Key issuing method and apparatus, communication device, and storage medium

Abstract

Embodiments of the present disclosure provide a key issuing method and apparatus, a communication device, and a storage medium. The method comprises: a first network element receiving a first message sent by a second network element, the first message being used for requesting a first key, and the first message at least comprising a first identifier which represents the identity of a first physical device; on the basis of stored first information, querying a first public key and a first data access control structure corresponding to the first identifier, and using the first public key on the basis of an attribute-based encryption algorithm and encrypting the first key on the basis of the first data access control structure to obtain a second key; and sending to the second network element a second message corresponding to the first message, the second message at least comprising the second key, so that the second network element issues the second key to a twin instance, the twin instance being associated with the first physical device.

Description

Key issuance method, device, communication equipment and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This disclosure is based on and claims the priority of Chinese patent application with application number 202311020817.0 and application date August 14, 2023. The entire contents of the Chinese patent application are hereby incorporated into this disclosure by reference. Technical Field

[0003] The present disclosure relates to the field of communication technology, and in particular to a key issuance method, apparatus, communication equipment, and storage medium. Background Art

[0004] In the application scenario of the Digital Twin Network (DTN), a physical device will have multiple twin instances. In the digital twin network, data needs to be collected into a data sharing warehouse. The digital twin network will have massive data storage and use, so it will use distributed technologies such as cloud storage and cloud computing. Plain text storage will have the risk of data leakage. If the traditional encryption mechanism is used, the physical device needs to encrypt the network data with the keys of different instances to generate multiple ciphertexts, and send them to the twin instances in the twin network respectively to achieve state synchronization between the twin device and the physical device. The digital twin network has the characteristics of high real-time performance. Multiple encryption and decryption will increase the processing delay of terminal data, and when a large number of devices are connected to the network, it will bring huge challenges to the network's storage and load.

[0005] Summary of the Invention

[0006] Embodiments of the present disclosure provide a key issuance method, apparatus, communication device, and storage medium.

[0007] The technical solution of the embodiment of the present disclosure is implemented as follows:

[0008] In the first aspect, an embodiment of the present disclosure provides a key issuance method, which is applied to a first network element of a digital twin network, and the method includes: receiving a first message sent by a second network element, the first message being used to request a first key; the first message including at least a first identifier representing the identity of a first physical device; querying a first public key and a first data access control structure corresponding to the first identifier based on the stored first information, using the first public key based on an attribute encryption algorithm and encrypting the first key based on the first data access control structure to obtain a second key; wherein the first information includes at least one group of associations between identifiers, public keys and data access control structures representing the identity of a physical device; the first key comes from a third network element; sending a second message corresponding to the first message to the second network element, the second message including at least the second key, so that the second network element can issue the second key to the twin instance, and the twin instance is associated with the first physical device.

[0009] In some optional embodiments of the present disclosure, before receiving the first message sent by the second network element, the method also includes: receiving a third message sent by the third network element, the third message being used to request anchoring or storage of the first key; the third message including at least the first key and the first identifier; the first key is generated by the third network element based on relevant information in the terminal device authentication process; and storing the first key and the first identifier.

[0010] In some optional embodiments of the present disclosure, before receiving the first message sent by the second network element, the method also includes: receiving a fourth message sent by the first physical device, the fourth message being used to request subscription to the twin service; the fourth message including at least the first public key and the first identifier; and storing the associated first public key and the first identifier in the first information.

[0011] In some optional embodiments of the present disclosure, the fourth message also includes the first data access control structure; storing the first public key and the first identifier with an associated relationship in the first information includes: storing the first public key, the first identifier and the first data access control structure with an associated relationship in the first information.

[0012] In some optional embodiments of the present disclosure, the method also includes: receiving a fifth message sent by the first physical device, the fifth message being used to request updating the digital twin access structure; the fifth message including at least the first identifier and the updated first data access control structure; and updating the data access control structure corresponding to the first identifier stored in the first information to the updated first data access control structure.

[0013] In some optional embodiments of the present disclosure, the second message further includes the validity period of the first key; and / or the third message further includes the validity period of the first key.

[0014] In some optional embodiments of the present disclosure, the physical device includes a terminal device or a network element.

[0015] In the second aspect, an embodiment of the present disclosure also provides a key issuance method, which is applied to the second network element of a digital twin network, and the method includes: sending a first message to the first network element, the first message being used to request a first key; the first message including at least a first identifier representing the identity of a first physical device; receiving a second message sent by the first network element, the second message including at least a second key, the second key being obtained by the first network element based on an attribute encryption algorithm, using the first public key corresponding to the stored first identifier and encrypting the first key based on a first data access control structure; sending a sixth message to the twin instance, the sixth message including the second key, and the twin instance being associated with the first physical device.

[0016] In some optional embodiments of the present disclosure, the second message and the sixth message also include the validity period of the first key.

[0017] On the third aspect, an embodiment of the present disclosure also provides a key issuance method, which is applied to a twin instance of a digital twin network, and the method includes: receiving a sixth message sent by a second network element, the sixth message including a second key, and the second key comes from a first network element; the second key is obtained by the first network element based on an attribute encryption algorithm, using a first public key corresponding to a stored first identifier representing the identity of a first physical device and encrypting the first key based on a first data access control structure; the twin instance is associated with the first physical device; and the first private key corresponding to the first public key is used to decrypt the second key to obtain the first key.

[0018] In some optional embodiments of the present disclosure, the sixth message also includes a validity period of the first key.

[0019] In a fourth aspect, an embodiment of the present disclosure also provides a key issuance method, which is applied to a third network element of a digital twin network, and the method includes: generating a first key associated with a first physical device; sending a third message to the first network element, wherein the third message is used to request anchoring or storage of the first key; and the third message includes at least the first key and a first identifier representing the identity of the first physical device.

[0020] In some optional embodiments of the present disclosure, the third message also includes a validity period of the first key.

[0021] In some optional embodiments of the present disclosure, generating a first key associated with the first device or the first network element includes: generating the first key based on relevant information in an authentication process with the first physical device.

[0022] In some optional embodiments of the present disclosure, the first physical device includes a first terminal device or a network element.

