Cross-node data transmission method and related device

Abstract

Embodiments of the present application provide a cross-node data transmission method and a related device, which are applied to a relay node of an ad hoc network. The method comprises : upon completion of neighbor discovery between a relay node and an adjacent node, receiving a routing diffusion message sent by the adjacent node, and authenticating the routing diffusion message on the basis of node one-way authentication information in the routing diffusion message; if the authentication result is that the routing diffusion message is sent by the adjacent node, establishing a correspondence between the adjacent node and challenge information; then receiving a data packet sent by the adjacent node, and verifying the data packet on the basis of the challenge information corresponding to the adjacent node; if the data packet is sent by the adjacent node, updating the data packet to obtain a forwarding packet; and sending the forwarding packet to the next hop node. In the process, two-way authentication does not need to be carried out between two adjacent nodes, so that the number of two-way authentications is reduced; and the relay node for forwarding a data packet does not need to decrypt and encrypt forwarded data, so that the energy consumption and transmission delay of nodes are reduced.

Description

Cross-node data transmission method and related device

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on August 11, 2023, with application number 202311018473.X and application name “Cross-node data transmission method and related device”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and in particular to a cross-node data transmission method and related devices. Background Art

[0003] In decentralized networks (such as ad hoc networks), device interconnection can expand the range of device connections and reduce network deployment costs. For example, a smart screen in the network needs to communicate with a smartwatch. The two cannot connect directly, but the smart screen can connect to the smartphone via a mobile hotspot (such as WiFi), and the smartphone and smartwatch can connect via Bluetooth. Data transmitted between the smartwatch and smart screen can be forwarded by the smartphone, thus enabling communication between the smart screen and smartwatch.

[0004] However, the devices responsible for data forwarding in the network are typically not routers or switches. For example, using smartphones as forwarding devices would disrupt the existing network security model of smartphones and introduce security risks. To ensure the security of forwarding devices, smartphones must authenticate the nodes at the link source and destination before forwarding data, and only forward data from authenticated nodes. This authentication process creates the following issues: Because data forwarding often occurs across relay nodes, each relay node must authenticate the data-sending node before forwarding data. This complex authentication process increases communication latency. Furthermore, when a smartphone acts as a forwarding node, it must decrypt the received data using the sender's corresponding key, and then encrypt it using the receiver's corresponding key. These encryption and decryption operations increase the smartphone's energy consumption and data transmission latency.

[0005] Summary of the Invention

[0006] The present application provides a cross-node data transmission method and related devices. When networking, adjacent nodes send routing diffusion messages to each other, and determine that the routing diffusion message is sent by the adjacent node through the security diffusion information written in the routing diffusion message. After the networking is completed, when a data message is received from the adjacent node, the challenge response information in the data message is verified based on the challenge information, so as to determine that the data message is sent by the adjacent node, thereby avoiding two-way identity authentication of the adjacent nodes. The relay node does not need to decrypt and encrypt the data message, which reduces the energy consumption and transmission delay of the node.

[0007] To achieve the above objectives, this application adopts the following technical solutions:

[0008] In a first aspect, a cross-node data transmission method is provided, which is applied to a relay node of a decentralized network, wherein the decentralized network includes at least three nodes, and the at least three nodes include the relay node and at least two adjacent nodes of the relay node. The method includes: after the relay node and the adjacent node complete neighbor discovery, the relay node receives a routing diffusion message sent by the adjacent node, the routing diffusion message carries node one-way authentication information and challenge information; the relay node authenticates the routing diffusion message based on the node one-way authentication information to obtain an authentication result; if the authentication result is that the routing diffusion message is sent by the adjacent node, then establishes a relationship between the adjacent node and the challenge information. The relay node receives the data message sent by the adjacent node, and the data message carries the challenge response information corresponding to the adjacent node; the relay node determines the challenge information corresponding to the adjacent node based on the corresponding relationship; verifies the challenge response information based on the challenge information to obtain a verification result; if the verification result is that it is determined that the data message is sent by the adjacent node, the relay node obtains the challenge response information corresponding to the relay node; the relay node updates the data message based on the challenge response information corresponding to the relay node to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to the relay node; and sends the forwarding message to the next hop node.

[0009] In this way, after completing neighbor discovery of adjacent nodes, adjacent nodes establish a network by mutually sending route diffusion messages. The route diffusion messages carry one-way authentication information and challenge information. The receiving node of the route diffusion message authenticates the sending node of the route diffusion message by performing one-way authentication information to verify whether the route diffusion message is sent by the adjacent node. If the route diffusion message is determined to be sent by the adjacent node based on the authentication result, the relay node establishes a correspondence between the sending node and the challenge information. After the network is established, the adjacent node sends a data message to the destination node through the relay node. The data message carries the challenge response information corresponding to the adjacent node. The relay node receives the data message sent by the adjacent node and verifies the challenge response message based on the challenge information. If the verification result shows that the forwarding message is sent by the adjacent node, the relay node updates the data message to obtain a forwarding message, and then sends the forwarding message to the next-hop node. During the above data transmission process, the relay node does not need to perform two-way authentication with the adjacent node, which reduces the number of two-way authentications. During the process of forwarding the data message by the relay node, it is not necessary to encrypt and decrypt the forwarded data message, which reduces the energy consumption of the relay node.

[0010] In some embodiments of the first aspect, the one-way authentication information includes signature information corresponding to the route diffusion message; the identity authentication of the route diffusion message based on the node one-way authentication information to obtain an authentication result includes: obtaining the public key of the adjacent node; and verifying the signature information based on the public key to obtain an authentication result.

[0011] In this way, since the public key is unique, the relay node uses the public key to authenticate the adjacent node to determine the identity of the adjacent node; then the signature information in the route diffusion message corresponding to the adjacent node is verified based on the public key to verify that the route diffusion message is sent by the adjacent node and not forged by other nodes, that is, the route diffusion message is authenticated.

[0012] In some embodiments of the first aspect, the challenge information includes a challenge random value, and the challenge response message includes a response random value; verifying the challenge response information based on the challenge information to obtain a verification result includes: if the challenge random value is equal to the response random value, determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value, determining that the data message is not sent by the adjacent node.

[0013] In this way, by comparing the challenge random number in the challenge information and the response random number in the challenge response information, it is detected whether the data message is sent by the adjacent node, thereby realizing verification of the data message.

[0014] In some embodiments of the first aspect, the challenge information includes the key negotiation parameters corresponding to the adjacent node, and the challenge response information includes a response information verification code; verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameters; if the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0015] In this way, by comparing the challenge information verification code in the challenge information and the response information verification code in the challenge response information, it is detected whether the data message is sent by the adjacent node, thereby realizing verification of the data message.

[0016] In some embodiments of the first aspect, the challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameter; if the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value or\and the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0017] In this way, by comparing the challenge information verification code in the challenge information and the response information verification code in the challenge response information, the challenge random number and the response random number, it is detected whether the data message is sent by the adjacent node, thereby realizing the verification of the data message.

[0018] In some embodiments of the first aspect, the challenge information also includes a valid time of the challenge random value; before verifying the challenge response information based on the challenge information, the method also includes: if it is determined based on the valid time that the challenge random value is within the valid time, then verifying the challenge response information based on the challenge information.

[0019] In this way, the validity period of the challenge random number is limited by the validity time, so as to improve the security of the challenge random number.

[0020] In some embodiments of the first aspect, the route diffusion message further carries a timestamp, where the timestamp is used to indicate a time corresponding to the route diffusion message.

[0021] In this way, since the timestamp has the characteristic of being non-repetitive, anti-replay attack can be achieved by adding the timestamp.

[0022] In some embodiments of the first aspect, the data message carries bidirectional authentication information, and the neighboring node performs bidirectional authentication with the destination node of the data message through the bidirectional authentication information.

[0023] In this way, the two-way authentication information carried in the data message can realize cross-node authentication to ensure the security of cross-node data transmission.

[0024] In the second aspect, a cross-node data transmission method is provided, which is applied to a sending node in a decentralized network, wherein the decentralized network includes at least three nodes, and the method includes: after the sending node and the adjacent node complete neighbor discovery, sending a routing diffusion message to the adjacent node, the routing diffusion message carries node one-way authentication information and challenge information, so that the adjacent node authenticates the routing diffusion message sent by the adjacent node based on the node one-way authentication information to obtain an authentication result; when the authentication result is that the routing diffusion message is sent by the sending node, the adjacent node establishes a corresponding relationship between the sending node and the challenge information; sending a data packet to the adjacent node, the data packet carries the corresponding The challenge response information of the sending node is the source node of the data message and the adjacent node is not the destination node of the data message, so that the adjacent node determines the challenge information corresponding to the sending node according to the corresponding relationship; the adjacent node verifies the challenge response information according to the challenge information to obtain a verification result; if the verification result is that the adjacent node determines that the data message is sent by the sending node, the adjacent node obtains the challenge response information corresponding to the relay node; the adjacent node updates the data message according to the challenge response information corresponding to the sending node to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to the adjacent node; the adjacent node sends the forwarding message to the next hop node.

