Method and apparatus for secure communication

Abstract

The present application relates to the technical field of wireless communication, and provides a method and apparatus for secure communication, which are used to implement secure communication by using a security module. In the method, a communication apparatus inputs i first data packets into a security module, and obtains i second data packets. i is an integer greater than or equal to 1, and the security module is used for performing security processing on the i first data packets. The communication apparatus modulates the i second data packets, then obtains a signal, and sends the signal. On the basis of the described solution, the communication apparatus can modulate the i second data packets outputted by the security module, and implement secure communication by using the security module.

Description

A secure communication method and device Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a secure communication method and device. Background Art

[0002] Secure transmission is the foundation of communication. Most secure transmission solutions are key-based and can be categorized as symmetric or asymmetric. Symmetric encryption involves a shared key between two parties, while asymmetric encryption requires one party to pass a public key to the other. The sender uses the public key for encryption, while the receiver uses the private key for decryption. Both methods require key maintenance and management, which requires complex protocols. Vulnerabilities in these protocols are often exploited by adversaries. Furthermore, these complex protocols incur additional communication overhead and latency, making them unsuitable for the highly dynamic nature of future communication networks.

[0003] Currently, physical layer security transmission technologies, such as secure coding, secure waveform modulation, or the introduction of artificial noise into the channel, can be used to achieve information transmission and provide basic security capabilities. However, the security capabilities provided by physical layer security transmission technologies are limited, and non-intended receivers are still likely to obtain transmitted information.

[0004] Summary of the Invention

[0005] The present application provides a secure communication method and apparatus for implementing secure communication using a security module.

[0006] In a first aspect, a secure communication method is provided. This method can be performed by a communication device. The communication device can be a terminal device or a network device, or a chip or chip system used in a terminal device or a network device. In this method, the communication device inputs i first data packets into a security module, obtaining i second data packets. Where i is an integer greater than or equal to 1, the security module is configured to perform security processing on the i first data packets. The communication device then modulates the i second data packets to obtain a signal and transmits the signal.

[0007] Based on this scheme, the communication device can modulate the i second data packets output by the security module and use the security module to achieve secure communication. The security module can diffuse random entropy to each data packet, so that each bit in the data packet obtains provable security strength.

[0008] In a possible implementation, the communication device adds a cyclic redundancy check (CRC) to each of the i second data packets and performs channel coding.

[0009] Based on the above scheme, for legitimate receivers, a CRC check is performed on each transmitted codeword after channel decoding. If the check passes, decoding is considered successful, and the communication device can input the i decoded second data packets into the security module's inverse processing module to obtain i first data packets. At non-target receivers, after completing channel decoding, the decoded codeword packets need to be input into the security module's inverse processing step. According to the working principle of the security module, if any packet decoding error occurs, the random error will be propagated by the security module, causing the non-target receiver to fail in the recovery of all packets, thereby achieving secure communication.

[0010] In a possible implementation, the communication device adds CRC to each of the i first data packets to obtain i third data packets, and inputs the i third data packets into a security module to obtain i second data packets.

[0011] Based on the above scheme, after completing channel decoding at the non-target receiver, the decoded codeword packets must be input into the inverse processing phase of the security module. Since the processing order at the transmitter in the above scheme is: CRC addition → randomness extraction → channel coding, the receiving end performs the inverse operations: channel decoding → inverse randomness extraction → CRC check. This means that after completing channel decoding, the non-target receiver has no way to determine whether each packet was decoded correctly. Instead, the decoded results are directly input into the inverse processing phase of the security module. According to the operating principle of the security module, if any packet decoding error occurs, the random error will be propagated by the security module, causing the non-target receiver to fail in recovering all packets, thus achieving secure communication.

[0012] In one possible implementation, the communication device adds CRC to each of the i first data packets and performs channel coding to obtain i fourth data packets. The communication device inputs the i fourth data packets into the security module to obtain i second data packets.

[0013] Based on the above scheme, at the non-target receiver, according to the working principle of the security module, if any packet in the demodulated bit sequence is erroneous, the random error will be propagated by the security module, causing the number of erroneous bits to exceed the error correction capability of the error-correcting code, making it impossible to correct the error. As a result, the non-target receiver will experience errors when recovering all message packets, thus achieving secure communication.

[0014] In one possible implementation, the security module is configured to generate i random seeds, where the i-th random seed is used to generate the i-th second data packet with the i-th first data packet. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet. If i is 1, the i-th random seed is generated based on a random vector.

[0015] Based on the above solution, the sending end and the receiving end can achieve secure communication of data packets through the security module.

[0016] In a second aspect, a secure communication method is provided. This method can be performed by a communication device. The communication device can be a terminal device or a network device, or alternatively, a chip or chip system applied to a terminal device or a network device. In this method, the communication device inputs the kth data packet into a security module and obtains the k+1th random information. Where k is an integer greater than or equal to 1, and the kth data packet is a data packet that has been successfully transmitted. Based on the k+1th random information and the k+1th data packet, the communication device obtains the k+1th signal and transmits the k+1th signal.

[0017] Based on this solution, the communication device can obtain the k+1th signal based on the k+1th random information and the k+1th data packet output by the security module, and implement secure communication using the security module.

[0018] In a possible implementation, the communication device modulates the k+1th random information and the k+1th data packet respectively, and processes the modulated signals to obtain the k+1th signal.

[0019] Based on the above scheme, since the legitimate receiver has correctly received the kth data packet, it can obtain the k+1th random information and determine the signal obtained by modulating the k+1th random information. Therefore, the legitimate receiver can obtain the signal modulated by the k+1th data packet and demodulate normally. On the other hand, due to the independence of the non-target link and the legitimate link, the decoding error pattern of the non-target receiver will not be consistent with that of the legitimate receiver. Therefore, even if the legitimate receiver correctly receives the kth data packet, the non-target receiver may not have also correctly received the kth data packet. As a result, the non-target receiver cannot obtain the correct k+1th random information or the signal obtained by modulating the k+1th random information, resulting in demodulation and decoding errors. In other words, a decoding error in the kth data packet will cause a decoding error in the k+1th data packet. This creates an error propagation effect: a decoding error in any packet by the non-target receiver will cause decoding errors in all subsequent packets, significantly improving system security.

[0020] In one possible implementation, the communication device generates a scrambling parameter based on the k+1th random information, and controls a modulation mode of the k+1th data packet based on the scrambling parameter to obtain a k+1th signal.

[0021] Based on the above scheme, the legitimate receiver, having correctly received the kth data packet, knows the scrambling parameters used to disrupt the modulation process, allowing normal demodulation. On the other hand, due to the independence of the non-target link and the legitimate link, the decoding error pattern of the non-target receiver will not be consistent with that of the legitimate receiver. Therefore, even if the legitimate receiver correctly receives the kth data packet, the non-target receiver may not have also correctly received the kth data packet. As a result, the non-target receiver cannot obtain the correct scrambling parameters, resulting in demodulation and decoding errors.

[0022] In one possible implementation, a communication device generates a permutation index based on the k+1th random information, where the permutation index corresponds to at least one permutation method. The communication device permutes bits included in the k+1th data packet based on the at least one permutation method corresponding to the permutation index. The communication device modulates the permuted k+1th data packet to obtain a k+1th signal.

[0023] Based on the above scheme, the legitimate receiver, having correctly received the kth data packet, knows the permutation index. Therefore, after demodulation, it can perform the inverse of the transmitter's permutation method on the bit sequence output by the demodulator, and then proceed with normal channel decoding. On the other hand, due to the independence of the non-target link and the legitimate link, the decoding error pattern of the non-target receiver will not be consistent with that of the legitimate receiver. Therefore, even if the legitimate receiver correctly receives the kth data packet, the non-target receiver may not have also correctly received the kth data packet. As a result, the non-target receiver cannot obtain the correct permutation index, resulting in an inability to perform the inverse of the transmitter's permutation method on the bit sequence output by the demodulator. Consequently, after decoding, the k+1th data packet cannot be correctly recovered.

[0024] In a possible implementation, the k+1th data packet is a data packet to which CRC is added and channel coded.

[0025] In a third aspect, a secure communication method is provided. This method can be performed by a communication device. The communication device can be a terminal device or a network device, or a chip or chip system used in the terminal device or network device. In this method, the communication device receives a signal and demodulates the signal to obtain i second data packets. The communication device inputs the i second data packets into a security module to obtain i first data packets. The security module is configured to perform security inverse processing on the i second data packets.

[0026] In a possible implementation, the communication device performs channel decoding on the i second data packets and then performs CRC check. If the check passes, the packets are input into the security module for security inverse processing.

[0027] In a possible implementation, the communication device performs channel decoding on i second data packets and inputs the decoded data into a security module to obtain i third data packets. The communication device performs CRC check on the i third data packets.