[0023] In a fifth aspect, an embodiment of the present disclosure further provides a key issuance device, which is applied to a first network element of a digital twin network; the device includes: a first communication unit and a first processing unit; wherein the first communication unit is configured to receive a first message sent by a second network element, the first message being used to request a first key; the first message includes at least a first identifier representing an identity of a first physical device;

[0024] The first processing unit is configured to query a first public key and a first data access control structure corresponding to the first identifier based on stored first information, and encrypt the first key using the first public key and the first data access control structure based on an attribute encryption algorithm to obtain a second key; wherein the first information includes at least one set of associations between an identifier representing an identity of a physical device, a public key, and a data access control structure; and the first key comes from a third network element;

[0025] The first communication unit is also configured to send a second message corresponding to the first message to the second network element, and the second message includes at least the second key, so that the second network element can issue the second key to the twin instance, and the twin instance is associated with the first physical device.

[0026] In the sixth aspect, an embodiment of the present disclosure also provides a key issuance device, which is applied to a second network element of a digital twin network, and the device includes: a second communication unit, configured to send a first message to the first network element, the first message being used to request a first key; the first message including at least a first identifier representing the identity of a first physical device; and further configured to receive a second message sent by the first network element, the second message including at least a second key, the second key being obtained by the first network element based on an attribute encryption algorithm, using the first public key corresponding to the stored first identifier and encrypting the first key based on a first data access control structure; and further configured to send a sixth message to the twin instance, the sixth message including the second key, and the twin instance being associated with the first physical device.

[0027] In a seventh aspect, an embodiment of the present disclosure further provides a key issuance device, which is applied to a twin instance of a digital twin network, and the device includes a third communication unit and a second processing unit; wherein the third communication unit is configured to receive a sixth message sent by a second network element, and the sixth message includes a second key, and the second key comes from a first network element; the second key is obtained by the first network element based on an attribute encryption algorithm, using a first public key corresponding to a first identifier representing the identity of a first physical device stored and encrypting the first key based on a first data access control structure; the twin instance is associated with the first physical device;

[0028] The second processing unit is configured to decrypt the second key using a first private key corresponding to the first public key to obtain the first key.

[0029] In an eighth aspect, an embodiment of the present disclosure further provides a key issuance device, which is applied to a third network element of a digital twin network, and includes: a third processing unit and a fourth communication unit; wherein the third processing unit is configured to generate a first key associated with a first physical device;

[0030] The fourth communication unit is configured to send a third message to the first network element, where the third message is used to request anchoring or storage of the first key; the third message includes at least the first key and a first identifier representing the identity of the first physical device.

[0031] In a ninth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored, which, when executed by a processor, implements the steps of the key issuance method described in any one of the first to fourth aspects of the embodiment of the present disclosure.

[0032] In the tenth aspect, an embodiment of the present disclosure further provides a communication device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the key issuance method described in any one of the first to fourth aspects of the embodiment of the present disclosure are implemented.

[0033] The key issuance method, device, communication equipment and storage medium provided by the embodiments of the present disclosure include: a first network element of a digital twin network receives a first message sent by a second network element, the first message is used to request a first key; the first message includes at least a first identifier representing the identity of a first physical device; based on the stored first information, a first public key and a first data access control structure corresponding to the first identifier are queried, and the first key is encrypted based on an attribute encryption algorithm using the first public key and based on the first data access control structure to obtain a second key; wherein, the first information includes at least one group of associations between identifiers, public keys and data access control structures representing the identity of physical devices; the first key comes from a third network element; a second message corresponding to the first message is sent to the second network element, the second message includes at least the second key, so that the second network element issues the second key to the twin instance, and the twin instance uses the first private key corresponding to the first public key to decrypt the second key to obtain the first key; the twin instance is associated with the first physical device. By adopting the technical solution of the embodiment of the present disclosure, repeated encryption of the same data is avoided through one-time data encryption of the first network element in the physical layer; and the use of symmetric encryption keys does not increase the processing delay of the network; in addition, the embodiment of the present disclosure adopts an attribute-based encryption method, and only twin instances that meet the data access control structure can decrypt the session key, providing fine-grained access control capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is a schematic diagram of the digital twin network architecture;

[0035] Figure 2 is a schematic diagram of the mapping between physical devices and twin instances in a digital twin application scenario;

[0036] FIG3 is a schematic diagram of a system architecture for applying the key issuance method according to an embodiment of the present disclosure;

[0037] FIG4 is a flowchart of a key distribution method according to an embodiment of the present disclosure;

[0038] FIG5 is a second flow chart of the key issuance method according to an embodiment of the present disclosure;

[0039] FIG6 is a third flow chart of the key issuance method according to an embodiment of the present disclosure;

[0040] FIG7 is a fourth flow chart of the key issuance method according to an embodiment of the present disclosure;

[0041] FIG8 is a first diagram of an interactive process of a key issuance method according to an embodiment of the present disclosure;

[0042] FIG9 is a second interactive flow diagram of the key issuance method according to an embodiment of the present disclosure;

[0043] FIG10 is a third interactive flow diagram of the key issuance method according to an embodiment of the present disclosure;

[0044] FIG11 is a schematic diagram of the first structure of a key issuing device according to an embodiment of the present disclosure;

[0045] FIG12 is a second schematic diagram of the structure of the key issuing device according to an embodiment of the present disclosure;

[0046] FIG13 is a third structural diagram of the key issuing device according to an embodiment of the present disclosure;

[0047] FIG14 is a fourth structural diagram of the key issuing device according to an embodiment of the present disclosure;

[0048] FIG15 is a schematic diagram of the hardware composition structure of the communication device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0049] The present disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0050] The technical solutions of the embodiments of the present disclosure can be applied to various communication systems, such as the Global System of Mobile Communication (GSM) system, the Long Term Evolution (LTE) system, or the 5G system. Optionally, the 5G system or 5G network may also be referred to as a New Radio (NR) system or NR network.

[0051] Exemplarily, the communication system applied in the embodiments of the present disclosure may include a network device and a terminal device (also referred to as a terminal, a communication terminal, etc.); the network device may be a device that communicates with the terminal device. Among them, the network device can provide communication coverage within a certain area and can communicate with terminals located in the area. Optionally, the network device can be a base station in each communication system, such as an evolved base station (eNB, Evolutional Node B) in an LTE system, or a base station (gNB) in a 5G system or an NR system.