[0025] In some embodiments of the second aspect, the one-way authentication information includes signature information corresponding to the route diffusion message.

[0026] In some embodiments of the second aspect, the challenge information includes a challenge random value, and the challenge response message includes at least one of a response random value and a key negotiation parameter.

[0027] In some embodiments of the second aspect, the data message further carries bidirectional authentication information, and the sending node performs bidirectional authentication with the destination node of the data message through the bidirectional authentication information.

[0028] According to a third aspect, a cross-node data transmission method is provided, which is applied to a receiving node of a decentralized network, wherein the decentralized network includes at least three nodes, and the method includes: after the receiving node and the adjacent node complete neighbor discovery, receiving a routing diffusion message sent by the adjacent node, the routing diffusion message carries node one-way authentication information and challenge information; authenticating the routing diffusion message based on the node one-way authentication information to obtain an authentication result; if the authentication result is that the routing diffusion message is sent by the adjacent node, establishing a correspondence between the adjacent node and the challenge information; receiving a forwarding message sent by the adjacent node, the forwarding message carries challenge response information corresponding to the adjacent node, the receiving node is the destination node of the forwarding message and the adjacent node is not the source node of the forwarding message; determining the challenge information corresponding to the adjacent node based on the correspondence; verifying the challenge response information based on the challenge information to obtain a verification result; if the verification result is that the challenge information matches the challenge response information, thereby determining that the forwarding message is sent by the adjacent node, parsing the load information of the forwarding message.

[0029] In some embodiments of the third aspect, the one-way authentication information includes signature information corresponding to the routing diffusion message; the receiving node performs identity authentication on the routing diffusion message based on the node one-way authentication information to obtain an authentication result, including: the receiving node obtains the public key of the adjacent node; the receiving node verifies the signature information based on the public key to obtain an authentication result.

[0030] In some embodiments of the third aspect, the challenge information includes a challenge random value, and the challenge response message includes a response random value; the challenge response information is verified based on the challenge information to obtain a verification result, including: if the challenge random value is equal to the response random value, then the challenge information matches the challenge response information, thereby determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value, then the challenge information does not match the challenge response information, thereby determining that the data message is not sent by the adjacent node.

[0031] In some embodiments of the third aspect, the challenge information includes the key negotiation parameters corresponding to the adjacent node, and the challenge response information includes a response information verification code; verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameters; if the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0032] In some embodiments of the third aspect, the challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; verifying the challenge response information based on the challenge information to obtain a verification result includes: determining the challenge information verification code based on the key negotiation parameters; if the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, determining that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value or\and the challenge information verification code is not equal to the response information verification code, determining that the data message is not sent by the adjacent node.

[0033] In some embodiments of the third aspect, the challenge information also includes a valid time of the challenge random value; before verifying the challenge response information based on the challenge information, the method also includes: if it is determined based on the valid time that the challenge random value is within the valid time, then verifying the challenge response information based on the challenge information.

[0034] In some embodiments of the third aspect, the route diffusion message further carries a timestamp, where the timestamp is used to indicate a time corresponding to the route diffusion message.

[0035] In some embodiments of the third aspect, the data message carries bidirectional authentication information, and the receiving node performs bidirectional authentication with the source node of the data message through the bidirectional authentication information.

[0036] In a fourth aspect, a cloud cross-node data transmission method is provided, which is applied to a decentralized network, wherein the decentralized network includes at least three nodes, and the method includes: after the at least three nodes complete neighbor discovery, the adjacent nodes among the at least three nodes send routing diffusion messages to each other, and the routing diffusion messages carry node one-way authentication information and challenge information; the at least three nodes authenticate the routing diffusion messages sent by the adjacent nodes based on the node one-way authentication information to obtain authentication results; if the authentication result is that the routing diffusion message is sent by the adjacent node, the at least three nodes establish a corresponding relationship between the adjacent node and the challenge information; the sending node among the at least three nodes sends a data message to the relay node, the source node of the data message is the sending node, and the relay node is The relay node is an adjacent node of the sending node and is not the destination node of the data message; the relay node receives the data message sent by the sending node, and the data message carries the challenge response information corresponding to the sending node; the relay node determines the challenge information corresponding to the sending node based on the corresponding relationship; the relay node verifies the challenge response information based on the challenge information to obtain a verification result; if the verification result is that the relay node determines that the data message is sent by the sending node, the relay node obtains the challenge response information corresponding to the relay node; the relay node updates the data message based on the challenge response information corresponding to the relay node to obtain a forwarding message, and the forwarding message carries the challenge response information corresponding to the relay node; the relay node sends the forwarding message to the next hop node.

[0037] In some embodiments of the fourth aspect, the one-way authentication information includes signature information corresponding to the routing diffusion message; the relay node performs identity authentication on the routing diffusion message based on the node one-way authentication information to obtain an authentication result, including: the relay node obtains the public key of the adjacent node; the relay node verifies the signature information based on the public key to obtain an authentication result.

[0038] In some embodiments of the fourth aspect, the challenge information includes a challenge random value, and the challenge response message includes a response random value; the relay node verifies the challenge response information based on the challenge information to obtain a verification result, including: if the challenge random value is equal to the response random value, the relay node determines that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value, the relay node determines that the data message is not sent by the adjacent node.

[0039] In some embodiments of the fourth aspect, the challenge information includes the key negotiation parameters corresponding to the adjacent node, and the challenge response information includes a response information verification code; the relay node verifies the challenge response information based on the challenge information to obtain a verification result, including: the relay node determines the challenge information verification code based on the key negotiation parameters; if the challenge information verification code is equal to the response information verification code, the relay node determines that the data message is sent by the adjacent node; if the challenge information verification code is not equal to the response information verification code, the relay node determines that the data message is not sent by the adjacent node.

[0040] In some embodiments of the fourth aspect, the challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; the relay node verifies the challenge response information based on the challenge information to obtain a verification result, including: the relay node determines the challenge information verification code based on the key negotiation parameter; if the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, then the relay node determines that the data message is sent by the adjacent node; if the challenge random value is not equal to the response random value or\and the challenge information verification code is not equal to the response information verification code, then the relay node determines that the data message is not sent by the adjacent node.

[0041] In some embodiments of the fourth aspect, the challenge information also includes a valid time of the challenge random value; before the relay node verifies the challenge response information based on the challenge information, the method also includes: if it is determined based on the valid time that the challenge random value is within the valid time, the relay node verifies the challenge response information based on the challenge information.

[0042] In some embodiments of the fourth aspect, the route diffusion message further carries a timestamp, where the timestamp is used to indicate a time corresponding to the route diffusion message.

[0043] In some embodiments of the fourth aspect, the data message carries bidirectional authentication information, and the sending node performs bidirectional authentication with the destination node of the data message through the bidirectional authentication information.

[0044] In a fifth aspect, a node is provided, comprising: a memory including computer-readable instructions;

[0045] A processor in communication with the memory, the processor being configured to execute the computer-readable instructions so that the node performs the cross-node data transmission method according to any one of the first aspect, the second aspect, and the third aspect.

[0046] In a sixth aspect, a computer-readable storage medium is provided, comprising a program or instruction, which, when executed by a processor, implements the cross-node data transmission method as described in any one of the first aspect, the second aspect, or the third aspect.

[0047] The beneficial effects brought about by each possible implementation method of the cross-node data transmission method provided in the second aspect of the embodiment of this application, the cross-node data transmission method provided in the third aspect, the cross-node data transmission method provided in the fourth aspect, the node provided in the fifth aspect, and the computer-readable storage medium provided in the sixth aspect can all be referred to the description of the various possible implementation methods in the first aspect, and will not be repeated here one by one. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] FIG1 is a schematic diagram of a heterogeneous network;

[0049] FIG2 is a schematic diagram of end-to-end cross-hop authentication in the heterogeneous network shown in FIG1 ;

[0050] FIG3 is a schematic diagram of a scenario of a cross-node data transmission method provided by an embodiment of the present application;

[0051] FIG4 is a schematic diagram of a flow chart of a cross-node data transmission method provided in an embodiment of the present application;

[0052] FIG5 is a schematic diagram of a flow chart of another cross-node data transmission method provided in an embodiment of the present application;

[0053] FIG6 is a schematic diagram of the structure of a routing diffusion message provided in an embodiment of the present application;

[0054] FIG7 is a schematic diagram of a flow chart of another cross-node data transmission method provided in an embodiment of the present application;

[0055] FIG8 is a schematic diagram of the structure of a node provided in an embodiment of the present application; DETAILED DESCRIPTION

[0056] The technical solutions in this application will be described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this specification, rather than all the embodiments.