[0028] In one possible implementation, the communication device inputs i second data packets into a security module to obtain i fourth data packets. The communication device performs channel decoding on the i fourth data packets and performs a CRC check. If the CRC check succeeds, i first data packets are obtained.

[0029] In one possible implementation, the security module is configured to generate i random seeds, where the i-th random seed is used to generate the i-th second data packet with the i-th first data packet. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet. If i is 1, the i-th random seed is generated based on a random vector.

[0030] In a fourth aspect, a secure communication method is provided. This method can be performed by a communication device. The communication device can be a terminal device or a network device, or a chip / chip system applied to the terminal device or network device. In this method, the communication device receives the k+1th signal and inputs the kth data packet into the security module to obtain the k+1th random information. Where k is an integer greater than or equal to 1, and the kth data packet is a data packet that has been successfully transmitted. Based on the k+1th random information and the k+1th signal, the communication device obtains the k+1th data packet.

[0031] In one possible implementation, the communication device obtains a signal modulated on the k+1th data packet based on a signal modulated on the k+1th random information and the k+1th signal. The communication device demodulates the signal modulated on the k+1th data packet to obtain the k+1th data packet.

[0032] In one possible implementation, the communication device generates a scrambling parameter based on the k+1th random information, and controls a demodulation method of the k+1th signal based on the scrambling parameter to obtain the k+1th data packet.

[0033] In one possible implementation, the communication device generates a permutation index based on the k+1th random information, the permutation index corresponding to at least one permutation method, and performs an inverse operation of the at least one permutation method on the demodulated k+1th signal to obtain the k+1th data packet.

[0034] In a possible implementation manner, the communication device performs channel decoding on the (k+1)th data packet and removes the CRC.

[0035] In a fifth aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0036] The processing unit is configured to input i first data packets into a security module to obtain i second data packets. Where i is an integer greater than or equal to 1, the security module is configured to perform security processing on the i first data packets. The processing unit is further configured to modulate the i second data packets to obtain a signal. The transceiver unit is configured to transmit the signal.

[0037] In a possible implementation, the processing unit is further configured to add a cyclic redundancy check (CRC) to each of the i second data packets and perform channel coding.

[0038] In a possible implementation, the processing unit is further configured to add CRC to each of the i first data packets to obtain i third data packets. The processing unit is further configured to input the i third data packets into the security module to obtain i second data packets.

[0039] In one possible implementation, the processing unit is further configured to add CRC to each of the i first data packets and perform channel coding to obtain i fourth data packets. The processing unit is further configured to input the i fourth data packets into the security module to obtain i second data packets.

[0040] In one possible implementation, the security module is configured to generate i random seeds, where the i-th random seed is used to generate the i-th second data packet with the i-th first data packet. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet. If i is 1, the i-th random seed is generated based on a random vector.

[0041] In a sixth aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0042] The processing unit is configured to input the kth data packet into the security module to obtain the k+1th random information. Here, k is an integer greater than or equal to 1, and the kth data packet is a successfully transmitted data packet. The processing unit is further configured to obtain the k+1th signal based on the k+1th random information and the k+1th data packet. The transceiver unit is configured to transmit the k+1th signal.

[0043] In a possible implementation, the processing unit is further configured to modulate the k+1th random information and the k+1th data packet respectively, and process the modulated signals to obtain the k+1th signal.

[0044] In one possible implementation, the processing unit is further configured to generate a scrambling parameter based on the k+1th random information and to control a modulation mode of the k+1th data packet based on the scrambling parameter to obtain a k+1th signal.

[0045] In one possible implementation, the processing unit is further configured to generate a permutation index based on the k+1th random information, where the permutation index corresponds to at least one permutation mode. The processing unit is further configured to permute bits contained in the k+1th data packet based on the at least one permutation mode corresponding to the permutation index. The processing unit is further configured to modulate the permuted k+1th data packet to obtain a k+1th signal.

[0046] In a possible implementation, the processing unit is further configured to: the k+1th data packet is a data packet after CRC is added and channel coding is performed.

[0047] In a seventh aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0048] The transceiver unit is configured to receive a signal. The processing unit is configured to demodulate the signal to obtain i second data packets. The processing unit is further configured to input the i second data packets into a security module to obtain i first data packets. The security module is configured to perform security inverse processing on the i second data packets.

[0049] In one possible implementation, the processing unit is further configured to perform CRC check on the i second data packets after channel decoding. If the check passes, the processing unit is further configured to input the decoded i second data packets into the security module for security inverse processing.

[0050] In a possible implementation, the processing unit is further configured to perform channel decoding on the i second data packets and then input the decoded data into the security module to obtain i third data packets. The processing unit is further configured to perform CRC check on the i third data packets.

[0051] In one possible implementation, the processing unit is further configured to input the i second data packets into the security module to obtain i fourth data packets. The processing unit is further configured to perform channel decoding and CRC check on the i fourth data packets. If the CRC check succeeds, i first data packets are obtained.

[0052] In one possible implementation, the security module is configured to generate i random seeds, where the i-th random seed is used to generate the i-th second data packet with the i-th first data packet. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data packet. If i is 1, the i-th random seed is generated based on a random vector.

[0053] In an eighth aspect, a communication device is provided, comprising: a processing unit and a transceiver unit.

[0054] The transceiver unit is configured to receive the k+1th signal. The processing unit is configured to input the kth data packet into the security module to obtain the k+1th random information. Here, k is an integer greater than or equal to 1, and the kth data packet is a successfully transmitted data packet. The processing unit is further configured to obtain the k+1th data packet based on the k+1th random information and the k+1th signal.

[0055] In one possible implementation, the processing unit is further configured to obtain a signal obtained by modulating the k+1th data packet based on a signal obtained by modulating the k+1th random information and the k+1th signal. The processing unit is further configured to demodulate the signal obtained by modulating the k+1th data packet to obtain the k+1th data packet.

[0056] In one possible implementation, the processing unit is further configured to generate a scrambling parameter based on the k+1th random information and to control a demodulation method of the k+1th signal based on the scrambling parameter to obtain the k+1th data packet.

[0057] In one possible implementation, the processing unit is further configured to generate a permutation index based on the k+1th random information, where the permutation index corresponds to at least one permutation method. The processing unit is further configured to perform an inverse operation of the at least one permutation method on the demodulated k+1th signal to obtain the k+1th data packet.

[0058] In a possible implementation, the processing unit is further configured to perform channel decoding and remove CRC on the k+1th data packet.

[0059] In a ninth aspect, a communication device is provided. The communication device may be a communication device in any possible implementation of the fourth to eighth aspects of the above-mentioned embodiments, or a chip provided in a communication device in any aspect of the fourth to eighth aspects. The communication device includes a communication interface and a processor, and optionally, further includes a memory. The memory is used to store computer programs, instructions, or data, and the processor is coupled to the memory and the communication interface. When the processor reads the computer program, instructions, or data, the communication device executes the method executed by the communication device in any possible implementation of the first to fourth aspects.

[0060] It should be understood that the communication interface can be implemented by an antenna, a feeder, a codec, etc. in the communication device, or, if the communication device is a chip provided in the communication device, the communication interface can be an input / output interface of the chip, such as an input / output pin, etc. The communication device may further include a transceiver for communicating between the communication device and other devices.

[0061] In a tenth aspect, an embodiment of the present application provides a chip system, which includes a processor and may also include a memory, for implementing the method performed by the communication device in any possible implementation of the first to fourth aspects. In one possible implementation, the chip system also includes a memory for storing program instructions and / or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices.

[0062] In an eleventh aspect, the present application provides a computer-readable storage medium storing a computer program or instruction. When the computer program or instruction is executed, the method performed by the communication device in the above aspects is implemented.

[0063] In a twelfth aspect, a computer program product is provided, comprising: computer program code or instructions, which, when executed, causes the method performed by the communication device in the above aspects to be executed.

[0064] In a thirteenth aspect, a communication device is provided, which includes a unit or module for executing the above-mentioned methods.

[0065] In a fourteenth aspect, a chip system is provided, comprising a logic circuit and an input / output interface. The logic circuit is configured to execute the method executed by the aforementioned communication device. The input / output interface is configured to communicate with other devices.

[0066] In a fifteenth aspect, a system is provided, comprising at least one communication device that performs any possible implementation of the first aspect and at least one communication device that performs any possible implementation of the third aspect.

[0067] In a sixteenth aspect, a system is provided, comprising at least one communication device that performs any possible implementation of the second aspect and at least one communication device that performs any possible implementation of the fourth aspect.

