categorized as symmetric or asymmetric. Symmetric encryption involves a shared key between two parties, while asymmetric encryption requires one party to pass a public key to the other. The sender uses the public key for encryption, while the receiver uses the private key for decryption. Both methods require key maintenance and management, which requires complex protocols. Vulnerabilities in these protocols are often exploited by adversaries. Furthermore, these complex protocols incur additional communication overhead and latency, making them unsuitable for the highly dynamic nature of future communication networks.

[0003] Currently, physical layer security transmission technologies, such as secure coding, secure waveform modulation, or the introduction of artificial noise into the channel, can be used to achieve information transmission and provide basic security capabilities. However, the security capabilities provided by physical layer security transmission technologies are limited, and non-intended receivers are still likely to obtain transmitted information.

[0004] Summary of the Invention

[0005] The present application provides a secure communication method and apparatus for preventing a decoding error of a data packet from spreading among different packets, thereby improving data transmission performance.

[0006] In a first aspect, a secure communication method is provided. The method can be performed by a communication device. The communication device can be a terminal device or a network device, or it can be said to be a chip / chip system applied to the terminal device or network device. In this method, the communication device receives an i-th codeword, which is obtained by encoding the i-th first data packet. The i-th first data packet is obtained by encrypting the i-th second data packet based on the i-th random seed. It should be understood that if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1th random seed and the i-1th second data packet, or the i-1th random seed is generated based on the i-1th random seed and the i-1th first data packet. If i is 1, the i-th random seed is generated based on a random vector. Based on the decoding result of the i-th codeword, the communication device sends response information for the i-th codeword. The response information is used to indicate whether the i-th codeword was successfully decoded or failed to be decoded.

[0007] Based on the above scheme, the security performance of the codeword can be improved by encrypting the codeword with a random seed. Not only that, the communication device at the sending end can determine whether the communication device at the receiving end correctly decodes the i-th codeword based on the response information. When transmitting the i+1-th codeword, the communication device at the sending end can adjust the random seed based on whether the receiving end correctly decodes the i-th codeword, thereby avoiding the continued spread of errors when the decoding of the i-th codeword fails.

[0008] In one possible implementation, the communication device determines the i-th second data packet and the i+1-th random seed based on the i-1-th random seed, the i-1-th first data packet, and the i-th first data packet. Alternatively, the communication device determines the i-th second data packet and the i+1-th random seed based on the i-1-th random seed, the i-1-th second data packet, and the i-th first data packet. The response information indicates that decoding of the i-1-th codeword was successful.

[0009] Based on the above scheme, when the communication device at the receiving end correctly decodes the i-th codeword, it can decrypt the i-th first data packet based on the i-th random seed to obtain the i-th second data packet and the i+1-th random seed, which can be used to decrypt the next codeword.

[0010] In one possible implementation, a communication device sets the i-th second data packet to a first fixed sequence. The response information indicates that decoding of the i-th codeword failed. The communication device receives the i+1-th codeword, which is obtained by encoding the i+1-th first data packet. The i+1-th first data packet is obtained by encrypting the i+1-th second data packet based on the i+1-th random seed, which is generated based on the first fixed sequence.

[0011] Since the communication device at the sending end encrypts the second data packet based on a random seed, if the communication device at the receiving end fails to decode the codeword, the communication device at the receiving end will not obtain the correct second data packet after decrypting the decoding result, and the error will spread between different data packets. Based on the above scheme, in the event of a decoding error, the second data packet is set to a fixed sequence, which can prevent the decoding error from spreading to the terminal device. At the same time, due to the independence of the non-target channel and the legitimate channel, the sequence number of the data packet that generates the decoding error of the non-target receiver cannot be completely consistent with that of the terminal device. This means that the non-target receiver cannot maintain synchronization with the random seed of the communication device at the sending end, so it can be guaranteed that the decoding error of the non-target receiver is spread, thereby achieving no impact on the transmission performance of the legitimate user while improving the security of the communication.

[0012] In one possible implementation, a communication device sets the (i+1)th random seed to a second fixed sequence. The response information indicates that decoding of the (i+1)th codeword failed. The communication device receives the (i+1)th codeword, which is obtained by encoding the (i+1)th first data packet. The (i+1)th first data packet is obtained by encrypting the (i+1)th second data packet based on the (i+1)th random seed.

[0013] Since the communication device at the transmitting end encrypts the second data packet based on the random seed, if the communication device at the receiving end fails to decode the codeword, the communication device at the receiving end will not obtain the correct second data packet after decrypting the decoding result, and the error will spread between different data packets. Based on the above scheme, in the event of a decoding error, the random seed is set to a fixed sequence, which can prevent the decoding error from spreading to the terminal device. At the same time, due to the independence of the non-target channel and the legitimate channel, the sequence number of the data packet with a decoding error generated by the non-target receiver cannot be completely consistent with that of the terminal device. This means that the non-target receiver cannot maintain synchronization of the random seed with the communication device at the transmitting end, so it can be guaranteed that the decoding error of the non-target receiver is spread, thereby achieving no impact on the transmission performance of the legitimate user while improving the security of the communication.

[0014] In one possible implementation, before the communication device sets the i-th second data packet to the first fixed sequence or sets the i+1-th random seed to the second fixed sequence, the i-th codeword satisfies the following conditions: decoding of the i-th codeword fails and the number of retransmissions of the i-th codeword reaches a preset threshold.

[0015] Based on the above solution, if decoding fails, the receiving communication device can request the transmitting communication device to retransmit the i-th codeword so that the receiving communication device can successfully decode it. If the number of retransmissions reaches a preset threshold, the receiving communication device can set the i-th second data packet to the first fixed sequence or the i+1th random seed to the second fixed sequence to prevent the error from spreading to other data packets.

[0016] In one possible implementation, the first fixed sequence is pre-agreed. Based on this solution, by pre-agreing on the first fixed sequence, even if the receiving communication device fails to decode the i-th codeword, the transmitting and receiving communication devices can still synchronize the (i+1)th random seed, thereby preventing the error of the i-th data packet from propagating to the (i+1)th data packet or even multiple subsequent data packets.

[0017] In one possible implementation, the second fixed sequence is pre-agreed. Based on this solution, by pre-agreing on the second fixed sequence, even if the receiving communication device fails to decode the i-th codeword, the transmitting and receiving communication devices can still synchronize the (i+1)th random seed, thereby preventing the error of the i-th data packet from propagating to the (i+1)th data packet or even multiple subsequent data packets.

[0018] In one possible implementation, a communication device receives a first codeword, which is obtained by encoding a first random seed. The communication device decodes the first codeword to obtain the first random seed. Based on this solution, the transmitting and receiving communication devices can synchronize the first random seed.

[0019] In a second aspect, a secure communication method is provided. The method can be performed by a communication device. The communication device can be a terminal device or a network device, or it can be said that it is a chip / chip system applied to the terminal device or the network device. In this method, the communication device encrypts the i-th second data packet based on the i-th random seed to obtain the i-th first data packet. Wherein, if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet; if i is equal to 1, the i-th random seed is generated based on a random vector. The communication device encodes the i-th first data packet to obtain the i-th codeword. The communication device sends the i-th codeword. The communication device receives response information for the i-th codeword. Wherein, the response information is used to indicate whether the i-th codeword is decoded successfully or failed.

[0020] In one possible implementation, the response information indicates that decoding of the i-th codeword failed. The communication device sets the i-th second data packet to the first fixed sequence. The communication device encrypts the i+1-th second data packet based on the i+1-th random seed to obtain the i+1-th first data packet. The i+1-th random seed is generated based on the first fixed sequence. The communication device encodes the i+1-th first data packet to obtain the i+1-th codeword. The communication device transmits the i+1-th codeword.

[0021] In one possible implementation, the response information indicates that decoding of the i-th codeword failed. The communication device sets the i+1th random seed to a second fixed sequence. The communication device encrypts the i+1th second data packet based on the i+1th random seed to obtain the i+1th first data packet. The i+1th random seed is generated based on the second fixed sequence. The communication device encodes the i+1th data packet to obtain the i+1th codeword. The communication device then transmits the i+1th codeword.