[0057] A decentralized network (or heterogeneous network) composed of multiple nodes, such as a terminal ad hoc network, is a network in which two nodes that are not directly connected can communicate across nodes through other nodes. For example, please refer to Figure 1, which is a schematic diagram of a heterogeneous network. The heterogeneous network in Figure 1 includes a smart screen (i.e., a smart screen), a smart phone, and a smart watch. Since the performance of the smart screen and the smart watch themselves does not support or is not within the signal range of each other, the smart screen and the smart watch cannot communicate directly, and need to rely on the smart phone as a relay forwarding device.

[0058] Specifically, the smartphone and the smart screen are connected through a wireless hotspot, and the smartphone and the smart watch are connected through Bluetooth; when the smart screen and the smart watch communicate, the smart screen sends a data message to the smartphone, and the smartphone acts as a forwarding device to forward the data message to the smart watch, thereby realizing communication between the smart watch and the smart screen.

[0059] Since the product positioning of most nodes in the network is not forwarding devices but data sources, when a node is used as a forwarding device, it will destroy the original network security model of the node. At the same time, the node will consume its energy when performing data forwarding services. For energy saving and security considerations, before the intermediate node forwards data, the sending node corresponding to the data message needs to be authenticated. Only after successful authentication can it be forwarded.

[0060] Please refer to Figure 2, which is a schematic diagram of the end-to-end cross-hop authentication of the heterogeneous network shown in Figure 1. Before the smart screen and the smart watch communicate, the smart watch and the smart phone perform two-way authentication. After the two-way authentication is successful, a secure channel is established. The smart phone and the smart screen perform two-way authentication. After the two-way authentication is successful, a secure channel is established. Then the smart watch and the smart screen can communicate through the secure channel.

[0061] After the user of the smartphone, smart screen, and smart watch in the heterogeneous network in Figure 2 logs in, the user's account sends the network identification, public and private key information, etc. to the smartphone, smart screen, and smart watch.

[0062] Before the smart screen and smart watch communicate, the user can select the device (i.e., smart watch) in the heterogeneous network that needs to communicate on the smart screen interface. At this time, the smart screen initiates a cross-node connection with the smart watch:

[0063] First, the smart screen initiates a two-way authentication connection with the smartphone to establish a secure channel between the smart screen and the smartphone. This two-way authentication can use protocols such as Password-based Authentication and Key Agreement (PAKE) and Transport Layer Security (TLS) to verify the authenticity of the smart screen and smartphone.

[0064] Then, after the two-way authentication between the smart screen and the smart phone is completed, the smartphone initiates a two-way authentication connection with the smart watch to establish a secure channel between the smartphone and the smart watch;

[0065] After the two-way authentication between the smartphone and the smartwatch is complete, the smartwatch and smart screen transmit data packets through the secure channel between the smart screen and smartphone, and the secure channel between the smartphone and the smartwatch. This forwarding of data packets is done through the smartphone's application layer, enabling two-way cross-hop authentication between the smartwatch and smart screen. This ensures end-to-end application-layer security.

[0066] The cross-hop authentication process described in Figure 2 has the following problems:

[0067] First, the above cross-hop authentication process includes multiple bidirectional authentications, which increases the node authentication overhead and the delay of cross-hop communication between nodes. In Figure 2, before the smart watch and smart screen communicate, the heterogeneous network needs to perform three bidirectional authentications, which is a relatively large number of bidirectional authentication processes.

[0068] Secondly, since the encryption keys corresponding to each security channel are different, when the relay node is forwarding data, the forwarded data needs to go through different security channels. When the intermediate node forwards the data received through one of the security channels to another security channel, it needs to decrypt the forwarded data using the key corresponding to the security channel on the sending side, and then encrypt the forwarded data using the key of the security channel on the receiving side. The encryption and decryption operations consume a lot of energy for the intermediate nodes and increase the data transmission delay.

[0069] Based on the above problems, an embodiment of the present application provides a cross-node data transmission method, which is applied to nodes in a decentralized network. After completing neighbor discovery of adjacent nodes, adjacent nodes are networked by sending routing diffusion messages to each other. The routing diffusion messages carry one-way authentication information and challenge information. The receiving node of the routing diffusion message uses the one-way authentication information to authenticate the sending node of the routing diffusion message to verify whether the routing diffusion message is sent by the adjacent node; if it is determined based on the authentication result that the routing diffusion message is sent by the adjacent node, the receiving node of the routing diffusion message establishes a corresponding relationship between the sending node and the challenge information; after the networking is completed, the sending node sends a data message to the destination node through the relay node, and the data message carries the challenge response information corresponding to the sending node. The sending node is the source node of the data message, and the receiving node is the destination node of the data message. There is at least one relay node between the sending node and the receiving node, and the relay node is used to forward the data message from the sending node to the receiving node. The sending node sends a data message to the adjacent relay node, and the relay node receives the data message sent by the adjacent sending node. The relay node verifies the challenge response message based on the challenge information. If the verification result is that the challenge information and the challenge response message match, and it is determined that the data message is sent by the sending node, the relay node updates the data message, obtains the forwarding message, and then sends the forwarding message to the next hop node. During the above data transmission process, the relay node does not need to perform two-way authentication with the sending node or the relay node of the previous hop of the data message, which reduces the number of two-way authentications. In the process of forwarding data messages by the relay node, there is no need to encrypt and decrypt the forwarded data messages, which reduces the energy consumption of the relay node and the data transmission delay.

[0070] First, the application scenarios of the cross-node data transmission method provided by this application are described.

[0071] The following is an explanation using the application scenario shown in Figure 3. Please refer to Figure 3, which is a schematic diagram of a scenario of a cross-node data transmission method provided by an embodiment of the present application. Figure 3 includes three nodes, which form a decentralized network. The decentralized network can be an ad hoc network or other types of networks. It is understood that in other embodiments, the number of nodes can be set according to the actual application scenario, such as four, five, or more than five, that is, the number of nodes in the decentralized network is at least three;

[0072] In FIG3 , the number of relay nodes between the source node and the destination node of the transmitted data message is one. It can be understood that the number of relay nodes between the source node and the destination node of the transmitted data message may be two or more.

[0073] In Figure 3, node A needs to communicate with node C. The data packets transmitted between nodes A and C need to be forwarded by node B. To ensure data security, node B needs to authenticate the data packets before forwarding them to confirm that the data packets are sent by node A. This ensures that the forwarded data packets are not forged.

[0074] Since the decentralized network in Figure 3 is a distributed temporary network, all nodes can join or leave the network at any time. Before the multiple nodes in the decentralized network shown in Figure 3 are networked, mutual trust is established at the user level by default, that is, every node in the decentralized network is trustworthy.

[0075] In some possible implementations, each node has a user account, and all nodes have the same user. Once a user logs in to a node, because all nodes in the network are accessed through the same account, the user can discover other nodes in the decentralized network through the application interface in the node, and thus confirm that all nodes in the decentralized network are trustworthy. In this way, mutual trust is achieved among all nodes in the decentralized network through the use of the same user account.

[0076] In some possible implementations, the user account of at least one node in the decentralized network is different from the user accounts of other nodes, and the user account of the node authorizes other users to use the node, so that all nodes in the decentralized network are used by the same user, and it can be determined that all nodes in the decentralized network are trusted nodes.

[0077] In some possible implementations, all nodes in the decentralized network are in a preset area when networking, for example, a decentralized network composed of nodes in the same office, then it can be determined that all nodes in the decentralized network are trustworthy.

[0078] Optionally, the decentralized network in Figure 3 can be a heterogeneous self-organizing network (or heterogeneous network), where a heterogeneous network refers to a network composed of computers, network equipment and systems produced by different manufacturers. The nodes of the heterogeneous network run on different protocols to support different functions or applications. Through heterogeneous connections, the interconnection capability between nodes is improved, the connection range is expanded, and the network deployment cost is saved.

[0079] The nodes in FIG3 may be nodes with data forwarding functions such as mobile terminals and routers.