[0068] The beneficial effects of the third to sixteenth aspects and their implementations can refer to the description of the beneficial effects of the methods of the first and second aspects and their implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] FIG1 is a schematic diagram of a communication system provided in an embodiment of the present application;

[0070] FIG2 is a schematic diagram of a keyless secure transmission architecture;

[0071] FIG3 is a schematic diagram of a security module;

[0072] FIG4 is an exemplary flow chart of a secure communication method provided in an embodiment of the present application;

[0073] FIG5 is a flowchart of a secure communication method provided in an embodiment of the present application;

[0074] FIG6 is a flowchart of another secure communication method provided in an embodiment of the present application;

[0075] FIG7 is a flowchart of another secure communication method provided in an embodiment of the present application;

[0076] FIG8 is a schematic diagram of a security module provided in an embodiment of the present application;

[0077] FIG9 is an exemplary flow chart of another secure communication method provided in an embodiment of the present application;

[0078] FIG10 is a flowchart of another secure communication method provided in an embodiment of the present application;

[0079] FIG11 is a flowchart of another secure communication method provided in an embodiment of the present application;

[0080] FIG12 is a flowchart of another secure communication method provided in an embodiment of the present application;

[0081] FIG13 is a schematic diagram of a communication device provided in an embodiment of the present application;

[0082] FIG14 is a schematic diagram of another communication device provided in an embodiment of the present application;

[0083] FIG15 is a schematic diagram of another communication device provided in an embodiment of the present application;

[0084] FIG16 is a schematic diagram of another communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] To facilitate understanding of the technical solutions involved in the embodiments of the present application, the technical terms provided in the embodiments of the present application are introduced.

[0086] 1) Random seed, also known as random entropy or state information (this application does not restrict the naming), refers to information used for secure processing of transport blocks. For example, it is used to encrypt transport blocks or to protect the integrity of transport blocks. Optionally, the random seed can be used directly for secure processing of transport blocks, or it can be used to generate a key using an algorithm such as a hash algorithm to securely process transport blocks.

[0087] Optionally, the random seed can be used as the input and output of the security module. The random seed output by the security module can be a function of the random seed input by the security module and the message input by the security module. There are many ways to implement this function, such as the output random seed Seed out =HASH(Seed in ,M out ), namely Seed i =HASH(Seed i-1 ,EXT(M i-1 ,Seed i-1 )). HASH is a hash operation, EXT is a random extraction operation, and Seed in is the random seed input by the security module, M out Is the message input by the security module. EXT(M i-1 ,Seed i-1 ) refers to the randomness extraction operation on the i-1th random seed and the i-1th message.

[0088] 2) Data grouping, which can also be understood as message grouping, refers to the grouping of information to be transmitted, such as source message grouping, encoded code block grouping, etc.

[0089] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0090] The technical solutions of the embodiments of the present application can be applied to New Radio (NR) systems, Global System of Mobile communication (GSM) systems, Code Division Multiple Access (CDMA) systems, Wideband Code Division Multiple Access (WCDMA) systems, General Packet Radio Service (GPRS), Long Term Evolution (LTE) systems, LTE Frequency Division Duplex (FDD) systems, LTE Time Division Duplex (TDD) systems, Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication systems, etc., without limitation herein.

[0091] FIG1 is a schematic diagram of the architecture of a communication system 1000 used in an embodiment of the present application. As shown in FIG1 , the communication system includes a wireless access network 100. The wireless access network 100 may include at least one network device (such as 110a and / or 110b in FIG1 ) and may also include at least one terminal device (such as at least one of 120a-120j in FIG1 ). The terminal device is connected to the access network device wirelessly, and the access network device is connected to the core network device wirelessly or by wire. Terminal devices and network devices may be connected to each other by wire or by wireless. FIG1 is only a schematic diagram, and the communication system may also include other network devices, such as wireless relay devices and wireless backhaul devices, which are not shown in FIG1 .

[0092] A network device is a network-side device with wireless transceiver capabilities. A network device can be a device in a radio access network (RAN) that provides wireless communication capabilities for terminal devices, and is called a RAN device. For example, a network device can be a base station, an evolved NodeB (eNodeB), a transmission reception point (TRP), a next-generation NodeB (gNB) in a fifth-generation (5G) mobile communication system, a next-generation base station in a sixth-generation (6G) mobile communication system, a base station in a future mobile communication system, or an access node in a WiFi system. It can also be a module or unit that performs some of the functions of a base station, such as a centralized unit (CU) or a distributed unit (DU). The CU here completes the functions of the radio resource control protocol and the packet data convergence protocol (PDCP) of the base station, and can also complete the function of the service data adaptation protocol (SDAP); the DU completes the functions of the radio link control layer and the medium access control (MAC) layer of the base station, and can also complete the functions of part of the physical layer or all of the physical layer. For the specific description of the above-mentioned protocol layers, please refer to the relevant technical specifications of the 3rd Generation Partnership Project (3GPP). The network device can be a macro base station (such as 110a in Figure 1), a micro base station or an indoor station (such as 110b in Figure 1), a relay node or a donor node, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the network device.

[0093] In another possible scenario, multiple RAN nodes collaborate to assist the terminal in achieving wireless access, and different RAN nodes implement part of the functions of the base station respectively. For example, the RAN node can be a CU, DU, CU-control plane (CP), CU-user plane (UP), or radio unit (RU). The CU and DU can be set separately, or they can be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH).

[0094] In different systems, CU (or CU-CP and CU-UP), DU or RU may also have different names, but those skilled in the art can understand their meanings. For example, in the ORAN system, CU may also be called O-CU (Open CU), DU may also be called O-DU, CU-CP may also be called O-CU-CP, CU-UP may also be called O-CU-UP, and RU may also be called O-RU. For the convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any unit of CU (or CU-CP, CU-UP), DU and RU in this application can be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0095] A terminal device is a user-side device with wireless transceiver capabilities. A terminal device may also be referred to as user equipment (UE), a mobile station, a mobile terminal, etc. Terminal devices can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things (IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearable, smart transportation, smart city, etc. The terminal device may be a mobile phone, a tablet computer, a computer with wireless transceiver capabilities, a wearable device, a vehicle, a drone, a helicopter, an airplane, a ship, a robot, a robotic arm, a smart home appliance, etc. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal device.

[0096] Network devices and terminal devices can be fixed or mobile. They can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; on water; and in the air on aircraft, balloons, and satellites. The embodiments of this application do not limit the application scenarios of network devices and terminal devices.

[0097] The roles of network devices and terminal devices can be relative. For example, the helicopter or drone 120i in Figure 1 can be configured as a mobile network device. To terminal devices 120j accessing the wireless access network 100 via 120i, terminal device 120i is a network device. However, to network device 110a, 120i is a terminal device, meaning that communication between 110a and 120i occurs via a wireless air interface protocol. Of course, communication between 110a and 120i can also occur via an interface protocol between network devices. In this case, 120i is also a network device relative to 110a. Therefore, both network devices and terminal devices can be collectively referred to as communication devices. 110a and 110b in Figure 1 can be referred to as communication devices with network device functionality, while 120a-120j in Figure 1 can be referred to as communication devices with terminal device functionality.

[0098] In the embodiments of the present application, the functions of the network device may also be performed by a module (such as a chip) in the network device, or by a control subsystem that includes the network device functions. The control subsystem that includes the network device functions here may be a control center in the above-mentioned application scenarios such as smart grid, industrial control, smart transportation, and smart city. The functions of the terminal device may also be performed by a module (such as a chip or a modem) in the terminal device, or by a device that includes the terminal device functions.

[0099] The keyless secure transmission architecture, shown in Figure 2, consists of a communication module and a security module. The communication module utilizes physical layer security transmission technologies, such as secure coding, secure waveform modulation, or artificial noise, to achieve information transmission and provide basic security capabilities. The security module is constructed using cryptographic primitives, enabling the system to achieve provable security strength.

[0100] The keyless secure transmission architecture shown in Figure 2 integrates cryptographic methods with physical layer security technologies to achieve a keyless, intrinsically secure mechanism. In this architecture, physical layer security techniques are first used to create a high error floor at non-target receivers, for example, greater than 0.1, thereby introducing random entropy into the non-target channel. Furthermore, a preprocessing module, such as a randomness extractor, is introduced into the legitimate transmitter. This module extracts and diffuses the random entropy introduced by physical layer security techniques into the non-target channel, generating an equivalent key with a near-uniform distribution. This is used to ensure provable security strength for each bit in the message packet.

[0101] In the keyless secure transmission architecture, the core module is the security module, which corresponds to the pre-processing part in Figure 2. One of the implementation structures is shown in Figure 3. In Figure 3, m1, m2, ..., m q Represents the source message group to be transmitted, x1, x2, ..., x q represents the coded packet output by the channel encoder. The error control coding (ECC) module can be the channel coding module in Figure 2. Channel coding can adopt various coding schemes widely used in communication systems, such as low-density parity check code (LDPC) or polar coding. It is understood that the ECC module is not part of the security module and is shown in Figure 2 for the sake of diagram integrity.