[0052] It should be understood that in the embodiments of the present disclosure, devices with communication functions in a network / system may be referred to as communication devices. Communication devices may include network devices and terminals with communication functions. The network devices and terminal devices may be the specific devices described above and will not be described in detail here. Communication devices may also include other devices in the communication system, such as network controllers, mobility management entities, and other network entities, which are not limited in the embodiments of the present disclosure.

[0053] It should be understood that the terms "system" and "network" are often used interchangeably herein. The term "and / or" is simply a description of an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " generally indicates that the related objects are in an "or" relationship.

[0054] The terms "first", "second", etc. in the specification and claims of the present disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application described herein can, for example, be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0055] Before describing the technical solution of the embodiment of the present disclosure in detail, a brief description of the digital twin network is first given.

[0056] A digital twin network (DTN) is a network system with physical entities and virtual twins that can interact and map in real time. Digital twins, the real-time mirroring of physical entities in the digital world, are becoming a new focus of global information technology development and industrial digital transformation. In future networks, with the continuous development of technologies such as cloud computing, big data, and artificial intelligence, and the ubiquity of information, digital twin technology will be widely used in fields such as intelligent manufacturing, smart cities, and scientific research, leading society as a whole to a "digital twin" world that combines virtual and real life. Currently, the digital twin network is under discussion within the International Telecommunication Union (ITU), and the overall design of the network framework has been completed. However, how to achieve interaction between network entities in the digital twin network has not yet been specifically defined.

[0057] The architecture of the digital twin network can be shown in Figure 1. The digital twin network can be designed as a "three-layer, three-domain, dual closed-loop" architecture as shown in the figure. The three layers refer to the physical network layer, twin network layer, and network application layer that constitute the digital twin network; the three domains refer to the twin network layer data domain, model domain, and management domain, which correspond to the three subsystems of data sharing warehouse, service mapping model, and network twin management respectively; "dual closed loop" refers to the "inner closed loop" simulation and optimization based on the service mapping model within the twin network layer, and the "outer closed loop" based on the three-layer architecture for control, feedback, and optimization of network applications.

[0058] The core of the digital twin network is data-based modeling, which provides data model instances for various network applications, maximizing the agility and programmability of network services. The service mapping model of the twin network layer consists of two parts: a basic model and a functional model. The basic model refers to the device model and topology model of the twin network entity corresponding to the physical entity network, based on the basic configuration of physical devices, environmental information, operating status, link topology, and other information, to achieve a real-time and accurate description of the physical network. The functional model refers to various data models for network analysis, simulation, diagnosis, prediction, and assurance, established for specific application scenarios, fully utilizing the network data in the data warehouse.

[0059] As shown in Figure 2, in multiple twin application scenarios, at the twin network layer, one physical device will correspond to multiple twin instances. Combined with Figure 1, data in a digital twin network needs to be collected into a shared data warehouse. This will require the storage and use of massive amounts of data, necessitating the use of distributed technologies such as cloud storage and cloud computing. Storing data in plain text presents the risk of data leakage. If traditional encryption mechanisms are employed, the physical device must encrypt network data using keys from different instances to generate multiple ciphertexts, which are then sent to the twin instances in the twin network to synchronize the states of the twin and physical devices. Digital twin networks are highly real-time, and multiple encryption and decryption steps increase terminal data processing latency. Furthermore, when massive numbers of devices are connected to the network, this poses significant challenges to network storage and load. A twin instance refers to the digital model of a device in the twin network, which may vary depending on the application.

[0060] Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is an attribute-based encryption mechanism based on ciphertext policies. The policy is embedded in the ciphertext, and the attributes are embedded in the user's key. The ciphertext corresponds to an access structure, and the key corresponds to a set of attributes. Decryption is possible only if the attributes in the set satisfy the access structure. CP-ABE attribute-based encryption uses cryptographic mechanisms to protect data. The data owner specifies the access policy for the ciphertext and associates the attribute set with the access resource. Data users can then access the ciphertext information based on their authorized attributes.

[0061] The public and private keys generated by the attribute-based encryption (CP-ABE) algorithm can achieve secure one-to-many data transmission. This approach requires the twin trusted center to generate public and private keys based on the CP-ABE algorithm, embed the model instance's attributes into the private key, send it to the twin instance, and then send the public key to the physical device. If the terminal has signed up for the digital twin service, the twin trusted center uses the CP-ABE initialization algorithm to generate {PK,MK}=Setup(), where PK serves as the device public key and MK is stored in the trusted center as the master key for generating the private key. When the twin layer generates a new twin instance, it requests the twin private key SK from the twin trusted center. The twin trusted center uses the CP-ABE private key generation algorithm to generate the key SK=KeyGen(MK,S), where S is the set of attributes of the twin instance. This public key encryption mechanism has relatively low encryption efficiency. Digital twin networks have high requirements for network real-time performance. Directly using the public and private key pairs generated by CP-ABE to encrypt and decrypt data increases data processing latency.

[0062] Based on this, the following embodiments of the present disclosure are proposed.

[0063] Figure 3 is a schematic diagram of the system architecture of the key issuance method applied in the embodiment of the present disclosure; as shown in Figure 3, this embodiment adds a twin management network element on the basis of the existing physical devices and authentication network elements in the physical layer of the digital twin network, which is responsible for providing securely transmitted keys for the physical devices and the twin instances of the twin layer. In other optional embodiments, the twin management network element may also be called the first network element, management network element, etc., as long as the corresponding functions can be achieved. The name of the network element is not limited in this embodiment. In actual applications, the first network element (or twin management network element) can be implemented through an independent physical entity, or it can be co-located with other network functions on a physical entity in the form of network functions. This embodiment does not limit this.