[0080] For ease of explanation, in the following embodiments, node B serves as a relay node, and node A and node C serve as adjacent nodes of node B respectively. It can be understood that in other embodiments, node A and node C can also serve as relay nodes, and node B can also serve as the source node or destination node of the data message.

[0081] Please refer to Figure 4, which is a flow chart of a cross-node data transmission method provided in an embodiment of the present application. The following is an example of Figure 4 applied to the decentralized network shown in Figure 3. As shown in Figure 4, the cross-node data transmission method includes: S401-S408.

[0082] S401, networking process.

[0083] The networking process involves: before a node joins a decentralized network, it conducts neighbor discovery with at least one node in the decentralized network. After neighbor discovery is complete between adjacent nodes in the decentralized network, they send route diffusion messages to each other, establishing routing relationships between adjacent nodes, building a routing table, and establishing routing relationships between nodes across hops. Route diffusion messages carry one-way authentication information and challenge information for the corresponding node.

[0084] As shown in Figure 4, nodes A and B, and nodes B and C are all adjacent nodes. After completing neighbor discovery, node A sends a route diffusion message to its adjacent node (node ​​B), and the route diffusion message carries the one-way authentication information and challenge information corresponding to node A; node B sends diffusion messages to its adjacent nodes (node ​​A and node C) respectively, and the route diffusion message carries the one-way authentication information and challenge information corresponding to node B; node C sends a diffusion message to its adjacent node (node ​​B), and the route diffusion message carries the one-way authentication information and challenge information corresponding to node C.

[0085] Among them, neighbor discovery is the process of adjacent nodes discovering each other, such as the terminal detecting the Bluetooth information sent by the smart watch, or the terminal detecting the channel signal, etc., to confirm the adjacent nodes that can be connected.

[0086] Route diffusion messages, which can be transmitted using Link-State Advertisements (LSAs) or Open Shortest Path First (OSPF), are used to establish networking between adjacent nodes after neighbor discovery is complete. This involves sending route diffusion messages between adjacent nodes to diffuse routes, build routing tables, and establish routing relationships across hops, thereby achieving networking.

[0087] S402: Authentication process.

[0088] The authentication process involves: after receiving a route diffusion message from a neighboring node, authenticating the route diffusion message based on the one-way authentication information in the route diffusion message to determine whether the route diffusion message was sent by the neighboring node. If the authentication result confirms that the route diffusion message was sent by the neighboring node, a corresponding relationship between the challenge information and the neighboring node is established. If the authentication result confirms that the route diffusion message was not sent by the neighboring node, the route diffusion message is discarded.

[0089] As shown in Figure 4, in Figure 4, node A authenticates the route diffusion message based on the one-way authentication information in the route diffusion message sent by node B to confirm that the route diffusion message is sent by node B, and establishes a corresponding relationship between node B and the challenge information in the corresponding route diffusion message, and then stores the corresponding relationship in node A;

[0090] In Figure 4, node B authenticates the route diffusion message based on the one-way authentication information in the route diffusion message sent by node A and node C to determine whether the route diffusion message is sent by node A or node C, and then establishes a correspondence between node A or node C and the challenge information in the corresponding route diffusion message, and stores the correspondence.

[0091] Optionally, the correspondence may be stored in the corresponding node in a table format. For example, node A stores the correspondence of node B in a challenge mapping table in node A, and the challenge mapping table includes correspondences of multiple nodes.

[0092] Optionally, the corresponding relationship includes a node identifier and challenge information corresponding to the node, wherein the node identifier may be a device identifier, such as a unique device identifier (UDID) of a smartphone.

[0093] In some possible implementations, if the nodes in the decentralized network have the function or configuration to perform two-way authentication on adjacent nodes, the nodes in the decentralized network unload (or cancel) the two-way authentication of neighboring devices through routing diffusion messages, thereby avoiding the increase in the number of authentication times and authentication delays of the two-way authentication of adjacent nodes during cross-node communication.

[0094] In some possible implementations, after neighbor discovery is completed between adjacent nodes, the adjacent nodes periodically send route diffusion messages between each other. After the relay node receives a new route diffusion message sent by the adjacent node, the relay node authenticates the route diffusion message based on the one-way authentication information in the most recently received route diffusion message to determine whether the route diffusion message is sent by the adjacent node; if the authentication result is that the route diffusion message is sent by the adjacent node, the correspondence between the adjacent node and the challenge information is updated; if the authentication result is that the route diffusion message is not sent by the adjacent node, the route diffusion message is discarded.

[0095] S403: Node A sends a data message to node B.

[0096] Among them, the data message carries challenge response information, and the challenge response information corresponds to the challenge information in the route diffusion message sent by node A to node B. The source node corresponding to the data message is node A, and the destination node is node C. Node B is not the destination node of the data message but acts as a relay node for forwarding the data message.

[0097] It can be understood that Figure 4 is only an example provided by this application, and node B serves as the only relay node. In other embodiments, the number of relay nodes between the source node and the destination node of the data message may be other numbers, such as two or more than two.

[0098] Optionally, after node A sends a route diffusion message to its adjacent nodes, node A stores the corresponding challenge information, determines the challenge response information corresponding to node A based on the challenge information before forming the data message, and then forms the data message based on the challenge response information.

[0099] For example, since the challenge information and the challenge response information satisfy the challenge response mechanism, that is, the challenge information in the route diffusion message sent by node A to node B and the challenge response information carried in the data packet sent by node A to node B can be exactly the same, or the challenge information and the challenge response information after processing are exactly the same.

[0100] In some possible implementations, when node A needs to communicate with other adjacent nodes in a decentralized network, node A forms a data message, which carries challenge response information. The challenge response information corresponds to the challenge information in the routing diffusion message sent by node A to the adjacent node; then node A queries the routing table, obtains the next-hop node information, and then sends the data message to the next-hop node.

[0101] S404: Node B receives the data message sent by node A, and determines the challenge information corresponding to node A based on the corresponding relationship.

[0102] Optionally, multiple correspondences are stored in node B. When node B receives a data message sent by node A, it queries the correspondence corresponding to node A based on the node identifier of node A (e.g., UDID of node A), thereby determining the challenge information corresponding to node A based on the correspondence corresponding to node A.

[0103] S405 , verifying the challenge response information based on the challenge information. If the verification result shows that the challenge information and the challenge response information match, thereby determining that the data message is sent by node A, then obtaining the challenge response information corresponding to node B.

[0104] The challenge response information corresponding to the node B matches the challenge information carried in the route diffusion message sent by the node B to its neighboring nodes.

[0105] Specifically, node B uses a challenge-response mechanism to verify the data message, wherein, during the networking process, the route diffusion message sent by node A to node B carries the challenge information corresponding to node A. After the networking is completed, the data message sent by node A to node B carries the challenge-response information corresponding to node A. Node B verifies the challenge-response information based on the challenge information. If the challenge information and the challenge-response information are the same, or the verification information formed based on the challenge information and the challenge-response information are the same, node B determines that the challenge information and the challenge-response information of node A match, and further determines that the data message is sent by node A to node B.

[0106] Furthermore, if the challenge information and the challenge response information are different, or the verification information formed based on the challenge information and the challenge response information are different, node B determines that the challenge information and the challenge response information of node A do not match, and then determines that the data message is not sent by node A to node B, and then discards the data message.

[0107] S406. Node B updates the data message according to the challenge response information corresponding to node B to obtain a forwarding message.

[0108] In some optional implementations, node B replaces the challenge response information corresponding to node A in the data message with the challenge response message corresponding to node B to obtain a forwarding message, which carries the challenge response information corresponding to node B.

[0109] Furthermore, if the challenge response information corresponding to node A is located in the extended header of the data message, node B replaces the challenge response information corresponding to node A in the extended header of the data message with the challenge response message corresponding to node B.

[0110] S407: Node B sends a forwarding message to node C.

[0111] Specifically, node B searches for the next-hop node information in a routing table or in a data message, and then sends a forwarding message to the next-hop node (eg, node C).

[0112] S408 , node C receives the forwarded message, determines the challenge information corresponding to node B according to the corresponding relationship, and verifies the forwarded message according to the challenge information corresponding to node B.

[0113] Optionally, node C receives a forwarding message sent by node B, queries the challenge information corresponding to node B based on the identification information and corresponding relationship of node B stored in node C, and then verifies whether the challenge information corresponding to node B matches the challenge response information in the forwarding message. If the challenge information does not match the challenge response information in the forwarding message, it is determined that the forwarding message is not sent by node B and the forwarding message is discarded; if the challenge information matches the challenge response information, it is determined that the forwarding message is sent by node B.