[0102] The randomness extraction operation is implemented by the security module shown in Figure 3. t0 is the initial random seed, which can be a random vector. The security module operates as follows: Within a packet, a bidirectional randomness extractor (BRE) extracts and diffuses random entropy introduced by non-target channels, protecting all bits within the packet. This allows random errors introduced by physical layer security techniques to be diffused within a packet. Between packets, a compressive randomness extractor (CRE) and a one-way randomness extractor (ORE) accumulate channel noise entropy from previous packets, preventing some packets from failing to achieve the required security strength due to insufficient random entropy introduced by the channel. This means that even if the non-target channel conditions within a packet are excellent, preventing the physical layer security techniques from introducing sufficient random entropy within the current packet, the CRE and ORE can still collect channel noise entropy from previous packets and aggregate and diffuse the random errors introduced by them into the current packet.

[0103] However, how the security module processes the input and output of each module in the current standard protocol and how to use the security module for secure communication have become technical issues that need to be solved.

[0104] In view of this, an embodiment of the present application provides a secure communication method. In this method, a communication device can input i first data packets into a security module to obtain i second data packets. Here, i is an integer greater than or equal to 1. The security module is used to securely process the i first data packets. The communication device can modulate the i second data packets to obtain a signal and transmit the signal. Based on this solution, the communication device can modulate the i second data packets output by the security module and implement secure communication using the security module. The security module can diffuse random entropy to each data packet, so that each bit in the data packet obtains provable security strength.

[0105] In an embodiment of the present application, the communication device at the transmitting end may be a terminal device or a network device, and the communication device at the receiving end may be a terminal device or a network device. For example, when the communication device at the transmitting end is a terminal device, the communication device at the receiving end may be a network device or a terminal device. For another example, when the communication device at the transmitting end is a network device, the communication device at the receiving end may be a terminal device or a network device. For ease of expression, this application will take the network device as the communication device at the transmitting end and the terminal device as the communication device at the receiving end as an example to describe the technical solution of the embodiment of the present application in detail. Optionally, a secure communication method provided in an embodiment of the present application can be implemented by the RU in the O-RAN scenario.

[0106] Referring to FIG. 4 , which is an exemplary flowchart of a secure communication method provided in an embodiment of the present application, the method may include the following operations.

[0107] S401: The network device inputs i first data packets into a security module to obtain i second data packets.

[0108] The security module can be configured to perform security processing, such as randomness extraction, on i first data packets. For example, the security module can generate i random seeds. The i-th random seed can be used to generate the i-th second data packet with the i-th first data packet. If i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1 second data packet or the i-1 first data packet, and the i-1 random seed. If i is 1, the i-th random seed is generated based on a random vector.

[0109] Taking Figure 3 as an example, if i is equal to 1, then the first random seed, t0, can be generated based on a random vector. The network device can input the first random seed t0 and the first second data packet m1 into the security module. The security module can then process m1 based on t0 and output the second random seed t1 and the first first data packet c1. The second random seed t1 can be obtained from the first first data packet c1 and the first random seed t0 as shown in Figure 3, or it can be obtained based on the first second data packet m1 and the first random seed t0. This application does not make any specific restrictions.

[0110] It is understandable that the random seed can directly perform security processing on the first data group through bit XOR or the like, or as shown in FIG3 , the random seed can also be used to derive a key to perform security processing on the first data group through bit XOR or encryption or the like, which is not specifically limited in this application.

[0111] S402: The network device modulates i second data packets to obtain a signal.

[0112] S403: The network device sends a signal.

[0113] Accordingly, the terminal device receives the signal.

[0114] After receiving the signal, the terminal device may demodulate the received signal and perform the inverse operation of the network device on the i second data packets obtained by the demodulated signal.

[0115] For example, the terminal device can perform a secure inverse process on the i-th second data packet, such as an inverse randomness extraction process. The terminal device can process the i-th second data packet based on the i-th random seed, thereby obtaining the i-th first data packet and the i+1-th random seed. Similarly, if i is an integer greater than or equal to 2, then the i-th random seed can be generated based on the i-1-th random seed and the i-1-th second data packet or the i-1-th first data packet. If i is equal to 1, then the i-th random seed can be generated based on a random vector.

[0116] For example, the terminal device can input the i-th second packet into the inverse security module. Taking Figure 3 as an example, if i equals 1, then the first random seed, t0, can be generated based on the random vector. The terminal device can input the first random seed t0 and the first first data packet c1 into the security module. The security module can then process c1 based on t0 and output the second random seed t1 and the first first data packet m1.

[0117] In a possible implementation, the input of the security module in S401 may be a source bit, or may be an output of other modules in the physical layer communication technology. The following describes three cases.

[0118] Case 1:

[0119] Referring to FIG5, in this case, the network device can group the source bits m1, m2, ..., m i , that is, i first data packets are input into the security module. The security module can process each packet m1, m2, ..., m i The network device will process the output of the security module into packets c1, c2, ..., c i , i.e., i second data packets are serial-to-parallel converted. The network device can convert each packet, i.e., c1, c2, ..., c i Channel coding and other operations are performed respectively. It can be understood that c1, c2, ..., c i It can be a packet with a cyclic redundancy check (CRC) added. For example, the network device can add a cyclic redundancy check (CRC) to each packet, that is, c1, c2, ..., c i After adding CRC, channel coding and other operations are performed. The network equipment converts each packet after channel coding into a parallel-serial codeword x1, x2, ..., x i Each codeword is then processed through symbol mapping, orthogonal frequency division multiplexing (OFDM) modulation, and multiple-input multiple-output (MIMO) precoding before being transmitted through the antenna.

[0120] It is understood that the serial-to-parallel conversion and parallel-to-serial conversion shown in FIG5 do not change the bits of each packet in the data packet. For example, the serial-to-parallel conversion converts each packet in series into each packet in parallel. i After serial-to-parallel conversion, it is still c1, c2, ..., c i .

[0121] It should be noted that the serial-to-parallel conversion and parallel-to-serial conversion shown in Figure 5 are optional operations. That is, the output of the security module does not need to undergo serial-to-parallel conversion. The network device can directly add a CRC to the output of the security module, that is, the i second data packets, and perform channel coding. In this case, parallel-to-serial conversion is also not required. Serial-to-parallel conversion can improve the efficiency of adding CRC and channel coding, and will not be repeated later. If i = 1, serial-to-parallel conversion and parallel-to-serial conversion are not required.

[0122] Based on the above scheme, on the one hand, at the non-target receiver, after the non-target receiver completes channel decoding, it is necessary to input the decoded codeword packets into the inverse processing link of the security module. According to the working principle of the security module, as long as any packet decoding error occurs, the random error will be propagated by the security module, causing the non-target receiver to recover all packets incorrectly, thereby achieving secure communication. On the other hand, for the legitimate receiver, a CRC check is performed on each transmitted codeword after channel decoding is completed. If the check passes, the decoding is considered successful, and the terminal device can input the i second data packets obtained by decoding into the inverse processing module of the security module to obtain i first data packets. Optionally, the terminal device can send an acknowledgment (ACK) to the network device, so that the sender and receiver can synchronously update the random seed for use when the next codeword undergoes security processing and security inverse processing.

[0123] Optionally, if verification fails, decoding is considered a failure, and a feedback control mechanism can be used to prevent error propagation. For example, the terminal device can send a negative acknowledgement (NACK) to the network device. The network device and the terminal device do not update the random seed, maintaining synchronization between the random seeds. The network device can then retransmit the data packet that failed verification to the terminal device until the legitimate receiver correctly decodes the data packet, ensuring that the performance of legitimate communication is not affected. However, the non-target receiver is a passive attacker and cannot use the feedback control mechanism to achieve error-free decoding itself, resulting in the aforementioned error propagation effect.

[0124] Case 2:

[0125] Referring to FIG6 , in this case, the network device can process each packet m1, m2, ..., m i , that is, i first data packets are serial-to-parallel converted. i third data packets, that is, c1, c2, ..., c i It can be for i first data packets m1, m2, ..., m i For example, the network device can add CRC to each packet, m1, m2, ..., m i Add CRC respectively to get i third data packets, that is, c1, c2, ..., c i The network device can group i third data into groups c1, c2, ..., c i After parallel-to-serial conversion, it is input into the security module. The security module can process each group c1, c2, ..., c iThe network device performs serial-to-parallel conversion on the i second data packets output by the security module and then performs channel coding one by one to obtain the code words x1, x2, ..., x i The network device treats the transmitted codewords x1, x2, ..., x i Each codeword is then processed through symbol mapping, OFDM modulation, MIMO precoding, and other processes before being transmitted through the antenna.