[0064] The present disclosure provides a key issuance method, which is applied to a first network element of a digital twin network. FIG4 is a flow chart of the key issuance method according to the present disclosure. As shown in FIG4 , the method includes:

[0065] Step 101: Receive a first message sent by a second network element, where the first message is used to request a first key; the first message includes at least a first identifier representing an identity of a first physical device;

[0066] Step 102: Querying a first public key and a first data access control structure corresponding to the first identifier based on the stored first information, and encrypting the first key based on the first data access control structure using the first public key using an attribute-based encryption algorithm to obtain a second key; wherein the first information includes at least one set of associations between an identifier representing a physical device identity, a public key, and a data access control structure; and the first key is from a third network element.

[0067] Step 103: Send a second message corresponding to the first message to the second network element, where the second message includes at least the second key, so that the second network element sends the second key to the twin instance, and the twin instance is associated with the first physical device.

[0068] In this embodiment, the first network element may be a twin management network element as shown in FIG3 . The second network element may be a data sharing warehouse of a digital twin network. As shown in FIG1 , the data sharing warehouse may have, for example, functions such as data management, data services, data storage, and data acquisition. In other optional embodiments, the second network element may also be a network element with other specific functions mentioned above in a digital twin network. This embodiment does not limit the name of the network element. The third network element may be a network element for authenticating a physical device, which may be called an authentication network element, or a device authentication network element, etc. This embodiment does not limit the name of the network element.

[0069] In this embodiment, the physical device includes a terminal device or a network element. The network element can be, for example, a core network element, an access network element, etc. In this embodiment, a physical device that can use the digital twin service, that is, a device that corresponds to one or more twin instances, can be referred to as a network element.

[0070] In this embodiment, the second network element sends a key request (i.e., a first message) to the first network element. The key request (i.e., the first message) may carry a first identifier (such as a device ID) of the first physical device corresponding to or associated with the twin instance. After the first network element receives the key request (i.e., the first message), it may determine the first public key and the first data access control structure corresponding to the first identifier based on the pre-stored first information; wherein, the first information includes at least one group of identifiers representing the identity of the physical device, the association relationship between the public key and the data access control structure, and the first information may be searched through the first identifier to obtain the first public key and the first data access control structure corresponding to the first identifier. Furthermore, the first network element may adopt an algorithm based on attribute encryption, utilize the first public key, and encrypt the first key based on the first data access control structure to obtain a second key. wherein, the algorithm based on attribute encryption may be the CP_ABE algorithm. Of course, this embodiment is not limited to the use of the CP_ABE algorithm, and other algorithms based on attribute encryption may also be within the protection scope of this embodiment.

[0071] As an example, the above encryption process may satisfy: K ET =K_en(K PK ,K AT ,H); where K_en represents the CP_ABE encryption algorithm; K PK represents the first public key; H represents the first data access control structure; K AT Represents the first key; K ET Indicates the second key.

[0072] In this embodiment, the first network element sends the second key to the second network element through a key response (i.e., a second message), so that the second network element sends the second key to the twin instance.

[0073] In some optional embodiments, the second message also includes the validity period of the first key; in other embodiments, the second message also includes the validity period of the second key, and the validity period of the second key is equivalent to the validity period of the first key.

[0074] In some optional embodiments of the present disclosure, before receiving the first message sent by the second network element, the method also includes: receiving a third message sent by the third network element, the third message being used to request anchoring or storage of the first key; the third message including at least the first key and the first identifier; the first key is generated by the third network element based on relevant information in the terminal device authentication process; and storing the first key and the first identifier.

[0075] In this embodiment, the third network element acts as an authentication network element. During the authentication process with the first physical device, the third network element generates a first key based on relevant information of the authentication process, and sends the first key and the first identifier of the first physical device to the first network element through a key anchoring request (i.e., the third message); the key anchoring request (i.e., the third message) is used to request the first network element to store the first key and the first identifier.

[0076] In some optional embodiments, the third message also includes the validity period of the first key. In other embodiments, the third message also includes the validity period of the second key, and the validity period of the second key is equivalent to the validity period of the first key.

[0077] In some optional embodiments of the present disclosure, before receiving the first message sent by the second network element, the method also includes: receiving a fourth message sent by the first physical device, the fourth message being used to request subscription to the twin service; the fourth message including at least the first public key and the first identifier; and storing the associated first public key and the first identifier in the first information.

[0078] In this embodiment, before making a key request, the first physical device first performs the ordering process of the digital twin service. In actual applications, each physical device (such as the first physical device) has a direct communication interface with the first network element, and can directly interact with the first network element through the interface. In other embodiments, the information exchanged between the first physical device and the first network element can also be forwarded through other network elements, for example, through a third network element (such as an authentication network element), which is not limited in this embodiment.

[0079] In this embodiment, the first physical device requests the first network element to subscribe to the digital twin service (or twin service) through the fourth message; the fourth message includes at least the first public key and the first identifier; after the first network element receives the fourth message, it stores the associated first public key and first identifier in the first information.

[0080] In some optional embodiments, the fourth message also includes the first data access control structure; storing the first public key and the first identifier with an associated relationship in the first information includes: storing the first public key, the first identifier and the first data access control structure with an associated relationship in the first information.

[0081] In some optional embodiments of the present disclosure, the method also includes: receiving a fifth message sent by the first physical device, the fifth message being used to request updating the digital twin access structure; the fifth message including at least the first identifier and the updated first data access control structure; and updating the data access control structure corresponding to the first identifier stored in the first information to the updated first data access control structure.

[0082] In this embodiment, the first physical device requests the first network element to update the digital twin access structure through the fifth message, that is, to update the data access control structure corresponding to the first identifier; then the fifth message includes the first identifier and the updated first data access control structure; after the first network element receives the fifth message, it can search for the first information based on the first identifier, obtain the association relationship related to the first identifier stored in the first information, and further update the data access control structure corresponding to the first identifier stored in the first information to the updated first data access control structure.

[0083] Based on the above embodiments, the present disclosure provides a key issuance method, which is applied to the second network element of the digital twin network. Figure 5 is a second flow chart of the key issuance method of the present disclosure embodiment. As shown in Figure 5, the method includes:

[0084] Step 201: Send a first message to a first network element, where the first message is used to request a first key; the first message includes at least a first identifier representing an identity of a first physical device;

[0085] Step 202: Receive a second message sent by the first network element, where the second message includes at least a second key, where the second key is obtained by the first network element encrypting the first key based on a first data access control structure using an attribute-based encryption algorithm, the first public key corresponding to the first identifier, and a stored algorithm.