[0114] Furthermore, since node C is the destination node of the forwarded message, after receiving the forwarded message, node C does not need to forward the forwarded message again, and node C analyzes the load information of the forwarded message.

[0115] In this way, during the cross-node data transmission process, the relay node (such as node B) authenticates the route diffusion message through the one-way authentication information in the route diffusion message sent by the adjacent node received during networking, and determines through authentication that the route diffusion message is sent by the adjacent node, and then realizes networking through the route diffusion message; after the networking is completed, after the relay node receives the data message sent by the adjacent node, it verifies the challenge response information in the data message based on the challenge information corresponding to the adjacent node. When the challenge response information matches the challenge information, it is determined that the data message is sent by the adjacent node, and then updates the data message based on the challenge response information corresponding to the relay node to obtain a forwarding message, and then forwards the forwarding message to the next hop node. In the above data transmission process, the relay node does not need to perform two-way authentication with the adjacent node, saving the interactive process of two-way authentication. The relay node verifies the forwarded data message through the challenge information of the corresponding adjacent node, and does not need to decrypt and encrypt the forwarded data message, reducing the energy consumption of the relay node and the data transmission delay.

[0116] When a node joins a decentralized network or a decentralized network begins to form a network, two adjacent nodes that have completed neighbor discovery send route diffusion messages to each other. When receiving a route diffusion message sent by an adjacent node, it is necessary to authenticate the route diffusion message to determine whether the route diffusion message is sent by the adjacent node. Since the private key of the node is unique and private (only the node itself knows it), the adjacent node uses the private key to form the signature information of the route diffusion message. Other nodes verify the signature information using the public key of the adjacent node to verify whether the route diffusion message is sent by the adjacent node or forged by other nodes.

[0117] In some possible implementations, the one-way authentication information includes signature information, which is obtained by encrypting the route diffusion message using the private key corresponding to the sending node (or source node) of the route diffusion message. Referring to Figure 5, Figure 5 is a schematic diagram of a cross-node data transmission method provided in an embodiment of the present application. After node B receives the route diffusion message sent by node A, it authenticates the route diffusion message based on the one-way authentication information in the route diffusion message, including:

[0118] S501, node B obtains the public key corresponding to node A;

[0119] In some possible implementations, after the user logs in to the account at node B, the network side where the account is located (for example, the business cloud side) will send the public key of the node that has completed user-level mutual trust with node B to the relay node. Node B can form a correspondence between the public key and the corresponding node and store it locally, such as the correspondence between the identifier of node A and its corresponding public key, and the correspondence between the identifier of node C and its corresponding public key. In this way, the node queries the correspondence between the public keys based on the identifier of node A to find the public key of the node.

[0120] In some possible implementations, the one-way authentication information also includes the public key corresponding to the node. After receiving the route diffusion message, node B determines the public key corresponding to node A by parsing the one-way authentication information in the route diffusion message.

[0121] S502: Node B verifies the signature information based on the public key.

[0122] Optionally, since the signature information is obtained by node A encrypting the route diffusion message using the private key corresponding to node A, node B uses the public key corresponding to node A to decrypt the signature information in the route diffusion message, and determines whether the data obtained after decryption is the same as the route diffusion message. If they are the same, it is determined that the route diffusion message is sent by the sending node; if they are not the same, it is determined that the route diffusion message is not sent by the sending node, and the route diffusion message is discarded.

[0123] In this way, node B obtains the public key corresponding to node A. Since the public key is unique, node B authenticates node A through the public key to determine the identity of node A; then, node B verifies the signature information in the route diffusion message corresponding to node A based on the public key to verify that the route diffusion message is sent by node A and not forged by other nodes, that is, the route diffusion message is authenticated.

[0124] Authentication of route diffusion messages based on public keys, private keys, and signature information is an asymmetric key-based authentication method. It is understood that in other embodiments, source authentication of route diffusion messages can also be performed using symmetric keys. Optionally, if all nodes in a decentralized network use the same user, then in a scenario where a user logs into an account through a node, the user account cloud can periodically send corresponding node key parameters to each node (different nodes have different node key parameters). When a node sends a route diffusion message to an adjacent node, it forms key information based on the node key parameters, calculates integrity protection information for the route diffusion message based on the key information, and uses the integrity protection information and the node key parameters as one-way authentication information for the node. When the adjacent node receives the route diffusion message, it determines the node's identity based on the node key parameters. Key information is then formed based on the node key parameters, and integrity protection information for the route diffusion message is calculated based on the key information. The calculated integrity protection information is then compared with the integrity protection information in the route diffusion message to determine whether they are identical. If they are identical, it is determined that the route diffusion message was sent by the corresponding node. If they are different, it is determined that the route diffusion message was not sent by the corresponding node and the route diffusion message is discarded.

[0125] After receiving the route diffusion message sent by node A, node B authenticates node A based on the one-way authentication information and performs message authentication on the route diffusion message to confirm that the route diffusion message was sent by node A. After completing the above authentication, node B forms a correspondence between node A and its corresponding challenge information. After the network is established, node B receives the data message sent by node A and verifies the data message based on the challenge information corresponding to node A to confirm that the data message was sent by node A. Only after the authentication is completed can node B forward the data message. The above verification process adopts a challenge-response mechanism. Only when the challenge information and the challenge-response information match can the data message be determined to be sent by node A. If the challenge information and the challenge-response information do not match, it is determined that the data message was not sent by node A.

[0126] Furthermore, node B verifies the data message based on the challenge information. If the challenge information includes a challenge random number, the challenge response information also includes a response random number. If the challenge random number and the response random number are equal, the challenge information and the challenge response information match, thereby determining that the data message is sent by node A. If the challenge random number and the response random number are not equal, the challenge information and the challenge response information do not match, and it is determined that the data message is not sent by node A. The challenge response information is then verified based on the challenge information to obtain a verification result, including:

[0127] If the challenge random number and the response random number are equal, the challenge information and the challenge response information match, and it is determined that the data message was sent by node A;

[0128] If the challenge random number and the response random number are not equal, the challenge information and the challenge response information do not match, and it is determined that the data message is not sent by node A.

[0129] In this way, by comparing the challenge random number in the challenge message and the response random number in the challenge response message, it is detected whether the data message is sent by node A, thereby realizing verification of the data message.

[0130] It can be understood that in order to improve the security of the challenge response mechanism, each challenge random number has a corresponding validity period. When the challenge random number corresponding to the adjacent node stored in the node is within the validity period, the challenge random number is determined to be valid and the data message can be verified. If the challenge random number is not within the validity period, the challenge random number cannot be used for data message verification, which can trigger the update of the challenge random number. Therefore, the challenge information also includes the validity period. Before verifying the data message based on the challenge information, it also includes:

[0131] Verify whether the challenge information is within the validity period according to the validity period, and if the challenge information is within the validity period, verify the data message according to the challenge information;

[0132] If the challenge information is not within the validity period, the data message is discarded, that is, the data message is not verified and there is no need to forward the data message.

[0133] In this way, before verifying the data message based on the challenge information, it is also necessary to detect the validity of the challenge information and verify the data message based on the challenge information within the validity period. If the challenge information is not within the validity period, the verification of the data message will not be performed. By verifying the validity period of the challenge information, the security of the challenge information can be improved.

[0134] In some possible implementations, when verifying a data message based on challenge information, it can also be implemented through a message authentication code, that is, the challenge information includes a first temporary key negotiation parameter, the first temporary key negotiation parameter is the challenge value corresponding to node A, and node B has its corresponding second temporary key negotiation parameter. The node can calculate the challenge message authentication code through the first temporary key negotiation parameter and the second temporary key negotiation parameter, wherein the Diffie-Hellman key exchange (DHE) or the elliptic curve Diffie-Hellman key exchange (ECDHE) can be used to construct a security verification key; the challenge response information also includes a response message authentication code, and then by comparing whether the challenge message authentication code and the response message authentication code are equal, if the two are equal, it is determined that the data message is sent by node A; if the two are not equal, it is determined that the data message is not sent by node A.

[0135] In this way, by comparing the challenge random number in the challenge message and the response random number in the challenge response message, it is detected whether the data message is sent by node A, thereby realizing verification of the data message.

[0136] In the above embodiment, when node B verifies the data message based on the challenge information, the challenge information may include a challenge random value or a temporary key negotiation parameter. It can be understood that the challenge information may include a challenge random value and a first temporary key negotiation parameter. Node B calculates the challenge information verification code based on the first temporary key negotiation parameter and the second temporary key negotiation parameter, and then compares the challenge random number and the response random number, the challenge information verification code and the response information verification code respectively. If they are all equal, it is determined that the data message is sent by node A; if one of them is not equal, it is determined that the data message is not sent by node A.