[0126] Based on the above scheme, after the non-target receiver completes channel decoding, it needs to input the decoded codeword packets into the security module's reverse processing. Since, in Case 2, the network device's processing order is: CRC addition → randomness extraction → channel coding, the receiving end performs the reverse operation: channel decoding → reverse randomness extraction → CRC check. This means that after completing channel decoding, the non-target receiver has no way to determine whether each packet was decoded correctly. Instead, the decoded results are directly input into the security module's reverse processing. According to the working principle of the security module, if any packet decoding error occurs, the random error will be propagated by the security module, causing the non-target receiver to fail to recover all packets, thus achieving secure communication.

[0127] On the other hand, for legitimate receivers, after completing channel decoding and security inversion processing for each codeword, a CRC check is performed. If the check passes, the first i data packets are obtained and an ACK is fed back, allowing both the sender and receiver to synchronously update the random seed for use in security processing and security inversion processing of the next codeword.

[0128] If verification fails, a NACK is returned and the random seed is not updated. This ensures that decoding errors in the current packet do not affect the recovery of subsequent packets, ensuring that legitimate communication performance is not affected. However, the non-target receiver is a passive attacker. It cannot send ACK / NACK to the legitimate transmitter and cannot synchronize the extractor state with the sender, resulting in the aforementioned error diffusion effect.

[0129] Case 3:

[0130] Referring to FIG7 , in this case, the network device can group the source bits m1, m2, ..., m i , that is, after channel coding the i first data packets, i fourth data packets are obtained, that is, c1, c2, ..., c i It can be understood that m1, m2, ..., m i It can be a packet with a cyclic redundancy check (CRC). For example, the network device can add a cyclic redundancy check (CRC) to each packet, that is, m1, m2, ..., mi After adding CRC, channel coding and other operations are performed to obtain i fourth data packets. The network device can input them into the security module. The security module can process each packet m1, m2, ..., m i The network device can process the i fourth data packets c1, c2, ..., c i Input to the security module. The security module can i The network device processes the second i data packets x1, x2, ..., x output by the security module. i After symbol mapping, OFDM modulation, MIMO precoding and other processing, it is finally sent through the antenna.

[0131] Based on the above scheme, at the non-target receiver, according to the working principle of the security module, if any packet in the demodulated bit sequence is erroneous, the random error will be propagated by the security module, causing the number of erroneous bits to exceed the error correction capability of the error-correcting code, making it impossible to correct the error. As a result, the non-target receiver will experience errors when recovering all message packets, thus achieving secure communication.

[0132] On the other hand, the legitimate receiver inputs the demodulated bit sequence into the inverse security module, which then performs channel decoding and CRC. If the verification passes, the first i data packets are obtained and an ACK is fed back, allowing both the sender and receiver to synchronously update the random seed for use in the security processing and security inverse processing of the next codeword. If the verification fails, a NACK is fed back and the random seed is not updated. This ensures that decoding errors in the current packet do not affect the recovery of subsequent packets, ensuring that the performance of legitimate communication is not affected. However, the non-target receiver is a passive attacker. It cannot send ACK / NACK to the legitimate transmitter and cannot synchronize the extractor state with the sender, resulting in the aforementioned error propagation effect.

[0133] The security modules in Figures 5 through 7 can be implemented using the architecture shown in Figure 3. Furthermore, physical layer security techniques can be utilized in channel coding, symbol mapping, OFDM modulation, and MIMO precoding. For example, artificial noise can be introduced into the MIMO precoding module to create a higher error floor for non-target receivers.

[0134] The embodiments of the present application introduce various situations in which a security module is applied to data transmission scenarios through Figures 5 to 7 above. Another secure communication method is also provided in the embodiments of the present application. In this method, the communication device can input the successfully transmitted data packet into the security module to obtain the k+1th random information. Wherein, k is an integer greater than or equal to 1. The communication device can obtain the k+1th signal based on the k+1th random information and the k+1th data packet, and send the k+1th signal. Based on this solution, the communication device can obtain the k+1th signal based on the k+1th random information and the k+1th data packet output by the security module, and use the security module to achieve secure communication.

[0135] In one possible scenario, the security module in the above solution can be implemented by the structure shown in FIG8. When k is greater than or equal to 1, the input of the security module is c k-1 , the output is p k , that is, the k+1th random information, t k or K k Represents the kth random seed. The kth random seed can be used to generate the k+1th random information with the kth data group. If k is an integer greater than or equal to 2, the kth random seed is generated based on the k-1th data group and the k-1th random seed. If k is 1, the kth random seed is generated based on the random vector.

[0136] Referring to FIG. 9 , which is an exemplary flowchart of a secure communication method provided in an embodiment of the present application, the method may include the following operations.

[0137] S901: The network device inputs the kth data packet into the security module to obtain the k+1th random information.

[0138] For example, the network device may input the kth data packet into the security module shown in FIG8 . k-1 Can be combined with the kth random seed t k , generate the k+1th random information p k The kth random seed and the kth data group c k-1 A k+1th random seed may be generated to generate k+2th random information.

[0139] The terminal device may also input the kth data packet into the security module to obtain the k+1th random information, and implement it by referring to the way in which the network device obtains the k+1th random information, which will not be repeated here.

[0140] S902: The network device obtains a k+1th signal based on the k+1th random information and the k+1th data packet.

[0141] For example, the network device may process the k+1th data packet based on the k+1th random information to obtain the k+1th signal.

[0142] S903: The network device sends the k+1th signal.

[0143] Correspondingly, the terminal device receives the k+1th signal.

[0144] After receiving the k+1th signal, the terminal device may demodulate the received signal. The terminal device may obtain the k+1th data packet based on the k+1th random information and the k+1th signal. For example, the terminal device may perform the inverse operation of the network device on the k+1th signal based on the k+1th random information to obtain the k+1th data packet.

[0145] In a possible implementation, when the network device obtains the k+1th signal based on the k+1th random information and the k+1th data packet in S902, the following three methods may be used.

[0146] Method 1:

[0147] In this manner, the network device can modulate the k+1th random information and the k+1th data packet respectively, and process the modulated signals to obtain the k+1th signal.

[0148] For example, referring to FIG10 , the network device may group the k+1th data into m k Add CRC to get c k . Network devices can c k After channel coding, modulation is performed to obtain a first modulated signal. The network device can send the kth data packet m k-1 Input to the security module, or the network device can send the kth data packet m k-1 After adding the CRC, the signal is input to the security module. The network device can modulate the k+1th random information output by the security module to obtain a second modulated signal. The network device can obtain the k+1th signal based on the first and second modulated signals. For example, the network device can multiply the first and second modulated signals symbol by symbol, equivalent to complex-domain scrambling, to form the k+1th signal.

[0149] Optionally, the network device can group the k+1th data into m k Or the k+1th data packet c after adding CRC k The kth data packet m is stored in the delay unit. The delay unit can be used to store the transmitted data packets. k-1 Or the kth data packet c after adding CRC k-1It can also be obtained from the delay unit, which will not be repeated later.

[0150] For the first data packet, the network device may add a CRC to the first data packet, perform channel coding on the first data packet, and then modulate the first signal. Optionally, the network device may encrypt the first data packet using the first random seed to improve transmission security, which will not be repeated later.

[0151] For example, the network device adds CRC to data packet m0 to obtain c0. The network device performs channel coding on c0 and then modulates it to obtain modulated signal 0. Optionally, the network device can also use the first random seed t0 to encrypt c0, and modulate the encrypted c0 to obtain modulated signal 0. The network device can send modulated signal 0. After receiving modulated signal 0, the terminal device can demodulate and perform channel decoding. The terminal device can perform CRC check on the result of channel decoding. If the check passes, it is considered that the decoding is successful, and the terminal device can obtain data packet m0. Optionally, the terminal device can send an ACK to the network device and update the random seed. If the check fails, it is considered that the terminal device has failed to decode, and a NACK can be fed back to the network device, allowing the network device to retransmit data packet m0 until the terminal device successfully decodes.

[0152] It should be noted that in method 1, the kth data packet is a successfully transmitted data packet, that is, a data packet that has been successfully decoded and restored by the terminal device after performing security inverse processing. Optionally, the kth data packet can be the successfully transmitted data packet closest to the k+1th data packet.