[0086] Step 203: Send a sixth message to the twin instance, wherein the sixth message includes the second key, and the twin instance is associated with the first physical device.

[0087] In this embodiment, the second network element can be a data sharing warehouse of the digital twin network. As shown in Figure 1, the data sharing warehouse has, for example, functions such as data management, data service, data storage, and data collection. In other optional embodiments, the second network element can also be other specific network elements with the above functions in the digital twin network. This embodiment does not limit the name of the network element.

[0088] In this embodiment, the second network element sends a key request (i.e., a first message) to the first network element. The key request (i.e., the first message) may carry the first identifier (such as the device ID) of the first physical device corresponding to or associated with the twin instance. After the first network element receives the key request (i.e., the first message), it may determine the first public key and the first data access control structure corresponding to the first identifier based on the pre-stored first information; wherein, the first information includes at least one group of identifiers representing the identity of the physical device, the association relationship between the public key and the data access control structure, and the first information may be searched through the first identifier to obtain the first public key and the first data access control structure corresponding to the first identifier. Furthermore, the first network element may adopt an algorithm based on attribute encryption, utilize the first public key, and encrypt the first key based on the first data access control structure to obtain the second key. Furthermore, the first network element sends the second key to the second network element through a key response (i.e., the second message); the second network element then sends the second key to the twin instance through a key sending message (i.e., the sixth message).

[0089] In some optional embodiments, both the second message and the sixth message further include the validity period of the first key. In other embodiments, the second message further includes the validity period of the second key, and the validity period of the second key is equivalent to the validity period of the first key; and / or the sixth message further includes the validity period of the second key, and the validity period of the second key is equivalent to the validity period of the first key.

[0090] The present disclosure provides a key issuance method, which is applied to a twin instance of a digital twin network. FIG6 is a flow chart of the key issuance method according to the present disclosure. As shown in FIG6 , the method includes:

[0091] Step 301: Receive a sixth message sent by a second network element, the sixth message including a second key, the second key coming from the first network element; the second key is obtained by the first network element using an attribute-based encryption algorithm, using a first public key corresponding to a stored first identifier representing the identity of a first physical device, and encrypting the first key based on a first data access control structure; the twin instance is associated with the first physical device;

[0092] Step 302: Decrypt the second key using the first private key corresponding to the first public key to obtain the first key.

[0093] In this embodiment, the twin instance receives the second key issued by the second network element through the sixth message, and uses the first private key corresponding to the first public key to decrypt the second key to obtain the first key. Exemplarily, the above decryption process can satisfy: K AT = ＝ K_de(K ET,K SK ); where K AT Represents the first key; K ET represents the second key; K_de represents the CP_ABE decryption algorithm; K SK Indicates the first private key corresponding to the first public key.

[0094] In each embodiment of the present disclosure, the first key is used to establish secure communication between the first physical device and the twin instance, that is, secure communication is established between the first physical device and the twin instance based on the first key.

[0095] In some optional embodiments, the sixth message further includes the validity period of the first key. In other embodiments, the sixth message further includes the validity period of the second key, and the validity period of the second key is equivalent to the validity period of the first key.

[0096] In other optional embodiments, the method of this embodiment can also be applied to a device with a twin instance, or it can also be called a twin device, a communication device, etc.; the second network element interacts with the twin instance by interacting with the device.

[0097] The present disclosure provides a key issuance method, which is applied to a third network element of a digital twin network. FIG7 is a fourth flow chart of the key issuance method according to the present disclosure embodiment. As shown in FIG7 , the method includes:

[0098] Step 401: Generate a first key associated with a first physical device;

[0099] Step 402: Send a third message to the first network element, where the third message is used to request anchoring or storage of the first key; the third message includes at least the first key and a first identifier representing the identity of the first physical device.

[0100] In this embodiment, the third network element may be a network element for authenticating a physical device, and may be called an authentication network element, or a device authentication network element, etc. This embodiment does not limit the name of the network element.

[0101] In this embodiment, the physical device includes a terminal device or a network element; that is, the first physical device includes a first terminal device or a network element (first terminal device / network element). The network element can be, for example, a core network element, an access network element, etc. In this embodiment, a physical device that can use the digital twin service, that is, a physical device that corresponds to one or more twin instances, can be referred to as a network element.

[0102] In this embodiment, the third network element can send the first key and the first identifier of the first physical device to the first network element through a key anchoring request (i.e., the third message); the key anchoring request (i.e., the third message) is used to request the first network element to store the first key and the first identifier.

[0103] In some optional embodiments, generating a first key associated with the first device or the first network element includes: generating the first key based on relevant information in an authentication process with the first physical device.

[0104] In this embodiment, the third network element, serving as an authentication network element, generates the first key based on relevant information of the authentication process during authentication with the first physical device. The relevant information of the authentication process may include relevant keys and / or vectors in the authentication process, and the first key is derived based on the relevant keys and / or vectors in the authentication process.

[0105] In addition, during the process of the third network element authenticating with the first physical device, the first physical device may also generate the first key according to relevant information in the authentication process.

[0106] In some optional embodiments, the third message also includes the validity period of the first key. In other embodiments, the third message also includes the validity period of the second key, and the validity period of the second key is equivalent to the validity period of the first key.

[0107] The key issuance method of the embodiment of the present disclosure is described in detail below with reference to a specific example. In the following example, the first network element is a twin management network element, the second network element is a data sharing warehouse, the third network element is an authentication network element, and the physical device is a physical terminal / network element.

[0108] Example 1

[0109] FIG8 is a first diagram of an interactive process of a key issuance method according to an embodiment of the present disclosure. As shown in FIG8 , the method includes:

[0110] Step 501: The physical terminal / network element performs a device authentication process with the authentication network element. After completing the device authentication, the physical terminal / network element and the authentication network element derive a key K based on the authentication related information (such as the relevant key and vector) in the authentication process. AT .

[0111] Here, the key K AT Equivalent to the first key mentioned above.

[0112] Step 502: The authentication network element sends a twin key anchoring request to the twin management network element, and the key anchoring request carries the key K AT , device ID and key validity period; the twin management network element saves KAT .