[0137] In this way, by comparing the challenge random number in the challenge message and the response random number in the challenge response message, as well as the challenge message verification code and the response message verification code, it is possible to detect whether the data message is sent by node A, thereby realizing verification of the data message.

[0138] In some possible implementations, the route diffusion message also carries a timestamp, which is used to identify the time of the current route diffusion message. The characteristics of the timestamp itself are used to prevent replay attacks.

[0139] Furthermore, both the sending node and the receiving node of the route diffusion message store the corresponding timestamp, and construct a timer based on the timestamp. When the timer expires, the sending node resends the route diffusion message to update the route diffusion message. That is, the route diffusion message is periodically sent through the timestamp to achieve real-time update of the corresponding relationship.

[0140] Please refer to Figure 6, which is a schematic diagram of the structure of a route diffusion message provided in an embodiment of the present application. The route diffusion message in Figure 6 includes UD ID, Network ID, User ID, RandValue, Lifetime, Timestamp, KeyShare, PK and Sig.

[0141] Among them, UD ID is the unique identifier of the node; Network ID is the identifier of the network where the node is located, which can be the Media Access Control Address (MAC address) or Internet Protocol Address (IP address) of the network where the node is located. User ID is the account identifier of the node currently logged in; RandValue is the challenge random number, that is, the random number is used as the challenge value; Lifetime is used to identify the validity period of the challenge random number; Timestamp is used to identify the time of the current route diffusion message; KeyShare is a temporary key negotiation parameter used to establish a fast and secure verification code between adjacent nodes; Param (PK) is the public key corresponding to the node, and adjacent nodes use this parameter to complete identity verification; Sig is the signature information. The source node of the route diffusion message signs the route diffusion message with the private key (Private Key) to form a signature information. The signature information is used to ensure the authenticity of the route diffusion message.

[0142] The following is an example of node B receiving the route diffusion message shown in Figure 6 sent by node A:

[0143] First, node B determines the public key of node A based on the UDID and User ID in the route diffusion message, and authenticates node A based on the public key.

[0144] If the identifier (UDID and User ID) of node A matches the corresponding public key, it is determined that the identity authentication of node A is successful; if the identifier (UDID and User ID) of node A does not match the corresponding public key, it is determined that the identity authentication of node A has failed.

[0145] Then, if the identity authentication of node A is successful, the signature data is verified according to the public key to realize message authentication of the route diffusion message, so as to authenticate that the route diffusion message is sent by node A.

[0146] If the public key verifies the signature data successfully, it is determined that the route diffusion message is sent by node A, and a corresponding relationship between the challenge information and node A is established. The challenge information includes RandValue, Lifetime and KeyShare.

[0147] If the verification result of the public key verifying the signature data fails, it is determined that the route diffusion message is not sent by node A, and the route diffusion message is discarded.

[0148] Optionally, the corresponding relationship of node A maintained by node B includes node A's UDID, node A's User ID, Network ID, node A's PK, node A's RandValue, Lifetime, node A's KeyShare, Timestamp, key AB， Among them, key AB It is a security verification key formed based on the KeyShare of node A and the KeyShare of node B. The formation method can be DHE or ECDHE, or other key derivation methods. The security verification key is generated by combining the temporary key parameters provided by two adjacent nodes and the security verification key is used as one of the challenge values.

[0149] Optionally, node B stores a neighbor device challenge mapping table, which has multiple correspondences. For example, in a decentralized network, node B has two adjacent nodes, and the neighbor device challenge mapping table of node B includes the correspondence of node A and the correspondence of node C.

[0150] In a decentralized network, when data is transmitted across nodes, the source node and the destination node need to undergo cross-node authentication. Only after the authentication is completed can the two nodes achieve secure cross-node communication. The following uses the cross-node authentication between nodes A and C as an example for explanation. After completing neighbor discovery, nodes A, B, and C send route diffusion messages between the two adjacent nodes to establish a routing relationship of a decentralized network through route diffusion messages, complete one-way identity authentication and message authentication of the adjacent nodes, and then establish a node correspondence. Then, node A sends a data message to node B. Node B verifies the data message based on the challenge information in the correspondence and sends the verified data message to the next hop node. The payload includes bidirectional authentication information. Node C starts the bidirectional authentication process with node A based on the bidirectional authentication information. During the bidirectional authentication process, node C can send a data message to node B. Node B verifies the data message and forwards the verified data message to node A. That is, the data messages exchanged between nodes A and C during the bidirectional authentication process are forwarded via node B. The bidirectional authentication process between nodes A and C requires multiple interactions between nodes A and C to complete. That is, node A needs to send a data message to node C via node B, and node C also needs to send a data message to node A via node B. This is explained below with reference to Figure 7.

[0151] Please refer to FIG. 7 , which is a flow chart of a method for cross-node data transmission according to an embodiment of the present application. After completing neighbor discovery between nodes in a decentralized network and sending route diffusion messages to each other, the method further includes:

[0152] S701: Node A sends a data message to node B.

[0153] The data message carries a security extension header and a payload. The security extension header includes challenge response information. The challenge response information includes a response random number corresponding to node A, a response random number corresponding to node B, and a security verification code.

[0154] Optionally, when node A initiates cross-hop authentication to node C, node A queries the routing table to determine that the next hop is node B, and then forms a data message according to the corresponding relationship of node B.

[0155] S702: Node B verifies the data message according to the corresponding relationship of node A. If the verification is successful, the data message is updated to obtain a forwarding message.

[0156] After node B receives the data message sent by node A, it verifies the data message according to the correspondence of node A, that is, first determines the challenge information corresponding to node A according to the identification information and the correspondence of node A, and obtains whether the challenge random value in the challenge information of node A exceeds the valid time. If it exceeds the valid time, the data message is discarded; if it does not exceed the valid time, it determines whether the challenge random value and the response random value of the challenge response information are equal. If they are not equal, the data message is discarded; if they are equal, the security verification code is calculated according to the temporary key parameter in the challenge information, and then the calculated security verification code is compared with the security verification code in the data message to see if they are equal. If they are not equal, the data message is discarded; if they are equal, the challenge response information corresponding to node B is obtained, and the challenge response information corresponding to node A in the data message is replaced with the challenge response information corresponding to node B to obtain a forwarded message.

[0157] S703: Node B sends a forwarding message to node C.

[0158] Node B queries the routing table, determines that the next hop is Node C, and then sends a forwarding message to Node C.

[0159] S704 , after receiving the forwarded message, node C verifies the forwarded message according to the corresponding relationship of node B. After the verification is completed, node C is determined to be the destination node of the forwarded message and the load information is parsed.

[0160] Node C parses the load information and then triggers a two-way authentication process between Node C and Node A.

[0161] Among them, due to the two-way authentication process between nodes, the two nodes need to interact multiple times, and node C can also send two-way authentication information to node A through node B.

[0162] S705: Node C sends a data message to node B.

[0163] S706 , Node B verifies the data message according to the corresponding relationship of Node C. If the verification is successful, the data message is updated to obtain a forwarding message.

[0164] S707: Node B sends a forwarding message to node A.

[0165] Thus, through the above process, nodes A and C achieve cross-node data transmission. There can be one or more relay nodes between nodes A and C. If there are two or more relay nodes, the other nodes process the data message in the same way as node B, which is not discussed here. Through forwarding by the relay nodes, cross-node data transmission is achieved between nodes A and C. Multiple data transmissions can complete cross-node authentication between nodes A and C.

[0166] The two-way authentication between nodes A and C includes, but is not limited to, public-private key authentication protocols, Password-Authenticated Key Exchange (PAKE) or Transport Layer Security (TLS). During cross-node authentication, data packets exchanged between nodes A and C are verified and forwarded by node B.

[0167] Furthermore, after nodes A and C complete cross-node authentication, a secure channel is established between them. However, data transmitted between nodes A and C still needs to be forwarded through node B. However, since a secure channel is established between nodes A and C, data transmitted between nodes can be encrypted using the key negotiated by nodes A and C.