[0022] In one possible implementation, before the communication device sets the i-th second data packet to the first fixed sequence or sets the i+1-th random seed to the second fixed sequence, the i-th codeword satisfies the following conditions: decoding of the i-th codeword fails and the number of retransmissions of the i-th codeword reaches a preset threshold.

[0023] In a possible implementation, the first fixed sequence is pre-agreed.

[0024] In a possible implementation, the second fixed sequence is pre-agreed.

[0025] In a possible implementation, the communication device encodes the first random seed to obtain the first codeword, and sends the first codeword.

[0026] According to a third aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0027] The transceiver unit is used to receive the i-th codeword. The i-th codeword is obtained by encoding the i-th first data packet. The i-th first data packet is obtained by encrypting the i-th second data packet based on the i-th random seed. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet or the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet. If i is equal to 1, the i-th random seed is generated based on a random vector. The processing unit is used to generate response information of the i-th codeword based on the decoding result of the i-th codeword. The transceiver unit is also used to send response information of the i-th codeword. The response information is used to indicate whether the i-th codeword is decoded successfully or failed.

[0028] In one possible implementation, the processing unit is further configured to determine the i-th second data packet and the i+1-th random seed based on the i-1-th random seed, the i-1-th first data packet, and the i-th first data packet. Alternatively, the processing unit is further configured to determine the i-th second data packet and the i+1-th random seed based on the i-1-th random seed, the i-1-th second data packet, and the i-th first data packet. The response information is used to indicate that decoding of the i-th codeword was successful.

[0029] In one possible implementation, the processing unit is further configured to set the i-th second data packet to a first fixed sequence. The response information indicates that decoding of the i-th codeword failed. The transceiver unit is further configured to receive an i+1-th codeword, where the i+1-th codeword is obtained by encoding the i+1-th first data packet. The i+1-th first data packet is obtained by encrypting the i+1-th second data packet based on an i+1-th random seed, where the i+1-th random seed is generated based on the first fixed sequence.

[0030] In one possible implementation, the processing unit is further configured to set the (i+1)th random seed to a second fixed sequence. The response information indicates that decoding of the (i)th codeword failed. The transceiver unit is further configured to receive the (i+1)th codeword, where the (i+1)th codeword is obtained by encoding the (i+1)th first data packet. The (i+1)th first data packet is obtained by encrypting the (i+1)th second data packet based on the (i+1)th random seed.

[0031] In one possible implementation, before the i-th second data packet is set to the first fixed sequence or before the i+1-th random seed is set to the second fixed sequence, the i-th codeword satisfies the following conditions: decoding of the i-th codeword fails and the number of retransmissions of the i-th codeword reaches a preset threshold.

[0032] In a possible implementation, the first fixed sequence is pre-agreed.

[0033] In a possible implementation, the second fixed sequence is pre-agreed.

[0034] In one possible implementation, the transceiver unit is further configured to receive a first codeword, where the first codeword is obtained by encoding the first random seed. The processing unit is further configured to decode the first codeword to obtain the first random seed.

[0035] In a fourth aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0036] A processing unit is configured to encrypt the i-th second data packet based on the i-th random seed to obtain the i-th first data packet. Wherein, if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet; if i is 1, the i-th random seed is generated based on a random vector. The processing unit is further configured to encode the i-th first data packet to obtain the i-th codeword. The transceiver unit is configured to transmit the i-th codeword. The transceiver unit is further configured to receive response information for the i-th codeword. The response information is configured to indicate whether the i-th codeword was successfully decoded or failed to be decoded.

[0037] In one possible implementation, the response information indicates that decoding of the i-th codeword failed. The processing unit is further configured to set the i-th second data packet to a first fixed sequence. The processing unit is further configured to encrypt the i-th second data packet based on the i+1-th random seed to obtain the i+1-th first data packet. The i+1-th random seed is generated based on the first fixed sequence. The processing unit is further configured to encode the i+1-th first data packet to obtain the i+1-th codeword. The transceiver unit is further configured to transmit the i+1-th codeword.

[0038] In one possible implementation, the response information indicates that decoding of the i-th codeword failed. The processing unit is further configured to set the i+1th random seed to a second fixed sequence. The processing unit is further configured to encrypt the i+1th second data packet based on the i+1th random seed to obtain the i+1th first data packet. The i+1th random seed is generated based on the second fixed sequence. The processing unit is further configured to encode the i+1th data packet to obtain the i+1th codeword. The transceiver unit is further configured to transmit the i+1th codeword.

[0039] In one possible implementation, before the i-th second data packet is set to the first fixed sequence or before the i+1-th random seed is set to the second fixed sequence, the i-th codeword satisfies the following conditions: decoding of the i-th codeword fails and the number of retransmissions of the i-th codeword reaches a preset threshold.

[0040] In a possible implementation, the first fixed sequence is pre-agreed.

[0041] In a possible implementation, the second fixed sequence is pre-agreed.

[0042] In a possible implementation, the processing unit is further configured to encode the first random seed to obtain the first codeword. The transceiver unit is further configured to send the first codeword.

[0043] In a fifth aspect, a communication device is provided. The communication device may be a communication device in any possible implementation of the third aspect or the fourth aspect of the above-mentioned embodiment, or a chip provided in a communication device in any of the third aspect or the fourth aspect. The communication device includes a communication interface and a processor, and optionally, also includes a memory. The memory is used to store computer programs, instructions, or data, and the processor is coupled to the memory and the communication interface. When the processor reads the computer program, instructions, or data, the communication device executes the method executed by the communication device in any possible implementation of the first aspect, or executes the method executed by the communication device in any possible implementation of the second aspect.

[0044] It should be understood that the communication interface can be implemented by an antenna, a feeder, a codec, etc. in the communication device, or, if the communication device is a chip provided in the communication device, the communication interface can be an input / output interface of the chip, such as an input / output pin, etc. The communication device may further include a transceiver for communicating between the communication device and other devices.

[0045] In a sixth aspect, an embodiment of the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method performed by the communication device in any possible implementation of the first to second aspects. In one possible implementation, the chip system also includes a memory for storing program instructions and / or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0046] In a seventh aspect, the present application provides a computer-readable storage medium, which stores a computer program or instruction. When the computer program or instruction is executed, the method performed by the communication device in the above aspects is implemented.

[0047] In an eighth aspect, a computer program product is provided, comprising: computer program code or instructions, which, when executed, causes the method performed by the communication device in the above aspects to be executed.

[0048] In a ninth aspect, a communication device is provided, which includes a unit or module for executing the above-mentioned methods.

[0049] In a tenth aspect, a chip system is provided, comprising a logic circuit and an input / output interface. The logic circuit is configured to execute the method executed by the aforementioned communication device. The input / output interface is configured to communicate with other devices.

[0050] In an eleventh aspect, a system is provided, comprising at least one communication device that performs any possible implementation of the first aspect and at least one communication device that performs any possible implementation of the second aspect.

[0051] The beneficial effects of the above-mentioned second to eleventh aspects and their implementation methods can refer to the description of the beneficial effects of the method of the first aspect and its implementation method. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] FIG1 is a schematic diagram of a communication system provided in an embodiment of the present application;

[0053] FIG2 is a schematic diagram of a keyless secure transmission architecture;

[0054] FIG3 is a schematic diagram of a security module;

[0055] FIG4 is an exemplary flow chart of a secure communication method provided in an embodiment of the present application;

[0056] FIG5 is a schematic diagram of a security processing method provided in an embodiment of the present application;

[0057] FIG6 is a schematic diagram of another secure communication method provided in an embodiment of the present application;

[0058] FIG7 is a schematic diagram of another secure communication method provided in an embodiment of the present application;

[0059] FIG8 is a schematic diagram of a communication device provided in an embodiment of the present application;

[0060] FIG9 is a schematic diagram of another communication device provided in an embodiment of the present application;

[0061] FIG10 is a schematic diagram of another communication device provided in an embodiment of the present application;

[0062] FIG11 is a schematic diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] To facilitate understanding of the technical solutions involved in the embodiments of the present application, the technical terms provided in the embodiments of the present application are introduced.