[0113] Here, the device ID represents the identity of the physical terminal / network element, which is equivalent to the identity identifier of the physical terminal / network element. The twin key anchor request is equivalent to the third message in the above embodiment.

[0114] Step 503: The data sharing warehouse sends a key request to the twin management network element, and the key request carries the device ID.

[0115] Here, the key request is equivalent to the first message in the above embodiment.

[0116] Steps 504 to 505: The twin management network element queries the twin public key K corresponding to the device according to the device ID PK And data access control structure H; using twin public key K PK Encrypt the symmetric session key K based on the data access structure H AT Get K ET .

[0117] Here, K ET =K_en(K PK ,K AT ,H); where K_en is the CP_ABE encryption algorithm, only the twin instance attributes satisfy the data access control structure H to decrypt K ET .

[0118] Step 506: The twin management network element sends a twin key response to the data sharing warehouse, and the twin key response carries K ET and key validity period.

[0119] Here, the twin key response is equivalent to the second message in the above embodiment.

[0120] Step 507: The data sharing warehouse sends the key to one or more twin instances corresponding to the physical device. ET and key validity period.

[0121] Step 508: The twin instance decrypts K using the twin private key ET Get the key K AT .

[0122] Here, K AT = = K_de(K ET ,K SK ), where K_de is the CP_ABE decryption algorithm, K SK It is the private key of the twin instance and also the twin public key K PK The corresponding private key.

[0123] Step 509: The physical terminal / network element and the twin instance are connected based on the key K AT Establish secure communications.

[0124] Example 2

[0125] This example is a scheme for updating the digital twin service subscription / access structure in the key issuance method. Figure 9 is a second interactive flow diagram of the key issuance method according to an embodiment of the present disclosure; as shown in Figure 9, the method includes:

[0126] Step 601: The physical terminal / network element sends a digital twin service subscription request to the twin management network element; wherein the digital twin service subscription request carries the twin public key K PK , data access structure H and device ID.

[0127] Here, the digital twin service subscription request may be equivalent to the fourth message in the above embodiment.

[0128] Step 602: After receiving the digital twin service subscription request, the twin management network element saves the twin public key K PK , data access structure H and device ID, and returns a response message indicating that the digital twin service subscription is completed.

[0129] Step 603: The physical terminal / network element sends a digital twin access structure update request to the twin management network element; wherein, the digital twin access structure update request carries a new data access control structure H' and a device ID. After receiving the request, the twin management network element updates the digital access control structure corresponding to or associated with the device ID to the new data access control structure H'.

[0130] Here, the digital twin access structure update request may be equivalent to the fifth message in the above embodiment.

[0131] Step 604: The twin management network element returns a response message to the physical terminal / network element indicating that the digital twin access structure update is complete.

[0132] Example 3

[0133] This example is a digital twin service subscription solution in the key issuance method. Figure 10 is a schematic diagram of the third interactive process of the key issuance method of the embodiment of the present disclosure; as shown in Figure 10, the method includes:

[0134] Step 701: The physical terminal / network element sends a digital twin service subscription request to the twin management network element; wherein the digital twin service subscription request carries the twin public key K PK and device ID.

[0135] Here, the digital twin service subscription request may be equivalent to the fourth message in the above embodiment.

[0136] Step 702: After receiving the digital twin service subscription request, the twin management network element saves the twin public key K PK and device ID, and returns a response message indicating that the digital twin service subscription is complete.

[0137] Based on the above embodiments, the present disclosure also provides a key issuing device, which is applied to the first network element of the digital twin network. Figure 11 is a schematic diagram of the composition structure of the key issuing device of the present disclosure embodiment; As shown in Figure 11, the device includes: a first communication unit 11 and a first processing unit 12; wherein,

[0138] The first communication unit 11 is configured to receive a first message sent by a second network element, where the first message is used to request a first key; the first message includes at least a first identifier representing an identity of the first physical device;

[0139] The first processing unit 12 is configured to query a first public key and a first data access control structure corresponding to the first identifier based on stored first information, and encrypt the first key using the first public key and the first data access control structure based on an attribute encryption algorithm to obtain a second key; wherein the first information includes at least one set of associations between an identifier representing an identity of a physical device, a public key, and a data access control structure; and the first key comes from a third network element;

[0140] The first communication unit 11 is also configured to send a second message corresponding to the first message to the second network element, and the second message includes at least the second key, so that the second network element can issue the second key to the twin instance, and the twin instance is associated with the first physical device.

[0141] In some optional embodiments of the present disclosure, the apparatus further comprises a storage unit;

[0142] The first communication unit 11 is further configured to, before receiving the first message sent by the second network element, receive a third message sent by the third network element, the third message being used to request anchoring or storing the first key; the third message including at least the first key and the first identifier; the first key being generated by the third network element based on relevant information in the terminal device authentication process;

[0143] The storage unit is configured to store the first key and the first identifier.

[0144] In some optional embodiments of the present disclosure, the first communication unit 11 is further configured to receive a fourth message sent by the first physical device before receiving the first message sent by the second network element, wherein the fourth message is used to request subscription to the twin service; the fourth message includes at least the first public key and the first identifier;

[0145] The first processing unit 12 is further configured to store the associated first public key and the first identifier in the first information.

[0146] In some optional embodiments of the present disclosure, the fourth message further includes the first data access control structure;

[0147] The first processing unit 12 is further configured to store the first public key, the first identifier, and the first data access control structure that have an associated relationship in the first information.

[0148] In some optional embodiments of the present disclosure, the first communication unit 11 is further configured to receive a fifth message sent by the first physical device, the fifth message being used to request an update of the digital twin access structure; the fifth message including at least the first identifier and the updated first data access control structure;

[0149] The first processing unit 12 is further configured to update the data access control structure corresponding to the first identifier stored in the first information to the updated first data access control structure.

[0150] In some optional embodiments of the present disclosure, the second message further includes the validity period of the first key; and / or the third message further includes the validity period of the first key.

[0151] In some optional embodiments of the present disclosure, the physical device includes a terminal device or a network element.