[0153] For example, the terminal device has successfully received data packet c0 and obtained m0. The network device may add a CRC to data packet m1 to obtain c1. The network device may perform channel coding on c1 and then modulate it to obtain the modulated signal of m1. The network device may obtain c0 from the delay unit and input c0 into the security module shown in Figure 8 to obtain the first random information p1. The network device may modulate the first random information p1 to obtain the modulated signal of p1. The network device may multiply the modulated signal of m1 and the modulated signal of p1 symbol by symbol to form the first signal. The network device transmits the first signal, and the terminal device receives the first signal. The terminal device may also obtain c0 from the delay unit and input c0 into the security module shown in Figure 8 to obtain the first random information p1. The terminal device may also modulate the first random information p1 to obtain the modulated signal of p1. The terminal device can obtain the modulated signal of m1 based on the first signal and the modulated signal of p1. For example, the terminal device can perform complex domain descrambling on the first signal based on the modulated signal of p1 to obtain the modulated signal of m1. The terminal device can demodulate the modulated signal of m1 and perform channel decoding.

[0154] The terminal device can perform a CRC check on the channel decoding result. If the check succeeds, the terminal device deems the decoding successful. The network device can then transmit the next data packet m2. The network device can then obtain a second signal based on the second random information p2 and data packet m2. The second random information p2 is obtained based on c1 or m1 and t1.

[0155] Optionally, if the verification fails, the terminal device deems the decoding to have failed. The terminal device can then send a NACK to the network device, instructing it to retransmit m1. Alternatively, if the maximum number of retransmissions is reached and the terminal device still fails to decode, the network device can transmit the next data packet, m2, to the terminal device. In this case, the random information used by the network device for secure processing of the next data packet, m2, can still be p1.

[0156] Based on the above scheme, for the legitimate receiver, since c k-1 Therefore, the legitimate receiver knows the symbol sequence used for complex domain scrambling and can demodulate normally after completing complex domain descrambling. On the other hand, due to the use of physical layer security technology, there is a high error floor at the non-target receiver, and due to the independence of the non-target link and the legitimate link, the decoding error pattern of the non-target receiver will not be consistent with that of the legitimate receiver. Therefore, when the legitimate receiver correctly receives c i-1 Under the premise that the non-target receiver does not necessarily receive c correctly k-1 , so that the non-target receiver cannot obtain the correct complex domain scrambled symbol sequence, which will lead to demodulation and decoding errors, that is, c k-1Decoding errors can cause c k This creates an error diffusion effect, that is, a decoding error of any packet by a non-target receiver will cause decoding errors in subsequent packets, thereby significantly improving the security of the system.

[0157] Method 2:

[0158] In this manner, the network device can generate scrambling parameters based on the k+1th random information. The scrambling parameters can control the modulation scheme of the k+1th data packet, or in other words, the scrambling parameters can indicate or describe the modulation scheme of the k+1th data packet. Alternatively, the scrambling parameters can correspond to the modulation scheme of the k+1th data packet. Based on the scrambling parameters, the network device can determine the modulation scheme of the k+1th data packet and modulate the k+1th data packet based on the modulation scheme to obtain the k+1th signal.

[0159] For example, referring to FIG11 , the network device may group the kth data into m k-1 Input to the security module, or the network device can send the kth data packet m k-1 After adding the CRC, the data is input into the security module. This allows the network device to obtain the bit stream output by the security module, which is the k+1th random information. This k+1th random information can be used to generate scrambling parameters. For example, the network device can generate scrambling parameters based on algorithms such as hashing and interleaving, which are not specifically limited in this application.

[0160] The network device can group the k+1th data into m k Add CRC to get c k . Network devices can c k After channel coding, modulation is performed. The network equipment modulates the channel coded c k During modulation, scrambling parameters can be used to control the modulation constellation format, such as the rotation angle of the constellation points or the mapping relationship between bits and constellation points.

[0161] Optionally, regarding the delay unit and the 1st data group and the kth data group, reference may be made to the relevant description in FIG10 , which will not be repeated here.

[0162] The terminal device can also group the kth data into m k-1 Input to the security module, or group the kth data into m k-1After adding CRC, it is input into the security module, so that the terminal device can obtain the bit stream output by the security module, that is, the k+1th random information. The k+1th random information can be used to generate scrambling parameters. It is understandable that the algorithm used by the terminal device to generate scrambling parameters is the same as the algorithm used by the network device to generate scrambling parameters, which can be pre-agreed and is not specifically limited in this application. In this way, when the terminal device demodulates the k+1th signal, it can be controlled by the scrambling parameters. The terminal device can perform channel decoding on the demodulated data packet and perform CRC check on the decoding result. This can be implemented with reference to the relevant description in Figure 10 and will not be repeated here.

[0163] Based on the above scheme, for the legitimate receiver, since it has correctly received c k-1 , so the legitimate receiver knows the scrambling parameters used to disrupt the modulation process and can demodulate normally. On the other hand, due to the use of physical layer security technology, there is a high error floor at the non-target receiver, and due to the independence of the non-target link and the legitimate link, the decoding error pattern of the non-target receiver will not be consistent with that of the legitimate receiver. Therefore, when the legitimate receiver correctly receives c k-1 Under the premise that the non-target receiver does not necessarily receive c correctly k-1 , so that the non-target receiver cannot obtain the correct scrambling parameters, which will lead to demodulation and decoding errors, that is, c k-1 Decoding errors can cause c i This creates an error diffusion effect, that is, a decoding error of any packet by a non-target receiver will cause decoding errors in subsequent packets, thereby significantly improving the security of the system.

[0164] Method 3:

[0165] In this way, the network device can generate a permutation index based on the k+1th random information. The permutation index corresponds to one or more permutation methods. The permutation method can be understood as a method of permuting a bit sequence. For example, the bit sequence contains three bits: abc, then there are a total of 6 possible permutation methods, namely: abc, bac, bca, acb, cab, cba. These 6 permutation methods can correspond one-to-one to the permutation index, or one of the 6 permutation methods can correspond to one or more permutation indexes. It can be understood that the correspondence between the permutation method and the permutation index can be pre-agreed by the network device and the terminal device, and this application does not make specific limitations. The network device can permute the k+1th data packet based on the permutation index and then modulate it to obtain the k+1th signal.

[0166] For example, referring to FIG12, the network device may group the kth data into m k-1 Input to the security module, or the network device can send the kth data packet m k-1 After adding the CRC, the data is input into the security module. This allows the network device to obtain the bit stream output by the security module, which is the k+1th random information. This k+1th random information can be used to generate a permutation index. For example, the network device can generate the permutation index based on an algorithm such as hashing or interleaving, which is not specifically limited in this application.

[0167] The network device can group the k+1th data into m k Add CRC to get c k . Network devices can c k After channel coding, the permutation is performed based on the permutation method corresponding to the permutation index. The network device can k Modulation is performed to obtain the k+1th signal.

[0168] Optionally, regarding the delay unit and the 1st data group and the kth data group, reference may be made to the relevant description in FIG10 , which will not be repeated here.

[0169] The terminal device can also group the kth data into m k-1 Input to the security module, or group the kth data into m k-1 After adding CRC, it is input into the security module, so that the terminal device can obtain the bit stream output by the security module, that is, the k+1th random information. The k+1th random information can be used to generate a permutation index. It is understandable that the algorithm for generating the permutation index by the terminal device is the same as the algorithm for generating the permutation index by the network device, which can be pre-agreed and is not specifically limited in this application. In this way, after demodulating the k+1th signal, the terminal device can perform an inverse operation on the demodulated data packet based on the permutation method corresponding to the permutation index, perform channel decoding, and perform CRC check on the decoding result. This can be implemented with reference to the relevant description in Figure 10 and will not be repeated here.

[0170] Based on the above scheme, for the legitimate receiver, since it has correctly received c k-1 , so the legitimate receiver knows the permutation index, so that after completing the demodulation, it can perform the inverse operation of the permutation method of the sender on the bit sequence output by the demodulator, and then perform normal channel decoding. On the other hand, due to the use of physical layer security technology, there is a high error floor at the non-target receiver, and due to the independence of the non-target link and the legitimate link, the decoding error pattern of the non-target receiver will not be consistent with that of the legitimate receiver. Therefore, when the legitimate receiver correctly receives c k-1 Under the premise that the non-target receiver does not necessarily receive c correctly k-1, so that the non-target receiver cannot obtain the correct permutation index, which results in the inability to perform the inverse operation of the permutation method of the sender on the bit sequence output by the demodulator. In this way, after decoding, c k Will not be able to recover correctly. k-1 Decoding errors will cause c k This creates an error diffusion effect, that is, a decoding error of any packet by a non-target receiver will cause decoding errors in subsequent packets, thereby significantly improving the security of the system.

[0171] Figure 13 is a schematic block diagram of a communication device 1300 provided in an embodiment of the present application. The communication device 1300 can correspond to the functions or steps implemented by the terminal device or network device in the above-mentioned various method embodiments. The communication device may include a processing unit 1310 and a transceiver unit 1320. Optionally, it may also include a storage unit, which can be used to store instructions (codes or programs) and / or data. The processing unit 1310 and the transceiver unit 1320 can be coupled to the storage unit. For example, the processing unit 1310 can read the instructions (codes or programs) and / or data in the storage unit to implement the corresponding method. The above-mentioned units can be set independently or partially or fully integrated.