[0064] 1) Random seed, also known as random entropy or state information, refers to information used for secure processing of transport blocks. For example, it is used for encryption or integrity protection of transport blocks. Alternatively, the random seed can be used directly for secure processing of transport blocks or derived through algorithms such as hashing algorithms to generate a key for secure processing of transport blocks.

[0065] Optionally, the random seed can be used as the input and output of the security module. The random seed output by the security module can be a function of the random seed input by the security module and the message input by the security module. There are many ways to implement this function, such as the output random seed Seed out =HASH(Seed in ,M out ), namely Seed i =HASH(Seed i-1 ,EXT(M i-1 ,Seed i-1 )). HASH is a hash operation, EXT is a random extraction operation, and Seed in is the random seed input by the security module, M out Is the message input by the security module. EXT(M i-1 ,Seed i-1) refers to the randomness extraction operation on the i-1th random seed and the i-1th message.

[0066] 2) Data grouping, which can also be understood as message grouping, refers to the grouping of information to be transmitted, such as source message grouping, encoded code block grouping, etc.

[0067] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0068] The technical solutions of the embodiments of the present application can be applied to New Radio (NR) systems, Global System of Mobile communication (GSM) systems, Code Division Multiple Access (CDMA) systems, Wideband Code Division Multiple Access (WCDMA) systems, General Packet Radio Service (GPRS), Long Term Evolution (LTE) systems, LTE Frequency Division Duplex (FDD) systems, LTE Time Division Duplex (TDD) systems, Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication systems, etc., without limitation herein.

[0069] FIG1 is a schematic diagram of the architecture of a communication system 1000 used in an embodiment of the present application. As shown in FIG1 , the communication system includes a wireless access network 100. The wireless access network 100 may include at least one network device (such as 110a and / or 110b in FIG1 ) and may also include at least one terminal device (such as at least one of 120a-120j in FIG1 ). The terminal device is connected to the network device wirelessly, and the network device is connected to the core network device wirelessly or by wire. Terminal devices and network devices may be connected to each other by wire or by wireless. FIG1 is only a schematic diagram, and the communication system may also include other network devices, such as wireless relay devices and wireless backhaul devices, which are not shown in FIG1 .

[0070] A network device is a network-side device with wireless transceiver capabilities. A network device can be a device in a radio access network (RAN) that provides wireless communication capabilities for terminal devices, and is called a RAN device. For example, a network device can be a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next-generation NodeB (gNB) in a fifth-generation (5G) mobile communication system, a next-generation base station in a sixth-generation (6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system. It can also be a module or unit that performs some of the functions of a base station, such as a centralized unit (CU) or a distributed unit (DU). The CU here completes the functions of the radio resource control protocol and the packet data convergence protocol (PDCP) of the base station, and can also complete the function of the service data adaptation protocol (SDAP); the DU completes the functions of the radio link control layer and the medium access control (MAC) layer of the base station, and can also complete the functions of part of the physical layer or all of the physical layer. For the specific description of the above-mentioned protocol layers, please refer to the relevant technical specifications of the 3rd Generation Partnership Project (3GPP). The network device can be a macro base station (such as 110a in Figure 1), a micro base station or an indoor station (such as 110b in Figure 1), a relay node or a donor node, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the network device.

[0071] In another possible scenario, multiple RAN nodes collaborate to assist the terminal in achieving wireless access, and different RAN nodes implement part of the functions of the base station respectively. For example, the RAN node can be a CU, DU, CU-control plane (CP), CU-user plane (UP), or radio unit (RU). The CU and DU can be set separately, or they can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0072] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (Open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0073] A terminal device is a user-side device with wireless transceiver capabilities. A terminal device may also be referred to as user equipment (UE), a mobile station, a mobile terminal, etc. Terminal devices can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things (IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearable, smart transportation, smart city, etc. The terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver capabilities, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a robotic arm, a smart home appliance, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0074] Network devices and terminal devices can be fixed or mobile. They can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; on water; and in the air on aircraft, balloons, and satellites. The embodiments of this application do not limit the application scenarios of network devices and terminal devices.

[0075] The roles of network devices and terminal devices can be relative. For example, the helicopter or drone 120i in Figure 1 can be configured as a mobile network device. For terminal devices 120j accessing the wireless access network 100 via 120i, terminal device 120i is a network device. However, for network device 110a, 120i is a terminal device, meaning that communication between 110a and 120i occurs via a wireless air interface protocol. Of course, communication between 110a and 120i can also occur via an interface protocol between network devices. In this case, 120i is also a network device relative to 110a. Therefore, both network devices and terminal devices can be collectively referred to as communication devices. 110a and 110b in Figure 1 can be referred to as communication devices with network device functionality, while 120a-120j in Figure 1 can be referred to as communication devices with terminal device functionality.

[0076] Network devices and terminal devices, network devices and network devices, and terminal devices and terminal devices can communicate through authorized spectrum, unauthorized spectrum, or both; can communicate through spectrum below 6 gigahertz (GHz), spectrum above 6 GHz, or spectrum below 6 GHz and spectrum above 6 GHz simultaneously. The embodiments of the present application do not limit the spectrum resources used for wireless communications.

[0077] In the embodiments of the present application, the functions of the network device may also be performed by a module (such as a chip) in the network device, or by a control subsystem that includes the network device functions. The control subsystem that includes the network device functions here may be a control center in the above-mentioned application scenarios such as smart grid, industrial control, smart transportation, and smart city. The functions of the terminal device may also be performed by a module (such as a chip or a modem) in the terminal device, or by a device that includes the terminal device functions.

[0078] The keyless secure transmission architecture, shown in Figure 2, consists of a communication module and a security module. The communication module utilizes physical layer security transmission technologies, such as secure coding, secure waveform modulation, or artificial noise, to achieve information transmission and provide basic security capabilities. The security module is constructed using cryptographic primitives, enabling the system to achieve provable security strength.

[0079] The keyless secure transmission architecture shown in Figure 2 integrates cryptographic methods with physical layer security technologies to achieve a keyless, intrinsically secure mechanism. In this architecture, physical layer security techniques are first used to create a high error floor at non-target receivers, for example, greater than 0.1, thereby introducing random entropy into the non-target channel. Furthermore, a preprocessing module, such as a randomness extractor, is introduced into the legitimate transmitter. This module extracts and diffuses the random entropy introduced by physical layer security techniques into the non-target channel, generating an equivalent key with a near-uniform distribution. This is used to ensure provable security strength for each bit in the message packet.

[0080] In the keyless secure transmission architecture, the core module is the security module, which corresponds to the preprocessing part in Figure 2. One of the implementation structures is shown in Figure 3. In Figure 3, m1, m2, ..., m q Represents the source message group to be transmitted, x1, x2, ..., x q represents the coded packet output by the channel encoder. The error control coding (ECC) module can be the channel coding module in Figure 2. Channel coding can adopt various coding schemes widely used in communication systems, such as low-density parity check code (LDPC) or polar coding. It is understood that the ECC module is not part of the security module and is shown in Figure 2 for the sake of diagram integrity.

[0081] The randomness extraction operation is implemented by the security module shown in Figure 3. t0 is the initial random seed, which can be a random vector. The security module operates as follows: Within a packet, a bidirectional randomness extractor (BRE) extracts and diffuses random entropy introduced by non-target channels, protecting all bits within the packet. This allows random errors introduced by physical layer security techniques to be diffused within a packet. Between packets, a compressive randomness extractor (CRE) and a one-way randomness extractor (ORE) accumulate channel noise entropy from previous packets, preventing some packets from failing to achieve the required security strength due to insufficient random entropy introduced by the channel. This means that even if the non-target channel conditions within a packet are excellent, preventing the physical layer security techniques from introducing sufficient random entropy within the current packet, the CRE and ORE can still collect channel noise entropy from previous packets and aggregate and diffuse the random errors introduced by them into the current packet.