[0152] In the embodiment of the present disclosure, the first processing unit 12 in the device can be implemented by a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA) in actual applications; the first communication unit 11 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0153] The embodiment of the present disclosure also provides a key issuance device, which is applied to the second network element of the digital twin network. Figure 12 is a schematic diagram of the second composition structure of the key issuance device of the embodiment of the present disclosure; as shown in Figure 12, the device includes: a second communication unit 21, configured to send a first message to the first network element, the first message is used to request a first key; the first message includes at least a first identifier representing the identity of the first physical device; it is also configured to receive a second message sent by the first network element, the second message includes at least a second key, the second key is obtained by the first network element based on an attribute encryption algorithm, using the first public key corresponding to the stored first identifier and encrypting the first key based on the first data access control structure; it is also configured to send a sixth message to the twin instance, the sixth message includes the second key, and the twin instance is associated with the first physical device.

[0154] In some optional embodiments of the present disclosure, the second message and the sixth message also include the validity period of the first key.

[0155] In the embodiment of the present disclosure, the second communication unit 21 in the device can be implemented in actual applications through a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna.

[0156] The present disclosure also provides a key issuing device, which is applied to a twin instance of a digital twin network. FIG13 is a third structural diagram of the key issuing device of the present disclosure embodiment; As shown in FIG13 , the device includes a third communication unit 31 and a second processing unit 32; wherein,

[0157] The third communication unit 31 is configured to receive a sixth message sent by the second network element, where the sixth message includes a second key, and the second key comes from the first network element; the second key is obtained by the first network element based on an attribute encryption algorithm, using a first public key corresponding to a stored first identifier representing an identity of the first physical device and encrypting the first key based on a first data access control structure; the twin instance is associated with the first physical device;

[0158] The second processing unit 32 is configured to decrypt the second key using a first private key corresponding to the first public key to obtain the first key.

[0159] In some optional embodiments of the present disclosure, the sixth message also includes a validity period of the first key.

[0160] In the embodiment of the present disclosure, the second processing unit 32 in the device can be implemented by a CPU, DSP, MCU or FPGA in actual applications; the third communication unit 31 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0161] The present disclosure also provides a key issuance device, which is applied to a third network element of a digital twin network. Figure 14 is a fourth schematic diagram of the structure of the key issuance device of the present disclosure embodiment; as shown in Figure 14, the device includes: a third processing unit 41 and a fourth communication unit 42; wherein the third processing unit 41 is configured to generate a first key associated with a first physical device;

[0162] The fourth communication unit 42 is configured to send a third message to the first network element, where the third message is used to request anchoring or storage of the first key; the third message includes at least the first key and a first identifier representing the identity of the first physical device.

[0163] In some optional embodiments of the present disclosure, the third message also includes a validity period of the first key.

[0164] In some optional embodiments of the present disclosure, the third processing unit 41 is configured to generate the first key based on relevant information in the authentication process of the first physical device.

[0165] In some optional embodiments of the present disclosure, the first physical device includes a first terminal device or a network element.

[0166] In the embodiment of the present disclosure, the third processing unit 41 in the device can be implemented by a CPU, DSP, MCU or FPGA in actual applications; the fourth communication unit 42 in the device can be implemented by a communication module (including: basic communication kit, operating system, communication module, standardized interface and protocol, etc.) and a transceiver antenna in actual applications.

[0167] The present disclosure also provides a communication device, which can be a first network element, a second network element, a twin instance, or a third network element of a digital twin network. Figure 15 is a schematic diagram of the hardware structure of a communication device according to an embodiment of the present disclosure. As shown in Figure 15, the communication device includes a memory 52, a processor 51, and a computer program stored in the memory 52 and executable on the processor 51. When the processor 51 executes the program, the steps of the key issuance method applied to the first network element, the second network element, the twin instance, or the third network element of the digital twin network are implemented.

[0168] Optionally, the communication device also includes at least one network interface 53. The various components in the communication device are coupled together via a bus system 54. It will be appreciated that bus system 54 is used to enable communication between these components. In addition to a data bus, bus system 54 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in FIG15 , all of these buses are labeled as bus system 54.

[0169] It is understood that the memory 52 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a magnetic disk or a magnetic tape. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory 52 described in the embodiments of the present disclosure is intended to include, but is not limited to, these and any other suitable types of memory.

[0170] The methods disclosed in the above-mentioned embodiments of the present disclosure can be applied to or implemented by the processor 51. The processor 51 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned method can be completed by the hardware integrated logic circuit in the processor 51 or by instructions in the form of software. The above-mentioned processor 51 can be a general-purpose processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor 51 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present disclosure. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present disclosure can be directly implemented as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 52. ​​The processor 51 reads the information in the memory 52 and completes the steps of the above-mentioned method in combination with its hardware.

[0171] In an exemplary embodiment, the communication device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0172] In exemplary embodiments, the present disclosure further provides a computer-readable storage medium, such as a memory 52 including a computer program. The computer program can be executed by the processor 51 of the communication device to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface mount storage, optical disk, or CD-ROM; or various devices including any one or any combination of the aforementioned memories.

[0173] The computer-readable storage medium provided by the embodiment of the present disclosure stores a computer program thereon, which, when executed by a processor, implements the steps of the key issuance method applied to the first network element, the second network element, the twin instance or the third network element of the digital twin network by the embodiment of the present disclosure.

[0174] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0175] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0176] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0177] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0178] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0179] In addition, all functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0180] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, ROM, RAM, disks or optical disks, etc. Various media that can store program codes.

[0181] Alternatively, if the above-mentioned integrated unit of the present disclosure is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present disclosure is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0182] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A key issuance method, the method being applied to a first network element of a digital twin network, the method comprising: receiving a first message sent by a second network element, where the first message is used to request a first key; The first message includes at least a first identifier representing an identity of a first physical device; Based on the stored first information, a first public key and a first data access control structure corresponding to the first identifier are queried, and a second key is obtained by encrypting the first key based on the attribute encryption algorithm using the first public key and the first data access control structure; wherein the first information includes at least one group of associations between an identifier representing an identity of a physical device, a public key, and a data access control structure; and the first key comes from a third network element; A second message corresponding to the first message is sent to the second network element, where the second message includes at least the second key, so that the second network element sends the second key to the twin instance, and the twin instance is associated with the first physical device.