[0172] Optionally, the transceiver unit 1320 may include a transmitting unit and a receiving unit, wherein the transmitting unit may be used to perform all transmitting operations performed by the communication device 1300 , and the receiving unit may be used to perform all receiving operations performed by the communication device 1300 .

[0173] In some possible implementations, the communication device 1300 can implement the behaviors and functions of the terminal device, etc. in the above-mentioned method embodiments. For example, the communication device 1300 can be a terminal device, or a component (such as a chip or circuit) used in the terminal device. The transceiver unit 1320 can be used to perform all receiving or sending operations performed by the terminal device in the embodiments shown in Figures 4 and / or 9. For example, S403 in the embodiment shown in Figure 4, and S903 in the embodiment shown in Figure 9 and / or other processes for supporting the technology described herein; wherein the processing unit 1310 is used to perform all operations except the receiving and sending operations performed by the terminal device in the embodiments shown in Figures 4 and / or 9.

[0174] For example, transceiver unit 1320 is configured to receive a signal. Processing unit 1310 is configured to demodulate the signal to obtain i second data packets. Processing unit 1310 is further configured to input the i second data packets into a security module to obtain i first data packets. The security module is configured to perform security inverse processing on the i second data packets.

[0175] For another example, transceiver unit 1320 is configured to receive the k+1th signal. Processing unit 1310 is configured to input the kth data packet into the security module to obtain the k+1th random information. Here, k is an integer greater than or equal to 1, and the kth data packet is a successfully transmitted data packet. Processing unit 1310 is further configured to obtain the k+1th data packet based on the k+1th random information and the k+1th signal.

[0176] In some possible implementations, the communication device 1300 can implement the behaviors and functions of the network device in the above-mentioned method embodiments. For example, the communication device 1300 can be a network device, or a component (such as a chip or circuit) used in a network device. The transceiver unit 1320 can be used to perform all receiving or sending operations performed by the network device in the embodiments shown in Figure 4 and / or Figure 9. For example, S403 in the embodiment shown in Figure 4, and S903 in the embodiment shown in Figure 9, and / or other processes for supporting the technology described herein; wherein the processing unit 1310 is used to perform all operations except the receiving and sending operations performed by the network device in the embodiment shown in Figure 4. For example, S401 and S402 in the embodiment shown in Figure 4, and S901 and S902 in the embodiment shown in Figure 9, and / or other processes for supporting the technology described herein.

[0177] For example, processing unit 1310 is configured to input i first data packets into a security module to obtain i second data packets. Where i is an integer greater than or equal to 1, the security module is configured to perform security processing on the i first data packets. Processing unit 1310 is further configured to modulate the i second data packets to obtain a signal. Transceiver unit 1320 is configured to transmit the signal.

[0178] For another example, processing unit 1310 is configured to input the kth data packet into the security module to obtain the k+1th random information. Here, k is an integer greater than or equal to 1, and the kth data packet is a successfully transmitted data packet. Processing unit 1310 is further configured to obtain the k+1th signal based on the k+1th random information and the k+1th data packet. Transceiver unit 1320 is configured to transmit the k+1th signal.

[0179] For the operations performed by the processing unit 1310 and the transceiver unit 1320 , reference may be made to the relevant description of the aforementioned method embodiment.

[0180] It should be understood that the processing unit 1310 in the embodiment of the present application can be implemented by a processor or a processor-related circuit component, and the transceiver unit 1320 can be implemented by a transceiver or a transceiver-related circuit component or a communication interface.

[0181] Based on the same concept, as shown in FIG14 , an embodiment of the present application provides a communication device 1400. The communication device 1400 includes a processor 1410. Optionally, the communication device 1400 may further include a memory 1420 for storing instructions executed by the processor 1410, or storing input data required by the processor 1410 to execute instructions, or storing data generated after the processor 1410 executes instructions. The processor 1410 can implement the method shown in the above method embodiment using the instructions stored in the memory 1420.

[0182] Based on the same concept, as shown in FIG15 , an embodiment of the present application provides a communication device 1500 , which can be a chip or a chip system. Optionally, in the embodiment of the present application, the chip system can be composed of a chip or include a chip and other discrete devices.

[0183] Communication device 1500 may include at least one processor 1510 coupled to a memory. Optionally, the memory may be located within or outside the device. For example, communication device 1500 may also include at least one memory 1520. Memory 1520 stores the necessary computer programs, configuration information, computer programs or instructions, and / or data for implementing any of the aforementioned embodiments. Processor 1510 may execute the computer programs stored in memory 1520 to perform the method in any of the aforementioned embodiments.

[0184] The coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units, or modules, which can be electrical, mechanical, or other forms, and is used for information exchange between devices, units, or modules. The processor 1510 may operate in conjunction with the memory 1520. The specific connection medium between the transceiver 1530, the processor 1510, and the memory 1520 is not limited in the embodiments of the present application.

[0185] The communication device 1500 may also include a transceiver 1530, and the communication device 1500 can exchange information with other devices through the transceiver 1530. The transceiver 1530 can be a circuit, a bus, a transceiver or any other device that can be used for information exchange, or it can be called a signal transceiver unit. As shown in Figure 15, the transceiver 1530 includes a transmitter 1531, a receiver 1532 and an antenna 1533. In addition, when the communication device 1500 is a chip-type device or circuit, the transceiver in the communication device 1500 can also be an input and output circuit and / or a communication interface, which can input data (or receive data) and output data (or send data). The processor is an integrated processor or microprocessor or integrated circuit, and the processor can determine the output data based on the input data.

[0186] In one possible implementation, the communication device 1500 can be applied to a terminal device. Specifically, the communication device 1500 can be a terminal device, or a device that can support the terminal device in implementing the functions of the terminal device in any of the above-mentioned embodiments. The memory 1520 stores the necessary computer programs, computer programs or instructions and / or data to implement the functions of the communication device in any of the above-mentioned embodiments. The processor 1510 can execute the computer program stored in the memory 1520 to perform the method performed by the terminal device in any of the above-mentioned embodiments.

[0187] In one possible implementation, the communication device 1500 can be applied to a network device. Specifically, the communication device 1500 can be a network device or a device that can support the network device in implementing the functions of the network device in any of the above-mentioned embodiments. The memory 1520 stores the necessary computer programs, computer programs or instructions and / or data to implement the functions of the network device in any of the above-mentioned embodiments. The processor 1510 can execute the computer program stored in the memory 1520 to perform the method performed by the network device in any of the above-mentioned embodiments.

[0188] Since the communication device 1500 provided in this embodiment can be applied to a terminal device to implement the method executed by the terminal device, or can be applied to a network device to implement the method executed by the network device, the technical effects that can be achieved can be referred to the above method embodiments and will not be repeated here.

[0189] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0190] In an embodiment of the present application, the memory may be a non-volatile memory, such as a hard disk drive (HDD) or a solid-state drive (SSD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory may also be any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in an embodiment of the present application may also be a circuit or any other device that can implement a storage function, for storing computer programs, computer programs or instructions and / or data.

[0191] Based on the above embodiments, referring to FIG16 , an embodiment of the present application also provides another communication device 1600, including: an input / output interface 1610 and a logic circuit 1620; the input / output interface 1610 is used to receive code instructions and transmit them to the logic circuit 1620; the logic circuit 1620 is used to run code instructions to execute the method executed by the terminal device or network device in any of the above embodiments.

[0192] Optionally, the input / output interface 1610 may be an interface on a chip, and the logic circuit 1620 may be one or more processors. Optionally, the one or more processors may be located inside or outside the device.

[0193] The following describes in detail the operations performed by the communication device when applied to a terminal device or a network device.

[0194] In an optional implementation, the communication device 1600 may be applied to a terminal device to execute the method executed by the aforementioned terminal device, specifically, for example, the method executed by the terminal device in the embodiments shown in FIG. 4 and / or FIG. 9 .

[0195] For example, input / output interface 1610 is configured to input a signal. Logic circuit 1620 is configured to demodulate the signal to obtain i second data packets. Logic circuit 1620 is further configured to input the i second data packets into a security module to obtain i first data packets. The security module is configured to perform security inverse processing on the i second data packets.

[0196] For another example, input / output interface 1610 is configured to input a k+1th signal. Logic circuit 1620 is configured to input the kth data packet into the security module to obtain a k+1th random information. Here, k is an integer greater than or equal to 1, and the kth data packet is a successfully transmitted data packet. Logic circuit 1620 is further configured to obtain a k+1th data packet based on the k+1th random information and the k+1th signal.