[0082] The security module shown in Figure 3 can achieve error diffusion between different packets, thereby deteriorating the decoding performance of non-target receivers, but it will also cause error diffusion at the legitimate receiver. Taking Figure 3 as an example, assuming that the first coded packet x1 received by the legitimate receiver is decoded incorrectly, that is, c1 is wrong, then the first message packet m1 recovered by the legitimate receiver will be wrong. According to the working principle of the security module, the recovery of subsequent packets needs to rely on the correct m1, which is equivalent to m1 acting as a key for the recovery of subsequent packets. Therefore, even if x2, x3, ..., x q Even if the decoding of each coding group is correct, it is still impossible to correctly recover m2, m3, ..., m q This is unacceptable in actual communication.

[0083] In view of this, an embodiment of the present application provides a secure communication method. In this method, a receiving end can send response information for the i-th codeword to a transmitting end based on the decoding result of the i-th codeword. The response information can indicate whether the i-th codeword was successfully decoded or failed to be decoded. Based on this, the transmitting end can determine whether the receiving end correctly decoded the i-th codeword based on the response information. When transmitting the i+1-th codeword, the transmitting end can adjust the random seed based on whether the receiving end correctly decoded the i-th codeword, thereby avoiding further error propagation when the i-th codeword fails to be decoded.

[0084] In the embodiments of the present application, the transmitting end may be a terminal device or a network device, and the receiving end may be a terminal device or a network device. For example, when the transmitting end is a terminal device, the receiving end may be a network device or a terminal device. For another example, when the transmitting end is a network device, the receiving end may be a terminal device or a network device. For ease of description, the present application will use a network device as the transmitting end and a terminal device as the receiving end as an example to describe the technical solution of the embodiments of the present application in detail. Optionally, a secure communication method provided in the embodiments of the present application can be implemented by an RU in an O-RAN scenario.

[0085] Referring to FIG. 4 , which is an exemplary flowchart of a secure communication method provided in an embodiment of the present application, the method may include the following operations.

[0086] S401: The terminal device receives the i-th codeword.

[0087] Correspondingly, the network device sends the i-th codeword.

[0088] The i-th codeword may be obtained by encoding the i-th first data packet. The i-th first data packet may be obtained by securely processing the i-th second data packet based on the i-th random seed. For example, the i-th first data packet may be obtained by encrypting the i-th second data packet based on the i-th random seed.

[0089] If i is an integer greater than or equal to 2, then the i-th random seed can be generated based on the i-1th random seed and the i-1th second data group or the i-1th first data group. If i is equal to 1, then the i-th random seed can be generated based on a random vector. It is understood that the random seed can directly process the second data group securely through a bitwise exclusive OR or other method, or as shown in Figure 3, the random seed can also be used to generate a key to process the second data group securely through a bitwise exclusive OR or encryption method, etc., and this application does not make specific limitations.

[0090] In one possible scenario, the network device may input the random seed and the second data packet into the security module shown in Figure 3 to obtain the first data packet. Optionally, the security module may be a randomness extractor for performing randomness extraction processing on the random seed and the second data packet.

[0091] Taking Figure 3 as an example, if i is equal to 1, then the first random seed, that is, t0, can be generated based on a random vector. The network device can input the first random seed t0 and the first second data packet m1 into the security module, and the security module can then process m1 based on t0 and output the second random seed t1 and the first first data packet c1. Among them, the second random seed t1 can be obtained by the first first data packet c1 and the first random seed t0 as shown in Figure 3, or it can be obtained based on the first second data packet m1 and the first random seed t0, and this application does not make specific limitations. The network device can add a cyclic redundancy check (CRC) to the first data packet c1 and perform channel coding to obtain the first codeword x1.

[0092] If i is an integer greater than or equal to 2, such as i equal to 2, the network device may input the second random seed t1 and the second second data packet m2 into the security module. The security module may then process m2 based on t1 and output the third random seed t2 and the second first data packet c2, and so on. Similarly, the third random seed t2 may be obtained from the second first data packet c2 and the second random seed t1 as shown in FIG3 , or may be obtained based on the second second data packet m2 and the second random seed t1, which is not specifically limited in this application. The network device may add a CRC to the second first data packet c2 and perform channel coding to obtain the second codeword x2.

[0093] Optionally, the second random seed, the third random seed to the i-th random seed may be stored in the security module to facilitate processing of a subsequent second data group without the need for output.

[0094] It is understood that the security processing of the random seed on the second data packet in FIG3 is illustrated by bit XOR as an example, but the security processing of the random seed on the second data packet can also include other methods, which are not specifically limited in this application. In addition, in the embodiment of this application, t0, t1, ..., t q-1 are random seeds, k1, k2,…,k q The random extraction result of random seeds is used as an example to illustrate the results. However, k1, k2, ..., k in Figure 3 q It can also be used as a random seed, which is not specifically limited in this application.

[0095] In a possible embodiment, the network device may simultaneously send multiple second data packets m1, m2, ...m qAnd the first random seed t0 is input into the security module, then the security module can process m1 based on t0 to obtain the second random seed t1 and the first first data packet c1. The security module can process m2 based on t1 to obtain the third random seed t2 and the third first data packet c2, and so on. The security module will output multiple first data packets, that is, c1, c2, ... c q The network device can add CRC to the multiple first data packets output by the security module and then independently perform channel coding to form the codeword to be transmitted. In order to improve efficiency, the network device can perform serial-to-parallel conversion on the multiple first data packets output by the security module, so that the multiple first data packets can be added with CRC and independently channel coded at the same time, and then the codewords x1, x2, ...x to be transmitted are formed after serial-to-parallel conversion. q .

[0096] Because synchronizing the first random seed t0 between the terminal device and the network device is crucial for accurate data packet transmission, in one possible scenario, the network device can send a random vector or the first random seed t0 to the terminal device. For example, the network device can encode the first random seed t0 as the codeword x0 and send it to the terminal device. The terminal device can decode x0 and perform a CRC check on the decoded result. If the check succeeds, the first random seed t0 is obtained. If the check fails, it means that the terminal device failed to decode x0. In this case, the terminal device can request the network device to retransmit x0 until the terminal device successfully decodes x0 and obtains the first random seed t0.

[0097] In another possible scenario, the terminal device and the network device can pre-agreed on the first random seed, the random vector used to generate the first random seed, and the algorithm used to generate the first random seed. For example, the first random seed, the random vector used to generate the first random seed, and the algorithm used to generate the first random seed can be agreed upon in a protocol predefined or pre-configured manner. In this way, the network device may not send x0 to the terminal device, or the network device may send x0 to the terminal device, but the terminal device does not need to retransmit x0 regardless of whether it successfully decodes x0.

[0098] S402: The terminal device sends response information of the i-th codeword based on the decoding result of the i-th codeword.

[0099] Correspondingly, the network device receives response information of the i-th codeword.

[0100] For example, the terminal device may decode the i-th codeword and perform a cyclic redundancy check (CRC) on the decoded result. If the check succeeds, it may be considered that the terminal device has successfully decoded the i-th codeword. If the check fails, it may be considered that the terminal device has failed to decode the i-th codeword. If the terminal device successfully decodes the i-th codeword, it may send response information of the i-th codeword to the network device to indicate that the i-th codeword decoding is successful. If the terminal device fails to decode the i-th codeword, it may send response information of the i-th codeword to the network device to indicate that the i-th codeword decoding is unsuccessful.

[0101] Optionally, the response information for the i-th codeword may indicate whether the i-th codeword was successfully decoded or failed to be decoded. For example, the response information may be an acknowledgment (ACK) or a non-acknowledgement (NACK). ACK may indicate that the i-th codeword was successfully decoded, while NACK may indicate that the i-th codeword was failed to be decoded.

[0102] In one possible scenario, the terminal device may perform a secure inverse process on the successfully decoded i-th codeword, that is, the i-th first data packet, such as an inverse randomness extraction process. For example, the terminal device may process the i-th first data packet based on the i-th random seed, thereby obtaining the i-th second data packet and the i+1-th random seed. Similarly, if i is equal to 1, then the i-th random seed may be generated based on a random vector. If i is an integer greater than or equal to 2, then the i-th random seed may be generated based on the i-1-th random seed and the i-1-th second data packet or the i-1-th first data packet.