2. The method according to claim 1, wherein: Before receiving the first message sent by the second network element, the method further includes: receiving a third message sent by the third network element, where the third message is used to request anchoring or storing the first key; the third message includes at least the first key and the first identifier; the first key is generated by the third network element according to relevant information in the terminal device authentication process; The first key and the first identifier are stored.

3. The method according to claim 1, wherein: Before receiving the first message sent by the second network element, the method further includes: receiving a fourth message sent by the first physical device, where the fourth message is used to request a subscription to a twin service; the fourth message includes at least the first public key and the first identifier; The first public key and the first identifier having an associated relationship are stored in the first information middle.

4. The method according to claim 3, wherein: The fourth message also includes the first data access control structure; The storing the first public key and the first identifier having an associated relationship in the first information includes: The first public key, the first identifier and the first data access control structure having an associated relationship are stored in the first information.

5. The method according to claim 4, wherein: The method further comprises: Receive a fifth message sent by the first physical device, where the fifth message is used to request updating of the digital twin access structure; the fifth message includes at least the first identifier and the updated first data access control structure; The data access control structure corresponding to the first identifier and stored in the first information is updated to be the updated first data access control structure.

6. The method according to claim 2, wherein: The second message also includes the validity period of the first key; and / or, The third message also includes the validity period of the first key.

7. The method according to claim 1, wherein: The physical device includes a terminal device or a network element.

8. A key issuance method, the method being applied to a second network element of a digital twin network, the method comprising: Sending a first message to a first network element, where the first message is used to request a first key; The first message includes at least a first identifier representing an identity of a first physical device; receiving a second message sent by the first network element, wherein the second message includes at least a second key, and the second key is obtained by encrypting the first key based on the attribute encryption algorithm of the first network element, using the first public key corresponding to the first identifier stored, and based on the first data access control structure. arrive; A sixth message is sent to the twin instance, wherein the sixth message includes the second key, and the twin instance is associated with the first physical device.

9. The method according to claim 8, wherein: The second message and the sixth message also include the validity period of the first key.

10. A key distribution method, the method being applied to a twin instance of a digital twin network, the method comprising: receiving a sixth message sent by the second network element, wherein the sixth message includes a second key, and the second key comes from the first network element; The second key is obtained by the first network element based on an attribute encryption algorithm, using a first public key corresponding to a first identifier representing an identity of a first physical device stored and encrypting the first key based on a first data access control structure; the twin instance is associated with the first physical device; The second key is decrypted using a first private key corresponding to the first public key to obtain the first key.

11. The method according to claim 10, wherein: The sixth message also includes the validity period of the first key.

12. A key issuance method, the method being applied to a third network element of a digital twin network, the method comprising: generating a first key associated with a first physical device; Sending a third message to the first network element, where the third message is used to request anchoring or storing the first key; The third message includes at least the first key and a first identifier indicating the identity of the first physical device.

13. The method according to claim 12, wherein: The third message also includes the validity period of the first key.

14. The method according to claim 12, wherein: The generating a first key associated with the first device or the first network element includes: The first key is generated based on relevant information in an authentication process with the first physical device.

15. The method according to claim 12, wherein: The first physical device includes a first terminal device or a network element.

16. A key issuing device, the device being applied to a first network element of a digital twin network; the device comprising: A first communication unit and a first processing unit; wherein, The first communication unit is configured to receive a first message sent by a second network element, where the first message is used to request a first key; the first message includes at least a first identifier representing an identity of a first physical device; The first processing unit is configured to query a first public key and a first data access control structure corresponding to the first identifier based on the stored first information, and encrypt the first key based on the attribute encryption algorithm using the first public key and the first data access control structure to obtain a second key; wherein the first information includes at least one group of associations between an identifier representing an identity of a physical device, a public key, and a data access control structure; and the first key comes from a third network element; The first communication unit is also configured to send a second message corresponding to the first message to the second network element, and the second message includes at least the second key, so that the second network element sends the second key to the twin instance, and the twin instance is associated with the first physical device.

17. A key issuing device, the device being applied to a second network element of a digital twin network, the device comprising: A second communication unit is configured to send a first message to the first network element, wherein the first message is used to request a first key; The first message includes at least a first identifier representing the identity of the first physical device; it is also configured to receive a second message sent by the first network element, the second message includes at least a second key, the second key is obtained by the first network element based on an attribute encryption algorithm, using the first public key corresponding to the stored first identifier and encrypting the first key based on a first data access control structure; it is also configured to send a sixth message to the twin instance, the sixth message includes the second key, and the twin instance is associated with the first physical device.

18. A key issuing device, the device being applied to a twin instance of a digital twin network, the device comprising a third communication unit and a second processing unit; wherein, The third communication unit is configured to receive a sixth message sent by the second network element, the sixth message including a second key, the second key coming from the first network element; the second key is obtained by the first network element based on an attribute encryption algorithm, using a first public key corresponding to a first identifier representing an identity of a first physical device stored and encrypting the first key based on a first data access control structure; the twin instance is associated with the first physical device; The second processing unit is configured to use a first private key corresponding to the first public key to decrypt the second key to obtain the first key.

19. A key issuing device, the device being applied to a third network element of a digital twin network, the device comprising: A third processing unit and a fourth communication unit; wherein, The third processing unit is configured to generate a first key associated with the first physical device; The fourth communication unit is configured to send a third message to the first network element, where the third message is used to request anchoring or storage of the first key; the third message includes at least the first key and a first identifier representing the identity of the first physical device.

20. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 7; or When the program is executed by a processor, the steps of the method according to claim 8 or 9 are implemented; or, When the program is executed by a processor, the steps of the method according to claim 10 or 11 are implemented; or, When the program is executed by a processor, the steps of the method according to any one of claims 12 to 15 are implemented.

21. A communication device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the program; or When the processor executes the program, the steps of the method according to claim 8 or 9 are implemented; or , When the processor executes the program, the steps of the method according to claim 10 or 11 are implemented; or, When the processor executes the program, the steps of the method according to any one of claims 12 to 15 are implemented.

Images