[0168] The cross-node data transmission method provided by the present application, after completing neighbor discovery of adjacent nodes, the adjacent nodes establish a network by mutually sending route diffusion messages. The route diffusion messages carry one-way authentication information and challenge information. The receiving node of the route diffusion message authenticates the sending node of the route diffusion message by performing one-way authentication information to verify whether the route diffusion message is sent by the adjacent node. If the route diffusion message is determined to be sent by the adjacent node based on the authentication result, the relay node establishes a corresponding relationship between the sending node and the challenge information. After the networking is completed, the adjacent node sends a data message to the destination node through the relay node. The data message carries the challenge response information corresponding to the adjacent node. The relay node receives the data message sent by the adjacent node and verifies the challenge response message based on the challenge information. If the verification result shows that the forwarded message is sent by the adjacent node, the relay node updates the data message to obtain a forwarded message, and then sends the forwarded message to the next-hop node. During the above data transmission process, the relay node does not need to perform two-way authentication with the adjacent node, reducing the number of two-way authentications. During the process of forwarding the data message by the relay node, the forwarded data message does not need to be encrypted or decrypted, reducing the energy consumption of the relay node.

[0169] It should be understood that the above is only intended to help those skilled in the art better understand the embodiments of the present application, and is not intended to limit the scope of the embodiments of the present application. Based on the above examples given, those skilled in the art can obviously make various equivalent modifications or changes. For example, certain steps in each of the above methods may not be necessary, or certain new steps may be added. Or a combination of any two or any multiple of the above embodiments. Such modifications, changes, or combined solutions also fall within the scope of the embodiments of the present application.

[0170] It should also be understood that the division of the modes, situations, categories and embodiments in the embodiments of the present application is only for the convenience of description and should not constitute a special limitation. The features of various modes, categories, situations and embodiments can be combined without contradiction.

[0171] It should also be understood that the various numerical numbers involved in the embodiments of this application are only for the convenience of description and are not intended to limit the scope of the embodiments of this application. The order of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0172] It should also be understood that the above description of the embodiments of the present application focuses on emphasizing the differences between the various embodiments. The same or similar points that are not mentioned can be referenced with each other. For the sake of brevity, they will not be repeated here.

[0173] The above describes the embodiments of the method and network provided by the embodiments of the present application in combination with Figures 1 to 7. The following describes the nodes provided by the embodiments of the present application.

[0174] In this embodiment, each node can be divided into functional modules according to the above method. For example, each function can be divided into separate functional modules, or two or more functions can be integrated into a single processing module. The above integrated modules can be implemented in hardware. It should be noted that the module division in this embodiment is illustrative and only represents a logical functional division. In actual implementation, other division methods may be used.

[0175] It should be noted that the relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0176] The node provided in the embodiment of the present application is used to execute the cross-node data transmission method provided in the above method embodiment, so that the same effect as the above implementation method can be achieved. In the case of an integrated unit, the node may include a processing module, a storage module, and a communication module. Among them, the processing module can be used to control and manage the actions of the node. For example, it can be used to support the node to execute the steps performed by the processing unit. The storage module can be used to support the storage of program code and data, etc. The communication module can be used to support the communication between the node and other devices.

[0177] The processing module may be a processor or a controller. It may be a device that implements or executes the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processing (DSP) and a microprocessor, and so on. The storage module may be a memory. The communication module may specifically be a device that interacts with other nodes, such as a radio frequency circuit, a Bluetooth chip, or a Wi-Fi chip.

[0178] Refer to Figure 8, which shows a structural diagram of an exemplary node of the present application. The node shown in Figure 8 can execute the steps in the cross-node data transmission method executed by any node provided in the embodiments of the present application.

[0179] The node 800 includes at least one processor 801 , a memory 803 , and at least one network interface 804 .

[0180] The processor 801 is, for example, a general-purpose CPU, a digital signal processor (DSP), a network processor (NP), a GPU, a neural network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASICs) for implementing the solution of the present application, a programmable logic device (PLD) or other programmable logic devices, a transistor logic device, a hardware component, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0181] Optionally, node 800 also includes a bus 802. Bus 802 is used to transmit information between the various components of node 800. Bus 802 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Bus 802 may be classified as an address bus, a data bus, a control bus, etc. For ease of illustration, FIG8 shows only one thick line, but this does not indicate that there is only one bus or only one type of bus.

[0182] The memory 803 is, for example, a read-only memory (ROM) or other type of storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 803 is, for example, independent and connected to the processor 801 via the bus 802. The memory 803 can also be integrated with the processor 801.

[0183] The network interface 804 uses any transceiver-like device for communicating with other devices or communication networks. The communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The network interface 804 can include a wired network interface or a wireless network interface. Specifically, the network interface 804 can be an Ethernet interface, such as a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a WLAN interface, a cellular network interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of the present application, the network interface 804 can be used for the node 800 to communicate with other devices.

[0184] In a specific implementation, as some embodiments, the processor 801 may include one or more CPUs. Each of these processors may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0185] In a specific implementation, as some embodiments, node 800 may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0186] In some embodiments, the memory 803 is used to store program instructions for executing the solution of the present application, and the processor 801 can execute the program instructions stored in the memory 803. That is, the node 800 can implement the method provided by the method embodiment shown in the above embodiment through the processor 801 and the program instructions in the memory 803. The program instructions may include one or more software modules. Optionally, the processor 801 itself can also store program instructions for executing the solution of the present application.

[0187] During the specific implementation process, the processor 801 in the node 800 of the present application reads the instructions in the memory 803, so that the node 800 shown in Figure 8 can execute all or part of the steps in the cross-node data transmission method performed by the node in the above embodiment.

[0188] The steps of the methods described in the above embodiments are performed by hardware integrated logic circuits or software instructions in the processor of node 800. The steps of the method embodiments disclosed in this application can be directly implemented as being executed by a hardware processor, or by a combination of hardware and software modules in the processor. The software modules can be located in a storage medium well-established in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method embodiments. To avoid repetition, they are not described in detail here.

[0189] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor that supports the Advanced RISC Machine (ARM) architecture.

[0190] Furthermore, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store device type information.

[0191] The memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache memory. By way of example and not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0192] An embodiment of the present application also provides a decentralized network comprising at least three nodes, wherein the node can execute the steps of the cross-node data transmission method executed by any node provided in the embodiment of the present application, and the node can execute the steps of the cross-node data transmission method executed by any node provided in the embodiment of the present application.

[0193] In an exemplary embodiment, an embodiment of the present application provides a computer program (product), which includes: computer program code, which, when executed by a computer, enables the computer to execute the steps of the cross-node data transmission method performed by any node provided in the embodiment of the present application.

[0194] In an exemplary embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a program or instruction. When the program or instruction runs on a computer, any one of the cross-node data transmission methods performed by the embodiments of the present application is executed.

[0195] In an exemplary embodiment, an embodiment of the present application provides a chip, including a processor, for calling and executing instructions stored in the memory from a memory, so that a communication device equipped with the chip executes a cross-node data transmission method executed by any node provided in an embodiment of the present application.

[0196] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described herein are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0197] In this application, the terms "first," "second," and the like are used to distinguish between identical or similar items having substantially the same function or effect. It should be understood that "first," "second," and "nth" do not have a logical or temporal dependency, nor do they limit the quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," and the like to describe various elements, these elements should not be limited by these terms. These terms are simply used to distinguish one element from another.

[0198] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0199] In this application, the term "at least one" means one or more, and the term "plurality" means two or more. For example, "plurality of second devices" means two or more second devices. The terms "system" and "network" are often used interchangeably herein.

[0200] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0201] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the listed items. The term "and / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0202] It should also be understood that the terms “if” and “if” may be interpreted to mean “when” or “upon” or “in response to determining” or “in response to detecting.” Similarly, the phrases “if it is determined that ” or “if [stated condition or event] is detected” may be interpreted to mean “upon determining ” or “in response to determining ” or “upon detecting [stated condition or event]” or “in response to detecting [stated condition or event],” depending on the context.

[0203] The above description is merely an embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

[0204] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A cross-node data transmission method, characterized in that: A relay node applied to a decentralized network, wherein the decentralized network includes at least three nodes, wherein the at least three nodes include the relay node and at least two adjacent nodes of the relay node, wherein the method includes: After the relay node and the adjacent node complete neighbor discovery, the relay node receives a route diffusion message sent by the adjacent node, where the route diffusion message carries node unidirectional authentication information and challenge information; The relay node authenticates the route diffusion message according to the node unidirectional authentication information to obtain an authentication result; If the authentication result is that the route diffusion message is sent by the adjacent node, the relay node establishes a corresponding relationship between the adjacent node and the challenge information; The relay node receives a data message sent by the adjacent node, where the data message carries challenge response information corresponding to the adjacent node; The relay node determines the challenge information corresponding to the adjacent node according to the corresponding relationship; The relay node verifies the challenge response information according to the challenge information to obtain a verification result; If the verification result is that the challenge information matches the challenge response information, thereby determining that the data message is sent by the neighboring node, the relay node obtains the challenge response information corresponding to the relay node; The relay node updates the data message according to the challenge response information corresponding to the relay node to obtain a forwarding message, wherein the forwarding message carries the challenge response information corresponding to the relay node; The relay node sends the forwarding message to the adjacent node corresponding to the next hop.