[0103] It is understandable that the terminal device can use the i-1th first data packet or the i-1th second data packet to generate the i-th random seed, which means that the i-1th codeword is successfully decoded or the i-1th codeword is successfully transmitted. If the terminal device does not successfully decode the i-1th codeword, then the terminal device cannot obtain the i-1th first data packet or the i-1th second data packet.

[0104] Taking Figure 3 as an example, if i equals 1, then the first random seed, t0, can be generated based on the random vector. The terminal device can input the first random seed t0 and the first first data packet c1 into the inverse security module. The inverse security module can then process c1 based on t0 and output the second random seed t1 and the first second data packet m1.

[0105] If i is an integer greater than or equal to 2, such as i equal to 2, the terminal device can input the second random seed t1 and the second first data packet c2 into the inverse security module. The inverse security module can then process c2 based on t1 and output the third random seed t2 and the third second data packet m2, and so on. Optionally, the second random seed, the third random seed through the i-th random seed can be stored in the inverse security module to facilitate processing of subsequent first data packets without outputting them.

[0106] It should be noted that S402 can be executed after obtaining the i-th second data group, or before obtaining the i-th second data group, or can be executed simultaneously with the security inverse processing operation of the i-th second data group, and this application does not make specific limitations.

[0107] In one possible implementation, if the response information indicates that the i-th codeword was successfully decoded, the network device may securely process the i+1-th second data packet based on the i+1-th random seed derived from the i-th second data packet or the i-th first data packet and the i-th random seed. It is understood that the operation of securely processing the i+1-th second data packet using the i+1-th random seed can be implemented with reference to the aforementioned operation of securely processing the i-th second data packet using the i-th random seed, and will not be further described herein.

[0108] Since the terminal device successfully decodes the i-th codeword, the terminal device can obtain the correct i-th first data packet or i-th second data packet, and thus can obtain the i+1-th random seed based on the i-th first data packet or i-th second data packet and the i-th random seed, without affecting the subsequent secure inverse processing operation. It should be noted that the operation of securely inverse processing the successfully decoded i+1-th codeword using the i+1-th random seed can be implemented with reference to the operation of securely inverse processing the successfully decoded i-th codeword using the i-th random seed, and will not be repeated here.

[0109] However, if the response information indicates that decoding of the i-th codeword failed, the terminal device cannot obtain the correct i-th first data packet or i-th second data packet. Therefore, if the i+1th data packet is obtained based on the i-th first data packet or i-th second data packet and the i-th random seed, the error of the i-th codeword will be propagated to multiple subsequent codewords and data packets. To avoid this problem, the network device and the terminal device can update the i+1th random seed when decoding of the i-th codeword fails. The following describes cases 1 and 2.

[0110] Case 1: The i-th second data packet is set as a first fixed sequence.

[0111] In case 1, the terminal device receives the i-th codeword x i Decoding failed, so the terminal device will not be able to decode x i Even if the decoding result is securely reversed, the accurate i-th second data packet m cannot be obtained. i In this case, the terminal device can send the ith second data packet m i It is set as the first fixed sequence. It is understandable that the first fixed sequence is a sequence agreed upon in advance by the terminal device and the network device, such as an all-0 sequence, an all-1 sequence, or other sequences known to both the terminal device and the network device.

[0112] Since the terminal device has the i-th codeword x i The decoding fails, so the terminal device will send a response message to the network device, such as NACK to indicate that the decoding of the i-th codeword has failed. The network device can understand that the terminal device has failed to decode the i-th codeword based on the NACK, and the network device can also send the i-th second data packet m i The network device can be configured according to the m set to the first fixed sequence. i and the i+1th second data packet m i+1 Generate the i+1th first data packet c i+1 .

[0113] For example, the network device can recalculate the i+1th random seed t according to the first fixed sequence. i+1 For example, the network device can generate a random sequence based on the first fixed sequence and the i-th random seed t i Generate the i+1th random seed t i+1 , or the network device can reset the i-th random seed according to the first fixed sequence, and generate the i+1-th random seed t based on the reset i-th random seed i+1 The network device can use the random seed t i+1 For the i+1th second data packet m i+1 Perform security processing to obtain the i+1th first data packet c i+1 The network device can process the first data packet c i+1 After adding CRC for channel coding, we get the i+1th codeword x i+1 Sent to the terminal device.

[0114] The terminal device can process the i+1th codeword x i+1 Decode and perform CRC. If the check succeeds, the terminal device can send an ACK to the network device and can process the decoded codeword x i+1 That is, the i+1th first data packet c i+1Perform a secure inverse processing operation. For example, the terminal device can recalculate the i+1th random seed t according to the first fixed sequence i+1 For example, the terminal device can generate a random sequence based on the first fixed sequence and the i-th random seed t i Generate the i+1th random seed t i+1 , or the terminal device resets the i-th random seed according to the first fixed sequence, and generates the i+1-th random seed t based on the reset i-th random seed i+1 The terminal device can use the random seed t i+1 For the i+1th first data packet c i+1 Perform secure inverse processing to obtain the i+2th random seed t i+2 and the i+1th second data packet m i+1 If the check fails, the terminal device may send a NACK to the network device and send the i+1th second data packet m i+1 Set as the first fixed sequence, and after receiving the i+2th codeword x i+2 Then repeat the above steps.

[0115] Taking Figure 3 as an example, the terminal device fails to decode the first codeword x1 and sends a NACK to the network device. The terminal device and the network device can set the first second data packet m1 to a first fixed sequence. The network device can recalculate the second random seed t2 based on the first fixed sequence. The network device can input the second random seed t2 and the second second data packet m2 into the security module for randomness extraction. The security module can perform security processing on the second second data packet m2 based on the second random seed t1 to obtain a third random seed t2 and a second first data packet c2. The network device can add a CRC to the second first data packet c1 and perform channel coding to generate the second codeword x2 and send it to the terminal device.

[0116] The terminal device can decode the second codeword and then perform a CRC. If the verification is successful, the terminal device can recalculate the second random seed t2 based on the first fixed sequence. The terminal device can input the second random seed t2 and the second first data packet c2 into the inverse security module for inverse randomness extraction. The inverse security module can generate the second random seed t1 based on t0 and the first fixed sequence, and perform a secure inverse process on the second first data packet c2 using the second random seed t1 to obtain the third random seed t2 and the second second data packet m2. If the verification fails, the terminal device can set the second second data packet m2 to the first fixed sequence and repeat the above process.

[0117] Based on the above scheme, since the second data packet is subjected to random extraction processing based on the random seed, if the terminal device fails to decode the codeword, then the terminal device will not obtain the correct second data packet by performing inverse random extraction processing on the decoding result, and the error will spread between different data packets. Based on Case 1, in the case of a decoding error, the second data packet is set to a fixed sequence, which can avoid the decoding error from spreading in the terminal device. At the same time, due to the independence of the non-target channel and the legitimate channel, the sequence number of the data packet with a decoding error generated by the non-target receiver cannot be completely consistent with that of the terminal device. This means that the non-target receiver cannot maintain synchronization of the random seed with the network device and the terminal device, so it can be guaranteed that the decoding error of the non-target receiver is spread, thereby achieving no impact on the transmission performance of the legitimate user while improving the security of the communication.

[0118] The following describes the situations of a legitimate terminal device and a non-target receiver with reference to FIG5 and FIG6.

[0119] To facilitate understanding of the technical solution for Case 1, transmission delay can be ignored in Figure 5. Referring to Figure 5, assume that the legitimate terminal device incorrectly decodes x1 at time t = 1, thus failing to correctly recover m1. The legitimate terminal device resets m1 to an all-zero sequence and sends a NACK to the network device. At time t = 2, the network device needs to send a new data packet m2. The network device first resets m1 to an all-zero sequence (consistent with the legitimate terminal device), then uses the security module to recalculate t1 and derive c2 from t1 and m2. The network device then adds a CRC to c2 and performs channel coding to obtain x2, which it then transmits. At time t = 2, the legitimate terminal device receives codeword x2. Assuming that the legitimate terminal device correctly decodes x2, it can obtain the correct c2. To recover data packet m2, the legitimate terminal device needs to recalculate t1 using the reset m1 (all-zero sequence) and input t1 and c2 into the inverse security module, performing the inverse operation of the network device-side security module.