[0197] Since the communication device 1600 provided in this embodiment can be applied to a terminal device to implement the method executed by the terminal device, the technical effects that can be obtained can be referred to the above method embodiment and will not be described in detail here.

[0198] In an optional implementation, the communication device 1600 may be applied to a network device to execute the method executed by the aforementioned network device, for example, the method executed by the network device in the embodiments shown in FIG. 4 and / or FIG. 9 .

[0199] For example, logic circuit 1620 is configured to input i first data packets into a security module to obtain i second data packets. Where i is an integer greater than or equal to 1, the security module is configured to perform security processing on the i first data packets. Logic circuit 1620 is also configured to modulate the i second data packets to obtain a signal. Input / output interface 1610 is configured to output the signal.

[0200] For another example, logic circuit 1620 is configured to input the kth data packet into the security module to obtain the k+1th random information. Here, k is an integer greater than or equal to 1, and the kth data packet is a successfully transmitted data packet. Logic circuit 1620 is further configured to obtain the k+1th signal based on the k+1th random information and the k+1th data packet. Input / output interface 1610 is configured to output the k+1th signal.

[0201] Since the communication device 1600 provided in this embodiment can be applied to a network device to implement the method executed by the above network device, the technical effects that can be obtained can be referred to the above method embodiment and will not be described in detail here.

[0202] Based on the above embodiments, embodiments of the present application further provide a communication system. The communication system includes at least one communication device applied to a terminal device and at least one communication device applied to a network device. The technical effects that can be achieved can be referenced to the above method embodiments and will not be further described here.

[0203] Based on the above embodiments, the present application also provides a system. The communication system includes at least one network device and a terminal device.

[0204] Based on the above embodiments, embodiments of the present application further provide a computer-readable storage medium storing a computer program or instructions. When the instructions are executed, the method executed by the terminal device or the method executed by the network device in any of the above embodiments is implemented. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0205] To implement the functions of the communication device shown in Figures 13 to 16 , embodiments of the present application further provide a chip including a processor for supporting the communication device in implementing the functions of the terminal device or network device described in the method embodiments. In one possible design, the chip is connected to or includes a memory, which is used to store computer programs, instructions, and data necessary for the communication device.

[0206] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0207] The present application is described with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by a computer program or instruction. These computer programs or instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0208] These computer programs or instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0209] These computer programs or instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0210] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application also intends to include these modifications and variations.

Claims

1. A secure communication method, characterized in that: include: Inputting i first data packets into a security module to obtain i second data packets; i is an integer greater than or equal to 1; The security module is used to perform security processing on the i first data packets; Modulating the i second data packets to obtain a signal; The signal is transmitted.

2. The method according to claim 1, characterized in that Also includes: A cyclic redundancy check CRC is added to each of the i second data packets, and channel coding is performed.

3. The method according to claim 1, characterized in that The step of inputting i first data packets into the security module comprises: Add CRC to i first data packets respectively to obtain i third data packets; The i third data packets are input into the security module to obtain the i second data packets.

4. The method according to claim 1, characterized in that The step of inputting i first data packets into the security module comprises: Add CRC to the i first data packets respectively, and perform channel coding to obtain i fourth data packets; The i fourth data packets are input into the security module to obtain the i second data packets.

5. The method according to any one of claims 1 to 4, characterized in that: The security module is used to generate i random seeds, and the i-th random seed is used to generate the i-th second data group with the i-th first data group; if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data group; if i is equal to 1, the i-th random seed is generated based on a random vector.

6. A secure communication method, characterized in that: include: Input the kth data group into the security module to obtain the k+1th random information; The k is an integer greater than or equal to 1; the kth data packet is a data packet that has been successfully transmitted; Based on the k+1th random information and the k+1th data packet, obtaining a k+1th signal; The k+1th signal is sent.

7. The method according to claim 6, characterized in that The generating the k+1th signal based on the k+1th random information and the k+1th data packet comprises: The k+1th random information and the k+1th data packet are modulated respectively, and the modulated signals are processed to obtain the k+1th signal.

8. The method according to claim 6, characterized in that The generating the k+1th signal based on the k+1th random information and the k+1th data packet comprises: Generate a scrambling parameter based on the k+1th random information; The modulation mode of the k+1th data packet is controlled based on the scrambling parameter to obtain the k+1th signal.

9. The method according to claim 6, characterized in that The generating the k+1th signal based on the k+1th random information and the k+1th data packet comprises: Generate a permutation index based on the k+1th random information, where the permutation index corresponds to at least one permutation mode; Permuting bits included in the k+1th data packet based on the at least one permutation method corresponding to the permutation index; The k+1th data packet after substitution is modulated to obtain the k+1th signal.

10. The method according to any one of claims 6 to 9, characterized in that: The k+1th data packet is a data packet after CRC is added and channel coding is performed.

11. A physical layer security communication method, characterized in that: include: Receive a signal; Demodulating the signal to obtain i second data packets; The i second data packets are input into a security module to obtain i first data packets, and the security module is used to perform security inverse processing on the i second data packets.

12. The method according to claim 11, characterized in that Also includes: After channel decoding of the i second data packets, a cyclic redundancy check CRC is performed. If the check passes, the decoded i second data packets are input into a security module for security inverse processing.

13. The method according to claim 11, characterized in that The step of inputting the i second data packets into a security module to obtain i first data packets comprises: Channel-decoding the i second data packets and inputting the resultant data into a security module to obtain i third data packets; A CRC check is performed on the i third data packets.

14. The method according to claim 11, characterized in that The step of inputting the i second data packets into a security module to obtain i first data packets comprises: Inputting the i second data packets into a security module to obtain i fourth data packets; Channel decoding the i fourth data packets and performing CRC check; When the CRC is successful, the i first data packets are obtained.

15. The method according to any one of claims 11 to 14, characterized in that: The security module is used to generate i random seeds, and the i-th random seed is used to generate the i-th second data group with the i-th first data group; if i is an integer greater than or equal to 2, the i-th random seed is generated based on the i-1-th random seed and the i-1-th second data group; if i is equal to 1, the i-th random seed is generated based on a random vector.

16. A secure communication method, characterized in that: include: Receive the k+1th signal; Input the kth data group into the security module to obtain the k+1th random information; The k is an integer greater than or equal to 1; the kth data packet is a data packet that has been successfully transmitted; Based on the k+1th random information and the k+1th signal, a k+1th data packet is obtained.

17. The method according to claim 16, characterized in that The obtaining a k+1th data packet based on the k+1th random information and the k+1th signal comprises: Obtaining a signal obtained by modulating the k+1th data packet based on a signal obtained by modulating the k+1th random information and the k+1th signal; The signal obtained by modulating the k+1th data packet is demodulated to obtain the k+1th data packet.

18. The method according to claim 16, characterized in that The obtaining a k+1th data packet based on the k+1th random information and the k+1th signal comprises: Generate a scrambling parameter based on the k+1th random information; The demodulation mode of the k+1th signal is controlled based on the scrambling parameter to obtain the k+1th data packet.

19. The method according to claim 16, characterized in that The obtaining a k+1th data packet based on the k+1th random information and the k+1th signal comprises: Generate a permutation index based on the k+1th random information, where the permutation index corresponds to at least one permutation mode; The demodulated k+1th signal is subjected to an inverse operation of the at least one permutation method to obtain the k+1th data packet.

20. The method according to any one of claims 16 to 19, characterized in that: Also includes: Channel decoding is performed on the k+1th data packet and a cyclic redundancy check CRC is removed.

21. A communication device, characterized in that: The method comprises a unit for executing the method according to any one of claims 1 to 5, or comprises a unit for executing the method according to any one of claims 6 to 10.

22. A communication device, characterized in that: The method comprises a unit for executing the method according to any one of claims 11 to 15, or comprises a unit for executing the method according to any one of claims 16 to 20.

23. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when called by an electronic device, cause the electronic device to execute the method as described in any one of claims 1 to 5, or cause the electronic device to execute the method as described in any one of claims 6 to 10, or cause the electronic device to execute the method as described in any one of claims 11 to 15, or cause the electronic device to execute the method as described in any one of claims 16 to 20.

24. A communication system, characterized in that: The method comprises an apparatus for executing the method according to any one of claims 1 to 5 and an apparatus for executing the method according to any one of claims 11 to 15, or comprises an apparatus for executing the method according to any one of claims 6 to 10 and an apparatus for executing the method according to any one of claims 16 to 20.

25. A chip system, characterized in that: The chip system comprises: Communication interface; A processor, used to call and run the instruction through the communication interface, so that the device installed with the chip system executes the method as described in any one of claims 1 to 5, or the device installed with the chip system executes the method as described in any one of claims 6 to 10, or the device installed with the chip system executes the method as described in any one of claims 11 to 15, or the device installed with the chip system executes the method as described in any one of claims 16 to 20.

Images