2. The method according to claim 1, characterized in that The one-way authentication information includes signature information corresponding to the route diffusion message; the relay node performs identity authentication on the route diffusion message according to the node one-way authentication information, and obtains an authentication result, including: The relay node obtains the public key of the adjacent node; The relay node verifies the signature information according to the public key to obtain an authentication result.

3. The method according to claim 1 or 2, characterized in that: The challenge information includes a challenge random value, and the challenge response message includes a response random value; The relay node verifies the challenge response information according to the challenge information to obtain a verification result, including: If the challenge random value is equal to the response random value, the relay node determines that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value, the relay node determines that the data message is not sent by the neighboring node.

4. The method according to claim 1 or 2, characterized in that: The challenge information includes a key negotiation parameter corresponding to the adjacent node, and the challenge response information includes a response information verification code; The relay node verifies the challenge response information according to the challenge information to obtain a verification result, including: The relay node determines a challenge information verification code according to the key negotiation parameter; If the challenge information verification code is equal to the response information verification code, the relay node determines that the challenge information matches the challenge response information, thereby determining that the data message is sent by the neighboring node; If the challenge information verification code is not equal to the response information verification code, the relay node determines that the challenge information and the challenge response information do not match, thereby determining that the data message is not sent by the neighboring node.

5. The method according to claim 1 or 2, characterized in that: The challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; The relay node verifies the challenge response information according to the challenge information to obtain a verification result, including: The relay node determines a challenge information verification code according to the key negotiation parameter; If the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, the relay node determines that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value or the challenge information verification code is not equal to the response information verification code, the relay node determines that the data message is not sent by the adjacent node.

6. The method according to claim 3 or 5, characterized in that: The challenge information also includes the validity period of the challenge random value; Before the relay node verifies the challenge response information according to the challenge information, the method further includes: If it is determined according to the valid time that the challenge random value is within the valid time, the relay node verifies the challenge response information according to the challenge information.

7. The method according to any one of claims 1 to 6, characterized in that: The route diffusion message also carries a timestamp, and the timestamp is used to indicate the time corresponding to the route diffusion message.

8. The method according to any one of claims 1 to 7, characterized in that: The data message carries bidirectional authentication information, and the adjacent node performs bidirectional authentication with the destination node of the data message through the bidirectional authentication information.

9. A cross-node data transmission method, characterized in that: Applied to a sending node of a decentralized network, the decentralized network includes at least three nodes, the at least three nodes include the sending node and at least one adjacent node of the sending node, the method includes: After the sending node and the adjacent node complete neighbor discovery, the sending node sends a route diffusion message to the adjacent node, the route diffusion message carrying node unidirectional authentication information and challenge information, so that the adjacent node authenticates the route diffusion message sent by the adjacent node according to the node unidirectional authentication information to obtain an authentication result; when the authentication result is that the route diffusion message is sent by the sending node, the adjacent node establishes a corresponding relationship between the sending node and the challenge information; The sending node sends a data message to the adjacent node, the data message carries the challenge response information corresponding to the sending node, the sending node is the source node of the data message and the adjacent node is not the destination node of the data message, so that the adjacent node determines the challenge information corresponding to the sending node according to the corresponding relationship; the adjacent node verifies the challenge response information according to the challenge information to obtain a verification result; if the verification result is that the adjacent node determines that the data message is sent by the sending node, the adjacent node obtains the challenge response information corresponding to the adjacent node; the adjacent node updates the data message according to the challenge response information corresponding to the sending node to obtain a forwarding message, the forwarding message carries the challenge response information corresponding to the adjacent node; the adjacent node sends the forwarding message to the next-hop node.

10. The method according to claim 9, characterized in that The one-way authentication information includes signature information corresponding to the route diffusion message.

11. The method according to claim 9 or 10, characterized in that: The challenge information includes a challenge random value, and the challenge response message includes at least one of a response random value and a key negotiation parameter.

12. The method according to any one of claims 9 to 11, characterized in that: The data message also carries two-way authentication information, and the sending node performs two-way authentication with the destination node of the data message through the two-way authentication information.

13. A cross-node data transmission method, characterized in that: Applied to a receiving node of a decentralized network, the decentralized network includes at least three nodes, the at least three nodes include the receiving node and at least one adjacent node of the receiving node, the method includes: After the receiving node and the adjacent node complete neighbor discovery, the receiving node receives a route diffusion message sent by the adjacent node, where the route diffusion message carries node unidirectional authentication information and challenge information; The receiving node authenticates the route diffusion message according to the node unidirectional authentication information to obtain an authentication result; If the authentication result is that the route diffusion message is sent by the adjacent node, the receiving node establishes a corresponding relationship between the adjacent node and the challenge information; The receiving node receives a forwarding message sent by the adjacent node, the forwarding message carries challenge response information corresponding to the adjacent node, the receiving node is a destination node of the forwarding message and the adjacent node is not a source node of the forwarding message; The receiving node determines the challenge information corresponding to the adjacent node according to the corresponding relationship; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result; If the verification result is that the challenge information matches the challenge response information, thereby determining that the forwarded message is sent by the adjacent node, the receiving node parses the load information of the forwarded message.

14. The method according to claim 13, characterized in that The one-way authentication information includes signature information corresponding to the route diffusion message; The receiving node performs identity authentication on the route diffusion message according to the node unidirectional authentication information to obtain an authentication result, including: The receiving node obtains the public key of the adjacent node; The receiving node verifies the signature information according to the public key to obtain an authentication result.

15. The method according to claim 13 or 14, characterized in that The challenge information includes a challenge random value, and the challenge response message includes a response random value; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result, including: If the challenge random value is equal to the response random value, the challenge information matches the challenge response information, thereby determining that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value, the challenge information and the challenge response information do not match, thereby determining that the data message is not sent by the neighboring node.

16. The method according to claim 13 or 14, characterized in that The challenge information includes a key negotiation parameter corresponding to the adjacent node, and the challenge response information includes a response information verification code; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result, including: The receiving node determines a challenge information verification code according to the key negotiation parameter; If the challenge information verification code is equal to the response information verification code, the receiving node determines that the data message is sent by the neighboring node; If the challenge information verification code is not equal to the response information verification code, the receiving node determines that the data message is not sent by the neighboring node.

17. The method according to claim 13 or 14, characterized in that The challenge information includes a challenge random value and a key negotiation parameter corresponding to the adjacent node, and the challenge response message includes a response random value and a response information verification code; The receiving node verifies the challenge response information according to the challenge information to obtain a verification result, including: Determining a challenge information verification code according to the key negotiation parameter; If the challenge random value is equal to the response random value and the challenge information verification code is equal to the response information verification code, the receiving node determines that the data message is sent by the neighboring node; If the challenge random value is not equal to the response random value or the challenge information verification code is not equal to the response information verification code, the receiving node determines that the data message is not sent by the neighboring node.

18. The method according to claim 15 or 17, characterized in that The challenge information also includes the validity period of the challenge random value; Before the receiving node verifies the challenge response information according to the challenge information, the method further includes: If it is determined according to the valid time that the challenge random value is within the valid time, the receiving node verifies the challenge response information according to the challenge information.

19. The method according to any one of claims 13 to 18, characterized in that The route diffusion message also carries a timestamp, and the timestamp is used to indicate the time corresponding to the route diffusion message.

20. The method according to any one of claims 13 to 19, characterized in that The load information includes bidirectional authentication information, and the receiving node performs bidirectional authentication with the source node of the data message through the bidirectional authentication information.

21. A node, characterized in that: include: a memory including computer-readable instructions; A processor in communication with the memory, the processor being used to execute the computer-readable instructions so that the node executes the cross-node data transmission method described in any one of claims 1-8 or the cross-node data transmission method described in any one of claims 9-12 or the cross-node data transmission method described in any one of claims 13-20.

22. A computer-readable storage medium, characterized in that: The method comprises a program or an instruction, which, when executed by a processor, implements the cross-node data transmission method as described in any one of claims 1 to 8, the cross-node data transmission method as described in any one of claims 9 to 12, or the cross-node data transmission method as described in any one of claims 13 to 20.

Images