[0120] As shown in Figure 5, because the network device and the authorized terminal device have reset m1 to the same sequence (all zeros), the t1 used by the authorized terminal device to recover m2 is the same as the t1 used by the network device. Therefore, provided x2 is correctly decoded, m2 can be correctly recovered. In other words, a decoding error by the authorized terminal device at t=1 will not be propagated by the security module, thereby affecting the recovery of subsequent data packets.

[0121] For non-target receivers, the use of physical layer security technology makes the decoding error probability of non-target receivers significantly higher than that of legitimate terminal devices. This means that in practice, the following situations will occur with a very high probability:

[0122] For one or more packets, the legitimate terminal device decodes correctly, but the non-target receiver decodes incorrectly. As shown in Figure 6, the legitimate terminal device decodes x2 correctly, but the non-target receiver decodes x2 incorrectly. Because the non-target receiver decodes x2 incorrectly, it cannot correctly recover c2, and therefore cannot correctly calculate t2. Thus, even if the subsequent codewords (x3, x4, ...) are decoded correctly, the corresponding data packets (m3, m4, ...) cannot be correctly recovered. Therefore, the error diffusion effect still exists, and transmission security can be guaranteed.

[0123] Case 2: Set the (i+1)th random seed to the second fixed sequence.

[0124] In case 2, the terminal device receives the i-th codeword x i Decoding failed, so the terminal device will not be able to decode x i Even if the decoding result is securely reversed, the accurate i-th second data packet m cannot be obtained. i In this case, the terminal device can use the i+1th random seed t i It is understood that the second fixed sequence is a sequence agreed upon in advance by the terminal device and the network device, such as an all-0 sequence, an all-1 sequence, or a sequence known to both the terminal device and the network device. Optionally, the terminal device may set the ith second data packet m i throw away.

[0125] Since the terminal device has the i-th codeword x i The decoding fails, so the terminal device will send a response message to the network device, such as NACK indicating that the decoding of the i-th codeword has failed. The network device can understand from the NACK that the terminal device has failed to decode the i-th codeword, and the network device can also set the i+1th random seed to the second fixed sequence. The network device can use the second fixed sequence and the i+1th second data packet m i+1 Generate the i+1th first data packet c i+1 .

[0126] For example, the network device can generate the i+1th random seed t according to the second fixed sequence. i+1 , and pass the i+1th random seed t i+1 For the i+1th second data packet m i+1 Perform security processing to obtain the i+1th first data packet c i+1 The network device can process the first data packet c i+1 After adding CRC for channel coding, we get the i+1th codeword x i+1 Sent to the terminal device.

[0127] The terminal device can process the i+1th codeword x i+1 Decode and perform CRC. If the check succeeds, the terminal device can send an ACK to the network device and can process the decoded codeword x i+1 That is, the i+1th first data packet c i+1 For example, the terminal device can generate the i+1th random seed t according to the second fixed sequence. i+1 The terminal device can use the random seed t i+1 For the i+1th first data packet c i+1 Perform secure inverse processing to obtain the i+2th random seed t i+2 and the i+1th second data packet m i+1 If the verification fails, the terminal device can send a NACK to the network device and send the i+1th random seed t i+1 Set as the second fixed sequence, and after receiving the i+2th codeword x i+2 Then repeat the above steps.

[0128] Taking Figure 3 as an example, the terminal device fails to decode the first codeword x1 and sends a NACK to the network device. The terminal device and the network device can set the first random seed t1 to a second fixed sequence. The network device can recalculate the second random seed t2 based on the second fixed sequence. The network device can input the second random seed t2 and the second second data packet m2 into the security module for randomness extraction. The security module can perform security processing on the second second data packet m2 based on the second random seed t1 to obtain a third random seed t2 and a second first data packet c2. The network device can add a CRC to the second first data packet c1 and perform channel coding to generate the second codeword x2 and send it to the terminal device.

[0129] The terminal device can decode the second codeword and then perform a CRC check. If the check succeeds, the terminal device can recalculate the second random seed t1 based on the second fixed sequence. The terminal device can input the second random seed t1 and the second first data packet c2 into the inverse security module for inverse randomness extraction. The inverse security module can perform a secure inverse process on the second first data packet c2 using the second random seed t1 to obtain a third random seed t2 and a second second data packet m2. If the check fails, the terminal device can set the second random seed t2 to the second fixed sequence and repeat the above process.

[0130] Based on the above scheme, since the second data packet is subjected to random extraction processing based on the random seed, if the terminal device fails to decode the codeword, then the terminal device will not obtain the correct second data packet by performing inverse random extraction processing on the decoding result, and the error will spread between different data packets. Based on situation 2, in the case of a decoding error, the random seed is set to a fixed sequence, which can prevent the decoding error from spreading in the terminal device. At the same time, due to the independence of the non-target channel and the legitimate channel, the sequence number of the data packet with a decoding error generated by the non-target receiver cannot be completely consistent with that of the terminal device. This means that the non-target receiver cannot keep the random seed synchronized with the network device and the terminal device, so it can be guaranteed that the decoding error of the non-target receiver is spread, thereby achieving no impact on the transmission performance of the legitimate user while improving the security of the communication.

[0131] The following describes the situation of a legitimate terminal device and a non-target receiver with reference to FIG. 7 .

[0132] To facilitate understanding of the technical solution for Case 2, the transmission delay can be ignored in Figure 7. Referring to Figure 7, assuming that the legitimate terminal device makes an error in decoding x1 at time t=1, it cannot correctly recover m1. The legitimate terminal device discards m1 and sets t1 to t 1,f (fixed sequence), and feedback NACK to the network device. At time t=2, the network device needs to send a new data packet m2. The network device first sets t1 to t 1,f (consistent with the legitimate terminal device), then use the security module to recalculate t1 and obtain c2 based on t1 and m2. The network device then adds CRC to c2 and performs channel coding to obtain x2, which is then sent out. At time t=2, the legitimate terminal device receives the codeword x2. Assuming that the legitimate terminal device decodes x2 correctly, it can obtain the correct c2. In order to recover data packet m2, the legitimate terminal device needs to convert t 1,f Together with c2, it is input into the inverse security module to implement the inverse operation of the security module on the network device side.

[0133] As shown in Figure 7, since the legitimate terminal device has reset t1 to t 1,f Therefore, the t1 used by the legitimate terminal device to recover m2 is consistent with the t1 used by the network device. Thus, provided that x2 is correctly decoded, m2 can be correctly recovered. In other words, a decoding error by the legitimate terminal device at t=1 will not be propagated by the security module, thereby affecting the recovery of subsequent data packets.

[0134] For non-target receivers, the use of physical layer security technology makes the probability of decoding errors significantly higher than that of legitimate terminal devices. This means that in practice, the following situations will occur with a very high probability:

[0135] For one or more data packets, the legitimate terminal device decodes correctly, but the non-target receiver decodes incorrectly. Using an analysis similar to Figure 6, we can see that if a data packet is decoded correctly by a legitimate terminal device but incorrectly by a non-target receiver, then even if the non-target receiver decodes all subsequent coded packets correctly, the corresponding information packet cannot be correctly recovered. Therefore, the error diffusion effect still exists, and transmission security can be guaranteed.

[0136] In a possible implementation, before the above cases 1 and 2, the network device may retransmit the i-th codeword x to the terminal device. i The retransmission uses t i Compared with the t used in S401 i For example, in S402, the terminal device sends a NACK to the network device indicating that decoding of the i-th codeword failed. The network device may then retransmit the i-th codeword. The terminal device may decode the retransmitted i-th codeword and perform a CRC. Optionally, the terminal device may combine the decoded retransmitted i-th codeword with the codeword in S401 to improve decoding performance.

[0137] If the CRC succeeds, it can be understood that the terminal device successfully decoded the retransmitted i-th codeword, and the terminal device can send an ACK to the network device. The terminal device can perform security inverse processing on the successfully decoded i-th codeword, that is, the i-th first data packet, such as inverse randomness extraction processing. This can be implemented with reference to the relevant content in S402 and is not further described here.

[0138] If the CRC fails, it means that the terminal device failed to decode the retransmitted i-th codeword, and the terminal device can send a NACK to the network device. The network device can retransmit the i-th codeword again until the maximum number of retransmissions is reached.

[0139] It is understandable that if the terminal device still fails to decode the i-th codeword after reaching the maximum number of retransmissions, the terminal device and the network device can execute the technical solutions shown in Cases 1 and 2. If the terminal device successfully decodes the i-th codeword during the retransmission process, the terminal device can perform security inverse processing on the successfully decoded i-th codeword, that is, the i-th first data packet, and the description will not be repeated here.

[0140] The following describes the communication device used to implement the above method in the embodiment of the present application with reference to the accompanying drawings. Therefore, the above contents can be used in subsequent embodiments, and repeated contents will not be repeated.

[0141] Figure 8 is a schematic block diagram of a communication device 800 provided in an embodiment of the present application. The communication device 800 can correspond to the functions or steps implemented by the terminal device or network device in the above-mentioned various method embodiments. The communication device may include a processing unit 810 and a transceiver unit 820. Optionally, it may also include a storage unit, which can be used to store instructions (codes or programs) and / or data. The processing unit 810 and the transceiver unit 820 can be coupled to the storage unit. For example, the processing unit 810 can read the instructions (codes or programs) and / or data in the storage unit to implement the corresponding method. The above-mentioned units can be set independently or partially or fully integrated.

[0142] Optionally, the transceiver unit 820 may include a sending unit and a receiving unit, wherein the sending unit may be used to perform all sending operations performed by the communication device 800, and the receiving unit may be used to perform all receiving operations performed by the communication device 800.

[0143] In some possible implementations, the communication device 800 can implement the behaviors and functions of the terminal device, etc. in the above-mentioned method embodiments. For example, the communication device 800 can be a terminal device, or a component (such as a chip or circuit) used in the terminal device. The transceiver unit 820 can be used to perform all receiving or sending operations performed by the terminal device in the embodiment shown in Figure 4. For example, S401 and S402 in the embodiment shown in Figure 4, and / or other processes for supporting the technology described herein; wherein the processing unit 810 is used to perform all operations except the receiving and sending operations performed by the terminal device in the embodiment shown in Figure 4.

[0144] For example, the transceiver unit 820 is used to receive the i-th codeword. The i-th codeword is obtained by encoding the i-th first data packet. The i-th first data packet is obtained by encrypting the i-th second data packet based on the i-th random seed. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet or the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet. If i is equal to 1, the i-th random seed is generated based on a random vector. The processing unit 810 is used to generate response information of the i-th codeword based on the decoding result of the i-th codeword. The transceiver unit 820 is also used to send response information of the i-th codeword. The response information is used to indicate whether the i-th codeword is decoded successfully or failed.

[0145] In some possible implementations, the communication device 800 can implement the behaviors and functions of the network device in the above-mentioned method embodiment. For example, the communication device 800 can be a network device, or a component (such as a chip or circuit) used in the network device. The transceiver unit 820 can be used to perform all receiving or sending operations performed by the network device in the embodiment shown in Figure 4. For example, S401 and S402 in the embodiment shown in Figure 4, and / or other processes for supporting the technology described herein; wherein the processing unit 810 is used to perform all operations except the sending and receiving operations performed by the network device in the embodiment shown in Figure 4.

[0146] For example, processing unit 810 is configured to encrypt the i-th second data packet based on the i-th random seed to obtain the i-th first data packet. Wherein, if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet; if i is 1, the i-th random seed is generated based on a random vector. Processing unit 810 is further configured to encode the i-th first data packet to obtain the i-th codeword. Transceiver unit 820 is configured to send the i-th codeword. Transceiver unit 820 is further configured to receive response information for the i-th codeword. The response information is used to indicate whether the i-th codeword was successfully decoded or failed to be decoded.

[0147] For the operations performed by the processing unit 810 and the transceiver unit 820, reference may be made to the relevant description of the aforementioned method embodiment.

[0148] It should be understood that the processing unit 810 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component, and the transceiver unit 820 can be implemented by a transceiver or a transceiver-related circuit component or a communication interface.

[0149] Based on the same concept, as shown in FIG9 , an embodiment of the present application provides a communication device 900. The communication device 900 includes a processor 910. Optionally, the communication device 900 may further include a memory 920 for storing instructions executed by the processor 910, or storing input data required by the processor 910 to execute instructions, or storing data generated after the processor 910 executes instructions. The processor 910 can implement the method shown in the above method embodiment through the instructions stored in the memory 920.

[0150] Based on the same concept, as shown in Figure 10, an embodiment of the present application provides a communication device 1000, which can be a chip or a chip system. Optionally, in the embodiment of the present application, the chip system can be composed of a chip, or can include a chip and other discrete devices.

[0151] Communication device 1000 may include at least one processor 1010, coupled to a memory. Optionally, the memory may be located within or outside the device. For example, communication device 1000 may also include at least one memory 1020. Memory 1020 stores the necessary computer programs, configuration information, computer programs or instructions, and / or data for implementing any of the above-described embodiments. Processor 1010 may execute the computer programs stored in memory 1020 to perform the method in any of the above-described embodiments.

[0152] The coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which can be electrical, mechanical, or other forms, and is used for information exchange between devices, units, or modules. The processor 1010 may operate in conjunction with the memory 1020. The specific connection medium between the transceiver 1030, the processor 1010, and the memory 1020 is not limited in the embodiments of the present application.

[0153] The communication device 1000 may also include a transceiver 1030, and the communication device 1000 can exchange information with other devices through the transceiver 1030. The transceiver 1030 can be a circuit, a bus, a transceiver or any other device that can be used for information exchange, or is called a signal transceiver unit. As shown in Figure 10, the transceiver 1030 includes a transmitter 1031, a receiver 1032 and an antenna 1033. In addition, when the communication device 1000 is a chip-type device or circuit, the transceiver in the communication device 1000 can also be an input and output circuit and / or a communication interface, which can input data (or receive data) and output data (or send data). The processor is an integrated processor or microprocessor or integrated circuit, and the processor can determine the output data based on the input data.

[0154] In one possible implementation, the communication device 1000 can be applied to a terminal device. Specifically, the communication device 1000 can be a terminal device, or a device that can support the terminal device in implementing the functions of the terminal device in any of the above-mentioned embodiments. The memory 1020 stores the necessary computer programs, computer programs or instructions and / or data to implement the functions of the communication device in any of the above-mentioned embodiments. The processor 1010 can execute the computer program stored in the memory 1020 to perform the method performed by the terminal device in any of the above-mentioned embodiments.

[0155] In one possible implementation, the communication device 1000 can be applied to a network device. Specifically, the communication device 1000 can be a network device, or a device that can support the network device in implementing the functions of the network device in any of the above-mentioned embodiments. The memory 1020 stores the necessary computer programs, computer programs or instructions and / or data to implement the functions of the network device in any of the above-mentioned embodiments. The processor 1010 can execute the computer program stored in the memory 1020 to perform the method performed by the network device in any of the above-mentioned embodiments.

[0156] Since the communication device 1000 provided in this embodiment can be applied to a terminal device to implement the method executed by the terminal device, or can be applied to a network device to implement the method executed by the network device, the technical effects that can be obtained can be referred to the above method embodiments and will not be repeated here.

[0157] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0158] In an embodiment of the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory may also be any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in an embodiment of the present application may also be a circuit or any other device that can implement a storage function, for storing computer programs, computer programs or instructions and / or data.

[0159] Based on the above embodiments, referring to FIG11 , an embodiment of the present application also provides another communication device 1100, including: an input / output interface 1110 and a logic circuit 1120; the input / output interface 1110 is used to receive code instructions and transmit them to the logic circuit 1120; the logic circuit 1120 is used to run code instructions to execute the method executed by the terminal device or network device in any of the above embodiments.

[0160] Optionally, the input / output interface 1110 may be an interface on a chip, and the logic circuit 1120 may be one or more processors. Optionally, the one or more processors may be located inside or outside the device.

[0161] The following describes in detail the operations performed by the communication device when applied to a terminal device or a network device.

[0162] In an optional implementation, the communication device 1100 may be applied to a terminal device to execute the method executed by the aforementioned terminal device, for example, the method executed by the terminal device in the embodiment shown in FIG. 4 .

[0163] Input / output interface 1110 is used to input the i-th codeword. The i-th codeword is obtained by encoding the i-th first data packet. The i-th first data packet is obtained by encrypting the i-th second data packet based on the i-th random seed. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet or the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet. If i is 1, the i-th random seed is generated based on a random vector. Logic circuit 1120 is used to generate response information for the i-th codeword based on the decoding result of the i-th codeword. Input / output interface 1110 is also used to output response information for the i-th codeword. The response information is used to indicate whether the i-th codeword was successfully decoded or failed.

[0164] Since the communication device 1100 provided in this embodiment can be applied to a terminal device to implement the method executed by the terminal device, the technical effects that can be obtained can be referred to the above method embodiment and will not be described in detail here.

[0165] In an optional implementation, the communication device 1100 may be applied to a network device to execute the method executed by the aforementioned network device, for example, the method executed by the network device in the embodiment shown in FIG. 4 .

[0166] Logic circuit 1120 is configured to encrypt the i-th second data packet based on the i-th random seed to obtain the i-th first data packet. Wherein, if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet; if i is 1, the i-th random seed is generated based on a random vector. Logic circuit 1120 is further configured to encode the i-th first data packet to obtain the i-th codeword. Input / output interface 1110 is configured to output the i-th codeword. Input / output interface 1110 is further configured to input response information for the i-th codeword. The response information indicates whether the i-th codeword was successfully decoded or failed to be decoded.

[0167] Since the communication device 1100 provided in this embodiment can be applied to a network device to implement the method executed by the above network device, the technical effects that can be obtained can be referred to the above method embodiment and will not be described in detail here.

[0168] Based on the above embodiments, embodiments of the present application further provide a communication system. The communication system includes at least one communication device applied to a terminal device and at least one communication device applied to a network device. The technical effects that can be achieved can be referenced to the above method embodiments and will not be further described here.

[0169] Based on the above embodiments, the present application also provides a system. The communication system includes at least one network device and a terminal device.

[0170] Based on the above embodiments, embodiments of the present application further provide a computer-readable storage medium storing a computer program or instructions. When the instructions are executed, the method executed by the terminal device or the method executed by the network device in any of the above embodiments is implemented. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0171] To implement the functions of the communication device shown in Figures 8 to 11 above, embodiments of the present application further provide a chip including a processor for supporting the communication device in implementing the functions of the terminal device or network device in the above method embodiments. In one possible design, the chip is connected to or includes a memory, which is used to store computer programs, instructions, and data necessary for the communication device.

[0172] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0173] The present application is described with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by a computer program or instruction. These computer programs or instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0174] These computer programs or instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0175] These computer programs or instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0176] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application also intends to include these modifications and variations.

Claims

1. A secure communication method, It is characterized in that include: Receive the i-th codeword; The i-th codeword is obtained by encoding the i-th first data packet; wherein the i-th first data packet is obtained by encrypting the i-th second data packet based on the i-th random seed; wherein, if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet or the i-th random seed is generated based on the i-1-th random seed and the i-1-th first data packet, and if i is equal to 1, the i-th random seed is generated based on a random vector; Based on the decoding result of the i-th codeword, response information of the i-th codeword is sent; wherein the response information is used to indicate whether the i-th codeword is decoded successfully or failed.

2. The method according to claim 1, It is characterized in that Also includes: Determine the i-th second data packet and the i+1-th random seed based on the i-1-th random seed, the i-1-th first data packet and the i-th first data packet; or determine the i-th second data packet and the i+1-th random seed based on the i-1-th random seed, the i-1-th second data packet and the i-th first data packet; The response information is used to indicate that the i-th codeword is decoded successfully.

3. The method according to claim 1 or 2, It is characterized in that Also includes: The i-th second data packet is set as a first fixed sequence; the response information is used to indicate that the i-th codeword decoding fails; An i+1th codeword is received, where the i+1th codeword is obtained by encoding the i+1th first data packet; the i+1th first data packet is obtained by encrypting the i+1th second data packet based on the i+1th random seed; and the i+1th random seed is generated based on the first fixed sequence.

4. The method according to claim 1 or 2, It is characterized in that Also includes: The i+1th random seed is set as a second fixed sequence; the response information is used to indicate that the decoding of the i-th codeword fails; An i+1th codeword is received, where the i+1th codeword is obtained by encoding the i+1th first data packet; the i+1th first data packet is obtained by encrypting the i+1th second data packet based on the i+1th random seed.

5. The method according to claim 3 or 4, It is characterized in that Before setting the i-th second data packet to the first fixed sequence or before setting the i+1-th random seed to the second fixed sequence, the i-th codeword satisfies the following conditions: The decoding of the i-th codeword fails and the number of retransmissions of the i-th codeword reaches a preset threshold.

6. The method according to claim 3, It is characterized in that The first fixed sequence is pre-agreed.

7. The method according to claim 4, It is characterized in that The second fixed sequence is pre-agreed.

8. The method according to any one of claims 1 to 5, It is characterized in that Also includes: Receiving a first codeword, where the first codeword is obtained by encoding a first random seed; The first codeword is decoded to obtain the first random seed.

9. A secure communication method, It is characterized in that include: The i-th second data packet is encrypted based on the i-th random seed to obtain the i-th first data packet; wherein, if i is an integer greater than or equal to 2, the i-th random seed is based on the i-1-th random seed and the i-1-th first data packet. Data group generation, if i is equal to 1, the i-th random seed is generated based on the random vector; Encoding the i-th first data packet to obtain an i-th codeword; Sending the i-th codeword; Receive response information of the i-th codeword; the response information is used to indicate whether the i-th codeword is decoded successfully or failed.

10. The method according to claim 9, It is characterized in that Also includes: The response information is used to indicate that the decoding of the i-th codeword fails, and the i-th second data packet is set as a first fixed sequence; Encrypting the i+1th second data packet based on the i+1th random seed to obtain the i+1th first data packet; wherein the i+1th random seed is generated based on the first fixed sequence; Encoding the (i+1)th first data packet to obtain an (i+1)th codeword; The i+1th codeword is sent.

11. The method according to claim 9, It is characterized in that Also includes: The response information is used to indicate that the decoding of the i-th codeword fails, and the i+1-th random seed is set as a second fixed sequence; Encrypting the i+1th second data packet based on the i+1th random seed to obtain the i+1th first data packet; wherein the i+1th random seed is generated based on the second fixed sequence; Encoding the i+1th data packet to obtain an i+1th codeword; The i+1th codeword is sent.

12. The method according to claim 10 or 11, It is characterized in that Before setting the i-th second data packet to the first fixed sequence or before setting the i+1-th random seed to the second fixed sequence, the i-th codeword satisfies the following conditions: The decoding of the i-th codeword fails and the number of retransmissions of the i-th codeword reaches a preset threshold.

13. The method according to claim 10, It is characterized in that The first fixed sequence is pre-agreed.

14. The method according to claim 11, It is characterized in that The second fixed sequence is pre-agreed.

15. The method according to any one of claims 9 to 11, It is characterized in that Also includes: Encode the first random seed to obtain the first codeword; The first codeword is sent.

16. A communication device, It is characterized in that The method comprises means for executing the method according to any one of claims 1 to 8.

17. A communication device, It is characterized in that The method comprises means for performing the method as claimed in any one of claims 9 to 15.

18. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer-executable instructions, which, when called by an electronic device, enable the electronic device to execute the method as claimed in any one of claims 1 to 8, or enable the electronic device to execute the method as claimed in any one of claims 9 to 15.

19. A communication system, It is characterized in that The invention comprises a device for executing the method according to any one of claims 1 to 8 and a device for executing the method according to any one of claims 9 to 15.

20. A chip system, It is characterized in that The chip system comprises: Communication interface; A processor is used to call and run the instruction through the communication interface, so that the device equipped with the chip system executes the method as described in any one of claims 1 to 8, or the device equipped with the chip system executes the method as described in any one of claims 9 to 15.

Images